Bucket

A private S3 bucket with encryption, TLS-only access and production versioning on by default. Grant access in one line instead of writing IAM policy.

Storage · anvil:aws:Bucket

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

versioning
boolean

Enable versioning in non-production stages. Versioning is always enabled in production. Incurs additional storage cost per version. Default: false.

versionRetention
string

How long non-current object versions are kept before automatic expiry. Strongly recommended when versioning is enabled to prevent unbounded storage growth. Default: keep forever.

  • 7d— 7 days
  • 30d— 30 days (1 month)
  • 90d— 90 days (3 months)
  • 1y— 1 year (365 days)
  • 3y— 3 years (1095 days) — FedRAMP minimum
  • 6y— 6 years (2190 days) — HIPAA minimum
  • 7y— 7 years (2555 days) — IRAP minimum
storageTransition
string

When to move objects to cheaper storage classes. Omit to use Intelligent-Tiering (recommended default). Only applies when no custom lifecycle is provided via hatch.

  • 30d— Standard → IA at 30 days, Glacier at 90 days
  • 90d— Standard → IA at 90 days, Glacier at 365 days
  • 1y— Standard → IA at 365 days, Glacier at 730 days
encryption
string

Upgrade at-rest encryption to SSE-KMS. Set to "kms" to enable. SSE-S3 (AES256) is always on by default at no cost. SSE-KMS incurs KMS API call cost and is required by HIPAA, PCI-DSS, FedRAMP, and IRAP.

logging
boolean

Enable S3 server access logging to the centralised logging bucket created during anvil bootstrap. Required by most compliance frameworks for audit trails. Incurs storage cost. Default: false.

retention
integer

Enable Object Lock with a retention period in days (COMPLIANCE mode). Objects cannot be deleted or overwritten until the period expires. Required by PCI-DSS (365), FedRAMP (1095), HIPAA (2190). Must be set at bucket creation. Default: 0 (disabled).

This component also accepts a hatch argument to override the underlying resource configuration. See Overrides & Escape Hatch.

Attributes

Outputs available once the resource is deployed.

arn
string

The ARN of the S3 bucket.

bucketName
string

The name of the S3 bucket.