Amazon S3Storage Stable

AWS::S3::Bucket

Creates an Amazon S3 bucket — a region-scoped, globally-named container for objects, and the resource most likely to be the last thing standing when you try to delete a stack.

Required properties 0 of 16

Ref returns Bucket nameacme-platform-assets-production

Fn::GetAtt 5 attributes

Replacement risk 2 2 properties force replacement

Minimal template

Every required property, nothing else

Resources:
  AssetBucket:
    Type: AWS::S3::Bucket
    Properties: {}

{
  "Resources": {
    "AssetBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {}
    }
  }
}

import { Bucket } from 'aws-cdk-lib/aws-s3';

// The CDK's defaults are not CloudFormation's: this bucket gets
// versioning off but encryption, TLS enforcement and full public
// access blocking on, because the construct sets them explicitly.
new Bucket(this, 'AssetBucket');

Every property is optional. A bucket with no properties at all is valid, gets a generated name, and — since April 2023 — has S3-managed encryption and all four public access blocks enabled by default. It is not, however, versioned, logged, or protected from deletion.

Overview #

A bucket is a region-scoped container for objects with a name that must be unique across every AWS account in the partition. That one sentence explains most of what is awkward about the resource: the name is contended, the name cannot change, and the bucket outlives the stack that created it far more often than anyone intends.

Almost every property is optional, and the ones that matter most for safety — versioning, lifecycle rules, logging — are all off by default. A bucket created with Properties: {} is encrypted and non-public, which is a meaningful improvement on the pre-2023 defaults, but it keeps no history, cleans up nothing, and records nothing.

Remarks

S3 has changed its defaults twice in ways that matter to templates written before the change, and both changes are invisible in the template itself.

April 2023 made all four public-access blocks default to on, and made BucketOwnerEnforced the default object ownership. Together these disable ACLs. A template carrying AccessControl: Private — added years ago as a belt-and-braces measure — now fails on create with AccessControlListNotSupported, and the fix is to delete the line rather than to change it.

January 2023 made SSE-S3 encryption apply to every new object automatically. Templates that set BucketEncryption to AES256 explicitly are not wrong, just redundant; the property is now interesting mainly as the way to move to SSE-KMS.

The practical consequence is that an S3 template’s age is legible from its properties, and old templates fail in ways whose error messages point at the wrong thing.

Deleting a bucket #

This is the single most common operational problem with the resource, and it is worth understanding before the first DELETE_FAILED.

There are three sensible postures, and picking one deliberately at create time saves an afternoon later:

Posture	How	When
Retain the bucket	`DeletionPolicy: Retain`	Anything holding data you would miss. The bucket survives the stack and becomes someone’s problem to clean up on purpose.
Empty then delete	A lifecycle rule that expires everything, or a custom resource that empties on delete	Ephemeral environments, per-PR stacks, test fixtures.
Accept the failure	Nothing	Never a plan, frequently the outcome.

A bucket you would actually deploy #

Everything above the bare minimum, with the reasoning inline.

Resources:
  AssetBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub 'acme-assets-${AWS::AccountId}-${AWS::Region}'

      # SSE-KMS with a bucket key: auditable, revocable, and roughly 99%
      # cheaper in KMS charges than per-object encryption.
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref DataKey

      # All four, always. Omitting one sets it to false.
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

      VersioningConfiguration:
        Status: Enabled

      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced

      LifecycleConfiguration:
        Rules:
          # Abandoned multipart uploads are invisible and billed in full.
          # This rule belongs on every bucket in existence.
          - Id: abort-incomplete-uploads
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7

          # Versioning without expiry is an unbounded storage bill.
          - Id: expire-old-versions
            Status: Enabled
            NoncurrentVersionExpirationInDays: 90
            ExpiredObjectDeleteMarker: true

      LoggingConfiguration:
        DestinationBucketName: !Ref LogBucket
        LogFilePrefix: !Sub 's3-access/acme-assets/'

      Tags:
        - Key: Environment
          Value: production
        - Key: Owner
          Value: platform

{
  "Resources": {
    "AssetBucket": {
      "Type": "AWS::S3::Bucket",
      "DeletionPolicy": "Retain",
      "UpdateReplacePolicy": "Retain",
      "Properties": {
        "BucketName": { "Fn::Sub": "acme-assets-${AWS::AccountId}-${AWS::Region}" },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "BucketKeyEnabled": true,
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms",
                "KMSMasterKeyID": { "Ref": "DataKey" }
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "VersioningConfiguration": { "Status": "Enabled" },
        "OwnershipControls": {
          "Rules": [{ "ObjectOwnership": "BucketOwnerEnforced" }]
        },
        "LifecycleConfiguration": {
          "Rules": [
            {
              "Id": "abort-incomplete-uploads",
              "Status": "Enabled",
              "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
            },
            {
              "Id": "expire-old-versions",
              "Status": "Enabled",
              "NoncurrentVersionExpirationInDays": 90,
              "ExpiredObjectDeleteMarker": true
            }
          ]
        },
        "LoggingConfiguration": {
          "DestinationBucketName": { "Ref": "LogBucket" },
          "LogFilePrefix": "s3-access/acme-assets/"
        },
        "Tags": [
          { "Key": "Environment", "Value": "production" },
          { "Key": "Owner", "Value": "platform" }
        ]
      }
    }
  }
}

import { RemovalPolicy, Duration } from 'aws-cdk-lib';
import { Bucket, BucketEncryption, BlockPublicAccess, ObjectOwnership } from 'aws-cdk-lib/aws-s3';

new Bucket(this, 'AssetBucket', {
  bucketName: `acme-assets-${Stack.of(this).account}-${Stack.of(this).region}`,
  encryption: BucketEncryption.KMS,
  encryptionKey: dataKey,
  bucketKeyEnabled: true,
  blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
  versioned: true,
  objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
  serverAccessLogsBucket: logBucket,
  serverAccessLogsPrefix: 's3-access/acme-assets/',
  removalPolicy: RemovalPolicy.RETAIN,
  lifecycleRules: [
    { id: 'abort-incomplete-uploads', abortIncompleteMultipartUploadAfter: Duration.days(7) },
    { id: 'expire-old-versions', noncurrentVersionExpiration: Duration.days(90), expiredObjectDeleteMarker: true },
  ],
});

Naming and referencing #

!Ref AssetBucket → acme-assets-123456789012-us-west-2

!GetAtt AssetBucket.Arn → arn:aws:s3:::acme-assets-123456789012-us-west-2

!GetAtt AssetBucket.RegionalDomainName → acme-assets-123456789012-us-west-2.s3.us-west-2.amazonaws.com

Properties

Expand a row for the full reference; nested types open in place

BucketName StringThe bucket's name, which must be unique across every AWS account in the partition. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Omitting the name lets CloudFormation generate one from the stack name, logical ID and a random suffix — mystack-assetbucket-1a2b3c4d5e6f. The generated name is ugly but it is also the only way to deploy the same template twice without a name collision.
Type
String
Required
No
Update behaviour
Replacement
Pattern
^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ Lowercase letters, digits, hyphens and periods. Must start and end alphanumerically.
Length
3 – 63
Example values
- acme-platform-assets-production
Renaming a bucket deletes it
BucketName is create-only. Changing it does not rename anything: CloudFormation creates a new, empty bucket and then deletes the old one — along with every object in it, if the deletion policy allows. There is no data migration and no warning beyond the change set saying Replacement: True.
Periods in the name break TLS
A name containing a period is legal, and it silently disables virtual-hosted-style HTTPS: the wildcard certificate for *.s3.amazonaws.com does not match my.bucket.s3.amazonaws.com, so every TLS client fails hostname verification. Use hyphens.
Remarks
Bucket names are global across the partition — not per account, not per region. This makes the namespace the one genuinely contended resource in S3, and it is why every organisation eventually adopts a naming convention containing the account ID or a company prefix.
It also means a name you release can be taken by someone else, so a deleted-and-recreated bucket may not be recoverable under the same name.
BucketEncryption BucketEncryptionDefault server-side encryption applied to objects written without their own encryption headers. No interruption — updates in place
Since January 2023 all new buckets have SSE-S3 (AES256) applied by default, so this property is about changing the algorithm — usually to a customer-managed KMS key — rather than about turning encryption on.
Type
BucketEncryption
Required
No
Update behaviour
No interruption
Remarks
Default encryption applies to objects written after it is configured. It does not re-encrypt what is already there. A bucket switched from SSE-S3 to SSE-KMS contains objects under both schemes indefinitely, and the only way to converge them is to copy every object over itself.
BucketEncryption properties
- ServerSideEncryptionConfiguration Array of ServerSideEncryptionRuleThe encryption rules. S3 accepts a list but applies exactly one. Required No interruption — updates in place
  The encryption rules. S3 accepts a list but applies exactly one.
  Type
  Array of ServerSideEncryptionRule
  Required
  Yes
  Update behaviour
  No interruption
  Items
  1 – 1
  A list that can only ever have one element
  This is modelled as a list because the underlying API is, but S3 rejects any list with more than one rule. The nesting exists for historical reasons and adds two levels of indentation for nothing — which is exactly the kind of structure that makes the AWS syntax block unreadable, and exactly why this page lets you expand into it instead of scrolling past it.
  ServerSideEncryptionRule properties
  ServerSideEncryptionByDefault ServerSideEncryptionByDefaultThe algorithm and key to apply by default. No interruption — updates in place
  The algorithm and key to apply by default.
  Type
  ServerSideEncryptionByDefault
  Required
  No
  Update behaviour
  No interruption
  ServerSideEncryptionByDefault properties
  SSEAlgorithm StringThe server-side encryption algorithm. Required No interruption — updates in place
  AES256 is SSE-S3: managed entirely by S3, free, and invisible. aws:kms is SSE-KMS: auditable in CloudTrail, revocable by key policy, and billed per request. aws:kms:dsse applies two layers of encryption for regimes that mandate it, at roughly double the KMS cost.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  AES256
  aws:kms
  aws:kms:dsse
  Example values
  aws:kms
  KMSMasterKeyID StringKey ID, ARN, alias name, or alias ARN of the KMS key. Conditional No interruption — updates in place
  Omitting it with aws:kms uses the AWS-managed aws/s3 key, which cannot be shared across accounts and whose policy you cannot edit.
  Type
  String
  Required
  ConditionalRequired when SSEAlgorithm is aws:kms or aws:kms:dsse and the AWS-managed key is not wanted.
  Update behaviour
  No interruption
  Example values
  alias/acme-data
  arn:aws:kms:us-west-2:123456789012:key/1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
  Use the key ARN, not the alias, for cross-account access
  An alias is resolved in the caller’s account. A principal in another account reading an object encrypted with alias/acme-data resolves that alias against their own account and fails with a confusing KMS.NotFoundException. Cross-account always needs the full key ARN.
  BucketKeyEnabled BooleanReduce KMS request costs by deriving a bucket-level data key. No interruption — updates in place
  With SSE-KMS and a busy bucket, this is the difference between a KMS request per object and a KMS request per bucket key rotation — commonly a 99% reduction in KMS charges. There is no downside for customer-managed keys; enable it.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
  Default
  false
  Note
  Has no effect when SSEAlgorithm is AES256, because SSE-S3 does not make per-object KMS calls in the first place.
PublicAccessBlockConfiguration PublicAccessBlockConfigurationFour independent switches that override any ACL or bucket policy granting public access. No interruption — updates in place
All four default to true for buckets created after April 2023. Specifying the property at all means specifying every switch you want on — omitted members within it default to false, not to the account setting.
Type
PublicAccessBlockConfiguration
Required
No
Update behaviour
No interruption
Partially specifying this property turns protections off
Writing only BlockPublicPolicy: true sets the other three to false, because CloudFormation sends the whole configuration object and S3 treats an absent member as unset. A template that looks like it is tightening one control has quietly loosened three.
Always write all four members, even the ones you are not changing.
PublicAccessBlockConfiguration properties
- BlockPublicAcls BooleanReject new public ACLs on PUT. Does not affect ACLs already set. No interruption — updates in place
  Reject new public ACLs on PUT. Does not affect ACLs already set.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
- IgnorePublicAcls BooleanIgnore every public ACL, including existing ones. This is the one that neutralises past mistakes. No interruption — updates in place
  Ignore every public ACL, including existing ones. This is the one that neutralises past mistakes.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
- BlockPublicPolicy BooleanReject bucket policies that grant public access. No interruption — updates in place
  Reject bucket policies that grant public access.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
- RestrictPublicBuckets BooleanRestrict access under a public policy to principals within the bucket owner's account and to AWS services. No interruption — updates in place
  Restrict access under a public policy to principals within the bucket owner's account and to AWS services.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
AccelerateConfiguration AccelerateConfigurationTransfer acceleration through CloudFront edge locations, for long-haul uploads. No interruption — updates in place
Billed per gigabyte on top of normal transfer, and only worth enabling when clients are far from the bucket’s region. S3 publishes a speed comparison tool; use it before turning this on.
Type
AccelerateConfiguration
Required
No
Update behaviour
No interruption
AccelerateConfiguration properties
- AccelerationStatus StringWhether transfer acceleration is on. Required No interruption — updates in place
  Whether transfer acceleration is on.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  Enabled
  Suspended
CorsConfiguration CorsConfigurationCross-origin rules for browsers reading the bucket directly. No interruption — updates in place
Cross-origin rules for browsers reading the bucket directly.
Type
CorsConfiguration
Required
No
Update behaviour
No interruption
CorsConfiguration properties
- CorsRules Array of CorsRuleThe rules, evaluated in order; the first match wins. Required No interruption — updates in place
  The rules, evaluated in order; the first match wins.
  Type
  Array of CorsRule
  Required
  Yes
  Update behaviour
  No interruption
  Items
  1 – 100
  CorsRule properties
  AllowedMethods Array of StringHTTP methods the rule permits. Required No interruption — updates in place
  HTTP methods the rule permits.
  Type
  Array of String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  GET
  PUT
  HEAD
  POST
  DELETE
  AllowedOrigins Array of StringOrigins the rule permits. `*` allows all. Required No interruption — updates in place
  Origins the rule permits. `*` allows all.
  Type
  Array of String
  Required
  Yes
  Update behaviour
  No interruption
  Example values
  ["https://app.acme.example"]
  AllowedHeaders Array of StringRequest headers permitted in the preflight response. No interruption — updates in place
  Request headers permitted in the preflight response.
  Type
  Array of String
  Required
  No
  Update behaviour
  No interruption
  ExposedHeaders Array of StringResponse headers the browser is allowed to read. No interruption — updates in place
  Browsers hide every response header from JavaScript unless it is listed here. ETag is the one people miss, and its absence breaks resumable-upload and cache-validation code with no visible error.
  Type
  Array of String
  Required
  No
  Update behaviour
  No interruption
  Id StringRule identifier. No interruption — updates in place
  Rule identifier.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Length
  0 – 255
  MaxAge IntegerSeconds a browser may cache the preflight response. No interruption — updates in place
  Seconds a browser may cache the preflight response.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
LifecycleConfiguration LifecycleConfigurationRules that transition objects between storage classes and eventually delete them. No interruption — updates in place
Rules that transition objects between storage classes and eventually delete them.
Type
LifecycleConfiguration
Required
No
Update behaviour
No interruption
LifecycleConfiguration properties
- Rules Array of LifecycleRuleThe rules, evaluated independently against every object. Required No interruption — updates in place
  The rules, evaluated independently against every object.
  Type
  Array of LifecycleRule
  Required
  Yes
  Update behaviour
  No interruption
  Items
  1 – 1000
  LifecycleRule properties
  Status StringWhether the rule is active. Required No interruption — updates in place
  Whether the rule is active.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  Enabled
  Disabled
  Id StringRule name, unique within the configuration. No interruption — updates in place
  Optional, but omitting it means S3 generates one and your rules become unidentifiable in the console and in any diff.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Length
  0 – 255
  Prefix StringKey prefix the rule applies to. Applies to every object when omitted. No interruption — updates in place
  Key prefix the rule applies to. Applies to every object when omitted.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Example values
  logs/
  AbortIncompleteMultipartUpload AbortIncompleteMultipartUploadClean up multipart uploads that were never completed. No interruption — updates in place
  Clean up multipart uploads that were never completed.
  Type
  AbortIncompleteMultipartUpload
  Required
  No
  Update behaviour
  No interruption
  Tip
  Add this to every bucket. Abandoned multipart uploads are invisible — they do not appear in the console object list — and they are billed at full storage rates indefinitely. Seven days is a sensible default and it is the single cheapest cost saving in S3.
  AbortIncompleteMultipartUpload properties
  DaysAfterInitiation IntegerDays after an upload starts before its parts are deleted. Required No interruption — updates in place
  Days after an upload starts before its parts are deleted.
  Type
  Integer
  Required
  Yes
  Update behaviour
  No interruption
  Range
  1 – ∞
  Example values
  7
  ExpirationDate StringDelete objects on a fixed date, in ISO 8601 at midnight UTC. No interruption — updates in place
  Delete objects on a fixed date, in ISO 8601 at midnight UTC.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Example values
  2027-01-01T00:00:00Z
  ExpirationInDays IntegerDelete objects this many days after creation. No interruption — updates in place
  Delete objects this many days after creation.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
  Range
  1 – ∞
  Example values
  90
  ExpiredObjectDeleteMarker BooleanRemove delete markers left with no non-current versions behind them. No interruption — updates in place
  Without this, a versioned bucket accumulates orphaned delete markers forever. They are tiny, but they slow every ListObjectsV2 and they are invisible in the console’s default view.
  Type
  Boolean
  Required
  No
  Update behaviour
  No interruption
  NoncurrentVersionExpirationInDays IntegerDelete non-current versions this many days after they stop being current. No interruption — updates in place
  Delete non-current versions this many days after they stop being current.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
  Range
  1 – ∞
  ObjectSizeGreaterThan IntegerOnly apply to objects larger than this many bytes. No interruption — updates in place
  Only apply to objects larger than this many bytes.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
  ObjectSizeLessThan IntegerOnly apply to objects smaller than this many bytes. No interruption — updates in place
  Only apply to objects smaller than this many bytes.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
  TagFilters Array of TagOnly apply to objects carrying all of these tags. No interruption — updates in place
  Only apply to objects carrying all of these tags.
  Type
  Array of Tag
  Required
  No
  Update behaviour
  No interruption
  Tag properties
  Key StringTag key. Case-sensitive, and cannot begin with `aws:`. Required No interruption — updates in place
  Tag key. Case-sensitive, and cannot begin with `aws:`.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  1 – 128
  Example values
  Environment
  Value StringTag value. Required No interruption — updates in place
  Tag value.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  0 – 256
  Example values
  production
  Transitions Array of LifecycleTransitionStorage-class transitions for current versions. No interruption — updates in place
  Storage-class transitions for current versions.
  Type
  Array of LifecycleTransition
  Required
  No
  Update behaviour
  No interruption
  LifecycleTransition properties
  StorageClass StringThe class to transition into. Required No interruption — updates in place
  The class to transition into.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  STANDARD_IA
  ONEZONE_IA
  INTELLIGENT_TIERING
  GLACIER_IR
  GLACIER
  DEEP_ARCHIVE
  TransitionInDays IntegerDays after creation to transition. Conditional No interruption — updates in place
  Days after creation to transition.
  Type
  Integer
  Required
  ConditionalOne of TransitionInDays or TransitionDate is required.
  Update behaviour
  No interruption
  Range
  −∞ – ∞
  Minimum ages are enforced silently
  STANDARD_IA and ONEZONE_IA have a 30-day minimum: a transition at day 1 is accepted by CloudFormation and then simply never happens. There is no error and no event. INTELLIGENT_TIERING has no minimum, which is why it is usually the better answer for unpredictable access patterns.
  TransitionDate StringFixed transition date, in ISO 8601 at midnight UTC. Conditional No interruption — updates in place
  Fixed transition date, in ISO 8601 at midnight UTC.
  Type
  String
  Required
  ConditionalOne of TransitionInDays or TransitionDate is required.
  Update behaviour
  No interruption
LoggingConfiguration LoggingConfigurationServer access logging to another bucket. No interruption — updates in place
Server access logging to another bucket.
Type
LoggingConfiguration
Required
No
Update behaviour
No interruption
A bucket that logs to itself grows without bound
Setting DestinationBucketName to this bucket creates a feedback loop: writing a log object is itself a request, which produces another log entry, which is eventually written as another object. Growth is sub-linear rather than explosive, but it never stops and the bill is real. Always log to a separate bucket.
LoggingConfiguration properties
- DestinationBucketName StringBucket that receives the logs. Must be in the same region. No interruption — updates in place
  Bucket that receives the logs. Must be in the same region.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
- LogFilePrefix StringKey prefix for delivered log objects. No interruption — updates in place
  Key prefix for delivered log objects.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Example values
  s3-access/acme-assets/
NotificationConfiguration NotificationConfigurationEvents published to Lambda, SQS, SNS, or EventBridge when objects change. No interruption — updates in place
Events published to Lambda, SQS, SNS, or EventBridge when objects change.
Type
NotificationConfiguration
Required
No
Update behaviour
No interruption
Circular dependency with the notification target
The bucket needs the target’s ARN, and the target’s resource policy needs the bucket’s ARN to authorise s3.amazonaws.com. Written directly, that is a dependency cycle CloudFormation refuses to resolve.
Break it by constructing the bucket ARN from the known bucket name (!Sub 'arn:${AWS::Partition}:s3:::${BucketNameParam}') in the target’s policy, rather than with !GetAtt Bucket.Arn.
NotificationConfiguration properties
- EventBridgeConfiguration EventBridgeConfigurationSend all events to EventBridge. No interruption — updates in place
  Almost always the better choice than the three direct integrations: one switch, no per-destination resource policy, no prefix-overlap rules, and filtering happens in EventBridge where it can be changed without touching the bucket.
  Type
  EventBridgeConfiguration
  Required
  No
  Update behaviour
  No interruption
  EventBridgeConfiguration properties
  EventBridgeEnabled BooleanWhether all bucket events are published to the default event bus. Required No interruption — updates in place
  Whether all bucket events are published to the default event bus.
  Type
  Boolean
  Required
  Yes
  Update behaviour
  No interruption
- LambdaConfigurations Array of LambdaConfigurationDirect Lambda invocations per event type. No interruption — updates in place
  Direct Lambda invocations per event type.
  Type
  Array of LambdaConfiguration
  Required
  No
  Update behaviour
  No interruption
  LambdaConfiguration properties
  Event StringThe S3 event type, such as `s3:ObjectCreated:*`. Required No interruption — updates in place
  The S3 event type, such as `s3:ObjectCreated:*`.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Example values
  s3:ObjectCreated:*
  Function StringARN of the function to invoke. Required No interruption — updates in place
  ARN of the function to invoke.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Filter NotificationFilterPrefix and suffix filter. No interruption — updates in place
  Prefix and suffix filter.
  Type
  NotificationFilter
  Required
  No
  Update behaviour
  No interruption
  NotificationFilter properties
  S3Key S3KeyFilterThe key filter rules. Required No interruption — updates in place
  The key filter rules.
  Type
  S3KeyFilter
  Required
  Yes
  Update behaviour
  No interruption
  S3KeyFilter properties
  Rules Array of FilterRuleAt most one prefix rule and one suffix rule. Required No interruption — updates in place
  At most one prefix rule and one suffix rule.
  Type
  Array of FilterRule
  Required
  Yes
  Update behaviour
  No interruption
  FilterRule properties
  Name StringWhich part of the key to match. Required No interruption — updates in place
  Which part of the key to match.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  prefix
  suffix
  Value StringThe prefix or suffix to match. Required No interruption — updates in place
  The prefix or suffix to match.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
- QueueConfigurations Array of QueueConfigurationDirect SQS deliveries per event type. No interruption — updates in place
  Direct SQS deliveries per event type.
  Type
  Array of QueueConfiguration
  Required
  No
  Update behaviour
  No interruption
  QueueConfiguration properties
  Event StringThe S3 event type. Required No interruption — updates in place
  The S3 event type.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Queue StringARN of the destination queue. Required No interruption — updates in place
  ARN of the destination queue.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Filter NotificationFilterPrefix and suffix filter. No interruption — updates in place
  Prefix and suffix filter.
  Type
  NotificationFilter
  Required
  No
  Update behaviour
  No interruption
  NotificationFilter properties
  S3Key S3KeyFilterThe key filter rules. Required No interruption — updates in place
  The key filter rules.
  Type
  S3KeyFilter
  Required
  Yes
  Update behaviour
  No interruption
  S3KeyFilter properties
  Rules Array of FilterRuleAt most one prefix rule and one suffix rule. Required No interruption — updates in place
  At most one prefix rule and one suffix rule.
  Type
  Array of FilterRule
  Required
  Yes
  Update behaviour
  No interruption
  FilterRule properties
  Name StringWhich part of the key to match. Required No interruption — updates in place
  Which part of the key to match.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  prefix
  suffix
  Value StringThe prefix or suffix to match. Required No interruption — updates in place
  The prefix or suffix to match.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
ObjectLockConfiguration ObjectLockConfigurationDefault retention applied to new objects. Requires ObjectLockEnabled. No interruption — updates in place
Default retention applied to new objects. Requires ObjectLockEnabled.
Type
ObjectLockConfiguration
Required
NoOnly valid when ObjectLockEnabled is true.
Update behaviour
No interruption
ObjectLockConfiguration properties
- ObjectLockEnabled StringMust be `Enabled`. The only accepted value. No interruption — updates in place
  Must be `Enabled`. The only accepted value.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Allowed values
  Enabled
- Rule ObjectLockRuleThe default retention rule. No interruption — updates in place
  The default retention rule.
  Type
  ObjectLockRule
  Required
  No
  Update behaviour
  No interruption
  ObjectLockRule properties
  DefaultRetention DefaultRetentionRetention applied to objects written without their own. No interruption — updates in place
  Retention applied to objects written without their own.
  Type
  DefaultRetention
  Required
  No
  Update behaviour
  No interruption
  DefaultRetention properties
  Mode StringWhether privileged users can shorten the retention. Conditional No interruption — updates in place
  GOVERNANCE can be overridden by a principal holding s3:BypassGovernanceRetention. COMPLIANCE cannot be overridden by anyone, ever, including the account root.
  Type
  String
  Required
  ConditionalRequired when DefaultRetention is present.
  Update behaviour
  No interruption
  Allowed values
  GOVERNANCE
  COMPLIANCE
  Days IntegerRetention length in days. Conditional No interruption — updates in place
  Retention length in days.
  Type
  Integer
  Required
  ConditionalExactly one of Days or Years is required.
  Update behaviour
  No interruption
  Range
  1 – ∞
  Years IntegerRetention length in years. Conditional No interruption — updates in place
  Retention length in years.
  Type
  Integer
  Required
  ConditionalExactly one of Days or Years is required.
  Update behaviour
  No interruption
  Range
  1 – ∞
ObjectLockEnabled BooleanWhether object lock can ever be used on this bucket. Cannot be turned on later. Replacement — CloudFormation creates a new resource and deletes the old one Create-only
Whether object lock can ever be used on this bucket. Cannot be turned on later.
Type
Boolean
Required
No
Update behaviour
Replacement
Caution
Object lock in COMPLIANCE mode cannot be shortened or removed by anyone, including the account root, until the retention period expires. A misconfigured retention of ten years means ten years of storage charges with no way to delete the data. Test in GOVERNANCE mode first, always.
OwnershipControls OwnershipControlsWhether object ACLs are honoured, and who owns objects uploaded by other accounts. No interruption — updates in place
BucketOwnerEnforced disables ACLs entirely and is the default for buckets created after April 2023. It is also the setting that makes a great deal of older documentation, and a great many older templates, stop working.
Type
OwnershipControls
Required
No
Update behaviour
No interruption
OwnershipControls properties
- Rules Array of OwnershipControlsRuleExactly one ownership rule. Required No interruption — updates in place
  Exactly one ownership rule.
  Type
  Array of OwnershipControlsRule
  Required
  Yes
  Update behaviour
  No interruption
  Items
  1 – 1
  OwnershipControlsRule properties
  ObjectOwnership StringWhether ACLs are honoured and who owns cross-account uploads. No interruption — updates in place
  BucketOwnerEnforced disables ACLs completely; the bucket owner owns every object and access is governed by policy alone. This is both the modern default and the setting you want — ACLs are a pre-IAM access mechanism that predates the account model.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Default
  BucketOwnerEnforced
  Allowed values
  BucketOwnerEnforced
  BucketOwnerPreferred
  ObjectWriter
ReplicationConfiguration ReplicationConfigurationAsynchronous replication of new objects to one or more destination buckets. No interruption — updates in place
Requires versioning on both source and destination. Replication is asynchronous with no ordering guarantee and no SLA unless Replication Time Control is enabled, so it is a durability and locality mechanism, not a consistency one.
Type
ReplicationConfiguration
Required
No
Update behaviour
No interruption
ReplicationConfiguration properties
- Role StringARN of the IAM role S3 assumes to replicate objects. Required No interruption — updates in place
  ARN of the IAM role S3 assumes to replicate objects.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
- Rules Array of ReplicationRuleThe replication rules. Required No interruption — updates in place
  The replication rules.
  Type
  Array of ReplicationRule
  Required
  Yes
  Update behaviour
  No interruption
  Items
  1 – 1000
  ReplicationRule properties
  Destination ReplicationDestinationWhere matching objects are replicated to. Required No interruption — updates in place
  Where matching objects are replicated to.
  Type
  ReplicationDestination
  Required
  Yes
  Update behaviour
  No interruption
  ReplicationDestination properties
  Bucket StringARN of the destination bucket. Required No interruption — updates in place
  ARN of the destination bucket.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  StorageClass StringStorage class for replicas. Defaults to the source object's class. No interruption — updates in place
  Storage class for replicas. Defaults to the source object's class.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Allowed values
  STANDARD
  STANDARD_IA
  ONEZONE_IA
  INTELLIGENT_TIERING
  GLACIER_IR
  GLACIER
  DEEP_ARCHIVE
  REDUCED_REDUNDANCY
  Account StringDestination account ID, for cross-account replication. No interruption — updates in place
  Destination account ID, for cross-account replication.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Status StringWhether the rule is active. Required No interruption — updates in place
  Whether the rule is active.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  Enabled
  Disabled
  Id StringRule identifier. No interruption — updates in place
  Rule identifier.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Prefix StringKey prefix the rule applies to. No interruption — updates in place
  Key prefix the rule applies to.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Priority IntegerTie-break when several rules match the same object. Higher wins. No interruption — updates in place
  Tie-break when several rules match the same object. Higher wins.
  Type
  Integer
  Required
  No
  Update behaviour
  No interruption
Tags Array of TagKey/value tags applied to the bucket itself, not to its objects. No interruption — updates in place
Key/value tags applied to the bucket itself, not to its objects.
Type
Array of Tag
Required
No
Update behaviour
No interruption
Items
0 – 50
Note
Bucket tags are used for cost allocation and access control. They are not inherited by objects — there is no mechanism in S3 for that, and object-level cost allocation does not exist.
Tag properties
- Key StringTag key. Case-sensitive, and cannot begin with `aws:`. Required No interruption — updates in place
  Tag key. Case-sensitive, and cannot begin with `aws:`.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  1 – 128
  Example values
  Environment
- Value StringTag value. Required No interruption — updates in place
  Tag value.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Length
  0 – 256
  Example values
  production
VersioningConfiguration VersioningConfigurationWhether the bucket keeps previous versions of overwritten and deleted objects. No interruption — updates in place
Whether the bucket keeps previous versions of overwritten and deleted objects.
Type
VersioningConfiguration
Required
No
Update behaviour
No interruption
Important
Versioning can be enabled and then suspended, but never switched off. A suspended bucket stops creating new versions and keeps every version it already has — which continue to cost storage until a lifecycle rule expires them.
VersioningConfiguration properties
- Status StringWhether object versions are retained. Required No interruption — updates in place
  Whether object versions are retained.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Allowed values
  Enabled
  Suspended
  Example values
  Enabled
WebsiteConfiguration WebsiteConfigurationStatic website hosting, which exposes an HTTP-only website endpoint distinct from the REST endpoint. No interruption — updates in place
Static website hosting, which exposes an HTTP-only website endpoint distinct from the REST endpoint.
Type
WebsiteConfiguration
Required
No
Update behaviour
No interruption
Warning
The website endpoint speaks HTTP only and does not support TLS at all. Any production use needs CloudFront in front of it — at which point the usual pattern is to skip website hosting entirely and use an origin access control against the REST endpoint, which keeps the bucket private.
WebsiteConfiguration properties
- IndexDocument StringObject key returned for a request ending in a slash. No interruption — updates in place
  Object key returned for a request ending in a slash.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Example values
  index.html
- ErrorDocument StringObject key returned for 4xx responses. No interruption — updates in place
  Object key returned for 4xx responses.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Example values
  error.html
- RedirectAllRequestsTo RedirectAllRequestsToRedirect every request to another host. Mutually exclusive with the other members. No interruption — updates in place
  Redirect every request to another host. Mutually exclusive with the other members.
  Type
  RedirectAllRequestsTo
  Required
  No
  Update behaviour
  No interruption
  RedirectAllRequestsTo properties
  HostName StringHost to redirect to. Required No interruption — updates in place
  Host to redirect to.
  Type
  String
  Required
  Yes
  Update behaviour
  No interruption
  Protocol StringProtocol of the redirect target. No interruption — updates in place
  Protocol of the redirect target.
  Type
  String
  Required
  No
  Update behaviour
  No interruption
  Allowed values
  http
  https
AccessControl StringA canned ACL applied to the bucket. No interruption — updates in place Deprecated
Deprecated
Superseded by OwnershipControls and bucket policies. Has no effect on buckets with BucketOwnerEnforced object ownership, which is the default.
A canned ACL applied to the bucket.
Type
String
Required
No
Update behaviour
No interruption
Allowed values
- Private
- PublicRead
- PublicReadWrite
- AuthenticatedRead
- LogDeliveryWrite
- BucketOwnerRead
- BucketOwnerFullControl
- AwsExecRead
Warning
On a bucket with the modern default of BucketOwnerEnforced, setting this property fails the stack with AccessControlListNotSupported. Templates carrying AccessControl: Private “for safety” are the most common cause of that error, and removing the line is the fix.

Property	Type	Required	Update	Description
BucketName	`String`	No	Replacement	The bucket's name, which must be unique across every AWS account in the partition.
BucketEncryption	`BucketEncryption`	No	None	Default server-side encryption applied to objects written without their own encryption headers.
BucketEncryption.ServerSideEncryptionConfiguration	`Array of ServerSideEncryptionRule`	Yes	None	The encryption rules. S3 accepts a list but applies exactly one.
BucketEncryption.ServerSideEncryptionConfiguration.ServerSideEncryptionByDefault	`ServerSideEncryptionByDefault`	No	None	The algorithm and key to apply by default.
BucketEncryption.ServerSideEncryptionConfiguration.BucketKeyEnabled	`Boolean`	No	None	Reduce KMS request costs by deriving a bucket-level data key.
PublicAccessBlockConfiguration	`PublicAccessBlockConfiguration`	No	None	Four independent switches that override any ACL or bucket policy granting public access.
PublicAccessBlockConfiguration.BlockPublicAcls	`Boolean`	No	None	Reject new public ACLs on PUT. Does not affect ACLs already set.
PublicAccessBlockConfiguration.IgnorePublicAcls	`Boolean`	No	None	Ignore every public ACL, including existing ones. This is the one that neutralises past mistakes.
PublicAccessBlockConfiguration.BlockPublicPolicy	`Boolean`	No	None	Reject bucket policies that grant public access.
PublicAccessBlockConfiguration.RestrictPublicBuckets	`Boolean`	No	None	Restrict access under a public policy to principals within the bucket owner's account and to AWS services.
AccelerateConfiguration	`AccelerateConfiguration`	No	None	Transfer acceleration through CloudFront edge locations, for long-haul uploads.
AccelerateConfiguration.AccelerationStatus	`String`	Yes	None	Whether transfer acceleration is on.
CorsConfiguration	`CorsConfiguration`	No	None	Cross-origin rules for browsers reading the bucket directly.
CorsConfiguration.CorsRules	`Array of CorsRule`	Yes	None	The rules, evaluated in order; the first match wins.
CorsConfiguration.CorsRules.AllowedMethods	`Array of String`	Yes	None	HTTP methods the rule permits.
CorsConfiguration.CorsRules.AllowedOrigins	`Array of String`	Yes	None	Origins the rule permits. `*` allows all.
CorsConfiguration.CorsRules.AllowedHeaders	`Array of String`	No	None	Request headers permitted in the preflight response.
CorsConfiguration.CorsRules.ExposedHeaders	`Array of String`	No	None	Response headers the browser is allowed to read.
CorsConfiguration.CorsRules.Id	`String`	No	None	Rule identifier.
CorsConfiguration.CorsRules.MaxAge	`Integer`	No	None	Seconds a browser may cache the preflight response.
LifecycleConfiguration	`LifecycleConfiguration`	No	None	Rules that transition objects between storage classes and eventually delete them.
LifecycleConfiguration.Rules	`Array of LifecycleRule`	Yes	None	The rules, evaluated independently against every object.
LifecycleConfiguration.Rules.Status	`String`	Yes	None	Whether the rule is active.
LifecycleConfiguration.Rules.Id	`String`	No	None	Rule name, unique within the configuration.
LifecycleConfiguration.Rules.Prefix	`String`	No	None	Key prefix the rule applies to. Applies to every object when omitted.
LifecycleConfiguration.Rules.AbortIncompleteMultipartUpload	`AbortIncompleteMultipartUpload`	No	None	Clean up multipart uploads that were never completed.
LifecycleConfiguration.Rules.ExpirationDate	`String`	No	None	Delete objects on a fixed date, in ISO 8601 at midnight UTC.
LifecycleConfiguration.Rules.ExpirationInDays	`Integer`	No	None	Delete objects this many days after creation.
LifecycleConfiguration.Rules.ExpiredObjectDeleteMarker	`Boolean`	No	None	Remove delete markers left with no non-current versions behind them.
LifecycleConfiguration.Rules.NoncurrentVersionExpirationInDays	`Integer`	No	None	Delete non-current versions this many days after they stop being current.
LifecycleConfiguration.Rules.ObjectSizeGreaterThan	`Integer`	No	None	Only apply to objects larger than this many bytes.
LifecycleConfiguration.Rules.ObjectSizeLessThan	`Integer`	No	None	Only apply to objects smaller than this many bytes.
LifecycleConfiguration.Rules.TagFilters	`Array of Tag`	No	None	Only apply to objects carrying all of these tags.
LifecycleConfiguration.Rules.Transitions	`Array of LifecycleTransition`	No	None	Storage-class transitions for current versions.
LoggingConfiguration	`LoggingConfiguration`	No	None	Server access logging to another bucket.
LoggingConfiguration.DestinationBucketName	`String`	No	None	Bucket that receives the logs. Must be in the same region.
LoggingConfiguration.LogFilePrefix	`String`	No	None	Key prefix for delivered log objects.
NotificationConfiguration	`NotificationConfiguration`	No	None	Events published to Lambda, SQS, SNS, or EventBridge when objects change.
NotificationConfiguration.EventBridgeConfiguration	`EventBridgeConfiguration`	No	None	Send all events to EventBridge.
NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled	`Boolean`	Yes	None	Whether all bucket events are published to the default event bus.
NotificationConfiguration.LambdaConfigurations	`Array of LambdaConfiguration`	No	None	Direct Lambda invocations per event type.
NotificationConfiguration.LambdaConfigurations.Event	`String`	Yes	None	The S3 event type, such as `s3:ObjectCreated:*`.
NotificationConfiguration.LambdaConfigurations.Function	`String`	Yes	None	ARN of the function to invoke.
NotificationConfiguration.LambdaConfigurations.Filter	`NotificationFilter`	No	None	Prefix and suffix filter.
NotificationConfiguration.QueueConfigurations	`Array of QueueConfiguration`	No	None	Direct SQS deliveries per event type.
NotificationConfiguration.QueueConfigurations.Event	`String`	Yes	None	The S3 event type.
NotificationConfigurationConfigurations.Queue	`String`	Yes	None	ARN of the destination queue.
NotificationConfiguration.QueueConfigurations.Filter	`NotificationFilter`	No	None	Prefix and suffix filter.
ObjectLockConfiguration	`ObjectLockConfiguration`	No	None	Default retention applied to new objects. Requires ObjectLockEnabled.
ObjectLockConfiguration.ObjectLockEnabled	`String`	No	None	Must be `Enabled`. The only accepted value.
ObjectLockConfiguration.Rule	`ObjectLockRule`	No	None	The default retention rule.
ObjectLockConfiguration.Rule.DefaultRetention	`DefaultRetention`	No	None	Retention applied to objects written without their own.
ObjectLockEnabled	`Boolean`	No	Replacement	Whether object lock can ever be used on this bucket. Cannot be turned on later.
OwnershipControls	`OwnershipControls`	No	None	Whether object ACLs are honoured, and who owns objects uploaded by other accounts.
OwnershipControls.Rules	`Array of OwnershipControlsRule`	Yes	None	Exactly one ownership rule.
OwnershipControls.Rules.ObjectOwnership	`String`	No	None	Whether ACLs are honoured and who owns cross-account uploads.
ReplicationConfiguration	`ReplicationConfiguration`	No	None	Asynchronous replication of new objects to one or more destination buckets.
ReplicationConfiguration.Role	`String`	Yes	None	ARN of the IAM role S3 assumes to replicate objects.
ReplicationConfiguration.Rules	`Array of ReplicationRule`	Yes	None	The replication rules.
ReplicationConfiguration.Rules.Destination	`ReplicationDestination`	Yes	None	Where matching objects are replicated to.
ReplicationConfiguration.Rules.Status	`String`	Yes	None	Whether the rule is active.
ReplicationConfiguration.Rules.Id	`String`	No	None	Rule identifier.
ReplicationConfiguration.Rules.Prefix	`String`	No	None	Key prefix the rule applies to.
ReplicationConfiguration.Rules.Priority	`Integer`	No	None	Tie-break when several rules match the same object. Higher wins.
Tags	`Array of Tag`	No	None	Key/value tags applied to the bucket itself, not to its objects.
Tags.Key	`String`	Yes	None	Tag key. Case-sensitive, and cannot begin with `aws:`.
Tags.Value	`String`	Yes	None	Tag value.
VersioningConfiguration	`VersioningConfiguration`	No	None	Whether the bucket keeps previous versions of overwritten and deleted objects.
VersioningConfiguration.Status	`String`	Yes	None	Whether object versions are retained.
WebsiteConfiguration	`WebsiteConfiguration`	No	None	Static website hosting, which exposes an HTTP-only website endpoint distinct from the REST endpoint.
WebsiteConfiguration.IndexDocument	`String`	No	None	Object key returned for a request ending in a slash.
WebsiteConfiguration.ErrorDocument	`String`	No	None	Object key returned for 4xx responses.
WebsiteConfiguration.RedirectAllRequestsTo	`RedirectAllRequestsTo`	No	None	Redirect every request to another host. Mutually exclusive with the other members.
WebsiteConfiguration.RedirectAllRequestsTo.HostName	`String`	Yes	None	Host to redirect to.
WebsiteConfiguration.RedirectAllRequestsTo.Protocol	`String`	No	None	Protocol of the redirect target.
AccessControl	`String`	No	None	A canned ACL applied to the bucket.

Generated from the schema. The first pair shows only required and conditionally-required properties — a template you can paste and deploy. Property keys are ordered alphabetically here rather than required-first, because that is the order a template file conventionally uses.

Type: AWS::S3::Bucket
Properties:
  {}

{
  "Type": "AWS::S3::Bucket",
  "Properties": {}
}

Every property, three levels deep:

Type: AWS::S3::Bucket
Properties:
  AccelerateConfiguration:
    AccelerationStatus: Enabled
  AccessControl: Private
  BucketEncryption:
    ServerSideEncryptionConfiguration:
    - BucketKeyEnabled: false
      ServerSideEncryptionByDefault:
        KMSMasterKeyID: alias/acme-data
        SSEAlgorithm: aws:kms
  BucketName: acme-platform-assets-production
  CorsConfiguration:
    CorsRules:
    - AllowedHeaders:
      - String
      AllowedMethods:
      - String
      AllowedOrigins:
      - String
      ExposedHeaders:
      - String
      Id: String
      MaxAge: 0.0
  LifecycleConfiguration:
    Rules:
    - AbortIncompleteMultipartUpload:
        DaysAfterInitiation: '7'
      ExpirationDate: '2027-01-01T00:00:00Z'
      ExpirationInDays: '90'
      ExpiredObjectDeleteMarker: false
      Id: String
      NoncurrentVersionExpirationInDays: 0.0
      ObjectSizeGreaterThan: 0.0
      ObjectSizeLessThan: 0.0
      Prefix: logs/
      Status: Enabled
      TagFilters:
      - Key: Environment
        Value: production
      Transitions:
      - StorageClass: STANDARD_IA
        TransitionDate: String
        TransitionInDays: 0.0
  LoggingConfiguration:
    DestinationBucketName: String
    LogFilePrefix: s3-access/acme-assets/
  NotificationConfiguration:
    EventBridgeConfiguration:
      EventBridgeEnabled: false
    LambdaConfigurations:
    - Event: s3:ObjectCreated:*
      Filter:
        S3Key: {}
      Function: String
    QueueConfigurations:
    - Event: String
      Filter:
        S3Key: {}
      Queue: String
  ObjectLockConfiguration:
    ObjectLockEnabled: Enabled
    Rule:
      DefaultRetention:
        Days: 0
        Mode: GOVERNANCE
        Years: 0
  ObjectLockEnabled: false
  OwnershipControls:
    Rules:
    - ObjectOwnership: BucketOwnerEnforced
  PublicAccessBlockConfiguration:
    BlockPublicAcls: false
    BlockPublicPolicy: false
    IgnorePublicAcls: false
    RestrictPublicBuckets: false
  ReplicationConfiguration:
    Role: String
    Rules:
    - Destination:
        Account: String
        Bucket: String
        StorageClass: STANDARD
      Id: String
      Prefix: String
      Priority: 0.0
      Status: Enabled
  Tags:
  - Key: Environment
    Value: production
  VersioningConfiguration:
    Status: Enabled
  WebsiteConfiguration:
    ErrorDocument: error.html
    IndexDocument: index.html
    RedirectAllRequestsTo:
      HostName: String
      Protocol: http

{
  "Type": "AWS::S3::Bucket",
  "Properties": {
    "AccelerateConfiguration": {
      "AccelerationStatus": "Enabled"
    },
    "AccessControl": "Private",
    "BucketEncryption": {
      "ServerSideEncryptionConfiguration": [
        {
          "BucketKeyEnabled": false,
          "ServerSideEncryptionByDefault": {
            "KMSMasterKeyID": "alias/acme-data",
            "SSEAlgorithm": "aws:kms"
          }
        }
      ]
    },
    "BucketName": "acme-platform-assets-production",
    "CorsConfiguration": {
      "CorsRules": [
        {
          "AllowedHeaders": [
            "String"
          ],
          "AllowedMethods": [
            "String"
          ],
          "AllowedOrigins": [
            "String"
          ],
          "ExposedHeaders": [
            "String"
          ],
          "Id": "String",
          "MaxAge": 0
        }
      ]
    },
    "LifecycleConfiguration": {
      "Rules": [
        {
          "AbortIncompleteMultipartUpload": {
            "DaysAfterInitiation": "7"
          },
          "ExpirationDate": "2027-01-01T00:00:00Z",
          "ExpirationInDays": "90",
          "ExpiredObjectDeleteMarker": false,
          "Id": "String",
          "NoncurrentVersionExpirationInDays": 0,
          "ObjectSizeGreaterThan": 0,
          "ObjectSizeLessThan": 0,
          "Prefix": "logs/",
          "Status": "Enabled",
          "TagFilters": [
            {
              "Key": "Environment",
              "Value": "production"
            }
          ],
          "Transitions": [
            {
              "StorageClass": "STANDARD_IA",
              "TransitionDate": "String",
              "TransitionInDays": 0
            }
          ]
        }
      ]
    },
    "LoggingConfiguration": {
      "DestinationBucketName": "String",
      "LogFilePrefix": "s3-access/acme-assets/"
    },
    "NotificationConfiguration": {
      "EventBridgeConfiguration": {
        "EventBridgeEnabled": false
      },
      "LambdaConfigurations": [
        {
          "Event": "s3:ObjectCreated:*",
          "Filter": {
            "S3Key": {}
          },
          "Function": "String"
        }
      ],
      "QueueConfigurations": [
        {
          "Event": "String",
          "Filter": {
            "S3Key": {}
          },
          "Queue": "String"
        }
      ]
    },
    "ObjectLockConfiguration": {
      "ObjectLockEnabled": "Enabled",
      "Rule": {
        "DefaultRetention": {
          "Days": 0,
          "Mode": "GOVERNANCE",
          "Years": 0
        }
      }
    },
    "ObjectLockEnabled": false,
    "OwnershipControls": {
      "Rules": [
        {
          "ObjectOwnership": "BucketOwnerEnforced"
        }
      ]
    },
    "PublicAccessBlockConfiguration": {
      "BlockPublicAcls": false,
      "BlockPublicPolicy": false,
      "IgnorePublicAcls": false,
      "RestrictPublicBuckets": false
    },
    "ReplicationConfiguration": {
      "Role": "String",
      "Rules": [
        {
          "Destination": {
            "Account": "String",
            "Bucket": "String",
            "StorageClass": "STANDARD"
          },
          "Id": "String",
          "Prefix": "String",
          "Priority": 0,
          "Status": "Enabled"
        }
      ]
    },
    "Tags": [
      {
        "Key": "Environment",
        "Value": "production"
      }
    ],
    "VersioningConfiguration": {
      "Status": "Enabled"
    },
    "WebsiteConfiguration": {
      "ErrorDocument": "error.html",
      "IndexDocument": "index.html",
      "RedirectAllRequestsTo": {
        "HostName": "String",
        "Protocol": "http"
      }
    }
  }
}

updates in place some interruption replacement create-only read-only write-only

Return values

What other resources can read from this one

Ref

Returns the bucket name — the value of BucketName, or the generated name if it was omitted.

!Ref MyResource → acme-platform-assets-production

`Fn::GetAtt` attributes

Attribute	Type	Description	Example value
Arn	`String`	The bucket’s ARN. Note that S3 bucket ARNs carry no account or region.	`arn:aws:s3:::acme-platform-assets-production`
DomainName	`String`	IPv4 REST endpoint hostname.	`acme-platform-assets-production.s3.amazonaws.com`
DualStackDomainName	`String`	Endpoint reachable over both IPv4 and IPv6.	`acme-platform-assets-production.s3.dualstack.us-west-2.amazonaws.com`
RegionalDomainName	`String`	Region-specific REST endpoint. Prefer this over DomainName — it avoids a redirect on the first request and works with SigV4 without a region lookup.	`acme-platform-assets-production.s3.us-west-2.amazonaws.com`
WebsiteURL	`String`	Website endpoint. Only meaningful when WebsiteConfiguration is set, and HTTP-only.	`http://acme-platform-assets-production.s3-website-us-west-2.amazonaws.com`

Required permissions

For the principal running the stack operation

create

s3:CreateBucket
s3:PutBucketTagging
s3:PutEncryptionConfiguration
s3:PutBucketPublicAccessBlock
s3:PutBucketVersioning
s3:PutBucketOwnershipControls
s3:PutLifecycleConfiguration
s3:PutBucketLogging
s3:PutBucketCORS
s3:PutBucketWebsite
s3:PutBucketNotification

read

s3:GetBucketTagging
s3:GetEncryptionConfiguration
s3:GetBucketPublicAccessBlock
s3:GetBucketVersioning
s3:GetBucketOwnershipControls
s3:GetLifecycleConfiguration
s3:GetBucketLogging
s3:GetBucketCORS
s3:GetBucketWebsite
s3:GetBucketNotification

update

s3:PutBucketTagging
s3:PutEncryptionConfiguration
s3:PutBucketPublicAccessBlock
s3:PutBucketVersioning
s3:PutBucketOwnershipControls
s3:PutLifecycleConfiguration
s3:PutBucketLogging
s3:PutBucketCORS
s3:PutBucketWebsite
s3:PutBucketNotification

delete

s3:DeleteBucket

list

s3:ListAllMyBuckets

{
  "Statement": [
    {
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketCORS",
        "s3:GetBucketLogging",
        "s3:GetBucketNotification",
        "s3:GetBucketOwnershipControls",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:ListAllMyBuckets",
        "s3:PutBucketCORS",
        "s3:PutBucketLogging",
        "s3:PutBucketNotification",
        "s3:PutBucketOwnershipControls",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutBucketTagging",
        "s3:PutBucketVersioning",
        "s3:PutBucketWebsite",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Sid": "ManageResource"
    }
  ],
  "Version": "2012-10-17"
}

Statement:
- Action:
  - s3:CreateBucket
  - s3:DeleteBucket
  - s3:GetBucketCORS
  - s3:GetBucketLogging
  - s3:GetBucketNotification
  - s3:GetBucketOwnershipControls
  - s3:GetBucketPublicAccessBlock
  - s3:GetBucketTagging
  - s3:GetBucketVersioning
  - s3:GetBucketWebsite
  - s3:GetEncryptionConfiguration
  - s3:GetLifecycleConfiguration
  - s3:ListAllMyBuckets
  - s3:PutBucketCORS
  - s3:PutBucketLogging
  - s3:PutBucketNotification
  - s3:PutBucketOwnershipControls
  - s3:PutBucketPublicAccessBlock
  - s3:PutBucketTagging
  - s3:PutBucketVersioning
  - s3:PutBucketWebsite
  - s3:PutEncryptionConfiguration
  - s3:PutLifecycleConfiguration
  Effect: Allow
  Resource: '*'
  Sid: ManageResource
Version: '2012-10-17'

Examples

1 worked scenario

Static site behind CloudFront The standard way to serve a static site from S3 — which is not the way most tutorials show, because website hosting cannot do TLS and origin access control keeps the bucket private. IntermediateAWS::S3::BucketAWS::Route53::RecordSetDiagram