(s3-deployment): support expected-bucket-owner

[pb8o]

Describe the feature

Support the expected bucket owner feature as described here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-owner-condition.html

Use Case

This helps customers validate that the bucket they are writing to is owned by the account they expect.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.189.0

Environment details (OS name and version, etc.)

Ubuntu 24.04

[pahud]

Hi @pb8o,

Thank you for the feature request!

Currently, the CDK's BucketDeployment construct does not support the expected-bucket-owner feature you mentioned. This enhancement would indeed improve the security and reliability of S3 deployments by ensuring the destination bucket owner is as expected, preventing potential misconfigurations or security risks.

We recommend extending the deployment properties to accept an optional expectedBucketOwner parameter, which would then be enforced on all underlying S3 requests.

We encourage community contributions, so if you're interested, feel free to open a Pull Request to add this capability!
Otherwise, we'll keep this feature request open for others to pick up.

Thanks for helping us improve the CDK!