S3

13 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

S3AccessGrant # CLOUD CONTROL · AWS::S3::AccessGrant

S3AccessGrant manages AWS::S3::AccessGrant through the AWS Cloud Control API.

kubectl get s3accessgrants · example on GitHub

Example

# S3AccessGrant — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3accessgrant
apiVersion: aws.konfig.io/v1alpha1
kind: S3AccessGrant
metadata:
  name: example-s3accessgrant
  namespace: default
spec:
  accessGrantsLocationConfiguration:
    s3SubPrefix: example
  accessGrantsLocationId: example-id
  applicationArn: arn:aws:iam::123456789012:role/example-role
  grantee:
    granteeIdentifier: example
    granteeType: IAM
  permission: READ
  providerRef:
    name: example-s3accessgrant
    region: us-east-1
  s3PrefixType: Object
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`accessGrantsLocationConfiguration`	object	—	The configuration options of the grant location, which is the S3 path to the data to which you are granting access.
`accessGrantsLocationConfiguration.s3SubPrefix`	string	yes	The S3 sub prefix of a registered location in your S3 Access Grants instance
`accessGrantsLocationId`	string	yes	The custom S3 location to be accessed by the grantee
`applicationArn`	string	—	The ARN of the application grantees will use to access the location
`grantee`	object	yes	The principal who will be granted permission to access S3.
`grantee.granteeIdentifier`	string	yes	The unique identifier of the Grantee
`grantee.granteeType`	enum	yes	Configures the transfer acceleration state for an Amazon S3 bucket. Allowed: `IAM, DIRECTORY_USER, DIRECTORY_GROUP`
`permission`	enum	yes	The level of access to be afforded to the grantee Allowed: `READ, WRITE, READWRITE`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`s3PrefixType`	enum	—	The type of S3SubPrefix. Allowed: `Object`
`tags`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`accessGrantArn`	string	—	The Amazon Resource Name (ARN) of the specified access grant.
`accessGrantId`	string	—	The ID assigned to this access grant.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`grantScope`	string	—	The S3 path of the data to which you are granting access.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3AccessGrantsInstance # CLOUD CONTROL · AWS::S3::AccessGrantsInstance

S3AccessGrantsInstance manages AWS::S3::AccessGrantsInstance through the AWS Cloud Control API.

kubectl get s3accessgrantsinstances · example on GitHub

Example

# S3AccessGrantsInstance — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3accessgrantsinstance
apiVersion: aws.konfig.io/v1alpha1
kind: S3AccessGrantsInstance
metadata:
  name: example-s3accessgrantsinstance
  namespace: default
spec:
  identityCenterArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-s3accessgrantsinstance
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`identityCenterArn`	string	—	The Amazon Resource Name (ARN) of the specified AWS Identity Center.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`accessGrantsInstanceArn`	string	—	The Amazon Resource Name (ARN) of the specified Access Grants instance.
`accessGrantsInstanceId`	string	—	A unique identifier for the specified access grants instance.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3AccessGrantsLocation # CLOUD CONTROL · AWS::S3::AccessGrantsLocation

S3AccessGrantsLocation manages AWS::S3::AccessGrantsLocation through the AWS Cloud Control API.

kubectl get s3accessgrantslocations · example on GitHub

Example

# S3AccessGrantsLocation — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3accessgrantslocation
apiVersion: aws.konfig.io/v1alpha1
kind: S3AccessGrantsLocation
metadata:
  name: example-s3accessgrantslocation
  namespace: default
spec:
  iamRoleArn: arn:aws:iam::123456789012:role/example-role
  locationScope: example
  providerRef:
    name: example-s3accessgrantslocation
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`iamRoleArn`	string	yes	The Amazon Resource Name (ARN) of the access grant location's associated IAM role.
`locationScope`	string	yes	Descriptor for where the location actually points
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`accessGrantsLocationArn`	string	—	The Amazon Resource Name (ARN) of the specified Access Grants location.
`accessGrantsLocationId`	string	—	The unique identifier for the specified Access Grants location.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3Bucket # GA

S3Bucket is the Schema for managing S3 Buckets.

kubectl get s3buckets · example on GitHub

Example

# S3Bucket — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucket
apiVersion: aws.konfig.io/v1alpha1
kind: S3Bucket
metadata:
  name: example-s3bucket
  namespace: default
spec:
  accelerateStatus: Enabled
  blockPublicAccess:
    blockPublicAcls: false
    blockPublicPolicy: false
    ignorePublicAcls: false
    restrictPublicBuckets: false
  bucketName: example-s3bucket
  corsRules:
  - allowedHeaders:
    - example
    allowedMethods:
    - example
    allowedOrigins:
    - example
    exposeHeaders:
    - example
    maxAgeSeconds: 300
  lifecycleRules:
  - abortIncompleteMultipartUploadDays: 7
    expirationDate: example
    expirationDays: 7
    noncurrentVersionExpirationDays: 7
    noncurrentVersionTransitions:
    - noncurrentDays: 7
      storageClass: example
    prefix: example
    status: Enabled
    transitions:
    - date: example
      days: 7
      storageClass: example
  loggingConfig:
    targetBucket: example
    targetPrefix: example
  notificationConfig:
    eventBridgeEnabled: true
    lambdaFunctionConfigurations:
    - events:
      - example
      filterPrefix: example
      filterSuffix: example
      lambdaFunctionArn: arn:aws:iam::123456789012:role/example-role
    queueConfigurations:
    - events:
      - example
      filterPrefix: example
      filterSuffix: example
      queueArn: arn:aws:iam::123456789012:role/example-role
    topicConfigurations:
    - events:
      - example
      filterPrefix: example
      filterSuffix: example
      topicArn: arn:aws:iam::123456789012:role/example-role
  objectLockConfig:
    objectLockEnabled: true
    rule:
      defaultRetention:
        days: 7
        mode: GOVERNANCE
        years: 1
  providerRef:
    name: example-s3bucket
    region: us-east-1
  region: us-east-1
  serverSideEncryption:
    kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
    sseAlgorithm: example
  tags:
    environment: dev
    team: platform
  versioning: true
  websiteConfig:
    errorDocument: example
    indexDocument: example
    redirectAllTo:
      hostName: example-s3bucket
      protocol: example
    routingRules:
    - redirect:
        hostName: example-s3bucket
        httpRedirectCode: example
        protocol: example
        replaceKeyPrefixWith: example
        replaceKeyWith: example

Spec

Field	Type	Required	Description
`accelerateStatus`	enum	—	AccelerateStatus enables S3 Transfer Acceleration: Enabled or Suspended. Allowed: `Enabled, Suspended`
`blockPublicAccess`	object	—	BlockPublicAccess configures S3 Block Public Access settings.
`blockPublicAccess.blockPublicAcls`	boolean	—	BlockPublicAcls blocks public ACLs.
`blockPublicAccess.blockPublicPolicy`	boolean	—	BlockPublicPolicy blocks public bucket policies.
`blockPublicAccess.ignorePublicAcls`	boolean	—	IgnorePublicAcls ignores existing public ACLs.
`blockPublicAccess.restrictPublicBuckets`	boolean	—	RestrictPublicBuckets restricts public bucket access.
`bucketName`	string	yes	BucketName is the globally unique name of the bucket.
`corsRules`	array<object>	—	CORSRules configures cross-origin resource sharing.
`corsRules[].allowedHeaders`	array<string>	—	AllowedHeaders specifies which headers are allowed in a pre-flight request.
`corsRules[].allowedMethods`	array<string>	yes	AllowedMethods specifies the HTTP methods allowed (GET, PUT, POST, DELETE, HEAD).
`corsRules[].allowedOrigins`	array<string>	yes	AllowedOrigins specifies the origins that are allowed.
`corsRules[].exposeHeaders`	array<string>	—	ExposeHeaders specifies headers the browser can access.
`corsRules[].id`	string	—	ID is an optional unique identifier for the rule.
`corsRules[].maxAgeSeconds`	integer	—	MaxAgeSeconds specifies how long the browser can cache the preflight response.
`lifecycleRules`	array<object>	—	LifecycleRules configures lifecycle management for objects in the bucket.
`lifecycleRules[].abortIncompleteMultipartUploadDays`	integer	—	AbortIncompleteMultipartUploadDays cancels incomplete multipart uploads after this many days.
`lifecycleRules[].expirationDate`	string	—	ExpirationDate is the ISO 8601 date for expiration.
`lifecycleRules[].expirationDays`	integer	—	ExpirationDays is the number of days before objects expire.
`lifecycleRules[].id`	string	—	ID is a unique identifier for the rule.
`lifecycleRules[].noncurrentVersionExpirationDays`	integer	—	NoncurrentVersionExpirationDays is the number of days before noncurrent versions expire.
`lifecycleRules[].noncurrentVersionTransitions`	array<object>	—	NoncurrentVersionTransitions defines storage class transitions for noncurrent versions.
`lifecycleRules[].noncurrentVersionTransitions[].noncurrentDays`	integer	—	NoncurrentDays is the number of days before transitioning.
`lifecycleRules[].noncurrentVersionTransitions[].storageClass`	string	yes	StorageClass is the target storage class.
`lifecycleRules[].prefix`	string	—	Prefix is the object key prefix to apply the rule to.
`lifecycleRules[].status`	enum	yes	Status is Enabled or Disabled. Allowed: `Enabled, Disabled`
`lifecycleRules[].transitions`	array<object>	—	Transitions defines storage class transitions.
`lifecycleRules[].transitions[].date`	string	—	Date is an ISO 8601 date for the transition.
`lifecycleRules[].transitions[].days`	integer	—	Days is the number of days after object creation.
`lifecycleRules[].transitions[].storageClass`	string	yes	StorageClass is the target storage class (e.g.
`loggingConfig`	object	—	LoggingConfig configures S3 server access logging.
`loggingConfig.targetBucket`	string	yes	TargetBucket is the bucket that receives access logs.
`loggingConfig.targetPrefix`	string	—	TargetPrefix is the prefix for log object keys.
`notificationConfig`	object	—	NotificationConfig configures event notifications.
`notificationConfig.eventBridgeEnabled`	boolean	—	EventBridgeEnabled enables routing events to Amazon EventBridge.
`notificationConfig.lambdaFunctionConfigurations`	array<object>	—	LambdaFunctionConfigurations configures Lambda function notifications.
`notificationConfig.lambdaFunctionConfigurations[].events`	array<string>	yes	Events is the list of S3 event types that trigger the notification.
`notificationConfig.lambdaFunctionConfigurations[].filterPrefix`	string	—	FilterPrefix restricts notifications to keys with this prefix.
`notificationConfig.lambdaFunctionConfigurations[].filterSuffix`	string	—	FilterSuffix restricts notifications to keys with this suffix.
`notificationConfig.lambdaFunctionConfigurations[].id`	string	—	ID is an optional unique identifier.
`notificationConfig.lambdaFunctionConfigurations[].lambdaFunctionArn`	string	yes	LambdaFunctionARN is the ARN of the Lambda function.
`notificationConfig.queueConfigurations`	array<object>	—	QueueConfigurations configures SQS queue notifications.
`notificationConfig.queueConfigurations[].events`	array<string>	yes	Events is the list of S3 event types that trigger the notification.
`notificationConfig.queueConfigurations[].filterPrefix`	string	—	FilterPrefix restricts notifications to keys with this prefix.
`notificationConfig.queueConfigurations[].filterSuffix`	string	—	FilterSuffix restricts notifications to keys with this suffix.
`notificationConfig.queueConfigurations[].id`	string	—	ID is an optional unique identifier.
`notificationConfig.queueConfigurations[].queueArn`	string	yes	QueueARN is the ARN of the SQS queue.
`notificationConfig.topicConfigurations`	array<object>	—	TopicConfigurations configures SNS topic notifications.
`notificationConfig.topicConfigurations[].events`	array<string>	yes	Events is the list of S3 event types that trigger the notification.
`notificationConfig.topicConfigurations[].filterPrefix`	string	—	FilterPrefix restricts notifications to keys with this prefix.
`notificationConfig.topicConfigurations[].filterSuffix`	string	—	FilterSuffix restricts notifications to keys with this suffix.
`notificationConfig.topicConfigurations[].id`	string	—	ID is an optional unique identifier.
`notificationConfig.topicConfigurations[].topicArn`	string	yes	TopicARN is the ARN of the SNS topic.
`objectLockConfig`	object	—	ObjectLockConfig configures S3 Object Lock.
`objectLockConfig.objectLockEnabled`	boolean	yes	ObjectLockEnabled enables Object Lock.
`objectLockConfig.rule`	object	—	Rule is the default retention rule.
`objectLockConfig.rule.defaultRetention`	object	yes	DefaultRetention is the default retention settings.
`objectLockConfig.rule.defaultRetention.days`	integer	—	Days is the retention period in days.
`objectLockConfig.rule.defaultRetention.mode`	enum	yes	Mode is GOVERNANCE or COMPLIANCE. Allowed: `GOVERNANCE, COMPLIANCE`
`objectLockConfig.rule.defaultRetention.years`	integer	—	Years is the retention period in years.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`region`	string	—	Region is the AWS region where the bucket is created.
`serverSideEncryption`	object	—	ServerSideEncryption configures default SSE for new objects.
`serverSideEncryption.kmsKeyId`	string	—	KMSKeyID is the KMS key ARN or ID (only for aws:kms).
`serverSideEncryption.sseAlgorithm`	string	yes	SSEAlgorithm is the server-side encryption algorithm: AES256 or aws:kms.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`versioning`	boolean	—	Versioning enables S3 versioning on the bucket.
`websiteConfig`	object	—	WebsiteConfig configures static website hosting.
`websiteConfig.errorDocument`	string	—	ErrorDocument is the key name used for 4XX errors.
`websiteConfig.indexDocument`	string	—	IndexDocument is the suffix for the index document (e.g.
`websiteConfig.redirectAllTo`	object	—	RedirectAllTo redirects all requests to another hostname.
`websiteConfig.redirectAllTo.hostName`	string	yes	HostName is the hostname to redirect to.
`websiteConfig.redirectAllTo.protocol`	string	—	Protocol is http or https.
`websiteConfig.routingRules`	array<object>	—	RoutingRules defines conditional redirect rules.
`websiteConfig.routingRules[].condition`	object	—	Condition is the condition that triggers this rule.
`websiteConfig.routingRules[].condition.httpErrorCodeReturnedEquals`	string	—	HttpErrorCodeReturnedEquals triggers the rule when this HTTP error code is returned.
`websiteConfig.routingRules[].condition.keyPrefixEquals`	string	—	KeyPrefixEquals triggers the rule when the key prefix matches.
`websiteConfig.routingRules[].redirect`	object	yes	Redirect defines where to redirect matching requests.
`websiteConfig.routingRules[].redirect.hostName`	string	—	HostName replaces the hostname in the redirect.
`websiteConfig.routingRules[].redirect.httpRedirectCode`	string	—	HttpRedirectCode is the HTTP redirect code (default 301).
`websiteConfig.routingRules[].redirect.protocol`	string	—	Protocol is http or https.
`websiteConfig.routingRules[].redirect.replaceKeyPrefixWith`	string	—	ReplaceKeyPrefixWith replaces the key prefix in the redirect.
`websiteConfig.routingRules[].redirect.replaceKeyWith`	string	—	ReplaceKeyWith replaces the entire key in the redirect.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the bucket.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`domainName`	string	—	DomainName is the bucket's regional domain name.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`websiteEndpoint`	string	—	WebsiteEndpoint is the website endpoint URL when website hosting is enabled.

S3BucketCORS # GA

S3BucketCORS is the Schema for managing S3 bucket CORS configurations.

kubectl get s3bucketcorses · example on GitHub

Example

# S3BucketCORS — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucketcors
apiVersion: aws.konfig.io/v1alpha1
kind: S3BucketCORS
metadata:
  name: example-s3bucketcors
  namespace: default
spec:
  bucketName: example-s3bucketcors
  corsRules:
  - allowedHeaders:
    - example
    allowedMethods:
    - example
    allowedOrigins:
    - example
    exposeHeaders:
    - example
    maxAgeSeconds: 300
  providerRef:
    name: example-s3bucketcors
    region: us-east-1

Spec

Field	Type	Required	Description
`bucketName`	string	yes	BucketName is the name of the S3 bucket.
`corsRules`	array<object>	yes	CORSRules are the CORS rules to apply.
`corsRules[].allowedHeaders`	array<string>	—	AllowedHeaders specifies which headers are allowed in a pre-flight request.
`corsRules[].allowedMethods`	array<string>	yes	AllowedMethods specifies the HTTP methods allowed (GET, PUT, POST, DELETE, HEAD).
`corsRules[].allowedOrigins`	array<string>	yes	AllowedOrigins specifies the origins that are allowed.
`corsRules[].exposeHeaders`	array<string>	—	ExposeHeaders specifies headers the browser can access.
`corsRules[].id`	string	—	ID is an optional unique identifier for the rule.
`corsRules[].maxAgeSeconds`	integer	—	MaxAgeSeconds specifies how long the browser can cache the preflight response.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

S3BucketLifecycle # GA

S3BucketLifecycle is the Schema for managing S3 bucket lifecycle configurations.

kubectl get s3bucketlifecycles · example on GitHub

Example

# S3BucketLifecycle — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucketlifecycle
apiVersion: aws.konfig.io/v1alpha1
kind: S3BucketLifecycle
metadata:
  name: example-s3bucketlifecycle
  namespace: default
spec:
  bucketName: example-s3bucketlifecycle
  providerRef:
    name: example-s3bucketlifecycle
    region: us-east-1
  rules:
  - abortIncompleteMultipartUploadDays: 7
    expirationDate: example
    expirationDays: 7
    noncurrentVersionExpirationDays: 7
    noncurrentVersionTransitions:
    - noncurrentDays: 7
      storageClass: example
    prefix: example
    status: Enabled
    transitions:
    - date: example
      days: 7
      storageClass: example

Spec

Field	Type	Required	Description
`bucketName`	string	yes	BucketName is the name of the S3 bucket.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rules`	array<object>	yes	Rules are the lifecycle rules to apply.
`rules[].abortIncompleteMultipartUploadDays`	integer	—	AbortIncompleteMultipartUploadDays cancels incomplete multipart uploads after this many days.
`rules[].expirationDate`	string	—	ExpirationDate is the ISO 8601 date for expiration.
`rules[].expirationDays`	integer	—	ExpirationDays is the number of days before objects expire.
`rules[].id`	string	—	ID is a unique identifier for the rule.
`rules[].noncurrentVersionExpirationDays`	integer	—	NoncurrentVersionExpirationDays is the number of days before noncurrent versions expire.
`rules[].noncurrentVersionTransitions`	array<object>	—	NoncurrentVersionTransitions defines storage class transitions for noncurrent versions.
`rules[].noncurrentVersionTransitions[].noncurrentDays`	integer	—	NoncurrentDays is the number of days before transitioning.
`rules[].noncurrentVersionTransitions[].storageClass`	string	yes	StorageClass is the target storage class.
`rules[].prefix`	string	—	Prefix is the object key prefix to apply the rule to.
`rules[].status`	enum	yes	Status is Enabled or Disabled. Allowed: `Enabled, Disabled`
`rules[].transitions`	array<object>	—	Transitions defines storage class transitions.
`rules[].transitions[].date`	string	—	Date is an ISO 8601 date for the transition.
`rules[].transitions[].days`	integer	—	Days is the number of days after object creation.
`rules[].transitions[].storageClass`	string	yes	StorageClass is the target storage class (e.g.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

S3BucketNotification # GA

S3BucketNotification is the Schema for managing S3 bucket notification configurations.

kubectl get s3bucketnotifications · example on GitHub

Example

# S3BucketNotification — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucketnotification
apiVersion: aws.konfig.io/v1alpha1
kind: S3BucketNotification
metadata:
  name: example-s3bucketnotification
  namespace: default
spec:
  bucketName: example-s3bucketnotification
  eventBridgeEnabled: true
  lambdaFunctionConfigurations:
  - events:
    - example
    lambdaFunctionArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-s3bucketnotification
    region: us-east-1
  queueConfigurations:
  - events:
    - example
    queueArn: arn:aws:iam::123456789012:role/example-role
  topicConfigurations:
  - events:
    - example
    topicArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`bucketName`	string	yes	BucketName is the name of the S3 bucket.
`eventBridgeEnabled`	boolean	—	EventBridgeEnabled enables delivery of all events to Amazon EventBridge.
`lambdaFunctionConfigurations`	array<object>	—	LambdaFunctionConfigurations are Lambda function notification configurations.
`lambdaFunctionConfigurations[].events`	array<string>	yes	Events is the list of S3 events that trigger this notification.
`lambdaFunctionConfigurations[].id`	string	—	ID is an optional unique identifier for this configuration.
`lambdaFunctionConfigurations[].lambdaFunctionArn`	string	yes	LambdaFunctionARN is the ARN of the Lambda function.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`queueConfigurations`	array<object>	—	QueueConfigurations are SQS queue notification configurations.
`queueConfigurations[].events`	array<string>	yes	Events is the list of S3 events that trigger this notification.
`queueConfigurations[].id`	string	—	ID is an optional unique identifier for this configuration.
`queueConfigurations[].queueArn`	string	yes	QueueARN is the ARN of the SQS queue.
`topicConfigurations`	array<object>	—	TopicConfigurations are SNS topic notification configurations.
`topicConfigurations[].events`	array<string>	yes	Events is the list of S3 events that trigger this notification.
`topicConfigurations[].id`	string	—	ID is an optional unique identifier for this configuration.
`topicConfigurations[].topicArn`	string	yes	TopicARN is the ARN of the SNS topic.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

S3BucketPolicy # GA

S3BucketPolicy is the Schema for managing S3 Bucket Policies.

kubectl get s3bucketpolicies · example on GitHub

Example

# S3BucketPolicy — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucketpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: S3BucketPolicy
metadata:
  name: example-s3bucketpolicy
  namespace: default
spec:
  bucketRef:
    bucketName: example-s3bucketpolicy
    name: example-s3bucketpolicy
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  providerRef:
    name: example-s3bucketpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`bucketRef`	object	yes	BucketRef references the target bucket.
`bucketRef.bucketName`	string	—	BucketName is a direct S3 bucket name (bypasses CR lookup).
`bucketRef.name`	string	—	Name is the name of an S3Bucket CR in the same namespace.
`policyDocument`	string	yes	PolicyDocument is the JSON IAM resource policy to attach to the bucket.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

S3BucketReplication # GA

S3BucketReplication is the Schema for managing S3 bucket replication configurations.

kubectl get s3bucketreplications · example on GitHub

Example

# S3BucketReplication — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3bucketreplication
apiVersion: aws.konfig.io/v1alpha1
kind: S3BucketReplication
metadata:
  name: example-s3bucketreplication
  namespace: default
spec:
  bucketName: example-s3bucketreplication
  providerRef:
    name: example-s3bucketreplication
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  rules:
  - destination:
      account: example
      bucket: example
      storageClass: example
    prefix: example
    priority: 1
    status: Enabled

Spec

Field	Type	Required	Description
`bucketName`	string	yes	BucketName is the name of the source S3 bucket.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes	RoleARN is the IAM role ARN that S3 assumes for replication.
`rules`	array<object>	yes	Rules are the replication rules.
`rules[].destination`	object	yes	Destination is the destination configuration for the rule.
`rules[].destination.account`	string	—	Account is the destination account ID for cross-account replication.
`rules[].destination.bucket`	string	yes	Bucket is the ARN of the destination bucket.
`rules[].destination.storageClass`	string	—	StorageClass overrides the storage class of replicated objects.
`rules[].id`	string	—	ID is an optional unique identifier for this rule.
`rules[].prefix`	string	—	Prefix filters objects for replication by key prefix.
`rules[].priority`	integer	—	Priority is used when multiple rules apply to the same object.
`rules[].status`	enum	yes	Status indicates whether the rule is enabled. Allowed: `Enabled, Disabled`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

S3MultiRegionAccessPoint # CLOUD CONTROL · AWS::S3::MultiRegionAccessPoint

S3MultiRegionAccessPoint manages AWS::S3::MultiRegionAccessPoint through the AWS Cloud Control API.

kubectl get s3multiregionaccesspoints · example on GitHub

Example

# S3MultiRegionAccessPoint — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3multiregionaccesspoint
apiVersion: aws.konfig.io/v1alpha1
kind: S3MultiRegionAccessPoint
metadata:
  name: example-s3multiregionaccesspoint
  namespace: default
spec:
  name: example-s3multiregionaccesspoint
  providerRef:
    name: example-s3multiregionaccesspoint
    region: us-east-1
  publicAccessBlockConfiguration:
    blockPublicAcls: false
    blockPublicPolicy: false
    ignorePublicAcls: false
    restrictPublicBuckets: false
  regions:
  - bucket: example
    bucketAccountId: '123456789012'

Spec

Field	Type	Required	Description
`name`	string	—	The name you want to assign to this Multi Region Access Point.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`publicAccessBlockConfiguration`	object	—	The PublicAccessBlock configuration that you want to apply to this Multi Region Access Point.
`publicAccessBlockConfiguration.blockPublicAcls`	boolean	—	Specifies whether Amazon S3 should block public access control lists (ACLs) for buckets in this account.
`publicAccessBlockConfiguration.blockPublicPolicy`	boolean	—	Specifies whether Amazon S3 should block public bucket policies for buckets in this account.
`publicAccessBlockConfiguration.ignorePublicAcls`	boolean	—	Specifies whether Amazon S3 should ignore public ACLs for buckets in this account.
`publicAccessBlockConfiguration.restrictPublicBuckets`	boolean	—	Specifies whether Amazon S3 should restrict public bucket policies for this bucket.
`regions`	array<object>	yes	The list of buckets that you want to associate this Multi Region Access Point with.
`regions[].bucket`	string	yes
`regions[].bucketAccountId`	string	—

Status

Field	Type	Required	Description
`alias`	string	—	The alias is a unique identifier to, and is part of the public DNS name for this Multi Region Access Point Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The timestamp of the when the Multi Region Access Point is created Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3MultiRegionAccessPointPolicy # CLOUD CONTROL · AWS::S3::MultiRegionAccessPointPolicy

S3MultiRegionAccessPointPolicy manages AWS::S3::MultiRegionAccessPointPolicy through the AWS Cloud Control API.

kubectl get s3multiregionaccesspointpolicies · example on GitHub

Example

# S3MultiRegionAccessPointPolicy — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3multiregionaccesspointpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: S3MultiRegionAccessPointPolicy
metadata:
  name: example-s3multiregionaccesspointpolicy
  namespace: default
spec:
  mrapName: example-s3multiregionaccesspointpolicy
  providerRef:
    name: example-s3multiregionaccesspointpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`mrapName`	string	yes	The name of the Multi Region Access Point to apply policy Create-only in AWS: changing it requires replacing the resource.
`policy`	object	yes	Policy document to apply to a Multi Region Access Point
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`policyStatus`	object	—	The Policy Status associated with this Multi Region Access Point Read-only: reported by AWS after creation.
`policyStatus.isPublic`	enum	yes	Specifies whether the policy is public or not. Allowed: `True, False`
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3StorageLens # CLOUD CONTROL · AWS::S3::StorageLens

S3StorageLens manages AWS::S3::StorageLens through the AWS Cloud Control API.

kubectl get s3storagelens · example on GitHub

Example

# S3StorageLens — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3storagelens
apiVersion: aws.konfig.io/v1alpha1
kind: S3StorageLens
metadata:
  name: example-s3storagelens
  namespace: default
spec:
  providerRef:
    name: example-s3storagelens
    region: us-east-1
  storageLensConfiguration:
    accountLevel:
      activityMetrics:
        isEnabled: true
      advancedCostOptimizationMetrics:
        isEnabled: true
      advancedDataProtectionMetrics:
        isEnabled: true
      advancedPerformanceMetrics:
        isEnabled: true
      detailedStatusCodesMetrics:
        isEnabled: true
    awsOrg:
      name: example-awsorg
    dataExport:
      cloudWatchMetrics:
        isEnabled: true
      s3BucketDestination:
        accountId: '123456789012'
        arn: arn:aws:iam::123456789012:role/example-role
        format: CSV
        outputSchemaVersion: V_1
        prefix: example
      storageLensTableDestination:
        isEnabled: true
    exclude:
      buckets:
      - example
      regions:
      - example
    expandedPrefixesDataExport:
      s3BucketDestination:
        accountId: '123456789012'
        arn: arn:aws:iam::123456789012:role/example-role
        format: CSV
        outputSchemaVersion: V_1
        prefix: example
      storageLensTableDestination:
        isEnabled: true
    id: example-id
    include:
      buckets:
      - example
      regions:
      - example
    isEnabled: true
    prefixDelimiter: example
    storageLensArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`storageLensConfiguration`	object	yes	S3StorageLensStorageLensConfiguration is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel`	object	yes	S3StorageLensAccountLevel is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.activityMetrics`	object	—	S3StorageLensActivityMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.activityMetrics.isEnabled`	boolean	—	Specifies whether activity metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.advancedCostOptimizationMetrics`	object	—	S3StorageLensAdvancedCostOptimizationMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.advancedCostOptimizationMetrics.isEnabled`	boolean	—	Specifies whether advanced cost optimization metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.advancedDataProtectionMetrics`	object	—	S3StorageLensAdvancedDataProtectionMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.advancedDataProtectionMetrics.isEnabled`	boolean	—	Specifies whether advanced data protection metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.advancedPerformanceMetrics`	object	—	S3StorageLensAdvancedPerformanceMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.advancedPerformanceMetrics.isEnabled`	boolean	—	Specifies whether the Advanced Performance Metrics is enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel`	object	yes	S3StorageLensBucketLevel is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.activityMetrics`	object	—	S3StorageLensActivityMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.activityMetrics.isEnabled`	boolean	—	Specifies whether activity metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.advancedCostOptimizationMetrics`	object	—	S3StorageLensAdvancedCostOptimizationMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.advancedCostOptimizationMetrics.isEnabled`	boolean	—	Specifies whether advanced cost optimization metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.advancedDataProtectionMetrics`	object	—	S3StorageLensAdvancedDataProtectionMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.advancedDataProtectionMetrics.isEnabled`	boolean	—	Specifies whether advanced data protection metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.advancedPerformanceMetrics`	object	—	S3StorageLensAdvancedPerformanceMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.advancedPerformanceMetrics.isEnabled`	boolean	—	Specifies whether the Advanced Performance Metrics is enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.detailedStatusCodesMetrics`	object	—	S3StorageLensDetailedStatusCodesMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.detailedStatusCodesMetrics.isEnabled`	boolean	—	Specifies whether detailed status codes metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.prefixLevel`	object	—	S3StorageLensPrefixLevel is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.prefixLevel.storageMetrics`	object	yes	S3StorageLensPrefixLevelStorageMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.bucketLevel.prefixLevel.storageMetrics.isEnabled`	boolean	—	Specifies whether prefix-level storage metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.bucketLevel.prefixLevel.storageMetrics.selectionCriteria`	object	—	S3StorageLensSelectionCriteria is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.detailedStatusCodesMetrics`	object	—	S3StorageLensDetailedStatusCodesMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.detailedStatusCodesMetrics.isEnabled`	boolean	—	Specifies whether detailed status codes metrics are enabled or disabled.
`storageLensConfiguration.accountLevel.storageLensGroupLevel`	object	—	S3StorageLensStorageLensGroupLevel is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.storageLensGroupLevel.storageLensGroupSelectionCriteria`	object	—	S3StorageLensStorageLensGroupSelectionCriteria is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.accountLevel.storageLensGroupLevel.storageLensGroupSelectionCriteria.exclude`	array<string>	—
`storageLensConfiguration.accountLevel.storageLensGroupLevel.storageLensGroupSelectionCriteria.include`	array<string>	—
`storageLensConfiguration.awsOrg`	object	—	S3StorageLensAwsOrg is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.awsOrg.arn`	string	yes
`storageLensConfiguration.dataExport`	object	—	S3StorageLensDataExport is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.dataExport.cloudWatchMetrics`	object	—	S3StorageLensCloudWatchMetrics is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.dataExport.cloudWatchMetrics.isEnabled`	boolean	yes	Specifies whether CloudWatch metrics are enabled or disabled.
`storageLensConfiguration.dataExport.s3BucketDestination`	object	—	S3StorageLensS3BucketDestination is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.dataExport.s3BucketDestination.accountId`	string	yes	The AWS account ID that owns the destination S3 bucket.
`storageLensConfiguration.dataExport.s3BucketDestination.arn`	string	yes	The ARN of the bucket to which Amazon S3 Storage Lens exports will be placed.
`storageLensConfiguration.dataExport.s3BucketDestination.encryption`	object	—
`storageLensConfiguration.dataExport.s3BucketDestination.format`	enum	yes	Specifies the file format to use when exporting Amazon S3 Storage Lens metrics export. Allowed: `CSV, Parquet`
`storageLensConfiguration.dataExport.s3BucketDestination.outputSchemaVersion`	enum	yes	The version of the output schema to use when exporting Amazon S3 Storage Lens metrics. Allowed: `V_1`
`storageLensConfiguration.dataExport.s3BucketDestination.prefix`	string	—	The prefix to use for Amazon S3 Storage Lens export.
`storageLensConfiguration.dataExport.storageLensTableDestination`	object	—	S3StorageLensStorageLensTableDestination is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.dataExport.storageLensTableDestination.encryption`	object	—
`storageLensConfiguration.dataExport.storageLensTableDestination.isEnabled`	boolean	yes	Specifies whether the export to S3 Tables is enabled or disabled.
`storageLensConfiguration.exclude`	object	—	S3StorageLensBucketsAndRegions is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.exclude.buckets`	array<string>	—
`storageLensConfiguration.exclude.regions`	array<string>	—
`storageLensConfiguration.expandedPrefixesDataExport`	object	—	S3StorageLensStorageLensExpandedPrefixesDataExport is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination`	object	—	S3StorageLensS3BucketDestination is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.accountId`	string	yes	The AWS account ID that owns the destination S3 bucket.
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.arn`	string	yes	The ARN of the bucket to which Amazon S3 Storage Lens exports will be placed.
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.encryption`	object	—
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.format`	enum	yes	Specifies the file format to use when exporting Amazon S3 Storage Lens metrics export. Allowed: `CSV, Parquet`
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.outputSchemaVersion`	enum	yes	The version of the output schema to use when exporting Amazon S3 Storage Lens metrics. Allowed: `V_1`
`storageLensConfiguration.expandedPrefixesDataExport.s3BucketDestination.prefix`	string	—	The prefix to use for Amazon S3 Storage Lens export.
`storageLensConfiguration.expandedPrefixesDataExport.storageLensTableDestination`	object	—	S3StorageLensStorageLensTableDestination is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.expandedPrefixesDataExport.storageLensTableDestination.encryption`	object	—
`storageLensConfiguration.expandedPrefixesDataExport.storageLensTableDestination.isEnabled`	boolean	yes	Specifies whether the export to S3 Tables is enabled or disabled.
`storageLensConfiguration.id`	string	yes
`storageLensConfiguration.include`	object	—	S3StorageLensBucketsAndRegions is a nested property type of AWS::S3::StorageLens.
`storageLensConfiguration.include.buckets`	array<string>	—
`storageLensConfiguration.include.regions`	array<string>	—
`storageLensConfiguration.isEnabled`	boolean	yes	Specifies whether the Amazon S3 Storage Lens configuration is enabled or disabled.
`storageLensConfiguration.prefixDelimiter`	string	—	The delimiter to divide S3 key into hierarchy of prefixes.
`storageLensConfiguration.storageLensArn`	string	—	The ARN for the Amazon S3 Storage Lens configuration.
`tags`	array<object>	—	A set of tags (key-value pairs) for this Amazon S3 Storage Lens configuration.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3StorageLensGroup # CLOUD CONTROL · AWS::S3::StorageLensGroup

S3StorageLensGroup manages AWS::S3::StorageLensGroup through the AWS Cloud Control API.

kubectl get s3storagelensgroups · example on GitHub

Example

# S3StorageLensGroup — S3
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3.html#s3storagelensgroup
apiVersion: aws.konfig.io/v1alpha1
kind: S3StorageLensGroup
metadata:
  name: example-s3storagelensgroup
  namespace: default
spec:
  filter:
    and:
      matchAnyPrefix:
      - example
      matchAnySuffix:
      - example
      matchAnyTag:
      - key: example
        value: example
      matchObjectAge:
        daysGreaterThan: 1
        daysLessThan: 1
      matchObjectSize:
        bytesGreaterThan: 1
        bytesLessThan: 1
    matchAnyPrefix:
    - example
    matchAnySuffix:
    - example
    matchAnyTag:
    - key: example
      value: example
    matchObjectAge:
      daysGreaterThan: 1
      daysLessThan: 1
    matchObjectSize:
      bytesGreaterThan: 1
      bytesLessThan: 1
    or:
      matchAnyPrefix:
      - example
      matchAnySuffix:
      - example
      matchAnyTag:
      - key: example
        value: example
      matchObjectAge:
        daysGreaterThan: 1
        daysLessThan: 1
      matchObjectSize:
        bytesGreaterThan: 1
        bytesLessThan: 1
  name: example-s3storagelensgroup
  providerRef:
    name: example-s3storagelensgroup
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`filter`	object	yes	S3StorageLensGroupFilter is a nested property type of AWS::S3::StorageLensGroup.
`filter.and`	object	—	S3StorageLensGroupAnd is a nested property type of AWS::S3::StorageLensGroup.
`filter.and.matchAnyPrefix`	array<string>	—
`filter.and.matchAnySuffix`	array<string>	—
`filter.and.matchAnyTag`	array<object>	—
`filter.and.matchAnyTag[].key`	string	yes
`filter.and.matchAnyTag[].value`	string	yes
`filter.and.matchObjectAge`	object	—	S3StorageLensGroupMatchObjectAge is a nested property type of AWS::S3::StorageLensGroup.
`filter.and.matchObjectAge.daysGreaterThan`	integer	—	Minimum object age to which the rule applies.
`filter.and.matchObjectAge.daysLessThan`	integer	—	Maximum object age to which the rule applies.
`filter.and.matchObjectSize`	object	—	S3StorageLensGroupMatchObjectSize is a nested property type of AWS::S3::StorageLensGroup.
`filter.and.matchObjectSize.bytesGreaterThan`	integer	—	Minimum object size to which the rule applies.
`filter.and.matchObjectSize.bytesLessThan`	integer	—	Maximum object size to which the rule applies.
`filter.matchAnyPrefix`	array<string>	—
`filter.matchAnySuffix`	array<string>	—
`filter.matchAnyTag`	array<object>	—
`filter.matchAnyTag[].key`	string	yes
`filter.matchAnyTag[].value`	string	yes
`filter.matchObjectAge`	object	—	S3StorageLensGroupMatchObjectAge is a nested property type of AWS::S3::StorageLensGroup.
`filter.matchObjectAge.daysGreaterThan`	integer	—	Minimum object age to which the rule applies.
`filter.matchObjectAge.daysLessThan`	integer	—	Maximum object age to which the rule applies.
`filter.matchObjectSize`	object	—	S3StorageLensGroupMatchObjectSize is a nested property type of AWS::S3::StorageLensGroup.
`filter.matchObjectSize.bytesGreaterThan`	integer	—	Minimum object size to which the rule applies.
`filter.matchObjectSize.bytesLessThan`	integer	—	Maximum object size to which the rule applies.
`filter.or`	object	—	S3StorageLensGroupOr is a nested property type of AWS::S3::StorageLensGroup.
`filter.or.matchAnyPrefix`	array<string>	—
`filter.or.matchAnySuffix`	array<string>	—
`filter.or.matchAnyTag`	array<object>	—
`filter.or.matchAnyTag[].key`	string	yes
`filter.or.matchAnyTag[].value`	string	yes
`filter.or.matchObjectAge`	object	—	S3StorageLensGroupMatchObjectAge is a nested property type of AWS::S3::StorageLensGroup.
`filter.or.matchObjectAge.daysGreaterThan`	integer	—	Minimum object age to which the rule applies.
`filter.or.matchObjectAge.daysLessThan`	integer	—	Maximum object age to which the rule applies.
`filter.or.matchObjectSize`	object	—	S3StorageLensGroupMatchObjectSize is a nested property type of AWS::S3::StorageLensGroup.
`filter.or.matchObjectSize.bytesGreaterThan`	integer	—	Minimum object size to which the rule applies.
`filter.or.matchObjectSize.bytesLessThan`	integer	—	Maximum object size to which the rule applies.
`name`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A set of tags (key-value pairs) for this Amazon S3 Storage Lens Group.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`storageLensGroupArn`	string	—	The ARN for the Amazon S3 Storage Lens Group.