amplify-cliを使って複数のS3バケットを管理する

amplify configure

amplify init

amplify storage add

amplify custom add

import * as cdk from '@aws-cdk/core';
import * as AmplifyHelpers from '@aws-amplify/cli-extensibility-helper';
import { AmplifyDependentResourcesAttributes } from '../../types/amplify-dependent-resources-ref';
import * as s3 from "@aws-cdk/aws-s3";
import * as iam from '@aws-cdk/aws-iam';

export class cdkStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps, amplifyResourceProps?: AmplifyHelpers.AmplifyResourceProps) {
    super(scope, id, props);
    /* Do not remove - Amplify CLI automatically injects the current deployment environment in this input parameter */
    new cdk.CfnParameter(this, 'env', {
      type: 'String',
      description: 'Current Amplify CLI env name',
    });
    const stackName = cdk.Fn.ref("AWS::StackName");
    const stackNameToken = cdk.Fn.split("-", stackName, 6);
    // stackに自動で付与されるランダム文字列を取得する
    const stackID = cdk.Fn.select(3, stackNameToken);
    const amplifyProjectInfo = AmplifyHelpers.getProjectInfo();
    // storageで作成されるバケットと命名規則を揃えておく
    const bucketNamePrefix = `${amplifyProjectInfo.projectName}-<bucketName>${stackID}`;
    const bucket = new s3.Bucket(this, "<bucketName>", {
      bucketName: `${bucketNamePrefix}-${cdk.Fn.ref('env')}`
    });
    // CORSの設定を行う
    bucket.addCorsRule({
      allowedHeaders: ["*"],
      allowedMethods: [
        s3.HttpMethods.GET,
        s3.HttpMethods.HEAD,
        s3.HttpMethods.PUT,
        s3.HttpMethods.POST,
        s3.HttpMethods.DELETE
      ],
      allowedOrigins: ["*"],
      exposedHeaders: [
        "x-amz-server-side-encryption",
        "x-amz-request-id",
        "x-amz-id-2",
        "ETag"
      ],
      maxAge: 3000
    })
    // ログイン済みユーザーへの書き込み権限を付与するために `auth` との依存関係を設定する
    const retVal: AmplifyDependentResourcesAttributes = AmplifyHelpers.addResourceDependency(this, 
      amplifyResourceProps.category, 
      amplifyResourceProps.resourceName, 
      [
        {category: "auth", resourceName: "<authResourceName>"}
      ]
    );
    // ログイン済みユーザーにアサインされるロールをArnから取得する
    const authRoleArn = cdk.Fn.join(":", [
        "arn",
        "aws",
        "iam",
        "",
        this.account,
        `role/amplify-${amplifyProjectInfo.projectName}-${cdk.Fn.ref('env')}-${stackID}-authRole`
    ]);
    const authRole = iam.Role.fromRoleArn(this, 'authRole', authRoleArn);
    // ログイン済みユーザーに読み書き権限を付与する
    bucket.grantReadWrite(authRole, 'private/${cognito-identity.amazonaws.com:sub}/*');
    // 別カテゴリから参照するために `BucketName` を `Output` に追加しておく
    new cdk.CfnOutput(this, 'BucketName', {
      value: bucket.bucketName,
      description: "The name of doclibrary bucket"
    });
  }
}

amplify storage override