S3 Express

3 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

S3ExpressAccessPoint # CLOUD CONTROL · AWS::S3Express::AccessPoint

S3ExpressAccessPoint manages AWS::S3Express::AccessPoint through the AWS Cloud Control API.

kubectl get s3expressaccesspoints · example on GitHub

Example

# S3ExpressAccessPoint — S3 Express
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3express.html#s3expressaccesspoint
apiVersion: aws.konfig.io/v1alpha1
kind: S3ExpressAccessPoint
metadata:
  name: example-s3expressaccesspoint
  namespace: default
spec:
  bucket: example
  bucketAccountId: '123456789012'
  name: example-s3expressaccesspoint
  providerRef:
    name: example-s3expressaccesspoint
    region: us-east-1
  publicAccessBlockConfiguration:
    blockPublicAcls: false
    blockPublicPolicy: false
    ignorePublicAcls: false
    restrictPublicBuckets: false
  scope:
    permissions:
    - example
    prefixes:
    - example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`bucket`	string	yes	The name of the bucket that you want to associate this Access Point with.
`bucketAccountId`	string	—	The AWS account ID associated with the S3 bucket associated with this access point.
`name`	string	—	The name you want to assign to this Access Point.
`policy`	object	—	The Access Point Policy you want to apply to this access point.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`publicAccessBlockConfiguration`	object	—	The PublicAccessBlock configuration that you want to apply to this Access Point.
`publicAccessBlockConfiguration.blockPublicAcls`	boolean	—	Specifies whether Amazon S3 should block public access control lists (ACLs) for buckets in this account.
`publicAccessBlockConfiguration.blockPublicPolicy`	boolean	—	Specifies whether Amazon S3 should block public bucket policies for buckets in this account.
`publicAccessBlockConfiguration.ignorePublicAcls`	boolean	—	Specifies whether Amazon S3 should ignore public ACLs for buckets in this account.
`publicAccessBlockConfiguration.restrictPublicBuckets`	boolean	—	Specifies whether Amazon S3 should restrict public bucket policies for this bucket.
`scope`	object	—	For directory buckets, you can ﬁlter access control to speciﬁc preﬁxes, API operations, or a combination of both.
`scope.permissions`	array<string>	—	You can include one or more API operations as permissions
`scope.prefixes`	array<string>	—	You can specify any amount of preﬁxes, but the total length of characters of all preﬁxes must be less than 256 bytes in size.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcConfiguration`	object	—	If you include this field, Amazon S3 restricts access to this Access Point to requests from the specified Virtual Private Cloud (VPC).
`vpcConfiguration.vpcId`	string	—	If this field is specified, this access point will only allow connections from the specified VPC ID.

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the specified accesspoint.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`networkOrigin`	enum	—	Indicates whether this Access Point allows access from the public Internet. Allowed: `Internet, VPC`
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3ExpressBucketPolicy # CLOUD CONTROL · AWS::S3Express::BucketPolicy

S3ExpressBucketPolicy manages AWS::S3Express::BucketPolicy through the AWS Cloud Control API.

kubectl get s3expressbucketpolicies · example on GitHub

Example

# S3ExpressBucketPolicy — S3 Express
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3express.html#s3expressbucketpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: S3ExpressBucketPolicy
metadata:
  name: example-s3expressbucketpolicy
  namespace: default
spec:
  bucket: example
  providerRef:
    name: example-s3expressbucketpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`bucket`	string	yes	The name of the S3 directory bucket to which the policy applies.
`policyDocument`	object	yes	A policy document containing permissions to add to the specified bucket.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

S3ExpressDirectoryBucket # CLOUD CONTROL · AWS::S3Express::DirectoryBucket

S3ExpressDirectoryBucket manages AWS::S3Express::DirectoryBucket through the AWS Cloud Control API.

kubectl get s3expressdirectorybuckets · example on GitHub

Example

# S3ExpressDirectoryBucket — S3 Express
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/s3express.html#s3expressdirectorybucket
apiVersion: aws.konfig.io/v1alpha1
kind: S3ExpressDirectoryBucket
metadata:
  name: example-s3expressdirectorybucket
  namespace: default
spec:
  bucketEncryption:
    serverSideEncryptionConfiguration:
    - bucketKeyEnabled: true
  bucketName: example-s3expressdirectorybucket
  dataRedundancy: SingleAvailabilityZone
  inventoryConfigurations:
  - destination:
      bucketAccountId: '123456789012'
      bucketArn: arn:aws:iam::123456789012:role/example-role
      format: CSV
      prefix: example
    enabled: true
    id: example-id
    includedObjectVersions: All
    optionalFields:
    - example
    prefix: example
    scheduleFrequency: Daily
  lifecycleConfiguration:
    rules:
    - expirationInDays: 7
      objectSizeGreaterThan: example
      objectSizeLessThan: example
      prefix: example
      status: Enabled
  locationName: example-s3expressdirectorybucket
  metricsConfigurations:
  - accessPointArn: arn:aws:iam::123456789012:role/example-role
    id: example-id
    prefix: example
  providerRef:
    name: example-s3expressdirectorybucket
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`bucketEncryption`	object	—	S3ExpressDirectoryBucketBucketEncryption is a nested property type of AWS::S3Express::DirectoryBucket.
`bucketEncryption.serverSideEncryptionConfiguration`	array<object>	yes	Specifies the default server-side-encryption configuration.
`bucketEncryption.serverSideEncryptionConfiguration[].bucketKeyEnabled`	boolean	—	Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket.
`bucketEncryption.serverSideEncryptionConfiguration[].serverSideEncryptionByDefault`	object	—	S3ExpressDirectoryBucketServerSideEncryptionByDefault is a nested property type of AWS::S3Express::DirectoryBucket.
`bucketEncryption.serverSideEncryptionConfiguration[].serverSideEncryptionByDefault.kmsMasterKeyID`	object	—	AWS Key Management Service (KMS) customer managed key ID to use for the default encryption.
`bucketEncryption.serverSideEncryptionConfiguration[].serverSideEncryptionByDefault.sseAlgorithm`	string	yes
`bucketName`	string	—	Specifies a name for the bucket.
`dataRedundancy`	enum	yes	Specifies the number of Availability Zone or Local Zone that's used for redundancy for the bucket. Allowed: `SingleAvailabilityZone, SingleLocalZone`
`inventoryConfigurations`	array<object>	—	The inventory configuration for an Amazon S3 Express bucket.
`inventoryConfigurations[].destination`	object	yes	S3ExpressDirectoryBucketDestination is a nested property type of AWS::S3Express::DirectoryBucket.
`inventoryConfigurations[].destination.bucketAccountId`	string	—	The account ID that owns the destination S3 bucket.
`inventoryConfigurations[].destination.bucketArn`	string	yes	The Amazon Resource Name (ARN) of the destination Amazon S3 bucket to which data is exported.
`inventoryConfigurations[].destination.format`	enum	yes	Specifies the file format used when exporting data to Amazon S3. Allowed: `CSV, ORC, Parquet`
`inventoryConfigurations[].destination.prefix`	string	—	The prefix to use when exporting data.
`inventoryConfigurations[].enabled`	boolean	yes	Specifies whether the inventory is enabled or disabled.
`inventoryConfigurations[].id`	string	yes	The ID used to identify the inventory configuration.
`inventoryConfigurations[].includedObjectVersions`	enum	yes	Object versions to include in the inventory list. Allowed: `All, Current`
`inventoryConfigurations[].optionalFields`	array<string>	—	Contains the optional fields that are included in the inventory results.
`inventoryConfigurations[].prefix`	string	—	The prefix that is prepended to all inventory results.
`inventoryConfigurations[].scheduleFrequency`	enum	yes	Specifies the schedule for generating inventory results. Allowed: `Daily, Weekly`
`lifecycleConfiguration`	object	—	Lifecycle rules that define how Amazon S3 Express manages objects during their lifetime.
`lifecycleConfiguration.rules`	array<object>	yes	A lifecycle rule for individual objects in an Amazon S3 Express bucket.
`lifecycleConfiguration.rules[].abortIncompleteMultipartUpload`	object	—	S3ExpressDirectoryBucketAbortIncompleteMultipartUpload is a nested property type of AWS::S3Express::DirectoryBucket.
`lifecycleConfiguration.rules[].abortIncompleteMultipartUpload.daysAfterInitiation`	integer	yes	Specifies the number of days after which Amazon S3 aborts an incomplete multipart upload.
`lifecycleConfiguration.rules[].expirationInDays`	integer	—
`lifecycleConfiguration.rules[].id`	string	—
`lifecycleConfiguration.rules[].objectSizeGreaterThan`	string	—
`lifecycleConfiguration.rules[].objectSizeLessThan`	string	—
`lifecycleConfiguration.rules[].prefix`	string	—
`lifecycleConfiguration.rules[].status`	enum	yes	Allowed: `Enabled, Disabled`
`locationName`	string	yes	Specifies the Zone ID of the Availability Zone or Local Zone where the directory bucket will be created.
`metricsConfigurations`	array<object>	—	Specifies the metrics configurations for the Amazon S3 Express bucket.
`metricsConfigurations[].accessPointArn`	string	—	The access point ARN used when evaluating a metrics filter.
`metricsConfigurations[].id`	string	yes	The ID used to identify the metrics configuration.
`metricsConfigurations[].prefix`	string	—	The prefix used when evaluating a metrics filter.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Returns the Amazon Resource Name (ARN) of the specified bucket.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`availabilityZoneName`	string	—	Returns the code for the Availability Zone or Local Zone where the directory bucket was created.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.