aws / aws/aws-cdk

(aws-s3): Cannot create account regional bucket with specified bucketName

Open
#38,095 2 comments 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-s3 bug effort/medium p1
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

To create a bucket in the account regional namespace, the L2 Bucket Construct requires specifying `bucketNamePrefix` + `bucketNamespace`. And, under normal circumstances, this is definitely the most convenient option. But CloudFormation does support `bucketName` + `bucketNamespace` (with the bucket name happening to end in the `-account-region-an` suffix). And I believe there are some circumstances where it would be desirable to allow this in the L2 construct.

In particular: when creating an Asset bucket for use with ServiceCatalog, the `bucketName` is required to be a synth-time literal, not a token. And therefore in this instance we cannot use `bucketNameprefix`, because it would make the `bucketName` a token.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

N/A - integration gap, not a regression

### Expected Behavior

CDK allows bucket creation with specified `bucketName` / `bucketNamespace`.

### Current Behavior

If you attempt to create a Bucket with a specified `bucketName` in the account regional namespace, then one of two things will happen:

1. If the `bucketNamespace` parameter is missing, you get a CloudFormation error:
```
Resource handler returned message: "The requested bucket is an account-regional namespace bucket, but your request is missing the required x-amz-bucket-namespace header.
```
2. If you do specify `bucketNamespace=ACCOUNT_REGIONAL`, then you get a CDK error.

### Reproduction Steps

```
asset_bucket = s3.Bucket(
self,
"AssetBucket",
bucket_name=f"my-sc-assets-{self.account}-{self.region}-an",
)
```

### Possible Solution

I believe this issue can be resolved entirely by adjusting the CDK-side validation logic. `bucketNamespace` is permissible with specified `bucketName`:

1. If the `bucketName` is a resolved string, we can compare the suffix directly.
2. If the `bucketName` is unresolved, then we would have to wait for CloudFormation to catch the error.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.257.0

### AWS CDK CLI version

2.257.0

### Node.js Version

v24.16.0

### OS

Fedora 43

### Language

Python

### Language Version

Python 3.11.15

### Other information

Related:
- https://github.com/aws/aws-cdk/pull/37386 (L2 bucketNamePrefix / bucketNamespace)
- https://github.com/aws/aws-cdk-rfcs/issues/458 (ProductStack asset support)
- https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_servicecatalog/README.html#using-assets-in-your-product-stack

Contributor guide

Open the contributing guide

Research direction

Start at the aws_s3.Bucket construct and its CDK-side validation logic, using the Python reproduction as the entry point. Done means a literal bucketName with the ACCOUNT_REGIONAL namespace is accepted while invalid suffixes and missing namespaces retain their current error behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, typescript
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.