AccessPoint

Source: src/AWS/S3Control/AccessPoint.ts

An Amazon S3 Access Point — a named network endpoint attached to a bucket with its own policy, public-access-block settings, and optional VPC restriction. Use access points to manage shared-dataset access at scale instead of maintaining one giant bucket policy.

Creating Access Points

Internet access point on a bucket

import * as S3 from "alchemy/AWS/S3";
import * as S3Control from "alchemy/AWS/S3Control";

const bucket = yield* S3.Bucket("data", {});
const accessPoint = yield* S3Control.AccessPoint("data-ap", {
  bucket: bucket.bucketName,
});

VPC-only access point

const accessPoint = yield* S3Control.AccessPoint("internal-ap", {
  bucket: bucket.bucketName,
  vpcConfiguration: { vpcId: vpc.vpcId },
});

Access point with explicit public-access-block

const accessPoint = yield* S3Control.AccessPoint("locked-ap", {
  bucket: bucket.bucketName,
  publicAccessBlock: {
    blockPublicAcls: true,
    ignorePublicAcls: true,
    blockPublicPolicy: true,
    restrictPublicBuckets: true,
  },
  tags: { team: "data" },
});

Granting Access

yield* S3Control.AccessPointPolicy("data-ap-policy", {
  accessPointName: accessPoint.accessPointName,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: `arn:aws:iam::${accountId}:role/reader` },
        Action: ["s3:GetObject"],
        Resource: [Output.interpolate`${accessPoint.accessPointArn}/object/*`],
      },
    ],
  },
});