(aws-s3): Cannot create account regional bucket with specified bucketName
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
To create a bucket in the account regional namespace, the L2 Bucket Construct requires specifying `bucketNamePrefix` + `bucketNamespace`. And, under normal circumstances, this is definitely the most convenient option. But CloudFormation does support `bucketName` + `bucketNamespace` (with the bucket name happening to end in the `-account-region-an` suffix). And I believe there are some circumstances where it would be desirable to allow this in the L2 construct.
In particular: when creating an Asset bucket for use with ServiceCatalog, the `bucketName` is required to be a synth-time literal, not a token. And therefore in this instance we cannot use `bucketNameprefix`, because it would make the `bucketName` a token.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
N/A - integration gap, not a regression
### Expected Behavior
CDK allows bucket creation with specified `bucketName` / `bucketNamespace`.
### Current Behavior
If you attempt to create a Bucket with a specified `bucketName` in the account regional namespace, then one of two things will happen:
1. If the `bucketNamespace` parameter is missing, you get a CloudFormation error:
```
Resource handler returned message: "The requested bucket is an account-regional namespace bucket, but your request is missing the required x-amz-bucket-namespace header.
```
2. If you do specify `bucketNamespace=ACCOUNT_REGIONAL`, then you get a CDK error.
### Reproduction Steps
```
asset_bucket = s3.Bucket(
self,
"AssetBucket",
bucket_name=f"my-sc-assets-{self.account}-{self.region}-an",
)
```
### Possible Solution
I believe this issue can be resolved entirely by adjusting the CDK-side validation logic. `bucketNamespace` is permissible with specified `bucketName`:
1. If the `bucketName` is a resolved string, we can compare the suffix directly.
2. If the `bucketName` is unresolved, then we would have to wait for CloudFormation to catch the error.
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.257.0
### AWS CDK CLI version
2.257.0
### Node.js Version
v24.16.0
### OS
Fedora 43
### Language
Python
### Language Version
Python 3.11.15
### Other information
Related:
- https://github.com/aws/aws-cdk/pull/37386 (L2 bucketNamePrefix / bucketNamespace)
- https://github.com/aws/aws-cdk-rfcs/issues/458 (ProductStack asset support)
- https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_servicecatalog/README.html#using-assets-in-your-product-stack
Contributor guide
Research direction
Start at the aws_s3.Bucket construct and its CDK-side validation logic, using the Python reproduction as the entry point. Done means a literal bucketName with the ACCOUNT_REGIONAL namespace is accepted while invalid suffixes and missing namespaces retain their current error behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python, typescript
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100