Repository: aws-cloudformation/community-registry-extensions (language: python)

Issue:
AwsCommunity::S3::BucketNotification
## AwsCommunity::S3::BucketNotification

### Tracking Issue

One of the top requests in the [CloudFormation coverage roadmap repo](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap) is [AWS::S3::BucketNotification](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/79), a resource that would solve the well-documented circular dependency issue that prevents a notification configuration from being created at the same time as the bucket and the queue, topic, or function that is receiving the notification.

This resource is an attempt to solve that problem externally with a public registry extension. While ideally the resource would be created as an integral part of the `AWS::S3::Bucket` resource, solving it here can serve as an example of what is possible with third party resource types. We also need a resource to use as a pilot for our build and release process.

**Schema design**

- Id
- Events
- Filters
- BucketArn
- TargetArn
- TargetType

This resource differs from the original in that you only configure one notification at a time. The resource handles the SDK calls to configure all notifications for the bucket, making sure not to change or delete any of the pre-existing notifications. It also creates the necessary role for S3 to access the target.

**Sample template**

```yml
Resources:
  Queue:
    Type: AWS::SQS::Queue
  Bucket:
    Type: AWS::S3::Bucket
  Notification:
    Type: AwsCommunity::S3::BucketNotification
    Properties:
      Id: MyNotification
      Events:
        - s3:ObjectCreated:*
      Filters:
        - Name: suffix
          Value: gif
      BucketArn: !GetAtt Bucket.Arn
      TargetType: Queue
      TargetArn: !GetAtt Queue.Arn
    DependsOn:
      - Bucket
      - Queue
```

**Downsides**

This resource intentionally introduces drift by altering the notification configuration on the bucket.



Discussion / hints:

Fix patch:
diff --git a/resources/BucketNotification/.gitignore b/resources/BucketNotification/.gitignore
new file mode 100644
index 00000000..abd8c212
--- /dev/null
+++ b/resources/BucketNotification/.gitignore
@@ -0,0 +1,131 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# celery beat schedule file
+celerybeat-schedule
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# contains credentials
+sam-tests/
+
+rpdk.log*
+awscommunity-s3-bucketnotifications.zip
+
diff --git a/resources/BucketNotification/.rpdk-config b/resources/BucketNotification/.rpdk-config
new file mode 100644
index 00000000..4dc6a5a8
--- /dev/null
+++ b/resources/BucketNotification/.rpdk-config
@@ -0,0 +1,21 @@
+{
+    "artifact_type": "RESOURCE",
+    "typeName": "AwsCommunity::S3::BucketNotification",
+    "language": "python37",
+    "runtime": "python3.7",
+    "entrypoint": "awscommunity_s3_bucketnotification.handlers.resource",
+    "testEntrypoint": "awscommunity_s3_bucketnotification.handlers.test_entrypoint",
+    "settings": {
+        "version": false,
+        "subparser_name": null,
+        "verbose": 0,
+        "force": false,
+        "type_name": null,
+        "artifact_type": null,
+        "endpoint_url": null,
+        "region": null,
+        "target_schemas": [],
+        "use_docker": true,
+        "protocolVersion": "2.0.0"
+    }
+}
diff --git a/resources/BucketNotification/README.md b/resources/BucketNotification/README.md
new file mode 100644
index 00000000..16f77610
--- /dev/null
+++ b/resources/BucketNotification/README.md
@@ -0,0 +1,24 @@
+# AwsLabs::S3::BucketNotification
+
+This CloudFormation registry extension resource type allows you to specify S3
+bucket notifications one at a time, in a way that does not result in a circular
+dependency error in your template.
+
+Note that this resource intentionally introduces drift into your template,
+since the official way to configure bucket notifications is to specify them as
+part of the `AWS::S3::Bucket` resource.
+
+## Development
+
+```sh
+cd resources/BucketNotification
+python3 -m venv .env
+source .env/bin/activate
+cd src
+pip install -r requirements.txt
+pip install -e .
+cd awscommunity_s3_bucketnotification
+pylint *.py
+python3 config_integ.py --profile YOUR_PROFILE_NAME
+```
+
diff --git a/resources/BucketNotification/awscommunity-s3-bucketnotification.json b/resources/BucketNotification/awscommunity-s3-bucketnotification.json
new file mode 100644
index 00000000..e02ec9b7
--- /dev/null
+++ b/resources/BucketNotification/awscommunity-s3-bucketnotification.json
@@ -0,0 +1,143 @@
+{
+    "typeName": "AwsCommunity::S3::BucketNotification",
+    "description": "Configure bucket notifications for a variety of targets.",
+    "sourceUrl": "https://github.com/aws-cloudformation/awslabs-registry-extension-bucket-notification.git",
+    "definitions": { 
+        "KeyVal": {
+            "description": "A key value pair",
+            "type": "object",
+            "properties": {
+                "Name": {
+                    "type": "string"
+                },
+                "Value": {
+                    "type": "string"
+                }
+            },
+            "additionalProperties": false
+        }
+    },
+    "tagging": {
+        "taggable": false
+    },
+    "properties": {
+        "Id": {
+            "description": "A unique identifier for the notification. This is required, since we have to query all notifications configured on the bucket in order to leave any of them not defined here intact.",
+            "type": "string"
+        },
+        "Events": {
+            "description": "The S3 event types. See https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types",
+            "type": "array",
+            "insertionOrder": false,
+            "items": {
+                "type": "string"
+            }
+        },
+        "Filters": {
+            "description": "The filters to apply to events",
+            "type": "array",
+            "insertionOrder": false,
+            "items": {
+                "$ref": "#/definitions/KeyVal"
+            }
+        },
+        "BucketArn": {
+            "description": "The ARN of the bucket",
+            "type": "string"
+        },
+        "TargetArn": {
+            "description": "The ARN to the Lambda Function, SQS Queue, or SNS Topic",
+            "type": "string"
+        },
+        "TargetType": {
+            "description": "The target type, Function, Queue, or Topic", 
+            "type": "string", 
+            "enum": [ "Function", "Queue", "Topic" ]
+        }
+    },
+    "additionalProperties": false,
+    "required": [
+        "Id",
+        "Events",
+        "BucketArn",
+        "TargetArn",
+        "TargetType"
+    ],
+    "primaryIdentifier": [
+        "/properties/Id",
+        "/properties/BucketArn"
+    ],
+    "createOnlyProperties": [
+        "/properties/Id",
+        "/properties/BucketArn"
+    ],
+    "handlers": {
+        "create": {
+            "permissions": [
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "s3:PutBucketNotification",
+                "s3:GetBucketNotification",
+                "sns:AddPermission",
+                "sns:ConfirmSubscription",
+                "sns:GetTopicAttributes",
+                "sns:RemovePermission",
+                "sns:SetTopicAttributes",
+                "sqs:AddPermission",
+                "sqs:GetQueueAttributes",
+                "sqs:SetQueueAttributes",
+                "sqs:GetQueueUrl",
+                "lambda:AddPermission",
+                "lambda:RemovePermission"
+            ]
+        },
+        "read": {
+            "permissions": [
+                "s3:GetBucketNotification",
+                "sns:ConfirmSubscription",
+                "sns:GetTopicAttributes",
+                "sqs:AddPermission",
+                "sqs:GetQueueAttributes",
+                "sqs:GetQueueUrl"
+            ]
+        },
+        "update": {
+            "permissions": [
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "s3:PutBucketNotification",
+                "s3:GetBucketNotification",
+                "sns:AddPermission",
+                "sns:ConfirmSubscription",
+                "sns:GetTopicAttributes",
+                "sns:RemovePermission",
+                "sns:SetTopicAttributes",
+                "sqs:AddPermission",
+                "sqs:GetQueueAttributes",
+                "sqs:SetQueueAttributes",
+                "sqs:GetQueueUrl",
+                "lambda:AddPermission",
+                "lambda:RemovePermission"
+            ]
+        },
+        "delete": {
+            "permissions": [
+                "iam:CreateRole",
+                "iam:DeleteRole",
+                "s3:PutBucketNotification",
+                "s3:GetBucketNotification",
+                "sns:AddPermission",
+                "sns:ConfirmSubscription",
+                "sns:GetTopicAttributes",
+                "sns:RemovePermission",
+                "sns:SetTopicAttributes",
+                "sqs:AddPermission",
+                "sqs:GetQueueAttributes",
+                "sqs:SetQueueAttributes",
+                "sqs:GetQueueUrl",
+                "lambda:AddPermission",
+                "lambda:RemovePermission"
+            ]
+        }
+    }
+}
diff --git a/resources/BucketNotification/docs/README.md b/resources/BucketNotification/docs/README.md
new file mode 100644
index 00000000..7cb6710f
--- /dev/null
+++ b/resources/BucketNotification/docs/README.md
@@ -0,0 +1,103 @@
+# AwsCommunity::S3::BucketNotification
+
+Configure bucket notifications for a variety of targets.
+
+## Syntax
+
+To declare this entity in your AWS CloudFormation template, use the following syntax:
+
+### JSON
+
+<pre>
+{
+    "Type" : "AwsCommunity::S3::BucketNotification",
+    "Properties" : {
+        "<a href="#id" title="Id">Id</a>" : <i>String</i>,
+        "<a href="#events" title="Events">Events</a>" : <i>[ String, ... ]</i>,
+        "<a href="#filters" title="Filters">Filters</a>" : <i>[ <a href="keyval.md">KeyVal</a>, ... ]</i>,
+        "<a href="#bucketarn" title="BucketArn">BucketArn</a>" : <i>String</i>,
+        "<a href="#targetarn" title="TargetArn">TargetArn</a>" : <i>String</i>,
+        "<a href="#targettype" title="TargetType">TargetType</a>" : <i>String</i>
+    }
+}
+</pre>
+
+### YAML
+
+<pre>
+Type: AwsCommunity::S3::BucketNotification
+Properties:
+    <a href="#id" title="Id">Id</a>: <i>String</i>
+    <a href="#events" title="Events">Events</a>: <i>
+      - String</i>
+    <a href="#filters" title="Filters">Filters</a>: <i>
+      - <a href="keyval.md">KeyVal</a></i>
+    <a href="#bucketarn" title="BucketArn">BucketArn</a>: <i>String</i>
+    <a href="#targetarn" title="TargetArn">TargetArn</a>: <i>String</i>
+    <a href="#targettype" title="TargetType">TargetType</a>: <i>String</i>
+</pre>
+
+## Properties
+
+#### Id
+
+A unique identifier for the notification. This is required, since we have to query all notifications configured on the bucket in order to leave any of them not defined here intact.
+
+_Required_: Yes
+
+_Type_: String
+
+_Update requires_: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)
+
+#### Events
+
+The S3 event types. See https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types
+
+_Required_: Yes
+
+_Type_: List of String
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
+#### Filters
+
+The filters to apply to events
+
+_Required_: No
+
+_Type_: List of <a href="keyval.md">KeyVal</a>
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
+#### BucketArn
+
+The ARN of the bucket
+
+_Required_: Yes
+
+_Type_: String
+
+_Update requires_: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)
+
+#### TargetArn
+
+The ARN to the Lambda Function, SQS Queue, or SNS Topic
+
+_Required_: Yes
+
+_Type_: String
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
+#### TargetType
+
+The target type, Function, Queue, or Topic
+
+_Required_: Yes
+
+_Type_: String
+
+_Allowed Values_: <code>Function</code> | <code>Queue</code> | <code>Topic</code>
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
diff --git a/resources/BucketNotification/docs/keyval.md b/resources/BucketNotification/docs/keyval.md
new file mode 100644
index 00000000..2b8be8f4
--- /dev/null
+++ b/resources/BucketNotification/docs/keyval.md
@@ -0,0 +1,42 @@
+# AwsCommunity::S3::BucketNotification KeyVal
+
+A key value pair
+
+## Syntax
+
+To declare this entity in your AWS CloudFormation template, use the following syntax:
+
+### JSON
+
+<pre>
+{
+    "<a href="#name" title="Name">Name</a>" : <i>String</i>,
+    "<a href="#value" title="Value">Value</a>" : <i>String</i>
+}
+</pre>
+
+### YAML
+
+<pre>
+<a href="#name" title="Name">Name</a>: <i>String</i>
+<a href="#value" title="Value">Value</a>: <i>String</i>
+</pre>
+
+## Properties
+
+#### Name
+
+_Required_: No
+
+_Type_: String
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
+#### Value
+
+_Required_: No
+
+_Type_: String
+
+_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
diff --git a/resources/BucketNotification/example_inputs/inputs_1_create.json b/resources/BucketNotification/example_inputs/inputs_1_create.json
new file mode 100644
index 00000000..c9b31228
--- /dev/null
+++ b/resources/BucketNotification/example_inputs/inputs_1_create.json
@@ -0,0 +1,9 @@
+{
+    "Id": "",
+    "Events": "",
+    "BucketArn": "",
+    "TargetArn": "",
+    "TargetType": "",
+    "Filter": ""
+}
+
diff --git a/resources/BucketNotification/example_inputs/inputs_1_invalid.json b/resources/BucketNotification/example_inputs/inputs_1_invalid.json
new file mode 100644
index 00000000..276c9bfa
--- /dev/null
+++ b/resources/BucketNotification/example_inputs/inputs_1_invalid.json
@@ -0,0 +1,8 @@
+{
+    "Id": "",
+    "Events": "",
+    "BucketArn": "",
+    "TargetArn": "",
+    "TargetType": "",
+    "Filter": ""
+}
diff --git a/resources/BucketNotification/example_inputs/inputs_1_update.json b/resources/BucketNotification/example_inputs/inputs_1_update.json
new file mode 100644
index 00000000..c9b31228
--- /dev/null
+++ b/resources/BucketNotification/example_inputs/inputs_1_update.json
@@ -0,0 +1,9 @@
+{
+    "Id": "",
+    "Events": "",
+    "BucketArn": "",
+    "TargetArn": "",
+    "TargetType": "",
+    "Filter": ""
+}
+
diff --git a/resources/BucketNotification/requirements.txt b/resources/BucketNotification/requirements.txt
new file mode 100644
index 00000000..ae233772
--- /dev/null
+++ b/resources/BucketNotification/requirements.txt
@@ -0,0 +1,1 @@
+cloudformation-cli-python-lib>=2.1.9
diff --git a/resources/BucketNotification/resource-role.yaml b/resources/BucketNotification/resource-role.yaml
new file mode 100644
index 00000000..591ad3cb
--- /dev/null
+++ b/resources/BucketNotification/resource-role.yaml
@@ -0,0 +1,52 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  This CloudFormation template creates a role assumed by CloudFormation
+  during CRUDL operations to mutate resources on behalf of the customer.
+
+Resources:
+  ExecutionRole:
+    Type: AWS::IAM::Role
+    Properties:
+      MaxSessionDuration: 8400
+      AssumeRolePolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: resources.cloudformation.amazonaws.com
+            Action: sts:AssumeRole
+            Condition:
+              StringEquals:
+                aws:SourceAccount:
+                  Ref: AWS::AccountId
+              StringLike:
+                aws:SourceArn:
+                  Fn::Sub: arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:type/resource/AwsCommunity-S3-BucketNotification/*
+      Path: "/"
+      Policies:
+        - PolicyName: ResourceTypePolicy
+          PolicyDocument:
+            Version: '2012-10-17'
+            Statement:
+              - Effect: Allow
+                Action:
+                - "iam:CreateRole"
+                - "iam:DeleteRole"
+                - "lambda:AddPermission"
+                - "lambda:RemovePermission"
+                - "s3:GetBucketNotification"
+                - "s3:PutBucketNotification"
+                - "sns:AddPermission"
+                - "sns:ConfirmSubscription"
+                - "sns:GetTopicAttributes"
+                - "sns:RemovePermission"
+                - "sns:SetTopicAttributes"
+                - "sqs:AddPermission"
+                - "sqs:GetQueueAttributes"
+                - "sqs:GetQueueUrl"
+                - "sqs:SetQueueAttributes"
+                Resource: "*"
+Outputs:
+  ExecutionRoleArn:
+    Value:
+      Fn::GetAtt: ExecutionRole.Arn
diff --git a/resources/BucketNotification/src/.pylintrc b/resources/BucketNotification/src/.pylintrc
new file mode 100644
index 00000000..8ee28d58
--- /dev/null
+++ b/resources/BucketNotification/src/.pylintrc
@@ -0,0 +1,618 @@
+[MAIN]
+
+# Analyse import fallback blocks. This can be used to support both Python 2 and
+# 3 compatible code, which means that the block might have code that exists
+# only in one or another interpreter, leading to false positives when analysed.
+analyse-fallback-blocks=no
+
+# Load and enable all available extensions. Use --list-extensions to see a list
+# all available extensions.
+#enable-all-extensions=
+
+# In error mode, messages with a category besides ERROR or FATAL are
+# suppressed, and no reports are done by default. Error mode is compatible with
+# disabling specific errors.
+#errors-only=
+
+# Always return a 0 (non-error) status code, even if lint errors are found.
+# This is primarily useful in continuous integration scripts.
+#exit-zero=
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code.
+extension-pkg-allow-list=
+
+# A comma-separated list of package or module names from where C extensions may
+# be loaded. Extensions are loading into the active Python interpreter and may
+# run arbitrary code. (This is an alternative name to extension-pkg-allow-list
+# for backward compatibility.)
+extension-pkg-whitelist=
+
+# Return non-zero exit code if any of these messages/categories are detected,
+# even if score is above --fail-under value. Syntax same as enable. Messages
+# specified are enabled, while categories only check already-enabled messages.
+fail-on=
+
+# Specify a score threshold to be exceeded before program exits with error.
+fail-under=10
+
+# Interpret the stdin as a python script, whose filename needs to be passed as
+# the module_or_package argument.
+#from-stdin=
+
+# Files or directories to be skipped. They should be base names, not paths.
+ignore=CVS,
+       models.py
+
+# Add files or directories matching the regex patterns to the ignore-list. The
+# regex matches against paths and can be in Posix or Windows format.
+ignore-paths=
+
+# Files or directories matching the regex patterns are skipped. The regex
+# matches against base names, not paths. The default value ignores Emacs file
+# locks
+ignore-patterns=^\.#
+
+# List of module names for which member attributes should not be checked
+# (useful for modules/projects where namespaces are manipulated during runtime
+# and thus existing member attributes cannot be deduced by static analysis). It
+# supports qualified module names, as well as Unix pattern matching.
+ignored-modules=
+
+# Python code to execute, usually for sys.path manipulation such as
+# pygtk.require().
+#init-hook=
+
+# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
+# number of processors available to use, and will cap the count on Windows to
+# avoid hangs.
+jobs=1
+
+# Control the amount of potential inferred values when inferring a single
+# object. This can help the performance when dealing with large functions or
+# complex, nested conditions.
+limit-inference-results=100
+
+# List of plugins (as comma separated values of python module names) to load,
+# usually to register additional checkers.
+load-plugins=
+
+# Pickle collected data for later comparisons.
+persistent=yes
+
+# Minimum Python version to use for version dependent checks. Will default to
+# the version used to run pylint.
+py-version=3.9
+
+# Discover python modules and packages in the file system subtree.
+recursive=no
+
+# When enabled, pylint would attempt to guess common misconfiguration and emit
+# user-friendly hints instead of false-positive error messages.
+suggestion-mode=yes
+
+# Allow loading of arbitrary C extensions. Extensions are imported into the
+# active Python interpreter and may run arbitrary code.
+unsafe-load-any-extension=no
+
+# In verbose mode, extra non-checker-related info will be displayed.
+#verbose=
+
+
+[REPORTS]
+
+# Python expression which should return a score less than or equal to 10. You
+# have access to the variables 'fatal', 'error', 'warning', 'refactor',
+# 'convention', and 'info' which contain the number of messages in each
+# category, as well as 'statement' which is the total number of statements
+# analyzed. This score is used by the global evaluation report (RP0004).
+evaluation=max(0, 0 if fatal else 10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10))
+
+# Template used to display messages. This is a python new-style format string
+# used to format the message information. See doc for all details.
+msg-template=
+
+# Set the output format. Available formats are text, parseable, colorized, json
+# and msvs (visual studio). You can also give a reporter class, e.g.
+# mypackage.mymodule.MyReporterClass.
+#output-format=
+
+# Tells whether to display a full report or only the messages.
+reports=no
+
+# Activate the evaluation score.
+score=yes
+
+
+[MESSAGES CONTROL]
+
+# Only show warnings with the listed confidence levels. Leave empty to show
+# all. Valid levels: HIGH, CONTROL_FLOW, INFERENCE, INFERENCE_FAILURE,
+# UNDEFINED.
+confidence=HIGH,
+           CONTROL_FLOW,
+           INFERENCE,
+           INFERENCE_FAILURE,
+           UNDEFINED
+
+# Disable the message, report, category or checker with the given id(s). You
+# can either give multiple identifiers separated by comma (,) or put this
+# option multiple times (only on the command line, not in the configuration
+# file where it should appear only once). You can also use "--disable=all" to
+# disable everything first and then re-enable specific checks. For example, if
+# you want to run only the similarities checker, you can use "--disable=all
+# --enable=similarities". If you want to run only the classes checker, but have
+# no Warning level messages displayed, use "--disable=all --enable=classes
+# --disable=W".
+disable=raw-checker-failed,
+        bad-inline-option,
+        locally-disabled,
+        file-ignored,
+        suppressed-message,
+        useless-suppression,
+        deprecated-pragma,
+        use-symbolic-message-instead,
+        fixme,
+        trailing-whitespace,
+        trailing-newlines,
+        invalid-name,
+        too-many-locals,
+        broad-except,
+        too-many-statements
+
+# Enable the message, report, category or checker with the given id(s). You can
+# either give multiple identifier separated by comma (,) or put this option
+# multiple time (only on the command line, not in the configuration file where
+# it should appear only once). See also the "--disable" option for examples.
+enable=c-extension-no-member
+
+
+[LOGGING]
+
+# The type of string formatting that logging methods do. `old` means using %
+# formatting, `new` is for `{}` formatting.
+logging-format-style=old
+
+# Logging modules to check that the string format arguments are in logging
+# function parameter format.
+logging-modules=logging
+
+
+[SPELLING]
+
+# Limits count of emitted suggestions for spelling mistakes.
+max-spelling-suggestions=4
+
+# Spelling dictionary name. Available dictionaries: none. To make it work,
+# install the 'python-enchant' package.
+spelling-dict=
+
+# List of comma separated words that should be considered directives if they
+# appear at the beginning of a comment and should not be checked.
+spelling-ignore-comment-directives=fmt: on,fmt: off,noqa:,noqa,nosec,isort:skip,mypy:
+
+# List of comma separated words that should not be checked.
+spelling-ignore-words=
+
+# A path to a file that contains the private dictionary; one word per line.
+spelling-private-dict-file=
+
+# Tells whether to store unknown words to the private dictionary (see the
+# --spelling-private-dict-file option) instead of raising a message.
+spelling-store-unknown-words=no
+
+
+[MISCELLANEOUS]
+
+# List of note tags to take in consideration, separated by a comma.
+notes=FIXME,
+      XXX,
+      TODO
+
+# Regular expression of note tags to take in consideration.
+notes-rgx=
+
+
+[TYPECHECK]
+
+# List of decorators that produce context managers, such as
+# contextlib.contextmanager. Add to this list to register other decorators that
+# produce valid context managers.
+contextmanager-decorators=contextlib.contextmanager
+
+# List of members which are set dynamically and missed by pylint inference
+# system, and so shouldn't trigger E1101 when accessed. Python regular
+# expressions are accepted.
+generated-members=
+
+# Tells whether to warn about missing members when the owner of the attribute
+# is inferred to be None.
+ignore-none=yes
+
+# This flag controls whether pylint should warn about no-member and similar
+# checks whenever an opaque object is returned when inferring. The inference
+# can return multiple potential results while evaluating a Python object, but
+# some branches might not be evaluated, which results in partial inference. In
+# that case, it might be useful to still emit no-member and other checks for
+# the rest of the inferred objects.
+ignore-on-opaque-inference=yes
+
+# List of symbolic message names to ignore for Mixin members.
+ignored-checks-for-mixins=no-member,
+                          not-async-context-manager,
+                          not-context-manager,
+                          attribute-defined-outside-init
+
+# List of class names for which member attributes should not be checked (useful
+# for classes with dynamically set attributes). This supports the use of
+# qualified names.
+ignored-classes=optparse.Values,thread._local,_thread._local,argparse.Namespace
+
+# Show a hint with possible names when a member name was not found. The aspect
+# of finding the hint is based on edit distance.
+missing-member-hint=yes
+
+# The minimum edit distance a name should have in order to be considered a
+# similar match for a missing member name.
+missing-member-hint-distance=1
+
+# The total number of similar names that should be taken in consideration when
+# showing a hint for a missing member.
+missing-member-max-choices=1
+
+# Regex pattern to define which classes are considered mixins.
+mixin-class-rgx=.*[Mm]ixin
+
+# List of decorators that change the signature of a decorated function.
+signature-mutators=
+
+
+[CLASSES]
+
+# Warn about protected attribute access inside special methods
+check-protected-access-in-special-methods=no
+
+# List of method names used to declare (i.e. assign) instance attributes.
+defining-attr-methods=__init__,
+                      __new__,
+                      setUp,
+                      __post_init__
+
+# List of member names, which should be excluded from the protected access
+# warning.
+exclude-protected=_asdict,
+                  _fields,
+                  _replace,
+                  _source,
+                  _make
+
+# List of valid names for the first argument in a class method.
+valid-classmethod-first-arg=cls
+
+# List of valid names for the first argument in a metaclass class method.
+valid-metaclass-classmethod-first-arg=cls
+
+
+[VARIABLES]
+
+# List of additional names supposed to be defined in builtins. Remember that
+# you should avoid defining new builtins when possible.
+additional-builtins=
+
+# Tells whether unused global variables should be treated as a violation.
+allow-global-unused-variables=yes
+
+# List of names allowed to shadow builtins
+allowed-redefined-builtins=
+
+# List of strings which can identify a callback function by name. A callback
+# name must start or end with one of those strings.
+callbacks=cb_,
+          _cb
+
+# A regular expression matching the name of dummy variables (i.e. expected to
+# not be used).
+dummy-variables-rgx=_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_
+
+# Argument names that match this expression will be ignored. Default to name
+# with leading underscore.
+ignored-argument-names=_.*|^ignored_|^unused_
+
+# Tells whether we should check for unused import in __init__ files.
+init-import=no
+
+# List of qualified module names which can have objects that can redefine
+# builtins.
+redefining-builtins-modules=six.moves,past.builtins,future.builtins,builtins,io
+
+
+[FORMAT]
+
+# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
+expected-line-ending-format=
+
+# Regexp for a line that is allowed to be longer than the limit.
+ignore-long-lines=^\s*(# )?<?https?://\S+>?$
+
+# Number of spaces of indent required inside a hanging or continued line.
+indent-after-paren=4
+
+# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
+# tab).
+indent-string='    '
+
+# Maximum number of characters on a single line.
+max-line-length=100
+
+# Maximum number of lines in a module.
+max-module-lines=1000
+
+# Allow the body of a class to be on the same line as the declaration if body
+# contains single statement.
+single-line-class-stmt=no
+
+# Allow the body of an if to be on the same line as the test if there is no
+# else.
+single-line-if-stmt=no
+
+
+[IMPORTS]
+
+# List of modules that can be imported at any level, not just the top level
+# one.
+allow-any-import-level=
+
+# Allow wildcard imports from modules that define __all__.
+allow-wildcard-with-all=no
+
+# Deprecated modules which should not be used, separated by a comma.
+deprecated-modules=
+
+# Output a graph (.gv or any supported image format) of external dependencies
+# to the given file (report RP0402 must not be disabled).
+ext-import-graph=
+
+# Output a graph (.gv or any supported image format) of all (i.e. internal and
+# external) dependencies to the given file (report RP0402 must not be
+# disabled).
+import-graph=
+
+# Output a graph (.gv or any supported image format) of internal dependencies
+# to the given file (report RP0402 must not be disabled).
+int-import-graph=
+
+# Force import order to recognize a module as part of the standard
+# compatibility libraries.
+known-standard-library=
+
+# Force import order to recognize a module as part of a third party library.
+known-third-party=enchant
+
+# Couples of modules and preferred modules, separated by a comma.
+preferred-modules=
+
+
+[EXCEPTIONS]
+
+# Exceptions that will emit a warning when caught.
+overgeneral-exceptions=BaseException,
+                       Exception
+
+
+[REFACTORING]
+
+# Maximum number of nested blocks for function / method body
+max-nested-blocks=5
+
+# Complete name of functions that never returns. When checking for
+# inconsistent-return-statements if a never returning function is called then
+# it will be considered as an explicit return statement and no message will be
+# printed.
+never-returning-functions=sys.exit,argparse.parse_error
+
+
+[SIMILARITIES]
+
+# Comments are removed from the similarity computation
+ignore-comments=yes
+
+# Docstrings are removed from the similarity computation
+ignore-docstrings=yes
+
+# Imports are removed from the similarity computation
+ignore-imports=yes
+
+# Signatures are removed from the similarity computation
+ignore-signatures=yes
+
+# Minimum lines number of a similarity.
+min-similarity-lines=4
+
+
+[DESIGN]
+
+# List of regular expressions of class ancestor names to ignore when counting
+# public methods (see R0903)
+exclude-too-few-public-methods=
+
+# List of qualified class names to ignore when counting class parents (see
+# R0901)
+ignored-parents=
+
+# Maximum number of arguments for function / method.
+max-args=5
+
+# Maximum number of attributes for a class (see R0902).
+max-attributes=7
+
+# Maximum number of boolean expressions in an if statement (see R0916).
+max-bool-expr=5
+
+# Maximum number of branch for function / method body.
+max-branches=12
+
+# Maximum number of locals for function / method body.
+max-locals=15
+
+# Maximum number of parents for a class (see R0901).
+max-parents=7
+
+# Maximum number of public methods for a class (see R0904).
+max-public-methods=20
+
+# Maximum number of return / yield for function / method body.
+max-returns=6
+
+# Maximum number of statements in function / method body.
+max-statements=50
+
+# Minimum number of public methods for a class (see R0903).
+min-public-methods=2
+
+
+[STRING]
+
+# This flag controls whether inconsistent-quotes generates a warning when the
+# character used as a quote delimiter is used inconsistently within a module.
+check-quote-consistency=no
+
+# This flag controls whether the implicit-str-concat should generate a warning
+# on implicit string concatenation in sequences defined over several lines.
+check-str-concat-over-line-jumps=no
+
+
+[BASIC]
+
+# Naming style matching correct argument names.
+argument-naming-style=snake_case
+
+# Regular expression matching correct argument names. Overrides argument-
+# naming-style. If left empty, argument names will be checked with the set
+# naming style.
+#argument-rgx=
+
+# Naming style matching correct attribute names.
+attr-naming-style=snake_case
+
+# Regular expression matching correct attribute names. Overrides attr-naming-
+# style. If left empty, attribute names will be checked with the set naming
+# style.
+#attr-rgx=
+
+# Bad variable names which should always be refused, separated by a comma.
+bad-names=foo,
+          bar,
+          baz,
+          toto,
+          tutu,
+          tata
+
+# Bad variable names regexes, separated by a comma. If names match any regex,
+# they will always be refused
+bad-names-rgxs=
+
+# Naming style matching correct class attribute names.
+class-attribute-naming-style=any
+
+# Regular expression matching correct class attribute names. Overrides class-
+# attribute-naming-style. If left empty, class attribute names will be checked
+# with the set naming style.
+#class-attribute-rgx=
+
+# Naming style matching correct class constant names.
+class-const-naming-style=UPPER_CASE
+
+# Regular expression matching correct class constant names. Overrides class-
+# const-naming-style. If left empty, class constant names will be checked with
+# the set naming style.
+#class-const-rgx=
+
+# Naming style matching correct class names.
+class-naming-style=PascalCase
+
+# Regular expression matching correct class names. Overrides class-naming-
+# style. If left empty, class names will be checked with the set naming style.
+#class-rgx=
+
+# Naming style matching correct constant names.
+const-naming-style=UPPER_CASE
+
+# Regular expression matching correct constant names. Overrides const-naming-
+# style. If left empty, constant names will be checked with the set naming
+# style.
+#const-rgx=
+
+# Minimum line length for functions/classes that require docstrings, shorter
+# ones are exempt.
+docstring-min-length=-1
+
+# Naming style matching correct function names.
+function-naming-style=snake_case
+
+# Regular expression matching correct function names. Overrides function-
+# naming-style. If left empty, function names will be checked with the set
+# naming style.
+#function-rgx=
+
+# Good variable names which should always be accepted, separated by a comma.
+good-names=i,
+           j,
+           k,
+           ex,
+           Run,
+           _
+
+# Good variable names regexes, separated by a comma. If names match any regex,
+# they will always be accepted
+good-names-rgxs=
+
+# Include a hint for the correct naming format with invalid-name.
+include-naming-hint=no
+
+# Naming style matching correct inline iteration names.
+inlinevar-naming-style=any
+
+# Regular expression matching correct inline iteration names. Overrides
+# inlinevar-naming-style. If left empty, inline iteration names will be checked
+# with the set naming style.
+#inlinevar-rgx=
+
+# Naming style matching correct method names.
+method-naming-style=snake_case
+
+# Regular expression matching correct method names. Overrides method-naming-
+# style. If left empty, method names will be checked with the set naming style.
+#method-rgx=
+
+# Naming style matching correct module names.
+module-naming-style=snake_case
+
+# Regular expression matching correct module names. Overrides module-naming-
+# style. If left empty, module names will be checked with the set naming style.
+#module-rgx=
+
+# Colon-delimited sets of names that determine each other's naming style when
+# the name regexes allow several styles.
+name-group=
+
+# Regular expression which should only match function or class names that do
+# not require a docstring.
+no-docstring-rgx=^_
+
+# List of decorators that produce properties, such as abc.abstractproperty. Add
+# to this list to register other decorators that produce valid properties.
+# These decorators are taken in consideration only for invalid-name.
+property-classes=abc.abstractproperty
+
+# Regular expression matching correct type variable names. If left empty, type
+# variable names will be checked with the set naming style.
+#typevar-rgx=
+
+# Naming style matching correct variable names.
+variable-naming-style=snake_case
+
+# Regular expression matching correct variable names. Overrides variable-
+# naming-style. If left empty, variable names will be checked with the set
+# naming style.
+#variable-rgx=
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/__init__.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config.py
new file mode 100644
index 00000000..2e0bd187
--- /dev/null
+++ b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config.py
@@ -0,0 +1,314 @@
+"""
+This module contains functions to act on a single notification configuration, 
+without changing any of the existing bucket configurations, unless the 
+Id for the notification is found among existing notifications. This allows 
+us to treat each indiidual notification as if it were an independent resource.
+
+The `model` argument to these functions is from the auto-generated `models.ResourceModel`.
+"""
+
+import json
+import logging
+#from awscommunity_s3_bucketnotification.models import ResourceModel
+from .models import ResourceModel
+
+LOG = logging.getLogger(__name__)
+
+def find(cfg, model_id):
+    """
+    Find the notification in the full config by id
+    Returns (notification, idx) or (None, -1)
+    """
+
+    notification = None
+
+    if not model_id:
+        return notification
+
+    idx = 0
+
+    # Iterate over the top level XConfigurations keys, e.g. TopicConfigurations
+    for t in cfg:
+        if t not in [
+                "TopicConfigurations", 
+                "QueueConfigurations", 
+                "LambdaFunctionConfigurations"]:
+            continue
+
+        if notification:
+            break
+        idx = 0
+
+        # Iterate over the array of notifications
+        for n in cfg[t]:
+            if n["Id"] == model_id:
+                notification = n
+                break
+            idx += 1
+    if not notification:
+        idx = -1
+
+    return (notification, idx)
+
+def get(session, bucket_arn, model_id):
+    "Get a ResourceModel instance for this id or None if not found"
+
+    # Get the full notification config on the bucket
+    cfg = get_all(session, bucket_arn)
+
+    (notification, _) = find(cfg, model_id)
+    if not notification:
+        return None
+
+    model = ResourceModel(Id=model_id, Events=None, Filters=None, 
+                BucketArn=bucket_arn, TargetArn="", TargetType="")
+    model.Id = model_id
+    model.BucketArn = bucket_arn
+    model.Events = notification["Events"] 
+    model.Filters = []
+    if "Filter" in notification and "Key" in notification["Filter"]:
+        if "FilterRules" in notification["Filter"]["Key"]:
+            model.Filters = notification["Filter"]["Key"]["FilterRules"]
+    if "TopicArn" in notification:
+        model.TargetArn = notification["TopicArn"]
+        model.TargetType = "Topic"
+    elif "QueueArn" in notification:
+        model.TargetArn = notification["QueueArn"]
+        model.TargetType = "Queue"
+    elif "LambdaFunctionArn" in notification:
+        model.TargetArn = notification["LambdaFunctionArn"]
+        model.TargetType = "Function"
+    else:
+        raise Exception("Unable to set TargetArn")
+
+    return model
+
+def get_all(session, bucket_arn):
+    "Get the complete notification configuration for the bucket"
+    s3 = session.client("s3")
+    bucket_name = bucket_arn.split(":")[-1]
+    cfg = s3.get_bucket_notification_configuration(Bucket=bucket_name)
+    if "ResponseMetadata" in cfg:
+        del cfg["ResponseMetadata"]
+    return cfg
+
+def delete(session, bucket_arn, model_id):
+    "Delete the notification on the bucket with the specified id"
+
+    cfg = get_all(session, bucket_arn)
+    if not cfg:
+        raise Exception("Unable to get config for the bucket")
+    (notification, idx) = find(cfg, model_id)
+    if not notification:
+        raise Exception(f"Id {model_id} not found in notification config for {bucket_arn}")
+
+    if "TopicArn" in notification:
+        del cfg["TopicConfigurations"][idx] 
+    elif "QueueArn" in notification:
+        del cfg["QueueConfigurations"][idx]
+    elif "LambdaFunctionArn" in notification:
+        del cfg["LambdaFunctionConfigurations"][idx]
+    else:
+        raise Exception("Unexpected notification missing Arn")
+
+    save_config(session, bucket_arn, cfg)
+
+def get_role_name(target_name, notification_id):
+    "Get the name of the role we create for S3 to notify the target"
+    return target_name + "-bktntf-" + notification_id
+
+def get_policy_name(role_name):
+    "Get the policy name for the role we create"
+    return role_name + "_policy"
+
+def delete_role(session, role_name, policy_arn):
+    "Delete the role we created for S3 to notifiy the target"
+
+    iam = session.client("iam")
+
+    try:
+        if policy_arn:
+            iam.delete_policy(PolicyArn=policy_arn)
+        else:
+            LOG.info("Unable to delete policy without policy_arn")
+    except iam.exceptions.NoSuchEntityException:
+        LOG.info("Tried to delete non-existent policy: %s", policy_arn)
+
+    try:
+        if role_name:
+            iam.delete_role(RoleName=role_name)
+        else:
+            LOG.info("Unable to delete role without role_name")
+    except iam.exceptions.NoSuchEntityException:
+        LOG.info("Tried to delete non-existent role: %s", role_name)
+
+def create_role(session, notification_id, target_type, target_arn, bucket_arn):
+    "Create the role that S3 needs to notify the target"
+
+    target_name = target_arn.split(":")[-1]
+    iam = session.client("iam")
+    sts = session.client("sts")
+    account_id = sts.get_caller_identity()["Account"]
+
+    action = ""
+    if target_type == "Queue":
+        action = "sqs:SendMessage"
+    elif target_type == "Topic":
+        action = "SNS:Publish"
+    elif target_type == "Function":
+        action = "lambda:InvokeFunction"
+    else:
+        raise Exception(f"Unexpected TargetType: {target_type}")
+
+    # Role for the bucket to access the topic
+    role_name = get_role_name(target_name, notification_id)
+
+    # Assume role policy document for S3
+    trust_policy = {
+          "Id": role_name + "-TrustPolicyId",
+          "Version": "2012-10-17",
+          "Statement": [ {
+                  "Effect": "Allow",
+                  "Principal": { "Service": "s3.amazonaws.com" },
+                  "Action": "sts:AssumeRole"
+              }
+          ]
+      }
+
+    # Check to see if the role is already there before creating.
+    # This shouldn't happen unless something unexpected happened 
+    # during an earlier attempt to create the resource.
+    try:
+        r = iam.get_role(RoleName=role_name)
+        LOG.info("Role already existed: %s", role_name)
+    except iam.exceptions.NoSuchEntityException:
+        LOG.info("Creating %s", role_name)
+        r = iam.create_role(
+          RoleName=role_name,
+          AssumeRolePolicyDocument=json.dumps(trust_policy))
+
+    policy = {
+        "Id": role_name + "-PolicyId",
+        "Version": "2012-10-17",
+        "Statement": [ {
+            "Action": action,
+            "Effect": "Allow",
+            "Resource": target_arn,
+            "Condition": {
+                "ArnLike": {
+                    "aws:SourceArn": bucket_arn
+                },
+                "StringEquals": {
+                    "aws:SourceAccount": account_id
+                }
+            }
+        } ]
+    }
+
+    policy_arn = None
+
+    if target_type in ["Queue", "Topic"]:
+        # For queues and topics we set the policy on the resource itself, 
+        # rather than on the role.
+        policy["Statement"][0]["Principal"] = { "Service": "s3.amazonaws.com" }
+        if target_type == "Queue":
+            sqs = session.client("sqs")
+            queue_url = sqs.get_queue_url(QueueName=target_name)["QueueUrl"]
+            sqs.set_queue_attributes(
+                QueueUrl=queue_url,
+                Attributes = {
+                    "Policy": json.dumps(policy)
+                }
+            )
+        else:
+            sns = session.client("sns")
+            sns.set_topic_attributes(
+                TopicArn=target_arn,
+                AttributeName="Policy",
+                AttributeValue=json.dumps(policy)
+            )
+    else:
+        # For lambda functions, we put the policy on the role
+        policy_name = get_policy_name(role_name)
+        policy_arn = f"arn:aws:iam::{account_id}:policy/{policy_name}"
+
+        # Check to see if the policy exists before creating. As with the role, 
+        # this should not happen, but we will assume it was the result of a prior
+        # attempt to create the resource that went wrong somehow.
+        try:
+            r = iam.get_policy(PolicyArn=policy_arn)
+            LOG.info("Policy already existed: %s", policy_arn)
+        except iam.exceptions.NoSuchEntityException:
+            LOG.info("Creating policy: %s", policy_name)
+            r = iam.create_policy(
+                PolicyName=policy_name,
+                PolicyDocument=json.dumps(policy))
+            policy_arn = r["Policy"]["Arn"]
+
+    r = iam.get_role(RoleName=role_name)
+    role_arn = r["Role"]["Arn"]
+    LOG.info("Created role %s", role_arn)
+
+    return role_name, policy_arn
+
+def save_config(session, bucket_arn, cfg):
+    "Save a configuration"
+
+    s3 = session.client("s3")
+
+    # This always fails if False. Not good, since we can't tell if we 
+    # actually made a mistake in configuration. TODO
+    skip_validation = True
+    
+    bucket_name = bucket_arn.split(":")[-1]
+
+    # Re-create the entire notification configuration for the bucket 
+    _ = s3.put_bucket_notification_configuration(Bucket=bucket_name, 
+            NotificationConfiguration=cfg, 
+            SkipDestinationValidation=skip_validation)
+
+def save(session, model):
+    "Save a single notification configuration"
+
+    # Get the current configuration for the bucket
+    cfg = get_all(session, model.BucketArn)
+    put_config = {}
+    put_config["Bucket"] = model.BucketArn
+    put_config["NotificationConfiguration"] = cfg
+
+    ntype = ""
+    if model.TargetType == "Function":
+        ntype = "LambdaFunctionConfigurations"
+    elif model.TargetType == "Queue":
+        ntype = "QueueConfigurations"
+    elif model.TargetType == "Topic":
+        ntype = "TopicConfigurations"
+    else:
+        raise Exception("Unexpected TargetType:" + model.TargetType)
+
+    (notification, _) = find(cfg, model.Id)
+
+    # If the notification is not present, create it 
+    if not notification:
+        notification = {}
+        if ntype not in cfg:
+            cfg[ntype] = {}
+        cfg[ntype].append(notification)
+
+    notification["Id"] = model.Id
+    if model.TargetType == "Function":
+        notification["LambdaFunctionArn"] = model.TargetArn
+    elif model.TargetType == "Queue":
+        notification["QueueArn"] = model.TargetArn
+    else:
+        notification["TopicArn"] = model.TargetArn
+    notification["Events"] = model.Events
+    notification["Filter"] = {}
+    notification["Filter"]["Key"] = {}
+    notification["Filter"]["Key"]["FilterRules"] = model.Filters
+
+    # Create the role needed for S3 to notify the target
+    create_role(session, model.Id, model.TargetType, model.TargetArn, model.BucketArn)
+
+    save_config(session, model.BucketArn, cfg)
+
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config_integ.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config_integ.py
new file mode 100644
index 00000000..ad4c2171
--- /dev/null
+++ b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/config_integ.py
@@ -0,0 +1,368 @@
+"""
+Manual integration test for the config module.
+Make sure creating, editing, and deleting individual notifications
+always leaves the remaining bucket notifications exactly as they were.
+"""
+
+#import argparse
+import json
+import logging
+import sys
+import time
+import boto3
+
+#from awscommunity_s3_bucketnotification.config import create_role, delete_role
+#from awscommunity_s3_bucketnotification.config import get, save, delete, get_all
+#from awscommunity_s3_bucketnotification.models import ResourceModel
+from .config import create_role, delete_role
+from .config import get, save, delete, get_all
+from .models import ResourceModel
+
+LOG = logging.getLogger(__name__)
+logging.basicConfig(level=logging.INFO)
+
+def main(profile_name): #pylint: disable=too-many-branches
+    "Execute the tests and clean up"
+
+    session = boto3.Session(profile_name=profile_name)
+    sts = session.client('sts')
+    identity = sts.get_caller_identity()
+    account_id = identity["Account"]
+    bucket_name = f"bucketnotification-config-integ-{account_id}"
+    bucket_arn = None
+    queue_name = "bucketnotification-config-integ"
+    queue_url = None
+    queue_arn = None
+    topic_name = "bucketnotification-config-integ"
+    topic_arn = None
+    function_name = "bucketnotification-config-integ"
+    function_arn = None
+    function_role_name = "bucketnotification-config-integ-function"
+    function_role_arn = None
+    s3 = session.client("s3")
+    sqs = session.client("sqs")
+    sns = session.client("sns")
+    lam = session.client("lambda")
+    iam = session.client('iam')
+    queue_role_name = None
+    queue_role_policy_arn = None
+    topic_role_name = None
+    topic_role_policy_arn = None
+    function_invoke_role_name = None
+    function_invoke_role_policy_arn = None
+
+    try:
+        # Create a bucket
+        print("About to create test bucket: ", bucket_name)
+        s3.create_bucket(Bucket=bucket_name)
+        bucket_arn = "arn:aws:s3:::" + bucket_name
+        print("Created bucket: ", bucket_name)
+
+        # Create an SQS Queue
+        print("About to create test queue:", queue_name)
+
+        r = None
+        tries = 0
+        succeeded = False
+        while tries < 6:
+            try:
+                r = sqs.create_queue(QueueName=queue_name)
+                succeeded = True
+                break
+            except sqs.exceptions.QueueDeletedRecently:
+                print("Waiting 10 seconds to retry creating queue")
+                tries = tries + 1
+                time.sleep(10)
+
+        if not succeeded:
+            raise Exception("Exceeded max retries for creating queue")
+
+        queue_url = r["QueueUrl"]
+        r = sqs.get_queue_attributes(
+            QueueUrl=queue_url,
+            AttributeNames=["QueueArn"])
+        queue_arn = r["Attributes"]["QueueArn"]
+        (queue_role_name, queue_role_policy_arn) = create_role(session,
+                "QTest1", "Queue", queue_arn, bucket_arn)
+
+        print("Created test queue:", queue_url)
+
+        # Create an SNS Topic
+        print("About to create topic:", topic_name)
+
+        r = sns.create_topic(Name=topic_name)
+        topic_arn = r["TopicArn"]
+        (topic_role_name, topic_role_policy_arn) = create_role(session,
+                "Topic1", "Topic", topic_arn, bucket_arn)
+
+        print("Created topic:", topic_arn)
+
+        # Create a Lambda Function
+        print("About to create function:", function_name)
+
+        # Policy for the function
+        lambda_execution_policy = {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Sid": "",
+              "Effect": "Allow",
+              "Principal": {
+                "Service": "lambda.amazonaws.com"
+              },
+              "Action": "sts:AssumeRole"
+            }
+          ]
+        }
+
+        r = iam.create_role(
+          RoleName=function_role_name,
+          AssumeRolePolicyDocument=json.dumps(lambda_execution_policy),
+        )
+        print("Sleeping for 10 seconds to avoid race condition")
+        time.sleep(10) # Potential race condition
+        r = iam.get_role(RoleName=function_role_name)
+        function_role_arn = r["Role"]["Arn"]
+        print("Created function role:", function_role_arn)
+
+        with open('awscommunity_s3_bucketnotification/test_lambda.zip', 'rb') as f:
+            zipped_code = f.read()
+
+        r = lam.create_function(FunctionName=function_name,
+                Runtime="python3.7", 
+                Role=function_role_arn,
+                Handler="test_lambda.handle", 
+                Code=dict(ZipFile=zipped_code))
+        function_arn = r["FunctionArn"]
+        (function_invoke_role_name, function_invoke_role_policy_arn) = \
+            create_role(session, "FuncTest1", "Function", function_arn, bucket_arn)
+        print("Created function:", r["FunctionArn"])
+
+        # Create notifications for each target type
+        # (Note that we aren't testing the notifications themselves, only the config)
+
+        ORIG_TOPIC_1 = "topic1"
+        ORIG_QUEUE_1 = "queue1"
+        ORIG_FUNCTION_1 = "func1"
+
+        original_configs = {
+            "TopicConfigurations": [
+                {
+                    "Id": ORIG_TOPIC_1, 
+                    "TopicArn": topic_arn,
+                    "Events": ["s3:ObjectCreated:*"],
+                    "Filter": {
+                        "Key": {
+                            "FilterRules": [
+                                {
+                                    "Name": "Suffix",
+                                    "Value": "jpg"
+                                }
+                            ]
+                        }
+                    }
+                }
+            ],
+            "QueueConfigurations": [
+                {
+                    "Id": ORIG_QUEUE_1, 
+                    "QueueArn": queue_arn,
+                    "Events": ["s3:ObjectCreated:*"],
+                    "Filter": {
+                        "Key": {
+                            "FilterRules": [
+                                {
+                                    "Name": "Suffix",
+                                    "Value": "png"
+                                }
+                            ]
+                        }
+                    }
+                }
+            ],
+            "LambdaFunctionConfigurations": [
+                {
+                    "Id": ORIG_FUNCTION_1, 
+                    "LambdaFunctionArn": function_arn,
+                    "Events": ["s3:ObjectCreated:*"],
+                    "Filter": {
+                        "Key": {
+                            "FilterRules": [
+                                {
+                                    "Name": "Suffix",
+                                    "Value": "gif"
+                                }
+                            ]
+                        }
+                    }
+                }
+            ]
+        }
+
+        # S3 has to verify that it can send the notifications, and sometimes
+        # the permissions have not yet propagated.
+        tries = 0
+        succeeded = False
+        max_tries = 1
+        while tries < max_tries:
+            try:
+                tries = tries + 1
+                print("About to try putting notification config")
+                r = s3.put_bucket_notification_configuration(
+                        Bucket=bucket_name,
+                        NotificationConfiguration=original_configs,
+                        SkipDestinationValidation=True)
+                # Skipping validation... can't get this to succeed, even with retries
+                # Confirmed that the targets are valid by creating the same thing
+                # in the console.
+                print("Successfully put the notification config")
+                succeeded = True
+                break
+            except Exception:
+                if tries >= max_tries:
+                    raise
+                print("Retrying for InvalidArgument exception")
+                time.sleep(10)
+        if not succeeded:
+            raise Exception("Exceeded max tries to put bucket notification confguration")
+
+        def validate_config(orig, current):
+            "Validate that the original config has not changed"
+
+            # Iterate over the top level keys: TopicConfgurations, etc
+            for key in orig:
+                if key not in current:
+                    raise Exception("Missing " + key)
+
+                # Iterate over the array of notifications under each XConfiguration
+                for orig_item in orig[key]:
+
+                    # Check each notification in the current config for a matching key
+                    id_found = False
+                    for cur_item in current[key]:
+                        if cur_item["Id"] == orig_item["Id"]:
+                            id_found = True
+                            # Make sure the dict hasn't changed
+                            if cur_item != orig_item:
+                                print("cur_item", json.dumps(cur_item))
+                                print("orig_item", json.dumps(orig_item))
+                                raise Exception("Not the same: " + orig_item["Id"])
+                    if not id_found:
+                        raise Exception(f"Did not find {orig_item['Id']} in {key}")
+
+        r = get_all(session, bucket_arn)
+        validate_config(original_configs, r)
+
+        # Test getting a notification
+        topic1 = get(session, bucket_arn, ORIG_TOPIC_1)
+        if not topic1:
+            raise Exception("Unable to get original topic")
+        orig_topic = original_configs["TopicConfigurations"][0]
+        assert orig_topic["Id"] == topic1.Id
+        assert orig_topic["Events"] == topic1.Events
+        assert orig_topic["Filter"]["Key"]["FilterRules"] == topic1.Filters
+        assert orig_topic["TopicArn"] == topic1.TargetArn
+
+        # Model a new notification and save it
+        NEW_ID = "topic2"
+        model = ResourceModel(Id=NEW_ID, 
+                Events=["s3:ObjectRemoved:*"], 
+                Filters=[{"Name": "Suffix", "Value": "xyz"}],
+                BucketArn=bucket_arn,
+                TargetType="Topic",
+                TargetArn=topic_arn)
+        save(session, model)
+
+        # Make sure none of the other notifications changed
+        r = get_all(session, bucket_arn)
+        validate_config(original_configs, r)
+
+        # Alter a notification
+        model.Events.append("s3:ObjectRestore:*")
+        save(session, model)
+
+        # Make sure none of the others changed
+        r = get_all(session, bucket_arn)
+        validate_config(original_configs, r)
+        
+        # Delete the new notification
+        delete(session, bucket_arn, NEW_ID)
+
+        # Make sure none of the others changed
+        r = get_all(session, bucket_arn)
+        validate_config(original_configs, r)
+
+        # Make sure it was actually deleted
+        print("r", json.dumps(r))
+        assert len(r["TopicConfigurations"]) == 1
+        assert r["TopicConfigurations"][0]["Id"] == ORIG_TOPIC_1
+
+        print("Done. All tests passed")
+    except Exception as e:
+        print("Tests failed")
+        LOG.exception(e) 
+
+    cleanup = True
+
+    if cleanup:
+
+        try:
+            # Delete the queue
+            sqs.delete_queue(QueueUrl=queue_url)
+            print("Deleted test queue:", queue_url)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the queue role
+            delete_role(session, queue_role_name, queue_role_policy_arn)
+            print("Deleted test queue role:", queue_role_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the topic
+            sns.delete_topic(TopicArn=topic_arn)
+            print("Deleted topic:", topic_arn)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the topic role
+            delete_role(session, topic_role_name, topic_role_policy_arn)
+            print("Deleted topic role:", topic_role_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the function
+            lam.delete_function(FunctionName=function_name)
+            print("Deleted function:", function_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the function invoke role
+            delete_role(session, function_invoke_role_name, function_invoke_role_policy_arn)
+            print("Deleted function invoke role:", function_invoke_role_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the function role
+            iam.delete_role(RoleName=function_role_name)
+            print("Deleted function role:", function_role_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        try:
+            # Delete the bucket
+            s3.delete_bucket(Bucket=bucket_name)
+            print("Deleted bucket: ", bucket_name)
+        except Exception as e:
+            LOG.exception(e) 
+
+        print("Cleanup complete")
+
+if __name__ == "__main__":
+    main()
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/handlers.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/handlers.py
new file mode 100644
index 00000000..3d891067
--- /dev/null
+++ b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/handlers.py
@@ -0,0 +1,118 @@
+"""
+Resource handler implementation for AwsCommunity::S3::BucketNotification
+"""
+
+import json
+import logging
+
+from cloudformation_cli_python_lib import (
+    Action,
+    OperationStatus,
+    ProgressEvent,
+    Resource,
+    exceptions,
+)
+
+#from awscommunity_s3_bucketnotification.config import get, save, delete
+#from awscommunity_s3_bucketnotification.models import ResourceModel
+
+from .config import get, save, delete
+from .models import ResourceModel
+
+
+# Use this logger to forward log messages to CloudWatch Logs.
+LOG = logging.getLogger(__name__)
+
+TYPE_NAME = "AwsCommunity::S3::BucketNotification"
+
+resource = Resource(TYPE_NAME, ResourceModel)
+test_entrypoint = resource.test_entrypoint
+
+@resource.handler(Action.CREATE)
+def create_handler(session, request, callback_context):
+    "Create the bucket notification"
+
+    model = request.desiredResourceState
+
+    progress = ProgressEvent(
+        status=OperationStatus.IN_PROGRESS,
+        resourceModel=model,
+    )
+    try:
+        save(session, model)
+        progress.status = OperationStatus.SUCCESS
+    except Exception as e:
+        raise exceptions.InternalFailure(e)
+
+    return progress
+
+@resource.handler(Action.UPDATE)
+def update_handler(session, request, callback_context):
+    "Update the bucket notification"
+
+    LOG.info("update_handler calling create_handler")
+
+    return create_handler(session, request, callback_context)
+
+@resource.handler(Action.DELETE)
+def delete_handler(session, request, callback_context):
+    "Delete the bucket notification"
+
+    
+    model = request.desiredResourceState
+
+    progress: ProgressEvent = ProgressEvent(
+        status=OperationStatus.IN_PROGRESS,
+        resourceModel=None,
+    )
+    try:
+        delete(session, model.BucketArn, model.Id)
+        progress.status = OperationStatus.SUCCESS
+    except Exception as e:
+        raise exceptions.InternalFailure(e)
+
+    return progress
+
+
+@resource.handler(Action.READ)
+def read_handler(session, request, callback_context):
+    "Read the bucket notification"
+
+    
+    model = request.desiredResourceState
+    LOG.debug("read_handler")
+
+    try:
+        model = get(session, model.BucketArn, model.Id)
+
+        progress: ProgressEvent = ProgressEvent(
+            status=OperationStatus.IN_PROGRESS,
+            resourceModel=model,
+        )
+        progress.status = OperationStatus.SUCCESS
+    except Exception as e:
+        raise exceptions.InternalFailure(e)
+
+    return progress
+
+# It doesn't really make sense for us to implement a list handler here, 
+# since we can't tell if we created the bucket notifications on all 
+# buckets in an account.
+
+#@resource.handler(Action.LIST)
+#def list_handler(session, request, callback_context):
+#    "List bucket notifications"
+#
+#    
+#    progress: ProgressEvent = ProgressEvent(
+#        status=OperationStatus.IN_PROGRESS,
+#        resourceModels=None,
+#    )
+#    try:
+#
+#        progress.status = OperationStatus.SUCCESS
+#    except Exception as e:
+#        raise exceptions.InternalFailure(e)
+#
+#    return progress
+#
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/models.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/models.py
new file mode 100644
index 00000000..a18a667f
--- /dev/null
+++ b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/models.py
@@ -0,0 +1,112 @@
+# DO NOT modify this file by hand, changes will be overwritten
+import sys
+from dataclasses import dataclass
+from inspect import getmembers, isclass
+from typing import (
+    AbstractSet,
+    Any,
+    Generic,
+    Mapping,
+    MutableMapping,
+    Optional,
+    Sequence,
+    Type,
+    TypeVar,
+)
+
+from cloudformation_cli_python_lib.interface import (
+    BaseModel,
+    BaseResourceHandlerRequest,
+)
+from cloudformation_cli_python_lib.recast import recast_object
+from cloudformation_cli_python_lib.utils import deserialize_list
+
+T = TypeVar("T")
+
+
+def set_or_none(value: Optional[Sequence[T]]) -> Optional[AbstractSet[T]]:
+    if value:
+        return set(value)
+    return None
+
+
+@dataclass
+class ResourceHandlerRequest(BaseResourceHandlerRequest):
+    # pylint: disable=invalid-name
+    desiredResourceState: Optional["ResourceModel"]
+    previousResourceState: Optional["ResourceModel"]
+    typeConfiguration: Optional["TypeConfigurationModel"]
+
+
+@dataclass
+class ResourceModel(BaseModel):
+    Id: Optional[str]
+    Events: Optional[Sequence[str]]
+    Filters: Optional[Sequence["_KeyVal"]]
+    BucketArn: Optional[str]
+    TargetArn: Optional[str]
+    TargetType: Optional[str]
+
+    @classmethod
+    def _deserialize(
+        cls: Type["_ResourceModel"],
+        json_data: Optional[Mapping[str, Any]],
+    ) -> Optional["_ResourceModel"]:
+        if not json_data:
+            return None
+        dataclasses = {n: o for n, o in getmembers(sys.modules[__name__]) if isclass(o)}
+        recast_object(cls, json_data, dataclasses)
+        return cls(
+            Id=json_data.get("Id"),
+            Events=json_data.get("Events"),
+            Filters=deserialize_list(json_data.get("Filters"), KeyVal),
+            BucketArn=json_data.get("BucketArn"),
+            TargetArn=json_data.get("TargetArn"),
+            TargetType=json_data.get("TargetType"),
+        )
+
+
+# work around possible type aliasing issues when variable has same name as a model
+_ResourceModel = ResourceModel
+
+
+@dataclass
+class KeyVal(BaseModel):
+    Name: Optional[str]
+    Value: Optional[str]
+
+    @classmethod
+    def _deserialize(
+        cls: Type["_KeyVal"],
+        json_data: Optional[Mapping[str, Any]],
+    ) -> Optional["_KeyVal"]:
+        if not json_data:
+            return None
+        return cls(
+            Name=json_data.get("Name"),
+            Value=json_data.get("Value"),
+        )
+
+
+# work around possible type aliasing issues when variable has same name as a model
+_KeyVal = KeyVal
+
+
+@dataclass
+class TypeConfigurationModel(BaseModel):
+
+    @classmethod
+    def _deserialize(
+        cls: Type["_TypeConfigurationModel"],
+        json_data: Optional[Mapping[str, Any]],
+    ) -> Optional["_TypeConfigurationModel"]:
+        if not json_data:
+            return None
+        return cls(
+        )
+
+
+# work around possible type aliasing issues when variable has same name as a model
+_TypeConfigurationModel = TypeConfigurationModel
+
+
diff --git a/resources/BucketNotification/template.yml b/resources/BucketNotification/template.yml
new file mode 100644
index 00000000..56f2f768
--- /dev/null
+++ b/resources/BucketNotification/template.yml
@@ -0,0 +1,24 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Transform: AWS::Serverless-2016-10-31
+Description: AWS SAM template for the AwsCommunity::S3::BucketNotification resource type
+
+Globals:
+  Function:
+    Timeout: 180  # docker start-up times can be long for SAM CLI
+    MemorySize: 256
+
+Resources:
+  TypeFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: awscommunity_s3_bucketnotification.handlers.resource
+      Runtime: python3.7
+      CodeUri: build/
+
+  TestEntrypoint:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: awscommunity_s3_bucketnotification.handlers.test_entrypoint
+      Runtime: python3.7
+      CodeUri: build/
+


Test patch:
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.py b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.py
new file mode 100644
index 00000000..64ee4e78
--- /dev/null
+++ b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.py
@@ -0,0 +1,12 @@
+"Test lambda handler for config_integ"
+import json
+
+def handle(event, context):
+    "Handler"
+    print(event)
+    print(context)
+    return {
+        'statusCode': 200,
+        'body': json.dumps('Hello World')
+    }
+
diff --git a/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.zip b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.zip
new file mode 100644
index 00000000..851747ce
Binary files /dev/null and b/resources/BucketNotification/src/awscommunity_s3_bucketnotification/test_lambda.zip differ
diff --git a/resources/BucketNotification/src/run_integ_test.py b/resources/BucketNotification/src/run_integ_test.py
new file mode 100644
index 00000000..31293275
--- /dev/null
+++ b/resources/BucketNotification/src/run_integ_test.py
@@ -0,0 +1,17 @@
+"Run manual integration tests"
+
+import argparse
+import sys
+from awscommunity_s3_bucketnotification import config_integ
+
+def main():
+    "Main"
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--profile', help='Use a specific AWS config profile')
+    args = parser.parse_args()
+    if not args.profile:
+        sys.exit("--profile is required")
+    config_integ.main(args.profile)
+
+if __name__ == "__main__":
+    main()
diff --git a/resources/BucketNotification/test-template.yml b/resources/BucketNotification/test-template.yml
new file mode 100644
index 00000000..b4f1f58f
--- /dev/null
+++ b/resources/BucketNotification/test-template.yml
@@ -0,0 +1,21 @@
+Resources:
+  Queue:
+    Type: AWS::SQS::Queue
+  Bucket:
+    Type: AWS::S3::Bucket
+  Notification:
+    Type: AwsCommunity::S3::BucketNotification
+    Properties:
+      Id: MyNotification
+      Events: 
+        - s3:ObjectCreated:*
+      Filters:
+        - Name: suffix
+          Value: gif
+      BucketArn: !GetAtt Bucket.Arn
+      TargetType: Queue
+      TargetArn: !GetAtt Queue.Arn
+    DependsOn:
+      - Bucket
+      - Queue
+