Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 262e8a7

Browse filesBrowse files
ysthakurysthakur
authored
feat(s3): add blockedEncryptionTypes field to s3.Bucket (#37047)
### Issue # Closes #36988. ### Reason for this change S3 recently added a new `BlockedEncryptionTypes` field to server-side encryption rules ([docs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/blocking-unblocking-s3-c-encryption-gpb.html)). This field allows users to explicitly block or unblock SSE-C encryption on their bucket. Users should be able to set this field through CDK. This will become especially important when SSE-C starts being blocked by default in April ([blog post](https://aws.amazon.com/blogs/storage/advanced-notice-amazon-s3-to-disable-the-use-of-sse-c-encryption-by-default-for-all-new-buckets-and-select-existing-buckets-in-april-2026/)). ### Description of changes Added a `blockedEncryptionTypes` field to the L2 `s3.Bucket` construct. - If `blockedEncryptionTypes` is not set, behavior is same as before. No default `blockedEncryptionTypes` value will be chosen (this is important, we want to let S3 choose what default to apply). - If `blockedEncryptionTypes` is set and `encryptionType` is `BucketEncryption.UNENCRYPTED`, a server-side encryption configuration will be added with just `blockedEncryptionTypes` - **This happens even if `bucketKeyEnabled` is explicitly set**. Please confirm that this is behavior you want. I went with it because `bucketKeyEnabled` is already ignored when `encryptionType` is `BucketEncryption.UNENCRYPTED`. ### Describe any new or updated permissions being added N/A ### Description of how you validated changes Ran unit tests, added integ tests. - Verified that the `MySsecBlockedBucket` bucket has `SSE-C` blocked (and no default server-side encryption type explicitly set) - Verified that the `MyKmsBucket` bucket has no encryption types blocked ### Checklist - [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 73e5006 commit 262e8a7
Copy full SHA for 262e8a7

11 files changed

+865-70Lines changed: 865 additions & 70 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/IntegTestDSSEBucketDefaultTestDeployAssert56801A2F.assets.json‎

Copy file name to clipboardExpand all lines: packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/IntegTestDSSEBucketDefaultTestDeployAssert56801A2F.assets.json
+3-2Lines changed: 3 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Collapse file

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/aws-cdk-s3-bucket-encryption.assets.json‎

Copy file name to clipboardExpand all lines: packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/aws-cdk-s3-bucket-encryption.assets.json
+6-5Lines changed: 6 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Collapse file

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/aws-cdk-s3-bucket-encryption.template.json‎

Copy file name to clipboardExpand all lines: packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/aws-cdk-s3-bucket-encryption.template.json
+24-1Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,11 @@
7676
"BucketEncryption": {
7777
"ServerSideEncryptionConfiguration": [
7878
{
79+
"BlockedEncryptionTypes": {
80+
"EncryptionType": [
81+
"NONE"
82+
]
83+
},
7984
"ServerSideEncryptionByDefault": {
8085
"KMSMasterKeyID": {
8186
"Fn::GetAtt": [
@@ -91,6 +96,24 @@
9196
},
9297
"UpdateReplacePolicy": "Delete",
9398
"DeletionPolicy": "Delete"
99+
},
100+
"MySSECBlockedBucket184125AB": {
101+
"Type": "AWS::S3::Bucket",
102+
"Properties": {
103+
"BucketEncryption": {
104+
"ServerSideEncryptionConfiguration": [
105+
{
106+
"BlockedEncryptionTypes": {
107+
"EncryptionType": [
108+
"SSE-C"
109+
]
110+
}
111+
}
112+
]
113+
}
114+
},
115+
"UpdateReplacePolicy": "Delete",
116+
"DeletionPolicy": "Delete"
94117
}
95118
},
96119
"Parameters": {
@@ -127,4 +150,4 @@
127150
]
128151
}
129152
}
130-
}
153+
}
Collapse file

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/cdk.out‎

Copy file name to clipboardExpand all lines: packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/cdk.out
+1-1Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Collapse file

‎packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/integ.json‎

Copy file name to clipboardExpand all lines: packages/@aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-encryption.js.snapshot/integ.json
+3-2Lines changed: 3 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.