Describe the feature

S3 recently added a new BlockedEncryptionTypes field to server-side encryption rules (docs). This field allows users to explicitly block or unblock SSE-C encryption on their bucket.

It would be good to add a corresponding blockedEncryptionTypes to the L2 Bucket construct so that one can block or unblock SSE-C when creating a bucket.

Use Case

I have buckets in which I want SSE-C to be blocked and others in which I want SSE-C to be unblocked. Currently, I have to modify SSE-C blocking after CDK creates my buckets.

This will become more important after SSE-C starts being blocked by default in April (blog post), since I won't be able to upload SSE-C objects to new buckets without unblocking SSE-C first.

Proposed Solution

The s3.Bucket construct should add a new blockedEncryptionTypes field that can be set to either ["NONE"] or ["SSE-C"]. When creating a bucket, if this field is set, a PutBucketEncryption should be sent with the BlockedEncryptionTypes field set to the value of this field (along with whatever default server-side encryption configuration has been set through the encryption, encryptionKey, and bucketKeyEnabled fields).

If this field is not set, any PutBucketEncryption request sent while creating the bucket should not have a BlockedEncryptionTypes field (i.e., CDK shouldn't be choosing a default value for this field).

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.x

AWS CDK CLI version

2.x

Environment details (OS name and version, etc.)

all