AccessPointPolicy

Source: src/AWS/S3Control/AccessPointPolicy.ts

The resource policy of an S3 Access Point. Grants principals access to objects through the access point — the delegated replacement for a giant shared bucket policy.

Note that the underlying bucket must delegate access control to the access point (or the principals must also be allowed by the bucket policy).

Attaching a Policy

import * as S3Control from "alchemy/AWS/S3Control";

const accessPoint = yield* S3Control.AccessPoint("data-ap", {
  bucket: bucket.bucketName,
});

yield* S3Control.AccessPointPolicy("data-ap-policy", {
  accessPointName: accessPoint.accessPointName,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: `arn:aws:iam::${accountId}:role/reader` },
        Action: ["s3:GetObject"],
        Resource: [Output.interpolate`${accessPoint.accessPointArn}/object/*`],
      },
    ],
  },
});