AMAZON S3 WITH SWAMP

S3 resources as behaviors

The @swamp/aws/s3 extension provides one behavior type for each kind of S3 resource. A behavior of type @swamp/aws/s3/bucket describes a single bucket. Its versioning, encryption, public access block, lifecycle rules and other settings are global arguments in the behavior definition. The other types cover bucket policies, access points, Multi-Region Access Points and their policies, S3 Access Grants instances, locations and grants, and Storage Lens configurations and groups.

Every type has create, get, delete, sync and list methods, and all except @swamp/aws/s3/multi-region-access-point also have update. Each method writes the resource state it reads or changes into the repository's data. A later method, workflow step or report can read that state. The getting started tutorial defines a versioned private bucket and creates it. Enforce TLS-only access with an S3 bucket policy attaches a policy to a bucket that already exists.

The @jentz/aws-s3-bucket-audit report reads the bucket and bucket-policy state that these behaviors write. It checks the state against rules for versioning, encryption, public access, object ownership, TLS-only policies, lifecycle and logging.

Task-focused extensions

Some extensions are built around one task rather than one resource:

• @mgreten/aws/s3-site-deploy uploads new and changed site files to a bucket, using MD5 hashes to find the changes, and removes stale objects. See Deploy a static site to an S3 bucket.
• @mgreten/s3-object-read verifies read access, then lists or downloads objects from S3-compatible storage within a prefix and with size limits.
• @mgreten/s3-backup-retention creates a backup retention plan that deletes nothing, then applies only a plan that has been confirmed exactly.

S3 as the Swamp datastore

The @swamp/s3-datastore extension stores a repository's data in an S3 bucket and keeps a local cache in sync with it. It uses S3 conditional writes as a distributed lock, so several machines and repositories can share one datastore. It also works with S3-compatible endpoints. @swamp/s3-datastore-bootstrap creates the bucket and a least-privilege IAM managed policy for it, as described in Provision an S3 bucket for the Swamp datastore.

Understanding Amazon S3 automation in Swamp covers how these pieces relate and how to choose between them. The extensions reference lists every type, global argument and method.