buckets

Creates, updates, deletes or gets a bucket resource or lists buckets in a region

Overview

Name	`buckets`
Type	Resource
Description	The `AWS::S3::Bucket` resource creates an Amazon S3 bucket in the same AWS Region where you create the AWS CloudFormation stack. To control how AWS CloudFormation handles the bucket when the stack is deleted, you can set a deletion policy for your bucket. You can choose to retain the bucket or to delete the bucket. For more information, see [DeletionPolicy Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html). You can only delete empty buckets. Deletion fails for buckets that have contents.
Id	`aws.s3.buckets`

Fields

Name	Datatype	Description
`accelerate_configuration`	`object`	Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see [Amazon S3 Transfer Acceleration](https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html) in the Amazon S3 User Guide.
`access_control`	`string`	This is a legacy property, and it is not recommended for most use cases. A majority of modern use cases in Amazon S3 no longer require the use of ACLs, and we recommend that you keep ACLs disabled. For more information, see [Controlling object ownership](https://docs.aws.amazon.com//AmazonS3/latest/userguide/about-object-ownership.html) in the Amazon S3 User Guide. A canned access control list (ACL) that grants predefined permissions to the bucket. For more information about canned ACLs, see [Canned ACL](https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl) in the Amazon S3 User Guide. S3 buckets are created with ACLs disabled by default. Therefore, unless you explicitly set the [AWS::S3::OwnershipControls](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html) property to enable ACLs, your resource will fail to deploy with any value other than Private. Use cases requiring ACLs are uncommon. The majority of access control configurations can be successfully and more easily achieved with bucket policies. For more information, see [AWS::S3::BucketPolicy](https://docs.aws.amazon.com//AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html). For examples of common policy configurations, including S3 Server Access Logs buckets and more, see [Bucket policy examples](https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html) in the Amazon S3 User Guide.
`analytics_configurations`	`array`	Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.
`bucket_encryption`	`object`	Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see [Amazon S3 Default Encryption for S3 Buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-encryption.html) in the Amazon S3 User Guide.
`bucket_name`	`string`	A name for the bucket. If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the bucket name. The bucket name must contain only lowercase letters, numbers, periods (.), and dashes (-) and must follow [Amazon S3 bucket restrictions and limitations](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html). For more information, see [Rules for naming Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html#bucketnamingrules) in the Amazon S3 User Guide. If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you need to replace the resource, specify a new name.
`cors_configuration`	`object`	Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see [Enabling Cross-Origin Resource Sharing](https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html) in the Amazon S3 User Guide.
`intelligent_tiering_configurations`	`array`	Defines how Amazon S3 handles Intelligent-Tiering storage.
`inventory_configurations`	`array`	Specifies the inventory configuration for an Amazon S3 bucket. For more information, see [GET Bucket inventory](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETInventoryConfig.html) in the Amazon S3 API Reference.
`lifecycle_configuration`	`object`	Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see [Object Lifecycle Management](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html) in the Amazon S3 User Guide.
`logging_configuration`	`object`	Settings that define where logs are stored.
`metrics_configurations`	`array`	Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For more information, see [PutBucketMetricsConfiguration](https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketPUTMetricConfiguration.html).
`notification_configuration`	`object`	Configuration that defines how Amazon S3 handles bucket notifications.
`object_lock_configuration`	`object`	This operation is not supported by directory buckets. Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see [Locking Objects](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html). + The `DefaultRetention` settings require both a mode and a period. + The `DefaultRetention` period can be either `Days` or `Years` but you must select one. You cannot specify `Days` and `Years` at the same time. + You can enable Object Lock for new or existing buckets. For more information, see [Configuring Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-configure.html).
`object_lock_enabled`	`boolean`	Indicates whether this bucket has an Object Lock configuration enabled. Enable `ObjectLockEnabled` when you apply `ObjectLockConfiguration` to a bucket.
`ownership_controls`	`object`	Configuration that defines how Amazon S3 handles Object Ownership rules.
`public_access_block_configuration`	`object`	Configuration that defines how Amazon S3 handles public access.
`replication_configuration`	`object`	Configuration for replicating objects in an S3 bucket. To enable replication, you must also enable versioning by using the `VersioningConfiguration` property. Amazon S3 can store replicated objects in a single destination bucket or multiple destination buckets. The destination bucket or buckets must already exist.
`tags`	`array`	An arbitrary set of tags (key-value pairs) for this S3 bucket.
`versioning_configuration`	`object`	Enables multiple versions of all objects in this bucket. You might enable versioning to prevent objects from being deleted or overwritten by mistake or to archive objects so that you can retrieve previous versions of them.
`website_configuration`	`object`	Information used to configure the bucket as a static website. For more information, see [Hosting Websites on Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html).
`arn`	`string`	The Amazon Resource Name (ARN) of the specified resource.
`domain_name`	`string`
`dual_stack_domain_name`	`string`
`regional_domain_name`	`string`
`website_url`	`string`
`region`	`string`	AWS region.

Methods

Name	Accessible by	Required Params
`create_resource`	`INSERT`	`BucketName, region`
`delete_resource`	`DELETE`	`data__Identifier, region`
`update_resource`	`UPDATE`	`data__Identifier, data__PatchDocument, region`
`list_resources`	`SELECT`	`region`
`get_resource`	`SELECT`	`data__Identifier, region`

`SELECT` examples

Gets all buckets in a region.

SELECT
region,
accelerate_configuration,
access_control,
analytics_configurations,
bucket_encryption,
bucket_name,
cors_configuration,
intelligent_tiering_configurations,
inventory_configurations,
lifecycle_configuration,
logging_configuration,
metrics_configurations,
notification_configuration,
object_lock_configuration,
object_lock_enabled,
ownership_controls,
public_access_block_configuration,
replication_configuration,
tags,
versioning_configuration,
website_configuration,
arn,
domain_name,
dual_stack_domain_name,
regional_domain_name,
website_url
FROM aws.s3.buckets
WHERE region = 'us-east-1';

Gets all properties from an individual bucket.

SELECT
region,
accelerate_configuration,
access_control,
analytics_configurations,
bucket_encryption,
bucket_name,
cors_configuration,
intelligent_tiering_configurations,
inventory_configurations,
lifecycle_configuration,
logging_configuration,
metrics_configurations,
notification_configuration,
object_lock_configuration,
object_lock_enabled,
ownership_controls,
public_access_block_configuration,
replication_configuration,
tags,
versioning_configuration,
website_configuration,
arn,
domain_name,
dual_stack_domain_name,
regional_domain_name,
website_url
FROM aws.s3.buckets
WHERE region = 'us-east-1' AND data__Identifier = '<BucketName>';

`INSERT` example

Use the following StackQL query and manifest file to create a new bucket resource, using stack-deploy.

Required Properties
All Properties
Manifest

/*+ create */
INSERT INTO aws.s3.buckets (
 BucketName,
 region
)
SELECT 
'{{ BucketName }}',
'{{ region }}';

/*+ create */
INSERT INTO aws.s3.buckets (
 AccelerateConfiguration,
 AccessControl,
 AnalyticsConfigurations,
 BucketEncryption,
 BucketName,
 CorsConfiguration,
 IntelligentTieringConfigurations,
 InventoryConfigurations,
 LifecycleConfiguration,
 LoggingConfiguration,
 MetricsConfigurations,
 NotificationConfiguration,
 ObjectLockConfiguration,
 ObjectLockEnabled,
 OwnershipControls,
 PublicAccessBlockConfiguration,
 ReplicationConfiguration,
 Tags,
 VersioningConfiguration,
 WebsiteConfiguration,
 region
)
SELECT 
 '{{ AccelerateConfiguration }}',
 '{{ AccessControl }}',
 '{{ AnalyticsConfigurations }}',
 '{{ BucketEncryption }}',
 '{{ BucketName }}',
 '{{ CorsConfiguration }}',
 '{{ IntelligentTieringConfigurations }}',
 '{{ InventoryConfigurations }}',
 '{{ LifecycleConfiguration }}',
 '{{ LoggingConfiguration }}',
 '{{ MetricsConfigurations }}',
 '{{ NotificationConfiguration }}',
 '{{ ObjectLockConfiguration }}',
 '{{ ObjectLockEnabled }}',
 '{{ OwnershipControls }}',
 '{{ PublicAccessBlockConfiguration }}',
 '{{ ReplicationConfiguration }}',
 '{{ Tags }}',
 '{{ VersioningConfiguration }}',
 '{{ WebsiteConfiguration }}',
 '{{ region }}';

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: bucket
    props:
      - name: AccelerateConfiguration
        value:
          AccelerationStatus: '{{ AccelerationStatus }}'
      - name: AccessControl
        value: '{{ AccessControl }}'
      - name: AnalyticsConfigurations
        value:
          - TagFilters:
              - Value: '{{ Value }}'
                Key: '{{ Key }}'
            StorageClassAnalysis:
              DataExport:
                S3BucketDestination:
                  OutputSchemaVersion: '{{ OutputSchemaVersion }}'
                  Format: '{{ Format }}'
                  AccountId: '{{ AccountId }}'
                  Arn: '{{ Arn }}'
                  Prefix: '{{ Prefix }}'
                  Encryption: {}
                CloudWatchMetrics:
                  IsEnabled: '{{ IsEnabled }}'
            Id: '{{ Id }}'
            Prefix: '{{ Prefix }}'
      - name: BucketEncryption
        value:
          ServerSideEncryptionConfiguration:
            - BucketKeyEnabled: '{{ BucketKeyEnabled }}'
              ServerSideEncryptionByDefault:
                KMSMasterKeyID: '{{ KMSMasterKeyID }}'
                SSEAlgorithm: '{{ SSEAlgorithm }}'
      - name: BucketName
        value: '{{ BucketName }}'
      - name: CorsConfiguration
        value:
          CorsRules:
            - AllowedHeaders:
                - '{{ AllowedHeaders[0] }}'
              AllowedMethods:
                - '{{ AllowedMethods[0] }}'
              AllowedOrigins:
                - '{{ AllowedOrigins[0] }}'
              ExposedHeaders:
                - '{{ ExposedHeaders[0] }}'
              Id: '{{ Id }}'
              MaxAge: '{{ MaxAge }}'
      - name: IntelligentTieringConfigurations
        value:
          - Id: '{{ Id }}'
            Prefix: '{{ Prefix }}'
            Status: '{{ Status }}'
            TagFilters:
              - null
            Tierings:
              - AccessTier: '{{ AccessTier }}'
                Days: '{{ Days }}'
      - name: InventoryConfigurations
        value:
          - Destination:
              BucketArn: '{{ BucketArn }}'
              BucketAccountId: '{{ BucketAccountId }}'
              Format: '{{ Format }}'
              Prefix: '{{ Prefix }}'
            Enabled: '{{ Enabled }}'
            Id: '{{ Id }}'
            IncludedObjectVersions: '{{ IncludedObjectVersions }}'
            OptionalFields:
              - '{{ OptionalFields[0] }}'
            Prefix: '{{ Prefix }}'
            ScheduleFrequency: '{{ ScheduleFrequency }}'
      - name: LifecycleConfiguration
        value:
          Rules:
            - AbortIncompleteMultipartUpload:
                DaysAfterInitiation: '{{ DaysAfterInitiation }}'
              ExpirationDate: '{{ ExpirationDate }}'
              ExpirationInDays: '{{ ExpirationInDays }}'
              ExpiredObjectDeleteMarker: '{{ ExpiredObjectDeleteMarker }}'
              Id: '{{ Id }}'
              NoncurrentVersionExpirationInDays: '{{ NoncurrentVersionExpirationInDays }}'
              NoncurrentVersionExpiration:
                NoncurrentDays: '{{ NoncurrentDays }}'
                NewerNoncurrentVersions: '{{ NewerNoncurrentVersions }}'
              NoncurrentVersionTransition:
                StorageClass: '{{ StorageClass }}'
                TransitionInDays: '{{ TransitionInDays }}'
                NewerNoncurrentVersions: '{{ NewerNoncurrentVersions }}'
              NoncurrentVersionTransitions:
                - null
              Prefix: '{{ Prefix }}'
              Status: '{{ Status }}'
              TagFilters:
                - null
              ObjectSizeGreaterThan: '{{ ObjectSizeGreaterThan }}'
              ObjectSizeLessThan: '{{ ObjectSizeLessThan }}'
              Transition:
                StorageClass: '{{ StorageClass }}'
                TransitionDate: null
                TransitionInDays: '{{ TransitionInDays }}'
              Transitions:
                - null
      - name: LoggingConfiguration
        value:
          DestinationBucketName: '{{ DestinationBucketName }}'
          LogFilePrefix: '{{ LogFilePrefix }}'
          TargetObjectKeyFormat: {}
      - name: MetricsConfigurations
        value:
          - AccessPointArn: '{{ AccessPointArn }}'
            Id: '{{ Id }}'
            Prefix: '{{ Prefix }}'
            TagFilters:
              - null
      - name: NotificationConfiguration
        value:
          EventBridgeConfiguration:
            EventBridgeEnabled: '{{ EventBridgeEnabled }}'
          LambdaConfigurations:
            - Event: '{{ Event }}'
              Filter:
                S3Key:
                  Rules:
                    - Name: '{{ Name }}'
                      Value: '{{ Value }}'
              Function: '{{ Function }}'
          QueueConfigurations:
            - Event: '{{ Event }}'
              Filter: null
              Queue: '{{ Queue }}'
          TopicConfigurations:
            - Event: '{{ Event }}'
              Filter: null
              Topic: '{{ Topic }}'
      - name: ObjectLockConfiguration
        value:
          ObjectLockEnabled: '{{ ObjectLockEnabled }}'
          Rule:
            DefaultRetention:
              Years: '{{ Years }}'
              Days: '{{ Days }}'
              Mode: '{{ Mode }}'
      - name: ObjectLockEnabled
        value: '{{ ObjectLockEnabled }}'
      - name: OwnershipControls
        value:
          Rules:
            - ObjectOwnership: '{{ ObjectOwnership }}'
      - name: PublicAccessBlockConfiguration
        value:
          BlockPublicAcls: '{{ BlockPublicAcls }}'
          IgnorePublicAcls: '{{ IgnorePublicAcls }}'
          BlockPublicPolicy: '{{ BlockPublicPolicy }}'
          RestrictPublicBuckets: '{{ RestrictPublicBuckets }}'
      - name: ReplicationConfiguration
        value:
          Role: '{{ Role }}'
          Rules:
            - DeleteMarkerReplication:
                Status: '{{ Status }}'
              Destination:
                AccessControlTranslation:
                  Owner: '{{ Owner }}'
                Account: '{{ Account }}'
                Bucket: '{{ Bucket }}'
                EncryptionConfiguration:
                  ReplicaKmsKeyID: '{{ ReplicaKmsKeyID }}'
                Metrics:
                  EventThreshold:
                    Minutes: '{{ Minutes }}'
                  Status: '{{ Status }}'
                ReplicationTime:
                  Status: '{{ Status }}'
                  Time: null
                StorageClass: '{{ StorageClass }}'
              Filter:
                And:
                  Prefix: '{{ Prefix }}'
                  TagFilters:
                    - null
                Prefix: '{{ Prefix }}'
                TagFilter: null
              Id: '{{ Id }}'
              Prefix: '{{ Prefix }}'
              Priority: '{{ Priority }}'
              SourceSelectionCriteria:
                ReplicaModifications:
                  Status: '{{ Status }}'
                SseKmsEncryptedObjects:
                  Status: '{{ Status }}'
              Status: '{{ Status }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'
      - name: VersioningConfiguration
        value:
          Status: '{{ Status }}'
      - name: WebsiteConfiguration
        value:
          ErrorDocument: '{{ ErrorDocument }}'
          IndexDocument: '{{ IndexDocument }}'
          RoutingRules:
            - RedirectRule:
                HostName: '{{ HostName }}'
                HttpRedirectCode: '{{ HttpRedirectCode }}'
                Protocol: '{{ Protocol }}'
                ReplaceKeyPrefixWith: '{{ ReplaceKeyPrefixWith }}'
                ReplaceKeyWith: '{{ ReplaceKeyWith }}'
              RoutingRuleCondition:
                KeyPrefixEquals: '{{ KeyPrefixEquals }}'
                HttpErrorCodeReturnedEquals: '{{ HttpErrorCodeReturnedEquals }}'
          RedirectAllRequestsTo:
            HostName: '{{ HostName }}'
            Protocol: '{{ Protocol }}'

`DELETE` example

/*+ delete */
DELETE FROM aws.s3.buckets
WHERE data__Identifier = '<BucketName>'
AND region = 'us-east-1';

Permissions

To operate on the buckets resource, the following permissions are required:

Create

s3:CreateBucket,
s3:PutBucketTagging,
s3:PutAnalyticsConfiguration,
s3:PutEncryptionConfiguration,
s3:PutBucketCORS,
s3:PutInventoryConfiguration,
s3:PutLifecycleConfiguration,
s3:PutMetricsConfiguration,
s3:PutBucketNotification,
s3:PutBucketReplication,
s3:PutBucketWebsite,
s3:PutAccelerateConfiguration,
s3:PutBucketPublicAccessBlock,
s3:PutReplicationConfiguration,
s3:PutObjectAcl,
s3:PutBucketObjectLockConfiguration,
s3:GetBucketAcl,
s3:ListBucket,
iam:PassRole,
s3:DeleteObject,
s3:PutBucketLogging,
s3:PutBucketVersioning,
s3:PutObjectLockConfiguration,
s3:PutBucketOwnershipControls,
s3:PutIntelligentTieringConfiguration

Read

s3:GetAccelerateConfiguration,
s3:GetLifecycleConfiguration,
s3:GetBucketPublicAccessBlock,
s3:GetAnalyticsConfiguration,
s3:GetBucketCORS,
s3:GetEncryptionConfiguration,
s3:GetInventoryConfiguration,
s3:GetBucketLogging,
s3:GetMetricsConfiguration,
s3:GetBucketNotification,
s3:GetBucketVersioning,
s3:GetReplicationConfiguration,
S3:GetBucketWebsite,
s3:GetBucketPublicAccessBlock,
s3:GetBucketObjectLockConfiguration,
s3:GetBucketTagging,
s3:GetBucketOwnershipControls,
s3:GetIntelligentTieringConfiguration,
s3:ListBucket

Update

s3:PutBucketAcl,
s3:PutBucketTagging,
s3:PutAnalyticsConfiguration,
s3:PutEncryptionConfiguration,
s3:PutBucketCORS,
s3:PutInventoryConfiguration,
s3:PutLifecycleConfiguration,
s3:PutMetricsConfiguration,
s3:PutBucketNotification,
s3:PutBucketReplication,
s3:PutBucketWebsite,
s3:PutAccelerateConfiguration,
s3:PutBucketPublicAccessBlock,
s3:PutReplicationConfiguration,
s3:PutBucketOwnershipControls,
s3:PutIntelligentTieringConfiguration,
s3:DeleteBucketWebsite,
s3:PutBucketLogging,
s3:PutBucketVersioning,
s3:PutObjectLockConfiguration,
s3:PutBucketObjectLockConfiguration,
s3:DeleteBucketAnalyticsConfiguration,
s3:DeleteBucketCors,
s3:DeleteBucketMetricsConfiguration,
s3:DeleteBucketEncryption,
s3:DeleteBucketLifecycle,
s3:DeleteBucketReplication,
iam:PassRole,
s3:ListBucket

Delete

s3:DeleteBucket,
s3:ListBucket

List

s3:ListAllMyBuckets

Overview​

Fields​

Methods​

SELECT examples​

INSERT example​

DELETE example​

Permissions​

Create​

Read​

Update​

Delete​

List​