feat(s3): attribute-based access control by badmintoncryer · Pull Request #36229 · aws/aws-cdk

badmintoncryer · 2025-11-27T15:10:21Z

Issue # (if applicable)

None

Reason for this change

AWS S3 general purpose bucket now supports for Attribute-based access control (ABAC).
https://docs.aws.amazon.com/ja_jp/AmazonS3/latest/userguide/buckets-tagging.html

Description of changes

add abacStatus to BucketProps

Describe any new or updated permissions being added

None

Description of how you validated changes

add both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

… buckets - Introduced `abacStatus` property to the S3 bucket construct to enable or disable ABAC. - Updated integration test to include `abacStatus` for both KMS-encrypted and S3-managed buckets. - Modified the snapshot to reflect changes in the bucket configuration. - Enhanced documentation to explain how to enable and disable ABAC for S3 buckets.

go-to-k · 2025-11-28T03:17:57Z

packages/aws-cdk-lib/aws-s3/test/bucket.test.ts

    });
  });

+  test.each([true, false])('bucket with ABAC status %s', (abacStatus) => {


Since the handling changes based on whether the value is undefined, it's a good idea to also check for undefined with Match.absent.

I've added it!

Could you combine them into one? Because they are tests for a single concern, it will be easier to grasp the test cases than separating them into individual tests.

test.each([ [true, 'Enabled'], [false, 'Disabled'], [undefined, Match.absent()], ])('bucket with ABAC status %s', (abacStatus, expected) => { const stack = new cdk.Stack(); new s3.Bucket(stack, 'MyBucket', { abacStatus, }); Template.fromStack(stack).hasResourceProperties('AWS::S3::Bucket', { AbacStatus: expected, }); });

badmintoncryer · 2025-11-28T03:45:26Z

@go-to-k Thank you for your review! I've addressed your comment.

packages/aws-cdk-lib/aws-s3/README.md

Co-authored-by: Kenta Goto <24818752+go-to-k@users.noreply.github.com>

badmintoncryer · 2025-11-28T12:02:31Z

@go-to-k I've updated!

go-to-k · 2025-11-28T12:16:09Z

@badmintoncryer

Did you forget to push your commit? :)

#36229 (comment)

badmintoncryer · 2025-11-28T14:13:35Z

@go-to-k I'm sorry for forgetting to push it.

go-to-k

Thanks for the changes.

github-actions · 2025-12-06T04:42:05Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	24 ran	24 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2025-12-06T04:42:06Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	24 ran	24 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

kumsmrit

Thank you for your contribution; I have added few minor comments.

packages/aws-cdk-lib/aws-s3/lib/bucket.ts

kumsmrit · 2026-02-23T11:27:14Z

packages/aws-cdk-lib/aws-s3/README.md

+## Attribute-Based Access Control (ABAC)
+
+You can enable ABAC (Attribute-Based Access Control) for an S3 general purpose bucket.
+When ABAC is enabled for the general purpose bucket, you can use tags to manage access to the general purpose buckets as well as for cost tracking purposes.


Can we also describe the disabled case for completeness?
"When ABAC is disabled for the general purpose buckets, you can only use tags for cost tracking purposes."

packages/aws-cdk-lib/aws-s3/lib/bucket.ts

Co-authored-by: kumsmrit <154323786+kumsmrit@users.noreply.github.com>

Pull request has been modified.

Co-authored-by: kumsmrit <154323786+kumsmrit@users.noreply.github.com>

badmintoncryer · 2026-02-23T15:43:26Z

@kumsmrit Thank you for your review!! I've addressed all of your comments.

kumsmrit

Thank you for addressing the comments.

mergify · 2026-02-23T17:34:52Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-02-23T17:35:03Z

mergify · 2026-02-23T18:05:06Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2026-02-23T18:05:47Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

badmintoncryer added 3 commits November 27, 2025 23:44

feat(s3): add ABAC status support to Bucket properties

84d1728

feat(s3): update ABAC documentation for general purpose buckets

48ec754

aws-cdk-automation requested a review from a team November 27, 2025 15:10

github-actions bot added p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Nov 27, 2025

aws-cdk-automation added pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Nov 27, 2025

go-to-k suggested changes Nov 28, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Nov 28, 2025

feat(s3): add test for bucket without ABAC status

d840993

go-to-k reviewed Nov 28, 2025

View reviewed changes

packages/aws-cdk-lib/aws-s3/README.md Outdated Show resolved Hide resolved

badmintoncryer and others added 2 commits November 28, 2025 21:00

Update packages/aws-cdk-lib/aws-s3/README.md

6e248f1

Co-authored-by: Kenta Goto <24818752+go-to-k@users.noreply.github.com>

feat(s3): enhance ABAC status tests to include undefined case

83a3ed3

Merge branch 'main' into s3-abac

32df704

go-to-k approved these changes Nov 28, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Nov 28, 2025

github-actions bot mentioned this pull request Dec 1, 2025

Monthly PR metrics report #36251

Open

badmintoncryer added 2 commits December 5, 2025 00:21

Merge branch 'main' into s3-abac

67abd34

Merge branch 'main' into s3-abac

b53444c

badmintoncryer added 3 commits December 22, 2025 07:28

Merge branch 'main' into s3-abac

5bf976c

Merge branch 'main' into s3-abac

2684855

Merge branch 'main' into s3-abac

45696ab

kumsmrit previously requested changes Feb 23, 2026

View reviewed changes

kumsmrit self-assigned this Feb 23, 2026

Update bucket.ts

495074e

Co-authored-by: kumsmrit <154323786+kumsmrit@users.noreply.github.com>

Update bucket.ts

f6c4a1e

Co-authored-by: kumsmrit <154323786+kumsmrit@users.noreply.github.com>

aws-cdk-automation removed the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Feb 23, 2026

badmintoncryer added 2 commits February 24, 2026 00:42

docs: update README and bucket.ts to clarify ABAC usage for S3 buckets

7ffe259

Merge branch 'main' into s3-abac

69b0fbb

kumsmrit approved these changes Feb 23, 2026

View reviewed changes

Merge branch 'main' into s3-abac

16a768c

mergify bot merged commit 9ec4db3 into aws:main Feb 23, 2026
22 of 23 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Feb 23, 2026

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Feb 23, 2026

Conversation

badmintoncryer commented Nov 27, 2025

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

go-to-k Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

go-to-k Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer commented Nov 28, 2025

Uh oh!

Uh oh!

badmintoncryer commented Nov 28, 2025

Uh oh!

go-to-k commented Nov 28, 2025

Uh oh!

badmintoncryer commented Nov 28, 2025

Uh oh!

go-to-k left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kumsmrit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kumsmrit Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

badmintoncryer commented Feb 23, 2026

Uh oh!

kumsmrit left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Feb 23, 2026

Uh oh!

mergify bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

mergify bot commented Feb 23, 2026

Uh oh!

Uh oh!

github-actions bot commented Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Dec 6, 2025 •

edited

Loading

github-actions bot commented Dec 6, 2025 •

edited

Loading

mergify bot commented Feb 23, 2026 •

edited

Loading