Skip to content

Commit f60d13b

Browse files
authored
docs(s3): updated docstring for BucketPolicy() (#31395)
### Issue #[31358](#31358) Closes #31358 . ### Reason for this change Exsiting [CDK Doc on BucketPolicy](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketPolicy.html) mentions as `Prefer to use` which is misleading as it does not clearly states the reprecussions. ### Description of changes I have added a sample of what would happen if this is used along with other Bucket properties. ### Description of how you validated changes This is a minor documentation change ### Checklist - [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 33eea3f commit f60d13b

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

packages/aws-cdk-lib/aws-s3/lib/bucket-policy.ts

+14-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,20 @@ export interface BucketPolicyProps {
3131
* policy if one doesn't exist yet, otherwise it will add to the existing
3232
* policy.
3333
*
34-
* Prefer to use `addToResourcePolicy()` instead.
34+
* The bucket policy method is implemented differently than `addToResourcePolicy()`
35+
* as `BucketPolicy()` creates a new policy without knowing one earlier existed.
36+
* e.g. if during Bucket creation, if `autoDeleteObject:true`, these policies are
37+
* added to the bucket policy:
38+
* ["s3:DeleteObject*", "s3:GetBucket*", "s3:List*", "s3:PutBucketPolicy"],
39+
* and when you add a new BucketPolicy with ["s3:GetObject", "s3:ListBucket"] on
40+
* this existing bucket, invoking `BucketPolicy()` will create a new Policy
41+
* without knowing one earlier exists already, so it creates a new one.
42+
* In this case, the custom resource handler will not have access to
43+
* `s3:GetBucketTagging` action which will cause failure during deletion of stack.
44+
*
45+
* Hence its strongly recommended to use `addToResourcePolicy()` method to add
46+
* new permissions to existing policy.
47+
*
3548
*/
3649
export class BucketPolicy extends Resource {
3750
/**

0 commit comments

Comments
 (0)