s3-presigned-urls-cdk-client

CDK Infrastructure

// cdk/lib/constructs/s3-uploads.ts

import { Construct } from "constructs";
import { RemovalPolicy, Duration } from "aws-cdk-lib";
import {
  Bucket,
  BucketEncryption,
  BlockPublicAccess,
  ObjectOwnership,
  HttpMethods,
  CorsRule,
} from "aws-cdk-lib/aws-s3";
import { Function } from "aws-cdk-lib/aws-lambda";
import { S3EventSource } from "aws-cdk-lib/aws-lambda-event-sources";
import { EventType } from "aws-cdk-lib/aws-s3";

export interface S3UploadsBucketProps {
  allowedOrigins: string[];
  validationFunction: Function;
}

export class S3UploadsBucket extends Construct {
  public readonly uploadsBucket: Bucket;
  public readonly quarantineBucket: Bucket;

  constructor(scope: Construct, id: string, props: S3UploadsBucketProps) {
    super(scope, id);

    // Quarantine bucket for failed validations
    this.quarantineBucket = new Bucket(this, "QuarantineBucket", {
      bucketName: "real-estate-quarantine",
      encryption: BucketEncryption.S3_MANAGED,
      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
      removalPolicy: RemovalPolicy.RETAIN,
      lifecycleRules: [
        {
          id: "DeleteAfter30Days",
          expiration: Duration.days(30),
        },
      ],
    });

    // Main uploads bucket
    this.uploadsBucket = new Bucket(this, "UploadsBucket", {
      bucketName: "real-estate-uploads",
      encryption: BucketEncryption.S3_MANAGED,
      blockPublicAccess: BlockPublicAccess.BLOCK_ALL,
      objectOwnership: ObjectOwnership.BUCKET_OWNER_ENFORCED,
      removalPolicy: RemovalPolicy.RETAIN,
      versioned: true,

      // CORS for presigned URL uploads from browser
      cors: [
        {
          allowedOrigins: props.allowedOrigins,
          allowedMethods: [HttpMethods.PUT, HttpMethods.POST, HttpMethods.GET],
          allowedHeaders: ["*"],
          exposedHeaders: ["ETag"],
          maxAge: 3600,
        },
      ],

      // Lifecycle rules
      lifecycleRules: [
        {
          id: "DeleteIncompleteMultipartUploads",
          abortIncompleteMultipartUploadAfter: Duration.days(1),
        },
        {
          id: "MoveToInfrequentAccess",
          transitions: [
            {
              storageClass: StorageClass.INFREQUENT_ACCESS,
              transitionAfter: Duration.days(90),
            },
          ],
        },
      ],
    });

    // Grant quarantine bucket access to validation function
    this.quarantineBucket.grantPut(props.validationFunction);
    this.uploadsBucket.grantReadWrite(props.validationFunction);
    this.uploadsBucket.grantDelete(props.validationFunction);

    // Trigger validation on upload
    props.validationFunction.addEventSource(
      new S3EventSource(this.uploadsBucket, {
        events: [EventType.OBJECT_CREATED],
      })
    );
  }
}