Package: aws-cdk.aws-s3-deployment
AWS S3 Deployment Construct Library---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.For more information on how to migrate, see theMigrating to AWS CDK v2guide.This library allows populating an S3 bucket with the contents of .zip files
from other S3 buckets or from local disk.The following example defines a publicly accessible S3 bucket with web hosting
enabled and populates it from a local directory on disk.website_bucket=s3.Bucket(self,"WebsiteBucket",website_index_document="index.html",public_read_access=True)s3deploy.BucketDeployment(self,"DeployWebsite",sources=[s3deploy.Source.asset("./website-dist")],destination_bucket=website_bucket,destination_key_prefix="web/static")This is what happens under the hood:When this stack is deployed (either viacdk deployor via CI/CD), the
contents of the localwebsite-distdirectory will be archived and uploaded
to an intermediary assets bucket. If there is more than one source, they will
be individually uploaded.TheBucketDeploymentconstruct synthesizes a custom CloudFormation resource
of typeCustom::CDKBucketDeploymentinto the template. The source bucket/key
is set to point to the assets bucket.The custom resource downloads the .zip archive, extracts it and issuesaws s3 sync --deleteagainst the destination bucket (in this casewebsiteBucket). If there is more than one source, the sources will be
downloaded and merged pre-deployment at this step.If you are referencing the filled bucket in another construct that depends on
the files already be there, be sure to usedeployment.deployedBucket. This
will ensure the bucket deployment has finished before the resource that uses
the bucket is created:# website_bucket: s3.Bucketdeployment=s3deploy.BucketDeployment(self,"DeployWebsite",sources=[s3deploy.Source.asset(path.join(__dirname,"my-website"))],destination_bucket=website_bucket)ConstructThatReadsFromTheBucket(self,"Consumer",{# Use 'deployment.deployedBucket' instead of 'websiteBucket' here"bucket":deployment.deployed_bucket})Supported sourcesThe following source types are supported for bucket deployments:Local .zip file:s3deploy.Source.asset('/path/to/local/file.zip')Local directory:s3deploy.Source.asset('/path/to/local/directory')Another bucket:s3deploy.Source.bucket(bucket, zipObjectKey)String data:s3deploy.Source.data('object-key.txt', 'hello, world!')(supportsdeploy-time values)JSON data:s3deploy.Source.jsonData('object-key.json', { json: 'object' })(supportsdeploy-time values)To create a source from a single file, you can passAssetOptionsto exclude
all but a single file:Single file:s3deploy.Source.asset('/path/to/local/directory', { exclude: ['**', '!onlyThisFile.txt'] })IMPORTANTTheaws-s3-deploymentmodule is only intended to be used with
zip files from trusted sources. Directories bundled by the CDK CLI (by usingSource.asset()on a directory) are safe. If you are usingSource.asset()orSource.bucket()to reference an existing zip file, make sure you trust the
file you are referencing. Zips from untrusted sources might be able to execute
arbitrary code in the Lambda Function used by this module, and use its permissions
to read or write unexpected files in the S3 bucket.Retain on DeleteBy default, the contents of the destination bucket willnotbe deleted when theBucketDeploymentresource is removed from the stack or when the destination is
changed. You can use the optionretainOnDelete: falseto disable this behavior,
in which case the contents will be deleted.Configuring this has a few implications you should be aware of:Logical ID ChangesChanging the logical ID of theBucketDeploymentconstruct, without changing the destination
(for example due to refactoring, or intentional ID change)will result in the deletion of the objects.
This is because CloudFormation will first create the new resource, which will have no affect,
followed by a deletion of the old resource, which will cause a deletion of the objects,
since the destination hasn't changed, andretainOnDeleteisfalse.Destination ChangesWhen the destination bucket or prefix is changed, all files in the previous destination willfirstbe
deleted and then uploaded to the new destination location. This could have availability implications
on your users.General RecommendationsShared BucketIf the destination bucketis notdedicated to the specificBucketDeploymentconstruct (i.e shared by other entities),
we recommend to always configure thedestinationKeyPrefixproperty. This will prevent the deployment from
accidentally deleting data that wasn't uploaded by it.Dedicated BucketIf the destination bucketisdedicated, it might be reasonable to skip the prefix configuration,
in which case, we recommend to removeretainOnDelete: false, and instead, configure theautoDeleteObjectsproperty on the destination bucket. This will avoid the logical ID problem mentioned above.PruneBy default, files in the destination bucket that don't exist in the source will be deleted
when theBucketDeploymentresource is created or updated. You can use the optionprune: falseto disable
this behavior, in which case the files will not be deleted.# destination_bucket: s3.Buckets3deploy.BucketDeployment(self,"DeployMeWithoutDeletingFilesOnDestination",sources=[s3deploy.Source.asset(path.join(__dirname,"my-website"))],destination_bucket=destination_bucket,prune=False)This option also enables you to
multiple bucket deployments for the same destination bucket & prefix,
each with its own characteristics. For example, you can set different cache-control headers
based on file extensions:# destination_bucket: s3.Buckets3deploy.BucketDeployment(self,"BucketDeployment",sources=[s3deploy.Source.asset("./website",exclude=["index.html"])],destination_bucket=destination_bucket,cache_control=[s3deploy.CacheControl.from_string("max-age=31536000,public,immutable")],prune=False)s3deploy.BucketDeployment(self,"HTMLBucketDeployment",sources=[s3deploy.Source.asset("./website",exclude=["*","!index.html"])],destination_bucket=destination_bucket,cache_control=[s3deploy.CacheControl.from_string("max-age=0,no-cache,no-store,must-revalidate")],prune=False)Exclude and Include FiltersThere are two points at which filters are evaluated in a deployment: asset bundling and the actual deployment. If you simply want to exclude files in the asset bundling process, you should leverage theexcludeproperty ofAssetOptionswhen defining your source:# destination_bucket: s3.Buckets3deploy.BucketDeployment(self,"HTMLBucketDeployment",sources=[s3deploy.Source.asset("./website",exclude=["*","!index.html"])],destination_bucket=destination_bucket)If you want to specify filters to be used in the deployment process, you can use theexcludeandincludefilters onBucketDeployment.  If excluded, these files will not be deployed to the destination bucket. In addition, if the file already exists in the destination bucket, it will not be deleted if you are using thepruneoption:# destination_bucket: s3.Buckets3deploy.BucketDeployment(self,"DeployButExcludeSpecificFiles",sources=[s3deploy.Source.asset(path.join(__dirname,"my-website"))],destination_bucket=destination_bucket,exclude=["*.txt"])These filters follow the same format that is used for the AWS CLI.  See the CLI documentation for information onUsing Include and Exclude Filters.Objects metadataYou can specify metadata to be set on all the objects in your deployment.
There are 2 types of metadata in S3: system-defined metadata and user-defined metadata.
System-defined metadata have a special purpose, for example cache-control defines how long to keep an object cached.
User-defined metadata are not used by S3 and keys always begin withx-amz-meta-(this prefix is added automatically).System defined metadata keys include the following:cache-control (--cache-controlinaws s3 sync)content-disposition (--content-dispositioninaws s3 sync)content-encoding (--content-encodinginaws s3 sync)content-language (--content-languageinaws s3 sync)content-type (--content-typeinaws s3 sync)expires (--expiresinaws s3 sync)x-amz-storage-class (--storage-classinaws s3 sync)x-amz-website-redirect-location (--website-redirectinaws s3 sync)x-amz-server-side-encryption (--sseinaws s3 sync)x-amz-server-side-encryption-aws-kms-key-id (--sse-kms-key-idinaws s3 sync)x-amz-server-side-encryption-customer-algorithm (--sse-c-copy-sourceinaws s3 sync)x-amz-acl (--aclinaws s3 sync)You can find more information about system defined metadata keys inS3 PutObject documentationandaws s3 syncdocumentation.website_bucket=s3.Bucket(self,"WebsiteBucket",website_index_document="index.html",public_read_access=True)s3deploy.BucketDeployment(self,"DeployWebsite",sources=[s3deploy.Source.asset("./website-dist")],destination_bucket=website_bucket,destination_key_prefix="web/static",# optional prefix in destination bucketmetadata=s3deploy.UserDefinedObjectMetadata(A="1",b="2"),# user-defined metadata# system-defined metadatacontent_type="text/html",content_language="en",storage_class=s3deploy.StorageClass.INTELLIGENT_TIERING,server_side_encryption=s3deploy.ServerSideEncryption.AES_256,cache_control=[s3deploy.CacheControl.set_public(),s3deploy.CacheControl.max_age(Duration.hours(1))],access_control=s3.BucketAccessControl.BUCKET_OWNER_FULL_CONTROL)CloudFront InvalidationYou can provide a CloudFront distribution and optional paths to invalidate after the bucket deployment finishes.importaws_cdk.aws_cloudfrontascloudfrontimportaws_cdk.aws_cloudfront_originsasoriginsbucket=s3.Bucket(self,"Destination")# Handles buckets whether or not they are configured for website hosting.distribution=cloudfront.Distribution(self,"Distribution",default_behavior=cloudfront.BehaviorOptions(origin=origins.S3Origin(bucket)))s3deploy.BucketDeployment(self,"DeployWithInvalidation",sources=[s3deploy.Source.asset("./website-dist")],destination_bucket=bucket,distribution=distribution,distribution_paths=["/images/*.png"])Size LimitsThe default memory limit for the deployment resource is 128MiB. If you need to
copy larger files, you can use thememoryLimitconfiguration to increase the
size of the AWS Lambda resource handler.The default ephemeral storage size for the deployment resource is 512MiB. If you
need to upload larger files, you may hit this limit. You can use theephemeralStorageSizeconfiguration to increase the storage size of the AWS Lambda
resource handler.NOTE: a new AWS Lambda handler will be created in your stack for each combination
of memory and storage size.EFS SupportIf your workflow needs more disk space than default (512 MB) disk space, you may attach an EFS storage to underlying
lambda function. To Enable EFS support setefsandvpcprops for BucketDeployment.Check sample usage below.
Please note that creating VPC inline may cause stack deletion failures. It is shown as below for simplicity.
To avoid such condition, keep your network infra (VPC) in a separate stack and pass as props.# destination_bucket: s3.Bucket# vpc: ec2.Vpcs3deploy.BucketDeployment(self,"DeployMeWithEfsStorage",sources=[s3deploy.Source.asset(path.join(__dirname,"my-website"))],destination_bucket=destination_bucket,destination_key_prefix="efs/",use_efs=True,vpc=vpc,retain_on_delete=False)Data with deploy-time valuesThe content passed toSource.data()orSource.jsonData()can include
references that will get resolved only during deployment.For example:importaws_cdk.aws_snsassns# destination_bucket: s3.Bucket# topic: sns.Topicapp_config={"topic_arn":topic.topic_arn,"base_url":"https://my-endpoint"}s3deploy.BucketDeployment(self,"BucketDeployment",sources=[s3deploy.Source.json_data("config.json",app_config)],destination_bucket=destination_bucket)The value intopic.topicArnis a deploy-time value. It only gets resolved
during deployment by placing a marker in the generated source file and
substituting it when its deployed to the destination with the actual value.NotesThis library uses an AWS CloudFormation custom resource which is about 10MiB in
size. The code of this resource is bundled with this library.AWS Lambda execution time is limited to 15min. This limits the amount of data
which can be deployed into the bucket by this timeout.When theBucketDeploymentis removed from the stack, the contents are retained
in the destination bucket (#952).If you are usings3deploy.Source.bucket()to take the file source from
another bucket: the deployed files will only be updated if the key (file name)
of the file in the source  bucket changes. Mutating the file in place will not
be good enough: the custom resource will simply not run if the properties don't
change.If you use assets (s3deploy.Source.asset()) you don't need to worry
about this: the asset system will make sure that if the files have changed,
the file name is unique and the deployment will run.DevelopmentThe custom resource is implemented in Python 3.7 in order to be able to leverage
the AWS CLI for "aws s3 sync". The code is underlib/lambdaand
unit tests are undertest/lambda.This package requires Python 3.7 during build time in order to create the custom
resource Lambda bundle and test it. It also relies on a few bash scripts, so
might be tricky to build on Windows.RoadmapSupport "blue/green" deployments (#954)