aws.s3.BucketServerSideEncryptionConfigurationV2
Explore with Pulumi AI
Provides a S3 bucket server-side encryption configuration resource.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var mykey = new Aws.Kms.Key("mykey", new()
{
Description = "This key is used to encrypt bucket objects",
DeletionWindowInDays = 10,
});
var mybucket = new Aws.S3.BucketV2("mybucket");
var example = new Aws.S3.BucketServerSideEncryptionConfigurationV2("example", new()
{
Bucket = mybucket.Id,
Rules = new[]
{
new Aws.S3.Inputs.BucketServerSideEncryptionConfigurationV2RuleArgs
{
ApplyServerSideEncryptionByDefault = new Aws.S3.Inputs.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs
{
KmsMasterKeyId = mykey.Arn,
SseAlgorithm = "aws:kms",
},
},
},
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/kms"
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/s3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
mykey, err := kms.NewKey(ctx, "mykey", &kms.KeyArgs{
Description: pulumi.String("This key is used to encrypt bucket objects"),
DeletionWindowInDays: pulumi.Int(10),
})
if err != nil {
return err
}
mybucket, err := s3.NewBucketV2(ctx, "mybucket", nil)
if err != nil {
return err
}
_, err = s3.NewBucketServerSideEncryptionConfigurationV2(ctx, "example", &s3.BucketServerSideEncryptionConfigurationV2Args{
Bucket: mybucket.ID(),
Rules: s3.BucketServerSideEncryptionConfigurationV2RuleArray{
&s3.BucketServerSideEncryptionConfigurationV2RuleArgs{
ApplyServerSideEncryptionByDefault: &s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs{
KmsMasterKeyId: mykey.Arn,
SseAlgorithm: pulumi.String("aws:kms"),
},
},
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.kms.Key;
import com.pulumi.aws.kms.KeyArgs;
import com.pulumi.aws.s3.BucketV2;
import com.pulumi.aws.s3.BucketServerSideEncryptionConfigurationV2;
import com.pulumi.aws.s3.BucketServerSideEncryptionConfigurationV2Args;
import com.pulumi.aws.s3.inputs.BucketServerSideEncryptionConfigurationV2RuleArgs;
import com.pulumi.aws.s3.inputs.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var mykey = new Key("mykey", KeyArgs.builder()
.description("This key is used to encrypt bucket objects")
.deletionWindowInDays(10)
.build());
var mybucket = new BucketV2("mybucket");
var example = new BucketServerSideEncryptionConfigurationV2("example", BucketServerSideEncryptionConfigurationV2Args.builder()
.bucket(mybucket.id())
.rules(BucketServerSideEncryptionConfigurationV2RuleArgs.builder()
.applyServerSideEncryptionByDefault(BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs.builder()
.kmsMasterKeyId(mykey.arn())
.sseAlgorithm("aws:kms")
.build())
.build())
.build());
}
}
import pulumi
import pulumi_aws as aws
mykey = aws.kms.Key("mykey",
description="This key is used to encrypt bucket objects",
deletion_window_in_days=10)
mybucket = aws.s3.BucketV2("mybucket")
example = aws.s3.BucketServerSideEncryptionConfigurationV2("example",
bucket=mybucket.id,
rules=[aws.s3.BucketServerSideEncryptionConfigurationV2RuleArgs(
apply_server_side_encryption_by_default=aws.s3.BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs(
kms_master_key_id=mykey.arn,
sse_algorithm="aws:kms",
),
)])
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const mykey = new aws.kms.Key("mykey", {
description: "This key is used to encrypt bucket objects",
deletionWindowInDays: 10,
});
const mybucket = new aws.s3.BucketV2("mybucket", {});
const example = new aws.s3.BucketServerSideEncryptionConfigurationV2("example", {
bucket: mybucket.id,
rules: [{
applyServerSideEncryptionByDefault: {
kmsMasterKeyId: mykey.arn,
sseAlgorithm: "aws:kms",
},
}],
});
resources:
mykey:
type: aws:kms:Key
properties:
description: This key is used to encrypt bucket objects
deletionWindowInDays: 10
mybucket:
type: aws:s3:BucketV2
example:
type: aws:s3:BucketServerSideEncryptionConfigurationV2
properties:
bucket: ${mybucket.id}
rules:
- applyServerSideEncryptionByDefault:
kmsMasterKeyId: ${mykey.arn}
sseAlgorithm: aws:kms
Create BucketServerSideEncryptionConfigurationV2 Resource
new BucketServerSideEncryptionConfigurationV2(name: string, args: BucketServerSideEncryptionConfigurationV2Args, opts?: CustomResourceOptions);
@overload
def BucketServerSideEncryptionConfigurationV2(resource_name: str,
opts: Optional[ResourceOptions] = None,
bucket: Optional[str] = None,
expected_bucket_owner: Optional[str] = None,
rules: Optional[Sequence[BucketServerSideEncryptionConfigurationV2RuleArgs]] = None)
@overload
def BucketServerSideEncryptionConfigurationV2(resource_name: str,
args: BucketServerSideEncryptionConfigurationV2Args,
opts: Optional[ResourceOptions] = None)
func NewBucketServerSideEncryptionConfigurationV2(ctx *Context, name string, args BucketServerSideEncryptionConfigurationV2Args, opts ...ResourceOption) (*BucketServerSideEncryptionConfigurationV2, error)
public BucketServerSideEncryptionConfigurationV2(string name, BucketServerSideEncryptionConfigurationV2Args args, CustomResourceOptions? opts = null)
public BucketServerSideEncryptionConfigurationV2(String name, BucketServerSideEncryptionConfigurationV2Args args)
public BucketServerSideEncryptionConfigurationV2(String name, BucketServerSideEncryptionConfigurationV2Args args, CustomResourceOptions options)
type: aws:s3:BucketServerSideEncryptionConfigurationV2
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args BucketServerSideEncryptionConfigurationV2Args
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args BucketServerSideEncryptionConfigurationV2Args
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args BucketServerSideEncryptionConfigurationV2Args
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args BucketServerSideEncryptionConfigurationV2Args
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args BucketServerSideEncryptionConfigurationV2Args
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
BucketServerSideEncryptionConfigurationV2 Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The BucketServerSideEncryptionConfigurationV2 resource accepts the following input properties:
- Bucket string
ID (name) of the bucket.
- Rules
List<Bucket
Server Side Encryption Configuration V2Rule Args> Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- Expected
Bucket stringOwner Account ID of the expected bucket owner.
- Bucket string
ID (name) of the bucket.
- Rules
[]Bucket
Server Side Encryption Configuration V2Rule Args Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- Expected
Bucket stringOwner Account ID of the expected bucket owner.
- bucket String
ID (name) of the bucket.
- rules
List<Bucket
Server Side Encryption Configuration V2Rule Args> Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- expected
Bucket StringOwner Account ID of the expected bucket owner.
- bucket string
ID (name) of the bucket.
- rules
Bucket
Server Side Encryption Configuration V2Rule Args[] Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- expected
Bucket stringOwner Account ID of the expected bucket owner.
- bucket str
ID (name) of the bucket.
- rules
Sequence[Bucket
Server Side Encryption Configuration V2Rule Args] Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- expected_
bucket_ strowner Account ID of the expected bucket owner.
- bucket String
ID (name) of the bucket.
- rules List<Property Map>
Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- expected
Bucket StringOwner Account ID of the expected bucket owner.
Outputs
All input properties are implicitly available as output properties. Additionally, the BucketServerSideEncryptionConfigurationV2 resource produces the following output properties:
- Id string
The provider-assigned unique ID for this managed resource.
- Id string
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
- id string
The provider-assigned unique ID for this managed resource.
- id str
The provider-assigned unique ID for this managed resource.
- id String
The provider-assigned unique ID for this managed resource.
Look up Existing BucketServerSideEncryptionConfigurationV2 Resource
Get an existing BucketServerSideEncryptionConfigurationV2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: BucketServerSideEncryptionConfigurationV2State, opts?: CustomResourceOptions): BucketServerSideEncryptionConfigurationV2
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
bucket: Optional[str] = None,
expected_bucket_owner: Optional[str] = None,
rules: Optional[Sequence[BucketServerSideEncryptionConfigurationV2RuleArgs]] = None) -> BucketServerSideEncryptionConfigurationV2
func GetBucketServerSideEncryptionConfigurationV2(ctx *Context, name string, id IDInput, state *BucketServerSideEncryptionConfigurationV2State, opts ...ResourceOption) (*BucketServerSideEncryptionConfigurationV2, error)
public static BucketServerSideEncryptionConfigurationV2 Get(string name, Input<string> id, BucketServerSideEncryptionConfigurationV2State? state, CustomResourceOptions? opts = null)
public static BucketServerSideEncryptionConfigurationV2 get(String name, Output<String> id, BucketServerSideEncryptionConfigurationV2State state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Bucket string
ID (name) of the bucket.
- Expected
Bucket stringOwner Account ID of the expected bucket owner.
- Rules
List<Bucket
Server Side Encryption Configuration V2Rule Args> Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- Bucket string
ID (name) of the bucket.
- Expected
Bucket stringOwner Account ID of the expected bucket owner.
- Rules
[]Bucket
Server Side Encryption Configuration V2Rule Args Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- bucket String
ID (name) of the bucket.
- expected
Bucket StringOwner Account ID of the expected bucket owner.
- rules
List<Bucket
Server Side Encryption Configuration V2Rule Args> Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- bucket string
ID (name) of the bucket.
- expected
Bucket stringOwner Account ID of the expected bucket owner.
- rules
Bucket
Server Side Encryption Configuration V2Rule Args[] Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- bucket str
ID (name) of the bucket.
- expected_
bucket_ strowner Account ID of the expected bucket owner.
- rules
Sequence[Bucket
Server Side Encryption Configuration V2Rule Args] Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
- bucket String
ID (name) of the bucket.
- expected
Bucket StringOwner Account ID of the expected bucket owner.
- rules List<Property Map>
Set of server-side encryption configuration rules. See below. Currently, only a single rule is supported.
Supporting Types
BucketServerSideEncryptionConfigurationV2Rule
- Apply
Server BucketSide Encryption By Default Server Side Encryption Configuration V2Rule Apply Server Side Encryption By Default Single object for setting server-side encryption by default. See below.
- Bucket
Key boolEnabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
- Apply
Server BucketSide Encryption By Default Server Side Encryption Configuration V2Rule Apply Server Side Encryption By Default Single object for setting server-side encryption by default. See below.
- Bucket
Key boolEnabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
- apply
Server BucketSide Encryption By Default Server Side Encryption Configuration V2Rule Apply Server Side Encryption By Default Single object for setting server-side encryption by default. See below.
- bucket
Key BooleanEnabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
- apply
Server BucketSide Encryption By Default Server Side Encryption Configuration V2Rule Apply Server Side Encryption By Default Single object for setting server-side encryption by default. See below.
- bucket
Key booleanEnabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
- apply_
server_ Bucketside_ encryption_ by_ default Server Side Encryption Configuration V2Rule Apply Server Side Encryption By Default Single object for setting server-side encryption by default. See below.
- bucket_
key_ boolenabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
- apply
Server Property MapSide Encryption By Default Single object for setting server-side encryption by default. See below.
- bucket
Key BooleanEnabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS.
BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefault
- Sse
Algorithm string Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- Kms
Master stringKey Id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
- Sse
Algorithm string Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- Kms
Master stringKey Id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
- sse
Algorithm String Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- kms
Master StringKey Id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
- sse
Algorithm string Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- kms
Master stringKey Id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
- sse_
algorithm str Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- kms_
master_ strkey_ id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
- sse
Algorithm String Server-side encryption algorithm to use. Valid values are
AES256
andaws:kms
- kms
Master StringKey Id AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of
sse_algorithm
asaws:kms
. The defaultaws/s3
AWS KMS master key is used if this element is absent while thesse_algorithm
isaws:kms
.
Import
S3 bucket server-side encryption configuration can be imported in one of two ways. If the owner (account ID) of the source bucket is the same account used to configure the AWS Provider, the S3 server-side encryption configuration resource should be imported using the bucket
e.g.,
$ pulumi import aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2 example bucket-name
If the owner (account ID) of the source bucket differs from the account used to configure the AWS Provider, the S3 bucket server-side encryption configuration resource should be imported using the bucket
and expected_bucket_owner
separated by a comma (,
) e.g.,
$ pulumi import aws:s3/bucketServerSideEncryptionConfigurationV2:BucketServerSideEncryptionConfigurationV2 example bucket-name,123456789012
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
aws
Terraform Provider.