'''
# AccessLogsBucket

Amazon S3 Bucket configured for S3 access logs storage.

## Overview

`AccessLogsBucket` construct is an Amazon S3 Bucket configured with best practices and smart defaults for storing S3 access logs:

* The default bucket name is in the form of `accesslogs-<CDK_ID>-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUEID>`
* The bucket encryption is S3 Managed.
* Public access is blocked.
* Two-step protection for bucket and objects deletion.
* SSL communication is enforced.

`AccessLogsBucket` extends the Amazon [S3 `Bucket`](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_s3/Bucket.html#bucket) CDK Construct. For custom requirements that are not covered, use the `Bucket` construct directly.

## Usage

```python
class ExampleDefaultAccessLogsBucketStack(cdk.Stack):
    def __init__(self, scope, id):
        super().__init__(scope, id)
        dsf.storage.AccessLogsBucket(self, "AccessLogsBucket")
```

## Bucket Naming

The construct ensures the default bucket name uniqueness which is a [pre-requisite](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html) to create Amazon S3 buckets.
To achieve this, the construct is creating the default bucket name like `accesslogs-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUEID>` where:

* `<AWS_ACCOUNT_ID>` and `<AWS_REGION>` are the account ID and region where you deploy the construct.
* `<UNIQUEID>` is an 8 characters unique ID calculated based on the CDK path.

If you provide the `bucketName` parameter, you need to ensure the name is globaly unique.
Alternatively, you can use the `BucketUtils.generateUniqueBucketName()` utility method to create unique names.
This method generates a unique name based on the provided name, the construct ID and the CDK scope:

* The bucket name is suffixed the AWS account ID, the AWS region and an 8 character hash of the CDK path.
* The maximum length for the bucket name is 26 characters.

```python
dsf.storage.AccessLogsBucket(self, "MyAccessLogs",
    bucket_name=dsf.utils.BucketUtils.generate_unique_bucket_name(self, "MyAccessLogs", "my-custom-name")
)
```

# AnalyticsBucket

Amazon S3 Bucket configured for analytics.

## Overview

`AnalyticsBucket` is an Amazon S3 Bucket configured with the following best-practices and defaults for analytics:

* The bucket name is in the form of `<BUCKET_NAME>-<CDK_ID>-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUEID>`
* Server side bucket encryption managed by KMS customer key. You need to provide a [KMS Key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)
* SSL communication enforcement.
* Access logged to an S3 bucket within a prefix matching the bucket name. By default, store logs in itself.
* All public access blocked.
* Two-step protection for bucket and objects deletion.

`AnalyticsBucket` extends the Amazon [S3 `Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) CDK Construct. For custom requirements that are not covered, use the [`Bucket`](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_s3/Bucket.html#bucket) construct directly.

## Usage

```python
class ExampleDefaultAnalyticsBucketStack(cdk.Stack):
    def __init__(self, scope, id):
        super().__init__(scope, id)
        key = Key(self, "DataKey",
            enable_key_rotation=True
        )

        dsf.storage.AnalyticsBucket(self, "AnalyticsBucket",
            encryption_key=key
        )
```

## Objects removal

You can specify if the bucket and objects should be deleted when the CDK resource is destroyed using `removalPolicy`. Refer to the [DataLakeStorage documentation](https://awslabs.github.io/data-solutions-framework-on-aws/docs/constructs/library/Storage/data-lake-storage#objects-removal)

:::warning
If no access logs bucket is configure, the `AnalyticsBucket` stores its access logs in itself.
This prevents from properly deleting the resources when the `removalPolicy` is set to `DESTROY` because it creates an edge case where the deletion of the S3 Objects recreates Objects corresponding the access logs. The S3 Bucket is then never empty and the deletion of the Bucket fails.
:::

## Bucket Naming

The construct ensures the default bucket name uniqueness which is a [pre-requisite](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html) to create Amazon S3 buckets.
To achieve this, the construct is creating the default bucket name like `accesslogs-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUEID>` where:

* `<AWS_ACCOUNT_ID>` and `<AWS_REGION>` are the account ID and region where you deploy the construct.
* `<UNIQUEID>` is an 8 characters unique ID calculated based on the CDK path.

If you provide the `bucketName` parameter, you need to ensure the name is globaly unique.
Alternatively, you can use the `BucketUtils.generateUniqueBucketName()` utility method to create unique names.
This method generates a unique name based on the provided name, the construct ID and the CDK scope:

* The bucket name is suffixed the AWS account ID, the AWS region and an 8 character hash of the CDK path.
* The maximum length for the bucket name is 26 characters.

```python
dsf.storage.AnalyticsBucket(self, "AnalyticsBucket",
    bucket_name=dsf.utils.BucketUtils.generate_unique_bucket_name(self, "AnalyticsBucket", "my-custom-name"),
    encryption_key=key
)
```

# DataLakeStorage

Data Lake based on medallion architecture and AWS best-practices.

## Overview

At the high level, `DataLakeStorage` creates three [Amazon S3](https://aws.amazon.com/s3) buckets configured specifically for data lake on AWS. By default these buckets are named *Bronze*, *Silver*, and *Gold* to represent [different data layers](https://docs.aws.amazon.com/prescriptive-guidance/latest/defining-bucket-names-data-lakes/data-layer-definitions.html). You can customize bucket names according to your needs.
`DataLakeStorage` uses [`AnalyticsBucket`](analytics-bucket) and [`AccessLogsBucket`](access-logs-bucket) constructs from DSF on AWS, to create storage and access logs buckets respectively. Your data lake storage is encrypted using [AWS KMS](https://aws.amazon.com/kms/) a default customer managed key. You can also provide your own KMS Key. We provide data lifecycle management that you can customize to your needs.

Here is the overview of `DataLakeStorage` features:

* Medalion design with S3 buckets for Bronze, Silver, and Gold data.
* Server-side encryption using a single KMS customer key for all S3 buckets.
* Enforced SSL in-transit encryption.
* Logs data lake access in a dedicated bucket within a prefix matching the bucket name.
* Buckets, objects and encryption keys can be retained when the CDK resource is destroyed (default).
* All public access blocked.

![Data lake storage](../../../website/static/img/adsf-data-lake-storage.png)

## Usage

```python
class ExampleDefaultDataLakeStorageStack(cdk.Stack):
    def __init__(self, scope, id):
        super().__init__(scope, id)
        dsf.storage.DataLakeStorage(self, "MyDataLakeStorage")
```

## Bucket naming

The construct ensures the default bucket names uniqueness which is a [pre-requisite](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html) to create Amazon S3 buckets.
To achieve this, the construct is creating the default bucket names like `<LAYER>-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUEID>` where:

* `<LAYER>` is the layer in the medallion architecture (bronze, silver or gold).
* `<AWS_ACCOUNT_ID>` and `<AWS_REGION>` are the account ID and region where you deploy the construct.
* `<UNIQUEID>` is an 8 characters unique ID calculated based on the CDK path.

If you provide the `bucketName` parameter, you need to ensure the name is globaly unique.
Alternatively, you can use the `BucketUtils.generateUniqueBucketName()` utility method to create unique names.
This method generates a unique name based on the provided name, the construct ID and the CDK scope:

* The bucket name is suffixed the AWS account ID, the AWS region and an 8 character hash of the CDK path.
* The maximum length for the bucket name is 26 characters.

```python
dsf.storage.DataLakeStorage(self, "MyDataLakeStorage",
    bronze_bucket_name=dsf.utils.BucketUtils.generate_unique_bucket_name(self, "MyDataLakeStorage", "custom-bronze-name")
)
```

## Objects removal

You can specify if buckets, objects and encryption keys should be deleted when the CDK resource is destroyed using `removalPolicy`. To have an additional layer of protection, we require users to set a global context value for data removal in their CDK applications.

Buckets, objects and encryption keys can be destroyed when the CDK resource is destroyed only if **both** data lake removal policy and DSF on AWS global removal policy are set to remove objects.

You can set `@data-solutions-framework-on-aws/removeDataOnDestroy` (`true` or `false`) global data removal policy in `cdk.json`:

```json title="cdk.json"
{
  "context": {
    "@data-solutions-framework-on-aws/removeDataOnDestroy": true
  }
}
```

Or programmatically in your CDK app:

```python
# Set context value for global data removal policy
self.node.set_context("@data-solutions-framework-on-aws/removeDataOnDestroy", True)

dsf.storage.DataLakeStorage(self, "DataLakeStorage",
    removal_policy=RemovalPolicy.DESTROY
)
```

## Data lifecycle management

We provide a simple [data lifecycle management](https://aws.amazon.com/s3/storage-classes/) for data lake storage, that you can customize to your needs. By default:

* Bronze data is moved to Infrequent Access after 30 days and archived to Glacier after 90 days.
* Silver and Gold data is moved to Infrequent Access after 90 days and is not archived.

Change the data lifecycle rules using the DataLakeStorage properties:

```python
dsf.storage.DataLakeStorage(self, "MyDataLakeStorage",
    bronze_bucket_infrequent_access_delay=90,
    bronze_bucket_archive_delay=180,
    silver_bucket_infrequent_access_delay=180,
    silver_bucket_archive_delay=360,
    gold_bucket_infrequent_access_delay=180,
    gold_bucket_archive_delay=360
)
```
'''
import abc
import builtins
import datetime
import enum
import typing

import jsii
import publication
import typing_extensions

from typeguard import check_type

from .._jsii import *

import aws_cdk as _aws_cdk_ceddda9d
import aws_cdk.aws_iam as _aws_cdk_aws_iam_ceddda9d
import aws_cdk.aws_kms as _aws_cdk_aws_kms_ceddda9d
import aws_cdk.aws_s3 as _aws_cdk_aws_s3_ceddda9d
import constructs as _constructs_77d1e7e8


class AccessLogsBucket(
    _aws_cdk_aws_s3_ceddda9d.Bucket,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-dsf.storage.AccessLogsBucket",
):
    '''Amazon S3 Bucket configured with best-practices and smart defaults for storing S3 access logs.

    Default bucket name is ``accesslogs-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUE_ID>``

    :see: https://awslabs.github.io/data-solutions-framework-on-aws/docs/constructs/library/Storage/access-logs-bucket

    Example::

        bucket = dsf.storage.AccessLogsBucket(self, "AccessLogsBucket")
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
        auto_delete_objects: typing.Optional[builtins.bool] = None,
        block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
        bucket_key_enabled: typing.Optional[builtins.bool] = None,
        bucket_name: typing.Optional[builtins.str] = None,
        cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        encryption: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketEncryption] = None,
        encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
        enforce_ssl: typing.Optional[builtins.bool] = None,
        event_bridge_enabled: typing.Optional[builtins.bool] = None,
        intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
        inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
        lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
        minimum_tls_version: typing.Optional[jsii.Number] = None,
        notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
        object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
        object_lock_enabled: typing.Optional[builtins.bool] = None,
        object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
        public_read_access: typing.Optional[builtins.bool] = None,
        removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
        server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
        server_access_logs_prefix: typing.Optional[builtins.str] = None,
        transfer_acceleration: typing.Optional[builtins.bool] = None,
        versioned: typing.Optional[builtins.bool] = None,
        website_error_document: typing.Optional[builtins.str] = None,
        website_index_document: typing.Optional[builtins.str] = None,
        website_redirect: typing.Optional[typing.Union[_aws_cdk_aws_s3_ceddda9d.RedirectTarget, typing.Dict[builtins.str, typing.Any]]] = None,
        website_routing_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.RoutingRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param access_control: Specifies a canned ACL that grants predefined permissions to the bucket. Default: BucketAccessControl.PRIVATE
        :param auto_delete_objects: Whether all objects should be automatically deleted when the bucket is removed from the stack or when the stack is deleted. Requires the ``removalPolicy`` to be set to ``RemovalPolicy.DESTROY``. **Warning** if you have deployed a bucket with ``autoDeleteObjects: true``, switching this to ``false`` in a CDK version *before* ``1.126.0`` will lead to all objects in the bucket being deleted. Be sure to update your bucket resources by deploying with CDK version ``1.126.0`` or later **before** switching this value to ``false``. Default: false
        :param block_public_access: The block public access configuration of this bucket. Default: - CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
        :param bucket_key_enabled: Whether Amazon S3 should use its own intermediary key to generate data keys. Only relevant when using KMS for encryption. - If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that). - If enabled, S3 will use its own time-limited key instead. Only relevant, when Encryption is set to ``BucketEncryption.KMS`` or ``BucketEncryption.KMS_MANAGED``. Default: - false
        :param bucket_name: Physical name of this bucket. Default: - Assigned by CloudFormation (recommended).
        :param cors: The CORS configuration of this bucket. Default: - No CORS configuration.
        :param encryption: The kind of server-side encryption to apply to this bucket. If you choose KMS, you can specify a KMS key via ``encryptionKey``. If encryption key is not specified, a key will automatically be created. Default: - ``KMS`` if ``encryptionKey`` is specified, or ``UNENCRYPTED`` otherwise. But if ``UNENCRYPTED`` is specified, the bucket will be encrypted as ``S3_MANAGED`` automatically.
        :param encryption_key: External KMS key to use for bucket encryption. The ``encryption`` property must be either not specified or set to ``KMS`` or ``DSSE``. An error will be emitted if ``encryption`` is set to ``UNENCRYPTED`` or ``S3_MANAGED``. Default: - If ``encryption`` is set to ``KMS`` and this property is undefined, a new KMS key will be created and associated with this bucket.
        :param enforce_ssl: Enforces SSL for requests. S3.5 of the AWS Foundational Security Best Practices Regarding S3. Default: false
        :param event_bridge_enabled: Whether this bucket should send notifications to Amazon EventBridge or not. Default: false
        :param intelligent_tiering_configurations: Inteligent Tiering Configurations. Default: No Intelligent Tiiering Configurations.
        :param inventories: The inventory configuration of the bucket. Default: - No inventory configuration
        :param lifecycle_rules: Rules that define how Amazon S3 manages objects during their lifetime. Default: - No lifecycle rules.
        :param metrics: The metrics configuration of this bucket. Default: - No metrics configuration.
        :param minimum_tls_version: Enforces minimum TLS version for requests. Requires ``enforceSSL`` to be enabled. Default: No minimum TLS version is enforced.
        :param notifications_handler_role: The role to be used by the notifications handler. Default: - a new role will be created.
        :param object_lock_default_retention: The default retention mode and rules for S3 Object Lock. Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported. Default: no default retention period
        :param object_lock_enabled: Enable object lock on the bucket. Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created. Default: false, unless objectLockDefaultRetention is set (then, true)
        :param object_ownership: The objectOwnership of the bucket. Default: - No ObjectOwnership configuration, uploading account will own the object.
        :param public_read_access: Grants public read access to all objects in the bucket. Similar to calling ``bucket.grantPublicAccess()`` Default: false
        :param removal_policy: Policy to apply when the bucket is removed from this stack. Default: - The bucket will be orphaned.
        :param server_access_logs_bucket: Destination bucket for the server access logs. Default: - If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
        :param server_access_logs_prefix: Optional log file prefix to use for the bucket's access logs. If defined without "serverAccessLogsBucket", enables access logs to current bucket with this prefix. Default: - No log file prefix
        :param transfer_acceleration: Whether this bucket should have transfer acceleration turned on or not. Default: false
        :param versioned: Whether this bucket should have versioning turned on or not. Default: false (unless object lock is enabled, then true)
        :param website_error_document: The name of the error document (e.g. "404.html") for the website. ``websiteIndexDocument`` must also be set if this is set. Default: - No error document.
        :param website_index_document: The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket. Default: - No index document.
        :param website_redirect: Specifies the redirect behavior of all requests to a website endpoint of a bucket. If you specify this property, you can't specify "websiteIndexDocument", "websiteErrorDocument" nor , "websiteRoutingRules". Default: - No redirection.
        :param website_routing_rules: Rules that define when a redirect is applied and the redirect behavior. Default: - No redirection rules.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da555e2c64ed475228e7d75a5dea9fad7a83230cde354814fa26bdc1657a3003)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = _aws_cdk_aws_s3_ceddda9d.BucketProps(
            access_control=access_control,
            auto_delete_objects=auto_delete_objects,
            block_public_access=block_public_access,
            bucket_key_enabled=bucket_key_enabled,
            bucket_name=bucket_name,
            cors=cors,
            encryption=encryption,
            encryption_key=encryption_key,
            enforce_ssl=enforce_ssl,
            event_bridge_enabled=event_bridge_enabled,
            intelligent_tiering_configurations=intelligent_tiering_configurations,
            inventories=inventories,
            lifecycle_rules=lifecycle_rules,
            metrics=metrics,
            minimum_tls_version=minimum_tls_version,
            notifications_handler_role=notifications_handler_role,
            object_lock_default_retention=object_lock_default_retention,
            object_lock_enabled=object_lock_enabled,
            object_ownership=object_ownership,
            public_read_access=public_read_access,
            removal_policy=removal_policy,
            server_access_logs_bucket=server_access_logs_bucket,
            server_access_logs_prefix=server_access_logs_prefix,
            transfer_acceleration=transfer_acceleration,
            versioned=versioned,
            website_error_document=website_error_document,
            website_index_document=website_index_document,
            website_redirect=website_redirect,
            website_routing_rules=website_routing_rules,
        )

        jsii.create(self.__class__, self, [scope, id, props])


class AnalyticsBucket(
    _aws_cdk_aws_s3_ceddda9d.Bucket,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-dsf.storage.AnalyticsBucket",
):
    '''Amazon S3 Bucket configured with best-practices and defaults for analytics.

    The default bucket name is ``analytics-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUE_ID>``

    :see: https://awslabs.github.io/data-solutions-framework-on-aws/docs/constructs/library/Storage/analytics-bucket

    Example::

        from aws_cdk.aws_kms import Key
        
        
        # Set context value for global data removal policy (or set in cdk.json).
        self.node.set_context("@data-solutions-framework-on-aws/removeDataOnDestroy", True)
        
        encryption_key = Key(self, "DataKey",
            removal_policy=cdk.RemovalPolicy.DESTROY,
            enable_key_rotation=True
        )
        
        dsf.storage.AnalyticsBucket(self, "MyAnalyticsBucket",
            encryption_key=encryption_key,
            removal_policy=cdk.RemovalPolicy.DESTROY
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        encryption_key: _aws_cdk_aws_kms_ceddda9d.IKey,
        access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
        auto_delete_objects: typing.Optional[builtins.bool] = None,
        block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
        bucket_key_enabled: typing.Optional[builtins.bool] = None,
        bucket_name: typing.Optional[builtins.str] = None,
        cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        enforce_ssl: typing.Optional[builtins.bool] = None,
        event_bridge_enabled: typing.Optional[builtins.bool] = None,
        intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
        inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
        lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
        notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
        object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
        object_lock_enabled: typing.Optional[builtins.bool] = None,
        object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
        public_read_access: typing.Optional[builtins.bool] = None,
        removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
        server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
        server_access_logs_prefix: typing.Optional[builtins.str] = None,
        transfer_acceleration: typing.Optional[builtins.bool] = None,
        versioned: typing.Optional[builtins.bool] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param encryption_key: External KMS Key to use for the S3 Bucket encryption. The ``encryption`` property must be either not specified or set to ``KMS`` or ``DSSE``. An error will be emitted if ``encryption`` is set to ``UNENCRYPTED`` or ``S3_MANAGED``. Default: - If ``encryption`` is set to ``KMS`` and this property is undefined, a new KMS key will be created and associated with this bucket.
        :param access_control: Specifies a canned ACL that grants predefined permissions to the bucket. Default: - BucketAccessControl.PRIVATE
        :param auto_delete_objects: Whether all objects should be automatically deleted when the S3 Bucket is removed from the stack or when the stack is deleted. Requires the ``removalPolicy`` to be set to ``RemovalPolicy.DESTROY``. Default: - False
        :param block_public_access: The block public access configuration of this bucket. Default: - CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
        :param bucket_key_enabled: Whether Amazon S3 should use its own intermediary key to generate data keys. Only relevant when using KMS for encryption. - If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that). - If enabled, S3 will use its own time-limited key instead. Only relevant, when Encryption is set to ``BucketEncryption.KMS`` or ``BucketEncryption.KMS_MANAGED``. Default: - False
        :param bucket_name: The physical name of this S3 Bucket. Default: - ``analytics-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUE_ID>``
        :param cors: The CORS configuration of this bucket. Default: - No CORS configuration.
        :param enforce_ssl: Enforces SSL for requests. S3.5 of the AWS Foundational Security Best Practices Regarding S3. Default: - False
        :param event_bridge_enabled: Whether this S3 Bucket should send notifications to Amazon EventBridge or not. Default: - False
        :param intelligent_tiering_configurations: Intelligent Tiering Configurations. Default: - No Intelligent Tiiering Configurations.
        :param inventories: The inventory configuration of the S3 Bucket. Default: - No inventory configuration
        :param lifecycle_rules: Rules that define how Amazon S3 manages objects during their lifetime. Default: - No lifecycle rules.
        :param metrics: The metrics configuration of this bucket. Default: - No metrics configuration.
        :param notifications_handler_role: The IAM Role to be used by the notifications handler. Default: - A new IAM Role will be created.
        :param object_lock_default_retention: The default retention mode and rules for S3 Object Lock. Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported. Default: - No default retention period
        :param object_lock_enabled: Enable object lock on the S3 Bucket. Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created. Default: - False, unless objectLockDefaultRetention is set (then, true)
        :param object_ownership: The objectOwnership of the S3 Bucket. Default: - No ObjectOwnership configuration, uploading account will own the object.
        :param public_read_access: Grants public read access to all objects in the S3 Bucket. Similar to calling ``bucket.grantPublicAccess()`` Default: - False
        :param removal_policy: The removal policy when deleting the CDK resource. If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true. Otherwise the removalPolicy is reverted to RETAIN. Default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        :param server_access_logs_bucket: S3 Bucket destination for the server access logs. Default: - If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
        :param server_access_logs_prefix: Optional log file prefix to use for the S3 Bucket's access logs. If defined without "serverAccessLogsBucket", enables access logs to current S3 Bucket with this prefix. Default: - No log file prefix
        :param transfer_acceleration: Whether this S3 Bucket should have transfer acceleration turned on or not. Default: - False
        :param versioned: Whether this S3 Bucket should have versioning turned on or not. Default: - False (unless object lock is enabled, then true)
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce37a4192de383edd1b255b7d9368f635675060d8a81f40c2659ba13d2fc4b30)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = AnalyticsBucketProps(
            encryption_key=encryption_key,
            access_control=access_control,
            auto_delete_objects=auto_delete_objects,
            block_public_access=block_public_access,
            bucket_key_enabled=bucket_key_enabled,
            bucket_name=bucket_name,
            cors=cors,
            enforce_ssl=enforce_ssl,
            event_bridge_enabled=event_bridge_enabled,
            intelligent_tiering_configurations=intelligent_tiering_configurations,
            inventories=inventories,
            lifecycle_rules=lifecycle_rules,
            metrics=metrics,
            notifications_handler_role=notifications_handler_role,
            object_lock_default_retention=object_lock_default_retention,
            object_lock_enabled=object_lock_enabled,
            object_ownership=object_ownership,
            public_read_access=public_read_access,
            removal_policy=removal_policy,
            server_access_logs_bucket=server_access_logs_bucket,
            server_access_logs_prefix=server_access_logs_prefix,
            transfer_acceleration=transfer_acceleration,
            versioned=versioned,
        )

        jsii.create(self.__class__, self, [scope, id, props])


@jsii.data_type(
    jsii_type="aws-dsf.storage.AnalyticsBucketProps",
    jsii_struct_bases=[],
    name_mapping={
        "encryption_key": "encryptionKey",
        "access_control": "accessControl",
        "auto_delete_objects": "autoDeleteObjects",
        "block_public_access": "blockPublicAccess",
        "bucket_key_enabled": "bucketKeyEnabled",
        "bucket_name": "bucketName",
        "cors": "cors",
        "enforce_ssl": "enforceSSL",
        "event_bridge_enabled": "eventBridgeEnabled",
        "intelligent_tiering_configurations": "intelligentTieringConfigurations",
        "inventories": "inventories",
        "lifecycle_rules": "lifecycleRules",
        "metrics": "metrics",
        "notifications_handler_role": "notificationsHandlerRole",
        "object_lock_default_retention": "objectLockDefaultRetention",
        "object_lock_enabled": "objectLockEnabled",
        "object_ownership": "objectOwnership",
        "public_read_access": "publicReadAccess",
        "removal_policy": "removalPolicy",
        "server_access_logs_bucket": "serverAccessLogsBucket",
        "server_access_logs_prefix": "serverAccessLogsPrefix",
        "transfer_acceleration": "transferAcceleration",
        "versioned": "versioned",
    },
)
class AnalyticsBucketProps:
    def __init__(
        self,
        *,
        encryption_key: _aws_cdk_aws_kms_ceddda9d.IKey,
        access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
        auto_delete_objects: typing.Optional[builtins.bool] = None,
        block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
        bucket_key_enabled: typing.Optional[builtins.bool] = None,
        bucket_name: typing.Optional[builtins.str] = None,
        cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        enforce_ssl: typing.Optional[builtins.bool] = None,
        event_bridge_enabled: typing.Optional[builtins.bool] = None,
        intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
        inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
        lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
        metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
        notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
        object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
        object_lock_enabled: typing.Optional[builtins.bool] = None,
        object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
        public_read_access: typing.Optional[builtins.bool] = None,
        removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
        server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
        server_access_logs_prefix: typing.Optional[builtins.str] = None,
        transfer_acceleration: typing.Optional[builtins.bool] = None,
        versioned: typing.Optional[builtins.bool] = None,
    ) -> None:
        '''Properties for the ``AnalyticsBucket`` construct.

        :param encryption_key: External KMS Key to use for the S3 Bucket encryption. The ``encryption`` property must be either not specified or set to ``KMS`` or ``DSSE``. An error will be emitted if ``encryption`` is set to ``UNENCRYPTED`` or ``S3_MANAGED``. Default: - If ``encryption`` is set to ``KMS`` and this property is undefined, a new KMS key will be created and associated with this bucket.
        :param access_control: Specifies a canned ACL that grants predefined permissions to the bucket. Default: - BucketAccessControl.PRIVATE
        :param auto_delete_objects: Whether all objects should be automatically deleted when the S3 Bucket is removed from the stack or when the stack is deleted. Requires the ``removalPolicy`` to be set to ``RemovalPolicy.DESTROY``. Default: - False
        :param block_public_access: The block public access configuration of this bucket. Default: - CloudFormation defaults will apply. New buckets and objects don't allow public access, but users can modify bucket policies or object permissions to allow public access
        :param bucket_key_enabled: Whether Amazon S3 should use its own intermediary key to generate data keys. Only relevant when using KMS for encryption. - If not enabled, every object GET and PUT will cause an API call to KMS (with the attendant cost implications of that). - If enabled, S3 will use its own time-limited key instead. Only relevant, when Encryption is set to ``BucketEncryption.KMS`` or ``BucketEncryption.KMS_MANAGED``. Default: - False
        :param bucket_name: The physical name of this S3 Bucket. Default: - ``analytics-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUE_ID>``
        :param cors: The CORS configuration of this bucket. Default: - No CORS configuration.
        :param enforce_ssl: Enforces SSL for requests. S3.5 of the AWS Foundational Security Best Practices Regarding S3. Default: - False
        :param event_bridge_enabled: Whether this S3 Bucket should send notifications to Amazon EventBridge or not. Default: - False
        :param intelligent_tiering_configurations: Intelligent Tiering Configurations. Default: - No Intelligent Tiiering Configurations.
        :param inventories: The inventory configuration of the S3 Bucket. Default: - No inventory configuration
        :param lifecycle_rules: Rules that define how Amazon S3 manages objects during their lifetime. Default: - No lifecycle rules.
        :param metrics: The metrics configuration of this bucket. Default: - No metrics configuration.
        :param notifications_handler_role: The IAM Role to be used by the notifications handler. Default: - A new IAM Role will be created.
        :param object_lock_default_retention: The default retention mode and rules for S3 Object Lock. Default retention can be configured after a bucket is created if the bucket already has object lock enabled. Enabling object lock for existing buckets is not supported. Default: - No default retention period
        :param object_lock_enabled: Enable object lock on the S3 Bucket. Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created. Default: - False, unless objectLockDefaultRetention is set (then, true)
        :param object_ownership: The objectOwnership of the S3 Bucket. Default: - No ObjectOwnership configuration, uploading account will own the object.
        :param public_read_access: Grants public read access to all objects in the S3 Bucket. Similar to calling ``bucket.grantPublicAccess()`` Default: - False
        :param removal_policy: The removal policy when deleting the CDK resource. If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true. Otherwise the removalPolicy is reverted to RETAIN. Default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        :param server_access_logs_bucket: S3 Bucket destination for the server access logs. Default: - If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
        :param server_access_logs_prefix: Optional log file prefix to use for the S3 Bucket's access logs. If defined without "serverAccessLogsBucket", enables access logs to current S3 Bucket with this prefix. Default: - No log file prefix
        :param transfer_acceleration: Whether this S3 Bucket should have transfer acceleration turned on or not. Default: - False
        :param versioned: Whether this S3 Bucket should have versioning turned on or not. Default: - False (unless object lock is enabled, then true)
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9e767bf9f848c363915ff8506179c6a3ef90c760716e38bfb8fa1e85a748923)
            check_type(argname="argument encryption_key", value=encryption_key, expected_type=type_hints["encryption_key"])
            check_type(argname="argument access_control", value=access_control, expected_type=type_hints["access_control"])
            check_type(argname="argument auto_delete_objects", value=auto_delete_objects, expected_type=type_hints["auto_delete_objects"])
            check_type(argname="argument block_public_access", value=block_public_access, expected_type=type_hints["block_public_access"])
            check_type(argname="argument bucket_key_enabled", value=bucket_key_enabled, expected_type=type_hints["bucket_key_enabled"])
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument cors", value=cors, expected_type=type_hints["cors"])
            check_type(argname="argument enforce_ssl", value=enforce_ssl, expected_type=type_hints["enforce_ssl"])
            check_type(argname="argument event_bridge_enabled", value=event_bridge_enabled, expected_type=type_hints["event_bridge_enabled"])
            check_type(argname="argument intelligent_tiering_configurations", value=intelligent_tiering_configurations, expected_type=type_hints["intelligent_tiering_configurations"])
            check_type(argname="argument inventories", value=inventories, expected_type=type_hints["inventories"])
            check_type(argname="argument lifecycle_rules", value=lifecycle_rules, expected_type=type_hints["lifecycle_rules"])
            check_type(argname="argument metrics", value=metrics, expected_type=type_hints["metrics"])
            check_type(argname="argument notifications_handler_role", value=notifications_handler_role, expected_type=type_hints["notifications_handler_role"])
            check_type(argname="argument object_lock_default_retention", value=object_lock_default_retention, expected_type=type_hints["object_lock_default_retention"])
            check_type(argname="argument object_lock_enabled", value=object_lock_enabled, expected_type=type_hints["object_lock_enabled"])
            check_type(argname="argument object_ownership", value=object_ownership, expected_type=type_hints["object_ownership"])
            check_type(argname="argument public_read_access", value=public_read_access, expected_type=type_hints["public_read_access"])
            check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
            check_type(argname="argument server_access_logs_bucket", value=server_access_logs_bucket, expected_type=type_hints["server_access_logs_bucket"])
            check_type(argname="argument server_access_logs_prefix", value=server_access_logs_prefix, expected_type=type_hints["server_access_logs_prefix"])
            check_type(argname="argument transfer_acceleration", value=transfer_acceleration, expected_type=type_hints["transfer_acceleration"])
            check_type(argname="argument versioned", value=versioned, expected_type=type_hints["versioned"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "encryption_key": encryption_key,
        }
        if access_control is not None:
            self._values["access_control"] = access_control
        if auto_delete_objects is not None:
            self._values["auto_delete_objects"] = auto_delete_objects
        if block_public_access is not None:
            self._values["block_public_access"] = block_public_access
        if bucket_key_enabled is not None:
            self._values["bucket_key_enabled"] = bucket_key_enabled
        if bucket_name is not None:
            self._values["bucket_name"] = bucket_name
        if cors is not None:
            self._values["cors"] = cors
        if enforce_ssl is not None:
            self._values["enforce_ssl"] = enforce_ssl
        if event_bridge_enabled is not None:
            self._values["event_bridge_enabled"] = event_bridge_enabled
        if intelligent_tiering_configurations is not None:
            self._values["intelligent_tiering_configurations"] = intelligent_tiering_configurations
        if inventories is not None:
            self._values["inventories"] = inventories
        if lifecycle_rules is not None:
            self._values["lifecycle_rules"] = lifecycle_rules
        if metrics is not None:
            self._values["metrics"] = metrics
        if notifications_handler_role is not None:
            self._values["notifications_handler_role"] = notifications_handler_role
        if object_lock_default_retention is not None:
            self._values["object_lock_default_retention"] = object_lock_default_retention
        if object_lock_enabled is not None:
            self._values["object_lock_enabled"] = object_lock_enabled
        if object_ownership is not None:
            self._values["object_ownership"] = object_ownership
        if public_read_access is not None:
            self._values["public_read_access"] = public_read_access
        if removal_policy is not None:
            self._values["removal_policy"] = removal_policy
        if server_access_logs_bucket is not None:
            self._values["server_access_logs_bucket"] = server_access_logs_bucket
        if server_access_logs_prefix is not None:
            self._values["server_access_logs_prefix"] = server_access_logs_prefix
        if transfer_acceleration is not None:
            self._values["transfer_acceleration"] = transfer_acceleration
        if versioned is not None:
            self._values["versioned"] = versioned

    @builtins.property
    def encryption_key(self) -> _aws_cdk_aws_kms_ceddda9d.IKey:
        '''External KMS Key to use for the S3 Bucket encryption.

        The ``encryption`` property must be either not specified or set to ``KMS`` or ``DSSE``.
        An error will be emitted if ``encryption`` is set to ``UNENCRYPTED`` or ``S3_MANAGED``.

        :default:

        - If ``encryption`` is set to ``KMS`` and this property is undefined,
        a new KMS key will be created and associated with this bucket.
        '''
        result = self._values.get("encryption_key")
        assert result is not None, "Required property 'encryption_key' is missing"
        return typing.cast(_aws_cdk_aws_kms_ceddda9d.IKey, result)

    @builtins.property
    def access_control(
        self,
    ) -> typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl]:
        '''Specifies a canned ACL that grants predefined permissions to the bucket.

        :default: - BucketAccessControl.PRIVATE
        '''
        result = self._values.get("access_control")
        return typing.cast(typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl], result)

    @builtins.property
    def auto_delete_objects(self) -> typing.Optional[builtins.bool]:
        '''Whether all objects should be automatically deleted when the S3 Bucket is removed from the stack or when the stack is deleted.

        Requires the ``removalPolicy`` to be set to ``RemovalPolicy.DESTROY``.

        :default: - False
        '''
        result = self._values.get("auto_delete_objects")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def block_public_access(
        self,
    ) -> typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess]:
        '''The block public access configuration of this bucket.

        :default:

        - CloudFormation defaults will apply. New buckets and objects don't allow public access,
        but users can modify bucket policies or object permissions to allow public access
        '''
        result = self._values.get("block_public_access")
        return typing.cast(typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess], result)

    @builtins.property
    def bucket_key_enabled(self) -> typing.Optional[builtins.bool]:
        '''Whether Amazon S3 should use its own intermediary key to generate data keys. Only relevant when using KMS for encryption.

        - If not enabled, every object GET and PUT will cause an API call to KMS (with the
          attendant cost implications of that).
        - If enabled, S3 will use its own time-limited key instead.

        Only relevant, when Encryption is set to ``BucketEncryption.KMS`` or ``BucketEncryption.KMS_MANAGED``.

        :default: - False
        '''
        result = self._values.get("bucket_key_enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def bucket_name(self) -> typing.Optional[builtins.str]:
        '''The physical name of this S3 Bucket.

        :default: - ``analytics-<AWS_ACCOUNT_ID>-<AWS_REGION>-<UNIQUE_ID>``
        '''
        result = self._values.get("bucket_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def cors(self) -> typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.CorsRule]]:
        '''The CORS configuration of this bucket.

        :default: - No CORS configuration.
        '''
        result = self._values.get("cors")
        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.CorsRule]], result)

    @builtins.property
    def enforce_ssl(self) -> typing.Optional[builtins.bool]:
        '''Enforces SSL for requests.

        S3.5 of the AWS Foundational Security Best Practices Regarding S3.

        :default: - False
        '''
        result = self._values.get("enforce_ssl")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def event_bridge_enabled(self) -> typing.Optional[builtins.bool]:
        '''Whether this S3 Bucket should send notifications to Amazon EventBridge or not.

        :default: - False
        '''
        result = self._values.get("event_bridge_enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def intelligent_tiering_configurations(
        self,
    ) -> typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration]]:
        '''Intelligent Tiering Configurations.

        :default: - No Intelligent Tiiering Configurations.
        '''
        result = self._values.get("intelligent_tiering_configurations")
        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration]], result)

    @builtins.property
    def inventories(
        self,
    ) -> typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.Inventory]]:
        '''The inventory configuration of the S3 Bucket.

        :default: - No inventory configuration
        '''
        result = self._values.get("inventories")
        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.Inventory]], result)

    @builtins.property
    def lifecycle_rules(
        self,
    ) -> typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.LifecycleRule]]:
        '''Rules that define how Amazon S3 manages objects during their lifetime.

        :default: - No lifecycle rules.
        '''
        result = self._values.get("lifecycle_rules")
        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.LifecycleRule]], result)

    @builtins.property
    def metrics(
        self,
    ) -> typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.BucketMetrics]]:
        '''The metrics configuration of this bucket.

        :default: - No metrics configuration.
        '''
        result = self._values.get("metrics")
        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_s3_ceddda9d.BucketMetrics]], result)

    @builtins.property
    def notifications_handler_role(
        self,
    ) -> typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole]:
        '''The IAM Role to be used by the notifications handler.

        :default: - A new IAM Role will be created.
        '''
        result = self._values.get("notifications_handler_role")
        return typing.cast(typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole], result)

    @builtins.property
    def object_lock_default_retention(
        self,
    ) -> typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention]:
        '''The default retention mode and rules for S3 Object Lock.

        Default retention can be configured after a bucket is created if the bucket already
        has object lock enabled. Enabling object lock for existing buckets is not supported.

        :default: - No default retention period
        '''
        result = self._values.get("object_lock_default_retention")
        return typing.cast(typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention], result)

    @builtins.property
    def object_lock_enabled(self) -> typing.Optional[builtins.bool]:
        '''Enable object lock on the S3 Bucket.

        Enabling object lock for existing buckets is not supported. Object lock must be enabled when the bucket is created.

        :default: - False, unless objectLockDefaultRetention is set (then, true)
        '''
        result = self._values.get("object_lock_enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def object_ownership(
        self,
    ) -> typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership]:
        '''The objectOwnership of the S3 Bucket.

        :default: - No ObjectOwnership configuration, uploading account will own the object.
        '''
        result = self._values.get("object_ownership")
        return typing.cast(typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership], result)

    @builtins.property
    def public_read_access(self) -> typing.Optional[builtins.bool]:
        '''Grants public read access to all objects in the S3 Bucket.

        Similar to calling ``bucket.grantPublicAccess()``

        :default: - False
        '''
        result = self._values.get("public_read_access")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def removal_policy(self) -> typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy]:
        '''The removal policy when deleting the CDK resource.

        If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true.
        Otherwise the removalPolicy is reverted to RETAIN.

        :default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        '''
        result = self._values.get("removal_policy")
        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy], result)

    @builtins.property
    def server_access_logs_bucket(
        self,
    ) -> typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket]:
        '''S3 Bucket destination for the server access logs.

        :default: - If "serverAccessLogsPrefix" undefined - access logs disabled, otherwise - log to current bucket.
        '''
        result = self._values.get("server_access_logs_bucket")
        return typing.cast(typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket], result)

    @builtins.property
    def server_access_logs_prefix(self) -> typing.Optional[builtins.str]:
        '''Optional log file prefix to use for the S3 Bucket's access logs.

        If defined without "serverAccessLogsBucket", enables access logs to current S3 Bucket with this prefix.

        :default: - No log file prefix
        '''
        result = self._values.get("server_access_logs_prefix")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def transfer_acceleration(self) -> typing.Optional[builtins.bool]:
        '''Whether this S3 Bucket should have transfer acceleration turned on or not.

        :default: - False
        '''
        result = self._values.get("transfer_acceleration")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def versioned(self) -> typing.Optional[builtins.bool]:
        '''Whether this S3 Bucket should have versioning turned on or not.

        :default: - False (unless object lock is enabled, then true)
        '''
        result = self._values.get("versioned")
        return typing.cast(typing.Optional[builtins.bool], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "AnalyticsBucketProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class DataLakeStorage(
    _constructs_77d1e7e8.Construct,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-dsf.storage.DataLakeStorage",
):
    '''Creates the storage layer for a data lake, composed of 3 ``AnalyticsBucket`` for Bronze, Silver, and Gold data.

    :see: https://awslabs.github.io/data-solutions-framework-on-aws/docs/constructs/library/Storage/data-lake-storage

    Example::

        # Set the context value for global data removal policy
        self.node.set_context("@data-solutions-framework-on-aws/removeDataOnDestroy", True)
        
        dsf.storage.DataLakeStorage(self, "MyDataLakeStorage",
            bronze_bucket_name="my-bronze",
            bronze_bucket_infrequent_access_delay=90,
            bronze_bucket_archive_delay=180,
            silver_bucket_name="my-silver",
            silver_bucket_infrequent_access_delay=180,
            silver_bucket_archive_delay=360,
            gold_bucket_name="my-gold",
            gold_bucket_infrequent_access_delay=180,
            gold_bucket_archive_delay=360,
            removal_policy=cdk.RemovalPolicy.DESTROY
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        bronze_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        bronze_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        bronze_bucket_name: typing.Optional[builtins.str] = None,
        data_lake_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
        gold_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        gold_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        gold_bucket_name: typing.Optional[builtins.str] = None,
        removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
        silver_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        silver_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        silver_bucket_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Construct a new instance of DataLakeStorage.

        :param scope: the Scope of the CDK Construct.
        :param id: the ID of the CDK Construct.
        :param bronze_bucket_archive_delay: Delay (in days) before archiving BRONZE data to frozen storage (Glacier storage class). Default: - Move objects to Glacier after 90 days.
        :param bronze_bucket_infrequent_access_delay: Delay (in days) before moving BRONZE data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 30 days.
        :param bronze_bucket_name: Name of the Bronze bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``bronze-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        :param data_lake_key: The KMS Key used to encrypt all DataLakeStorage S3 buckets. Default: - A single KMS customer key is created.
        :param gold_bucket_archive_delay: Delay (in days) before archiving GOLD data to frozen storage (Glacier storage class). Default: - Objects are not archived to Glacier.
        :param gold_bucket_infrequent_access_delay: Delay (in days) before moving GOLD data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 90 days.
        :param gold_bucket_name: Name of the Gold bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``gold-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        :param removal_policy: The removal policy when deleting the CDK resource. If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true. Otherwise, the removalPolicy is reverted to RETAIN. Default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        :param silver_bucket_archive_delay: Delay (in days) before archiving SILVER data to frozen storage (Glacier storage class). Default: - Objects are not archived to Glacier.
        :param silver_bucket_infrequent_access_delay: Delay (in days) before moving SILVER data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 90 days.
        :param silver_bucket_name: Name of the Silver bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``silver-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7b6bad95445d946e813b33e3fd8174bb21769b02dbb078d8c74b4c8f345c2bc)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = DataLakeStorageProps(
            bronze_bucket_archive_delay=bronze_bucket_archive_delay,
            bronze_bucket_infrequent_access_delay=bronze_bucket_infrequent_access_delay,
            bronze_bucket_name=bronze_bucket_name,
            data_lake_key=data_lake_key,
            gold_bucket_archive_delay=gold_bucket_archive_delay,
            gold_bucket_infrequent_access_delay=gold_bucket_infrequent_access_delay,
            gold_bucket_name=gold_bucket_name,
            removal_policy=removal_policy,
            silver_bucket_archive_delay=silver_bucket_archive_delay,
            silver_bucket_infrequent_access_delay=silver_bucket_infrequent_access_delay,
            silver_bucket_name=silver_bucket_name,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="retrieveVersion")
    def retrieve_version(self) -> typing.Any:
        '''Retrieve DSF package.json version.'''
        return typing.cast(typing.Any, jsii.invoke(self, "retrieveVersion", []))

    @jsii.python.classproperty
    @jsii.member(jsii_name="DSF_OWNED_TAG")
    def DSF_OWNED_TAG(cls) -> builtins.str:
        return typing.cast(builtins.str, jsii.sget(cls, "DSF_OWNED_TAG"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="DSF_TRACKING_CODE")
    def DSF_TRACKING_CODE(cls) -> builtins.str:
        return typing.cast(builtins.str, jsii.sget(cls, "DSF_TRACKING_CODE"))

    @builtins.property
    @jsii.member(jsii_name="accessLogsBucket")
    def access_logs_bucket(self) -> AccessLogsBucket:
        '''The S3 Bucket for access logs.'''
        return typing.cast(AccessLogsBucket, jsii.get(self, "accessLogsBucket"))

    @builtins.property
    @jsii.member(jsii_name="bronzeBucket")
    def bronze_bucket(self) -> AnalyticsBucket:
        '''The S3 Bucket for Bronze layer.'''
        return typing.cast(AnalyticsBucket, jsii.get(self, "bronzeBucket"))

    @builtins.property
    @jsii.member(jsii_name="dataLakeKey")
    def data_lake_key(self) -> _aws_cdk_aws_kms_ceddda9d.IKey:
        '''The KMS Key used to encrypt all DataLakeStorage S3 buckets.'''
        return typing.cast(_aws_cdk_aws_kms_ceddda9d.IKey, jsii.get(self, "dataLakeKey"))

    @builtins.property
    @jsii.member(jsii_name="goldBucket")
    def gold_bucket(self) -> AnalyticsBucket:
        '''The S3 Bucket for Gold layer.'''
        return typing.cast(AnalyticsBucket, jsii.get(self, "goldBucket"))

    @builtins.property
    @jsii.member(jsii_name="silverBucket")
    def silver_bucket(self) -> AnalyticsBucket:
        '''The S3 Bucket for Silver layer.'''
        return typing.cast(AnalyticsBucket, jsii.get(self, "silverBucket"))


@jsii.data_type(
    jsii_type="aws-dsf.storage.DataLakeStorageProps",
    jsii_struct_bases=[],
    name_mapping={
        "bronze_bucket_archive_delay": "bronzeBucketArchiveDelay",
        "bronze_bucket_infrequent_access_delay": "bronzeBucketInfrequentAccessDelay",
        "bronze_bucket_name": "bronzeBucketName",
        "data_lake_key": "dataLakeKey",
        "gold_bucket_archive_delay": "goldBucketArchiveDelay",
        "gold_bucket_infrequent_access_delay": "goldBucketInfrequentAccessDelay",
        "gold_bucket_name": "goldBucketName",
        "removal_policy": "removalPolicy",
        "silver_bucket_archive_delay": "silverBucketArchiveDelay",
        "silver_bucket_infrequent_access_delay": "silverBucketInfrequentAccessDelay",
        "silver_bucket_name": "silverBucketName",
    },
)
class DataLakeStorageProps:
    def __init__(
        self,
        *,
        bronze_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        bronze_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        bronze_bucket_name: typing.Optional[builtins.str] = None,
        data_lake_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
        gold_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        gold_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        gold_bucket_name: typing.Optional[builtins.str] = None,
        removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
        silver_bucket_archive_delay: typing.Optional[jsii.Number] = None,
        silver_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
        silver_bucket_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties for the DataLakeStorage Construct.

        :param bronze_bucket_archive_delay: Delay (in days) before archiving BRONZE data to frozen storage (Glacier storage class). Default: - Move objects to Glacier after 90 days.
        :param bronze_bucket_infrequent_access_delay: Delay (in days) before moving BRONZE data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 30 days.
        :param bronze_bucket_name: Name of the Bronze bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``bronze-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        :param data_lake_key: The KMS Key used to encrypt all DataLakeStorage S3 buckets. Default: - A single KMS customer key is created.
        :param gold_bucket_archive_delay: Delay (in days) before archiving GOLD data to frozen storage (Glacier storage class). Default: - Objects are not archived to Glacier.
        :param gold_bucket_infrequent_access_delay: Delay (in days) before moving GOLD data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 90 days.
        :param gold_bucket_name: Name of the Gold bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``gold-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        :param removal_policy: The removal policy when deleting the CDK resource. If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true. Otherwise, the removalPolicy is reverted to RETAIN. Default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        :param silver_bucket_archive_delay: Delay (in days) before archiving SILVER data to frozen storage (Glacier storage class). Default: - Objects are not archived to Glacier.
        :param silver_bucket_infrequent_access_delay: Delay (in days) before moving SILVER data to cold storage (Infrequent Access storage class). Default: - Move objects to Infrequent Access after 90 days.
        :param silver_bucket_name: Name of the Silver bucket. Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended). Default: - ``silver-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0cf3d43b2d7ce199048a525c05ac3e62d39475ff9e43b6627e331c93bc6a9258)
            check_type(argname="argument bronze_bucket_archive_delay", value=bronze_bucket_archive_delay, expected_type=type_hints["bronze_bucket_archive_delay"])
            check_type(argname="argument bronze_bucket_infrequent_access_delay", value=bronze_bucket_infrequent_access_delay, expected_type=type_hints["bronze_bucket_infrequent_access_delay"])
            check_type(argname="argument bronze_bucket_name", value=bronze_bucket_name, expected_type=type_hints["bronze_bucket_name"])
            check_type(argname="argument data_lake_key", value=data_lake_key, expected_type=type_hints["data_lake_key"])
            check_type(argname="argument gold_bucket_archive_delay", value=gold_bucket_archive_delay, expected_type=type_hints["gold_bucket_archive_delay"])
            check_type(argname="argument gold_bucket_infrequent_access_delay", value=gold_bucket_infrequent_access_delay, expected_type=type_hints["gold_bucket_infrequent_access_delay"])
            check_type(argname="argument gold_bucket_name", value=gold_bucket_name, expected_type=type_hints["gold_bucket_name"])
            check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
            check_type(argname="argument silver_bucket_archive_delay", value=silver_bucket_archive_delay, expected_type=type_hints["silver_bucket_archive_delay"])
            check_type(argname="argument silver_bucket_infrequent_access_delay", value=silver_bucket_infrequent_access_delay, expected_type=type_hints["silver_bucket_infrequent_access_delay"])
            check_type(argname="argument silver_bucket_name", value=silver_bucket_name, expected_type=type_hints["silver_bucket_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if bronze_bucket_archive_delay is not None:
            self._values["bronze_bucket_archive_delay"] = bronze_bucket_archive_delay
        if bronze_bucket_infrequent_access_delay is not None:
            self._values["bronze_bucket_infrequent_access_delay"] = bronze_bucket_infrequent_access_delay
        if bronze_bucket_name is not None:
            self._values["bronze_bucket_name"] = bronze_bucket_name
        if data_lake_key is not None:
            self._values["data_lake_key"] = data_lake_key
        if gold_bucket_archive_delay is not None:
            self._values["gold_bucket_archive_delay"] = gold_bucket_archive_delay
        if gold_bucket_infrequent_access_delay is not None:
            self._values["gold_bucket_infrequent_access_delay"] = gold_bucket_infrequent_access_delay
        if gold_bucket_name is not None:
            self._values["gold_bucket_name"] = gold_bucket_name
        if removal_policy is not None:
            self._values["removal_policy"] = removal_policy
        if silver_bucket_archive_delay is not None:
            self._values["silver_bucket_archive_delay"] = silver_bucket_archive_delay
        if silver_bucket_infrequent_access_delay is not None:
            self._values["silver_bucket_infrequent_access_delay"] = silver_bucket_infrequent_access_delay
        if silver_bucket_name is not None:
            self._values["silver_bucket_name"] = silver_bucket_name

    @builtins.property
    def bronze_bucket_archive_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before archiving BRONZE data to frozen storage (Glacier storage class).

        :default: - Move objects to Glacier after 90 days.
        '''
        result = self._values.get("bronze_bucket_archive_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def bronze_bucket_infrequent_access_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before moving BRONZE data to cold storage (Infrequent Access storage class).

        :default: - Move objects to Infrequent Access after 30 days.
        '''
        result = self._values.get("bronze_bucket_infrequent_access_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def bronze_bucket_name(self) -> typing.Optional[builtins.str]:
        '''Name of the Bronze bucket.

        Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended).

        :default: - ``bronze-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        '''
        result = self._values.get("bronze_bucket_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def data_lake_key(self) -> typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey]:
        '''The KMS Key used to encrypt all DataLakeStorage S3 buckets.

        :default: - A single KMS customer key is created.
        '''
        result = self._values.get("data_lake_key")
        return typing.cast(typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey], result)

    @builtins.property
    def gold_bucket_archive_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before archiving GOLD data to frozen storage (Glacier storage class).

        :default: - Objects are not archived to Glacier.
        '''
        result = self._values.get("gold_bucket_archive_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def gold_bucket_infrequent_access_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before moving GOLD data to cold storage (Infrequent Access storage class).

        :default: - Move objects to Infrequent Access after 90 days.
        '''
        result = self._values.get("gold_bucket_infrequent_access_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def gold_bucket_name(self) -> typing.Optional[builtins.str]:
        '''Name of the Gold bucket.

        Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended).

        :default: - ``gold-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        '''
        result = self._values.get("gold_bucket_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def removal_policy(self) -> typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy]:
        '''The removal policy when deleting the CDK resource.

        If DESTROY is selected, context value ``@data-solutions-framework-on-aws/removeDataOnDestroy`` needs to be set to true.
        Otherwise, the removalPolicy is reverted to RETAIN.

        :default: - The resources are not deleted (``RemovalPolicy.RETAIN``).
        '''
        result = self._values.get("removal_policy")
        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy], result)

    @builtins.property
    def silver_bucket_archive_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before archiving SILVER data to frozen storage (Glacier storage class).

        :default: - Objects are not archived to Glacier.
        '''
        result = self._values.get("silver_bucket_archive_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def silver_bucket_infrequent_access_delay(self) -> typing.Optional[jsii.Number]:
        '''Delay (in days) before moving SILVER data to cold storage (Infrequent Access storage class).

        :default: - Move objects to Infrequent Access after 90 days.
        '''
        result = self._values.get("silver_bucket_infrequent_access_delay")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def silver_bucket_name(self) -> typing.Optional[builtins.str]:
        '''Name of the Silver bucket.

        Use ``BucketUtils.generateUniqueBucketName()`` to generate a unique name (recommended).

        :default: - ``silver-<ACCOUNT_ID>-<REGION>-<UNIQUE_ID>`` will be used.
        '''
        result = self._values.get("silver_bucket_name")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "DataLakeStorageProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


__all__ = [
    "AccessLogsBucket",
    "AnalyticsBucket",
    "AnalyticsBucketProps",
    "DataLakeStorage",
    "DataLakeStorageProps",
]

publication.publish()

def _typecheckingstub__da555e2c64ed475228e7d75a5dea9fad7a83230cde354814fa26bdc1657a3003(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
    auto_delete_objects: typing.Optional[builtins.bool] = None,
    block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
    bucket_key_enabled: typing.Optional[builtins.bool] = None,
    bucket_name: typing.Optional[builtins.str] = None,
    cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    encryption: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketEncryption] = None,
    encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
    enforce_ssl: typing.Optional[builtins.bool] = None,
    event_bridge_enabled: typing.Optional[builtins.bool] = None,
    intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
    inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
    lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
    minimum_tls_version: typing.Optional[jsii.Number] = None,
    notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
    object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
    object_lock_enabled: typing.Optional[builtins.bool] = None,
    object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
    public_read_access: typing.Optional[builtins.bool] = None,
    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
    server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
    server_access_logs_prefix: typing.Optional[builtins.str] = None,
    transfer_acceleration: typing.Optional[builtins.bool] = None,
    versioned: typing.Optional[builtins.bool] = None,
    website_error_document: typing.Optional[builtins.str] = None,
    website_index_document: typing.Optional[builtins.str] = None,
    website_redirect: typing.Optional[typing.Union[_aws_cdk_aws_s3_ceddda9d.RedirectTarget, typing.Dict[builtins.str, typing.Any]]] = None,
    website_routing_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.RoutingRule, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce37a4192de383edd1b255b7d9368f635675060d8a81f40c2659ba13d2fc4b30(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    encryption_key: _aws_cdk_aws_kms_ceddda9d.IKey,
    access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
    auto_delete_objects: typing.Optional[builtins.bool] = None,
    block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
    bucket_key_enabled: typing.Optional[builtins.bool] = None,
    bucket_name: typing.Optional[builtins.str] = None,
    cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    enforce_ssl: typing.Optional[builtins.bool] = None,
    event_bridge_enabled: typing.Optional[builtins.bool] = None,
    intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
    inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
    lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
    notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
    object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
    object_lock_enabled: typing.Optional[builtins.bool] = None,
    object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
    public_read_access: typing.Optional[builtins.bool] = None,
    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
    server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
    server_access_logs_prefix: typing.Optional[builtins.str] = None,
    transfer_acceleration: typing.Optional[builtins.bool] = None,
    versioned: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9e767bf9f848c363915ff8506179c6a3ef90c760716e38bfb8fa1e85a748923(
    *,
    encryption_key: _aws_cdk_aws_kms_ceddda9d.IKey,
    access_control: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BucketAccessControl] = None,
    auto_delete_objects: typing.Optional[builtins.bool] = None,
    block_public_access: typing.Optional[_aws_cdk_aws_s3_ceddda9d.BlockPublicAccess] = None,
    bucket_key_enabled: typing.Optional[builtins.bool] = None,
    bucket_name: typing.Optional[builtins.str] = None,
    cors: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.CorsRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    enforce_ssl: typing.Optional[builtins.bool] = None,
    event_bridge_enabled: typing.Optional[builtins.bool] = None,
    intelligent_tiering_configurations: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.IntelligentTieringConfiguration, typing.Dict[builtins.str, typing.Any]]]] = None,
    inventories: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.Inventory, typing.Dict[builtins.str, typing.Any]]]] = None,
    lifecycle_rules: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.LifecycleRule, typing.Dict[builtins.str, typing.Any]]]] = None,
    metrics: typing.Optional[typing.Sequence[typing.Union[_aws_cdk_aws_s3_ceddda9d.BucketMetrics, typing.Dict[builtins.str, typing.Any]]]] = None,
    notifications_handler_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
    object_lock_default_retention: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectLockRetention] = None,
    object_lock_enabled: typing.Optional[builtins.bool] = None,
    object_ownership: typing.Optional[_aws_cdk_aws_s3_ceddda9d.ObjectOwnership] = None,
    public_read_access: typing.Optional[builtins.bool] = None,
    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
    server_access_logs_bucket: typing.Optional[_aws_cdk_aws_s3_ceddda9d.IBucket] = None,
    server_access_logs_prefix: typing.Optional[builtins.str] = None,
    transfer_acceleration: typing.Optional[builtins.bool] = None,
    versioned: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7b6bad95445d946e813b33e3fd8174bb21769b02dbb078d8c74b4c8f345c2bc(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    bronze_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    bronze_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    bronze_bucket_name: typing.Optional[builtins.str] = None,
    data_lake_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
    gold_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    gold_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    gold_bucket_name: typing.Optional[builtins.str] = None,
    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
    silver_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    silver_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    silver_bucket_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0cf3d43b2d7ce199048a525c05ac3e62d39475ff9e43b6627e331c93bc6a9258(
    *,
    bronze_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    bronze_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    bronze_bucket_name: typing.Optional[builtins.str] = None,
    data_lake_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
    gold_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    gold_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    gold_bucket_name: typing.Optional[builtins.str] = None,
    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
    silver_bucket_archive_delay: typing.Optional[jsii.Number] = None,
    silver_bucket_infrequent_access_delay: typing.Optional[jsii.Number] = None,
    silver_bucket_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass
