Skip to main content

AMAZON S3 EXTENSIONS

Every Swamp extension that covers Amazon S3, as published in the registry. Install any of them with swamp extension pull.

Extensions

Extension Version License Contents
@swamp/s3-datastore 2026.10.13.1 - 1 datastores
@swamp/aws/s3 2026.10.13.1 - 10 behavior types
@swamp/s3-datastore-bootstrap 2026.10.13.1 - 1 behavior types, 1 workflows
@mgreten/aws/s3-site-deploy 2026.10.14.1 MIT 1 behavior types
@jentz/aws-s3-bucket-audit 2026.07.19.0 - 1 reports
@mgreten/s3-object-read 2026.10.14.1 MIT 1 behavior types
@mgreten/s3-backup-retention 2026.10.14.1 MIT 1 behavior types

@swamp/s3-datastore

swamp extension pull @swamp/s3-datastore

Datastore type @swamp/s3-datastore

Store data in an Amazon S3 bucket with local cache synchronization.

Name Type Required Description
bucket string yes S3 bucket name
prefix string no Key prefix within the bucket
region string no AWS region (defaults to environment/credentials)
endpoint string no Custom S3-compatible endpoint URL (e.g., https://nyc3.digitaloceanspaces.com)
forcePathStyle boolean no Use path-style addressing (bucket in path, not subdomain). Default: false
pullConcurrency number no Maximum concurrent S3 downloads during pull. Default: 50
pushConcurrency number no Maximum concurrent S3 uploads during push. Default: 25
requestTimeoutMs number no Per-request timeout in milliseconds. Default: 30000.

@swamp/aws/s3

swamp extension pull @swamp/aws/s3

Behavior type @swamp/aws/s3/access-grant

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AccessGrantsLocationId string yes The custom S3 location to be accessed by the grantee
Tags array of object {Key: string, Value: string} no -
Permission "READ" | "WRITE" | "READWRITE" yes The level of access to be afforded to the grantee
ApplicationArn string no The ARN of the application grantees will use to access the location
S3PrefixType "Object" no The type of S3SubPrefix.
Grantee object {GranteeType: "IAM" | "DIRECTORY_USER" | "DIRECTORY_GROUP", GranteeIdentifier: string} yes The principal who will be granted permission to access S3.
AccessGrantsLocationConfiguration object {S3SubPrefix: string} no The configuration options of the grant location, which is the S3 path to the data to which you are granting access.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 AccessGrant -
get Get a S3 AccessGrant identifier
update Update a S3 AccessGrant -
delete Delete a S3 AccessGrant identifier
sync Sync S3 AccessGrant state from AWS -
list List S3 AccessGrant resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 AccessGrant resource state

Behavior type @swamp/aws/s3/access-grants-instance

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
IdentityCenterArn string no The Amazon Resource Name (ARN) of the specified AWS Identity Center.
Tags array of object {Key: string, Value: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 AccessGrantsInstance -
get Get a S3 AccessGrantsInstance identifier
update Update a S3 AccessGrantsInstance -
delete Delete a S3 AccessGrantsInstance identifier
sync Sync S3 AccessGrantsInstance state from AWS -
list List S3 AccessGrantsInstance resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 AccessGrantsInstance resource state

Behavior type @swamp/aws/s3/access-grants-location

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
IamRoleArn string yes The Amazon Resource Name (ARN) of the access grant location's associated IAM role.
LocationScope string yes Descriptor for where the location actually points
Tags array of object {Key: string, Value: string} no -

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 AccessGrantsLocation -
get Get a S3 AccessGrantsLocation identifier
update Update a S3 AccessGrantsLocation -
delete Delete a S3 AccessGrantsLocation identifier
sync Sync S3 AccessGrantsLocation state from AWS -
list List S3 AccessGrantsLocation resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 AccessGrantsLocation resource state

Behavior type @swamp/aws/s3/access-point

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name string no The name you want to assign to this Access Point. If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the access point name.
Bucket string yes The name of the bucket that you want to associate this Access Point with.
BucketAccountId string no The AWS account ID associated with the S3 bucket associated with this access point.
VpcConfiguration object {VpcId?: string} no If you include this field, Amazon S3 restricts access to this Access Point to requests from the specified Virtual Private Cloud (VPC).
PublicAccessBlockConfiguration object {BlockPublicAcls?: boolean, IgnorePublicAcls?: boolean, BlockPublicPolicy?: boolean, RestrictPublicBuckets?: boolean} no The PublicAccessBlock configuration that you want to apply to this Access Point. You can enable the configuration options in any combination. For more information about when Amazon S3 considers a bucket or object public, see https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status 'The Meaning of Public' in the Amazon Simple Storage Service Developer Guide.
Policy object no The Access Point Policy you want to apply to this access point.
Tags array of object {Key: string, Value: string} no An arbitrary set of tags (key-value pairs) for this S3 Access Point.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 AccessPoint -
get Get a S3 AccessPoint identifier
update Update a S3 AccessPoint -
delete Delete a S3 AccessPoint identifier
sync Sync S3 AccessPoint state from AWS -
list List S3 AccessPoint resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 AccessPoint resource state

Behavior type @swamp/aws/s3/bucket

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
BucketNamespace "global" | "account-regional" no -
InventoryConfigurations array of object {Destination: object {BucketArn: string, Format: "CSV" | "ORC" | "Parquet", BucketAccountId?: string, Prefix?: string}, OptionalFields?: array of "Size" | "LastModifiedDate" | "StorageClass" | "ETag" | "IsMultipartUploaded" | "ReplicationStatus" | "EncryptionStatus" | "ObjectLockRetainUntilDate" | "ObjectLockMode" | "ObjectLockLegalHoldStatus" | "ObjectLockEventHoldStatus" | "ObjectLockEventHoldDuration" | "IntelligentTieringAccessTier" | "BucketKeyStatus" | "ChecksumAlgorithm" | "ObjectAccessControlList" | "ObjectOwner" | "LifecycleExpirationDate" | "IntelligentTieringReferenceDate", IncludedObjectVersions: "All" | "Current", Enabled: boolean, Id: string, Prefix?: string, ScheduleFrequency: "Daily" | "Weekly"} no Specifies the S3 Inventory configuration for an Amazon S3 bucket. For more information, see GET Bucket inventory in the Amazon S3 API Reference.
BucketNamePrefix string no -
WebsiteConfiguration object {IndexDocument?: string, RedirectAllRequestsTo?: object {Protocol?: "http" | "https", HostName: string}, RoutingRules?: array of object {RedirectRule: object, RoutingRuleCondition?: object}, ErrorDocument?: string} no Information used to configure the bucket as a static website. For more information, see Hosting Websites on Amazon S3.
AccessControl "AuthenticatedRead" | "AwsExecRead" | "BucketOwnerFullControl" | "BucketOwnerRead" | "LogDeliveryWrite" | "Private" | "PublicRead" | "PublicReadWrite" no This is a legacy property, and it is not recommended for most use cases. A majority of modern use cases in Amazon S3 no longer require the use of ACLs, and we recommend that you keep ACLs disabled. For more information, see Controlling object ownership in the Amazon S3 User Guide. A canned access control list (ACL) that grants predefined permissions to the bucket. For more information about canned ACLs, see Canned ACL in the Amazon S3 User Guide. S3 buckets are created with ACLs disabled by default. Therefore, unless you explicitly set the AWS::S3::OwnershipControls property to enable ACLs, your resource will fail to deploy with any value other than Private. Use cases requiring ACLs are uncommon. The majority of access control configurations can be successfully and more easily achieved with bucket policies. For more information, see AWS::S3::BucketPolicy. For examples of common policy configurations, including S3 Server Access Logs buckets and more, see Bucket policy examples in the Amazon S3 User Guide.
MetadataTableConfiguration object {S3TablesDestination: object {TableBucketArn: string}} no The metadata table configuration of an S3 general purpose bucket.
AnalyticsConfigurations array of object {StorageClassAnalysis: object {DataExport?: object}, TagFilters?: array of object, Id: string, Prefix?: string} no Specifies the configuration and any analyses for the analytics filter of an Amazon S3 bucket.
AbacStatus "Enabled" | "Disabled" no The ABAC status of the general purpose bucket. When ABAC is enabled for the general purpose bucket, you can use tags to manage access to the general purpose buckets as well as for cost tracking purposes. When ABAC is disabled for the general purpose buckets, you can only use tags for cost tracking purposes. For more information, see Using tags with S3 general purpose buckets.
AccelerateConfiguration object {AccelerationStatus: "Enabled" | "Suspended"} no Configures the transfer acceleration state for an Amazon S3 bucket. For more information, see Amazon S3 Transfer Acceleration in the Amazon S3 User Guide.
PublicAccessBlockConfiguration object {RestrictPublicBuckets?: boolean, BlockPublicPolicy?: boolean, BlockPublicAcls?: boolean, IgnorePublicAcls?: boolean} no Configuration that defines how Amazon S3 handles public access.
BucketName string no A name for the bucket. If you don't specify a name, AWS CloudFormation generates a unique ID and uses that ID for the bucket name. The bucket name must contain only lowercase letters, numbers, periods (.), and dashes (-) and must follow Amazon S3 bucket restrictions and limitations. For more information, see Rules for naming Amazon S3 buckets in the Amazon S3 User Guide. If you specify a name, you can't perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you need to replace the resource, specify a new name.
OwnershipControls object {Rules: array of object {ObjectOwnership?: "ObjectWriter" | "BucketOwnerPreferred" | "BucketOwnerEnforced"}} no Configuration that defines how Amazon S3 handles Object Ownership rules.
ObjectLockConfiguration object {ObjectLockEnabled?: string, Rule?: object {DefaultRetention?: object {Years?: integer, Days?: integer, Mode?: "COMPLIANCE" | "GOVERNANCE", DefaultEventHold?: object}}} no This operation is not supported for directory buckets. Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see Locking Objects. The DefaultRetention settings require both a mode and a period. The DefaultRetention period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time. You can enable Object Lock for new or existing buckets. For more information, see Configuring Object Lock. You must URL encode any signed header values that contain spaces. For example, if your header value is my file.txt, containing two spaces after my, you must URL encode this value to my%20%20file.txt.
ObjectLockEnabled boolean no Indicates whether this bucket has an Object Lock configuration enabled. Enable ObjectLockEnabled when you apply ObjectLockConfiguration to a bucket.
LoggingConfiguration object {TargetObjectKeyFormat?: object, LogFilePrefix?: string, DestinationBucketName?: string} no Settings that define where logs are stored.
MetadataConfiguration object {Destination?: object {TableBucketArn?: string, TableBucketType: "aws" | "customer"}, JournalTableConfiguration: object {EncryptionConfiguration?: object {KmsKeyArn?: string, SseAlgorithm: "aws:kms" | "AES256"}, RecordExpiration: object {Days?: integer, Expiration: "ENABLED" | "DISABLED"}}, InventoryTableConfiguration?: object {ConfigurationState: "ENABLED" | "DISABLED", EncryptionConfiguration?: object {KmsKeyArn?: string, SseAlgorithm: "aws:kms" | "AES256"}}, AnnotationTableConfiguration?: object {Role?: string, ConfigurationState: "ENABLED" | "DISABLED", EncryptionConfiguration?: object {KmsKeyArn?: string, SseAlgorithm: "aws:kms" | "AES256"}}} no The S3 Metadata configuration for a general purpose bucket.
ReplicationConfiguration object {Role: string, Rules: array of object {Status: "Disabled" | "Enabled", Destination: object, Filter?: object, Priority?: integer, SourceSelectionCriteria?: object, Id?: string, Prefix?: string, DeleteMarkerReplication?: object}} no Configuration for replicating objects in an S3 bucket. To enable replication, you must also enable versioning by using the VersioningConfiguration property. Amazon S3 can store replicated objects in a single destination bucket or multiple destination buckets. The destination bucket or buckets must already exist.
Tags array of object {Value: string, Key: string} no An arbitrary set of tags (key-value pairs) for this S3 bucket.
BucketEncryption object {ServerSideEncryptionConfiguration: array of object {BucketKeyEnabled?: boolean, BlockedEncryptionTypes?: object, ServerSideEncryptionByDefault?: object}} no Specifies default encryption for a bucket using server-side encryption with Amazon S3-managed keys (SSE-S3), AWS KMS-managed keys (SSE-KMS), or dual-layer server-side encryption with KMS-managed keys (DSSE-KMS). For information about the Amazon S3 default encryption feature, see Amazon S3 Default Encryption for S3 Buckets in the Amazon S3 User Guide.
NotificationConfiguration object {TopicConfigurations?: array of object {Filter?: object, Event: string, Topic: string}, QueueConfigurations?: array of object {Filter?: object, Event: string, Queue: string}, LambdaConfigurations?: array of object {Function: string, Filter?: object, Event: string}, EventBridgeConfiguration?: object {EventBridgeEnabled: boolean}} no Configuration that defines how Amazon S3 handles bucket notifications.
LifecycleConfiguration object {TransitionDefaultMinimumObjectSize?: "varies_by_storage_class" | "all_storage_classes_128K", Rules: array of object {Status: "Enabled" | "Disabled", ExpiredObjectDeleteMarker?: boolean, NoncurrentVersionExpirationInDays?: integer, Transitions?: array, ObjectSizeGreaterThan?: string, TagFilters?: array, NoncurrentVersionTransitions?: array, Prefix?: string, ObjectSizeLessThan?: string, NoncurrentVersionTransition?: object, ExpirationDate?: string, NoncurrentVersionExpiration?: object, ExpirationInDays?: integer, Transition?: object, Id?: string, AbortIncompleteMultipartUpload?: object}} no Specifies the lifecycle configuration for objects in an Amazon S3 bucket. For more information, see Object Lifecycle Management in the Amazon S3 User Guide.
VersioningConfiguration object {Status: "Enabled" | "Suspended"} no Enables multiple versions of all objects in this bucket. You might enable versioning to prevent objects from being deleted or overwritten by mistake or to archive objects so that you can retrieve previous versions of them. When you enable versioning on a bucket for the first time, it might take a short amount of time for the change to be fully propagated. We recommend that you wait for 15 minutes after enabling versioning before issuing write operations ( PUT or DELETE) on objects in the bucket.
MetricsConfigurations array of object {AccessPointArn?: string, TagFilters?: array of object, Id: string, Prefix?: string} no Specifies a metrics configuration for the CloudWatch request metrics (specified by the metrics configuration ID) from an Amazon S3 bucket. If you're updating an existing metrics configuration, note that this is a full replacement of the existing metrics configuration. If you don't include the elements you want to keep, they are erased. For more information, see PutBucketMetricsConfiguration.
IntelligentTieringConfigurations array of object {Status: "Disabled" | "Enabled", Tierings: array of object, TagFilters?: array of object, Id: string, Prefix?: string} no Defines how Amazon S3 handles Intelligent-Tiering storage.
CorsConfiguration object {CorsRules: array of object {ExposedHeaders?: array, AllowedMethods: array, AllowedOrigins: array, AllowedHeaders?: array, MaxAge?: integer, Id?: string}} no Describes the cross-origin access configuration for objects in an Amazon S3 bucket. For more information, see Enabling Cross-Origin Resource Sharing in the Amazon S3 User Guide.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 Bucket -
get Get a S3 Bucket identifier
update Update a S3 Bucket -
delete Delete a S3 Bucket identifier
sync Sync S3 Bucket state from AWS -
list List S3 Bucket resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 Bucket resource state

Behavior type @swamp/aws/s3/bucket-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Bucket string yes The name of the Amazon S3 bucket to which the policy applies.
PolicyDocument object yes A policy document containing permissions to add to the specified bucket. In IAM, you must provide policy documents in JSON format. However, in CloudFormation you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to IAM. For more information, see the AWS::IAM::Policy PolicyDocument resource description in this guide and Access Policy Language Overview in the Amazon S3 User Guide.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 BucketPolicy -
get Get a S3 BucketPolicy identifier
update Update a S3 BucketPolicy -
delete Delete a S3 BucketPolicy identifier
sync Sync S3 BucketPolicy state from AWS -
list List S3 BucketPolicy resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 BucketPolicy resource state

Behavior type @swamp/aws/s3/multi-region-access-point

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PublicAccessBlockConfiguration object {RestrictPublicBuckets?: boolean, BlockPublicPolicy?: boolean, BlockPublicAcls?: boolean, IgnorePublicAcls?: boolean} no The PublicAccessBlock configuration that you want to apply to this Multi Region Access Point. You can enable the configuration options in any combination. For more information about when Amazon S3 considers a bucket or object public, see https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html#access-control-block-public-access-policy-status 'The Meaning of Public' in the Amazon Simple Storage Service Developer Guide.
Regions array of object {Bucket: string, BucketAccountId?: string} yes The list of buckets that you want to associate this Multi Region Access Point with.
Name string no The name you want to assign to this Multi Region Access Point.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 MultiRegionAccessPoint -
get Get a S3 MultiRegionAccessPoint identifier
delete Delete a S3 MultiRegionAccessPoint identifier
sync Sync S3 MultiRegionAccessPoint state from AWS -
list List S3 MultiRegionAccessPoint resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 MultiRegionAccessPoint resource state

Behavior type @swamp/aws/s3/multi-region-access-point-policy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
MrapName string yes The name of the Multi Region Access Point to apply policy
Policy object yes Policy document to apply to a Multi Region Access Point

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 MultiRegionAccessPointPolicy -
get Get a S3 MultiRegionAccessPointPolicy identifier
update Update a S3 MultiRegionAccessPointPolicy -
delete Delete a S3 MultiRegionAccessPointPolicy identifier
sync Sync S3 MultiRegionAccessPointPolicy state from AWS -
list List S3 MultiRegionAccessPointPolicy resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 MultiRegionAccessPointPolicy resource state

Behavior type @swamp/aws/s3/storage-lens

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
StorageLensConfiguration object {AccountLevel: object {AdvancedDataProtectionMetrics?: object {IsEnabled?: boolean}, StorageLensGroupLevel?: object {StorageLensGroupSelectionCriteria?: object}, ActivityMetrics?: object {IsEnabled?: boolean}, AdvancedPerformanceMetrics?: object {IsEnabled?: boolean}, BucketLevel: object {AdvancedDataProtectionMetrics?: object, PrefixLevel?: object, ActivityMetrics?: object, AdvancedPerformanceMetrics?: object, AdvancedCostOptimizationMetrics?: object, DetailedStatusCodesMetrics?: object}, AdvancedCostOptimizationMetrics?: object {IsEnabled?: boolean}, DetailedStatusCodesMetrics?: object {IsEnabled?: boolean}}, Exclude?: object {Regions?: array of string, Buckets?: array of string}, IsEnabled: boolean, Include?: object {Regions?: array of string, Buckets?: array of string}, PrefixDelimiter?: string, AwsOrg?: object {Arn: string}, Id: string, DataExport?: object {StorageLensTableDe yes Specifies the details of Amazon S3 Storage Lens configuration.
Tags array of object {Value: string, Key: string} no A set of tags (key-value pairs) for this Amazon S3 Storage Lens configuration.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 StorageLens -
get Get a S3 StorageLens identifier
update Update a S3 StorageLens -
delete Delete a S3 StorageLens identifier
sync Sync S3 StorageLens state from AWS -
list List S3 StorageLens resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 StorageLens resource state

Behavior type @swamp/aws/s3/storage-lens-group

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey string no AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken string no AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region string no AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name string yes The name that identifies the Amazon S3 Storage Lens Group.
Filter object {MatchAnyPrefix?: array of string, MatchAnySuffix?: array of string, MatchAnyTag?: array of object {Key: string, Value: string}, MatchObjectSize?: object {BytesGreaterThan?: integer, BytesLessThan?: integer}, MatchObjectAge?: object {DaysGreaterThan?: integer, DaysLessThan?: integer}, And?: object {MatchAnyPrefix?: array of string, MatchAnySuffix?: array of string, MatchAnyTag?: array of object, MatchObjectSize?: object {BytesGreaterThan?: integer, BytesLessThan?: integer}, MatchObjectAge?: object {DaysGreaterThan?: integer, DaysLessThan?: integer}}, Or?: object {MatchAnyPrefix?: array of string, MatchAnySuffix?: array of string, MatchAnyTag?: array of object, MatchObjectSize?: object {BytesGreaterThan?: integer, BytesLessThan?: integer}, MatchObjectAge?: object {DaysGreaterThan?: integer, DaysLessThan?: integer}}} yes Sets the Storage Lens Group filter.
Tags array of object {Key: string, Value: string} no A set of tags (key-value pairs) for this Amazon S3 Storage Lens Group.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a S3 StorageLensGroup -
get Get a S3 StorageLensGroup identifier
update Update a S3 StorageLensGroup -
delete Delete a S3 StorageLensGroup identifier
sync Sync S3 StorageLensGroup state from AWS -
list List S3 StorageLensGroup resources maxPages (optional), resourceModel (optional)

Data written:

Resource Description
state S3 StorageLensGroup resource state

@swamp/s3-datastore-bootstrap

swamp extension pull @swamp/s3-datastore-bootstrap

Behavior type @swamp/s3-datastore-bootstrap/provisioner

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
bucket_name string yes S3 bucket name to create.
region string yes AWS region for the bucket (e.g. us-east-1).
prefix string no Optional key prefix within the bucket (surfaced in state for the setup step).
policy_name string no IAM managed policy name. Defaults to swamp-s3-datastore-<bucket_name>.

Methods, run with swamp behavior run:

Method Description Arguments
provision Create/verify the S3 bucket and the scoped IAM managed policy for @swamp/s3-datastore. -

Data written:

Resource Description
state S3 bucket + IAM managed policy provisioned for swamp.

Workflows in @swamp/s3-datastore-bootstrap

Workflow Description
@swamp/bootstrap-s3-datastore Provision an S3 bucket + least-privilege IAM managed policy for @swamp/s3-datastore, then switch the current repo to use S3.

@mgreten/aws/s3-site-deploy

swamp extension pull @mgreten/aws/s3-site-deploy

Behavior type @mgreten/aws/s3-site-deploy

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
bucket string yes S3 bucket name to deploy to
region string no AWS region for the S3 bucket
accessKeyId string no AWS access key ID — use a vault expression, e.g. ${{ vault.get(my-vault, AWS_ACCESS_KEY_ID) }}
secretAccessKey string no AWS secret access key — use a vault expression, e.g. ${{ vault.get(my-vault, AWS_SECRET_ACCESS_KEY) }}
skipPaths array of string no Additional top-level paths to exclude from deployment (e.g. ['CLAUDE.md', 'Makefile', 'docs']). Paths starting with '.' or '_' are always skipped.

Methods, run with swamp behavior run:

Method Description Arguments
deploy Upload changed/new site files to S3 and remove stale objects from the bucket -

Data written:

Resource Description
deployment Deployment result metadata

@jentz/aws-s3-bucket-audit

swamp extension pull @jentz/aws-s3-bucket-audit

Reports in @jentz/aws-s3-bucket-audit

Report Description
@jentz/aws-s3-bucket-audit Audit S3 buckets against standard security best practices (versioning, encryption, public-access block, ownership, TLS-only policy, lifecycle, logging) plus tag inventory. Operates on bucket state and bucket-policy data produced earlier in the workflow.

@mgreten/s3-object-read

swamp extension pull @mgreten/s3-object-read

Behavior type @mgreten/s3-object-read

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessKeyId string no -
secretAccessKey string no -
endpoint string yes -
region string no -
bucket string yes -
prefix string no -
forcePathStyle boolean no -
maximumListObjects integer no -
maximumObjectBytes integer no -

Methods, run with swamp behavior run:

Method Description Arguments
verifyReadAccess HEAD the bucket, list one prefix-scoped object, and range-read one byte when nonempty -
listObjects Persist a bounded, prefix-scoped listing of object metadata; never object contents maximum (optional)
downloadObject Download one explicitly named, prefix-scoped object as a bounded artifact; contents may be sensitive key

Data written:

Resource Description
verification Read-access verification metadata
objectListing Bounded object metadata listing; object names may be sensitive
downloadMetadata Downloaded object metadata; object names may be sensitive
object Bounded downloaded object; content may be sensitive

@mgreten/s3-backup-retention

swamp extension pull @mgreten/s3-backup-retention

Behavior type @mgreten/s3-backup-retention

Global arguments, set with --global-arg on swamp behavior create:

None.

Methods, run with swamp behavior run:

Method Description Arguments
verifyCredentialIsolation Verify operational credentials cannot list the other bucket -
verifyLifecycle Verify destination lifecycle with auditor-only credentials -
previewRetention Create or verify an immutable no-delete retention plan -
applyRetention Delete destination objects in one exactly confirmed immutable plan -

Data written:

Resource Description
retentionPlan Immutable deterministic retention preview
applyReceipt Digest-bound retention apply receipt
lifecycleVerification Provider lifecycle retention proof
credentialIsolationVerification Cross-bucket AccessDenied credential-isolation proof