S3: bucket gets deployed with incorrect public access settings

[piotrwalczak1]

Describe the bug

When deploying the s3 bucket with all 4 options for blockPublicAccess set to false, the bucket is deployed only with two false options. S3 block public access for account is set to all 4 options as false as false.

Per account setting:

S3 bucket configuration:

S3 for bucket after deployment:

Expected Behavior

If I am deploying a public bucket with all 4 blockPublicAccess flags set to false, I expect it to be deployed with all disabled flags. Per account flags are turned off for block public access.

Current Behavior

I gets deployed with 2 false options instead of 4.

Reproduction Steps

    const helloworldbucket = new s3.Bucket(this, "HelloWorldBucketMin", {
      websiteIndexDocument: "index.html",
      publicReadAccess: true,
      blockPublicAccess: {
        blockPublicAcls: false,
        blockPublicPolicy: false,
        ignorePublicAcls: false,
        restrictPublicBuckets: false,
      },
    });

    new BucketDeployment(this, "hello-world-min-depl", {
      sources: [Source.asset("./dist")],
      destinationBucket: helloworldbucket,
    });

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.72.1 (build ddbfac7)

Framework Version

No response

Node.js Version

18.x.x

OS

Ubuntu

Language

Typescript

Language Version

No response

Other information

No response

[khushail]

Hi @piotrwalczak1 , thanks for reaching out. i tried to reproduce the scenario and it works for me with code shared by you.

I changed the setting to true and hence all public access were blocked like this -

Then I reverted it back to see if there is an issue but it was working as expected.

Could you try rerunning the code and see if its still an issue?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[piotrwalczak1]

d see if its still an issue

Hi, Can you please try to redeploy the stack after you deployed it? It seems to me it happens on redeploy. It was only on first deployment when it worked, but on any subsequent deployments those 2 options are marked again.

[pahud]

Resource handler returned message: "The bucket you are attempting to access must be addressed using the specified endpoint. Please send all future requests to this endpoint."

Did you mean it only happens when you redeploy exactly the same stack? I doesn't seem to make any sense. If you didn't modify any CDK code, the redeploy will simply be ignored because cdk diff should be empty. Please clarify and let me know what the cdk diff returns.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.