Package software.amazon.awscdk.services.lambda

Class DirectS3Read

java.lang.Object
software.amazon.jsii.JsiiObject
software.amazon.awscdk.services.lambda.DirectS3Read
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-17T14:54:06.804Z") @Stability(Stable) public class DirectS3Read extends software.amazon.jsii.JsiiObject
The DirectS3Read configuration for an S3 Files filesystem mount.

Direct reads let Lambda read objects straight from the backing S3 bucket for higher throughput, instead of routing every read through the file system mount.

Create one with a factory method:

  • DirectS3Read.enabled(bucket) — turn direct reads on and grant the execution role read access to bucket.
  • DirectS3Read.enabledWithoutGrant() — turn direct reads on but add no S3 permissions; grant read access to the execution role yourself.
  • DirectS3Read.auto() — let the service decide based on the function's memory.
  • DirectS3Read.disabled() — always read through the mount.

Example: 

 import software.amazon.awscdk.*;
 import software.amazon.awscdk.services.ec2.*;
 import software.amazon.awscdk.services.s3.*;
 import software.amazon.awscdk.services.s3files.*;
 Vpc vpc = new Vpc(this, "Vpc");
 // Versioning is required — S3 Files relies on object versions for consistency.
 Bucket bucket = Bucket.Builder.create(this, "Bucket").versioned(true).build();
 // S3 Files assumes this role to sync data between S3 and the file system.
 Role role = Role.Builder.create(this, "S3FilesRole")
         .assumedBy(new ServicePrincipal("elasticfilesystem.amazonaws.com"))
         .build();
 // S3 permissions: read/write access to the bucket and objects
 role.addToPolicy(PolicyStatement.Builder.create()
         .actions(List.of("s3:ListBucket*"))
         .resources(List.of(bucket.getBucketArn()))
         .build());
 role.addToPolicy(PolicyStatement.Builder.create()
         .actions(List.of("s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject*", "s3:List*", "s3:PutObject*"))
         .resources(List.of(bucket.arnForObjects("*")))
         .build());
 // EventBridge permissions: S3 Files creates rules prefixed "DO-NOT-DELETE-S3-Files"
 // to detect S3 object changes and trigger data synchronization.
 role.addToPolicy(PolicyStatement.Builder.create()
         .actions(List.of("events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets"))
         .resources(List.of(String.format("arn:%s:events:*:*:rule/DO-NOT-DELETE-S3-Files*", Aws.PARTITION)))
         .conditions(Map.of("StringEquals", Map.of("events:ManagedBy", "elasticfilesystem.amazonaws.com")))
         .build());
 role.addToPolicy(PolicyStatement.Builder.create()
         .actions(List.of("events:DescribeRule", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule"))
         .resources(List.of(String.format("arn:%s:events:*:*:rule/*", Aws.PARTITION)))
         .build());
 CfnFileSystem fileSystem = CfnFileSystem.Builder.create(this, "S3FilesFs")
         .bucket(bucket.getBucketArn())
         .roleArn(role.getRoleArn())
         .build();
 SecurityGroup sg = SecurityGroup.Builder.create(this, "MountTargetSG").vpc(vpc).build();
 // Create a mount target in each private subnet so Lambda can reach the file system via NFS.
 vpc.privateSubnets.forEach((subnet, i) =>
   new s3files.CfnMountTarget(this, `MountTarget${i}`, {
     fileSystemId: fileSystem.attrFileSystemId,
     subnetId: subnet.subnetId,
     securityGroups: [sg.securityGroupId],
   }));
 // The access point defines the POSIX identity and root path Lambda uses on the file system.
 CfnAccessPoint accessPoint = CfnAccessPoint.Builder.create(this, "AccessPoint")
         .fileSystemId(fileSystem.getAttrFileSystemId())
         .rootDirectory(RootDirectoryProperty.builder()
                 .path("/export/lambda")
                 .creationPermissions(CreationPermissionsProperty.builder().ownerGid("1001").ownerUid("1001").permissions("750").build())
                 .build())
         .posixUser(PosixUserProperty.builder().gid("1001").uid("1001").build())
         .build();
 Function fn = Function.Builder.create(this, "MyFunction")
         .runtime(Runtime.NODEJS_LATEST)
         .handler("index.handler")
         .code(Code.fromAsset(join(__dirname, "lambda-handler")))
         .vpc(vpc)
         .filesystem(FileSystem.fromS3FilesAccessPoint(accessPoint, "/mnt/s3files", S3FilesOptions.builder()
                 // Enables direct reads and grants s3:GetObject/s3:GetObjectVersion on the bucket to the execution role.
                 .directS3Read(DirectS3Read.enabled(bucket))
                 .build()))
         .build();

  • Nested Class Summary

    Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

    software.amazon.jsii.JsiiObject.InitializationMode

  • Constructor Summary

    Constructors
    Modifier
    Constructor
    Description
    protected
    DirectS3Read(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
     
    protected
    DirectS3Read(software.amazon.jsii.JsiiObjectRef objRef)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static DirectS3Read
    auto()
    Let the service decide whether to use direct S3 read based on the function's memory configuration: direct reads are active for functions with 512 MB or more of memory.
    static DirectS3Read
    disabled()
    Disable direct S3 read;
    static DirectS3Read
    enabled(IBucket bucket)
    Enable direct S3 reads, bypassing the mount for higher throughput, and grant the function's execution role s3:GetObject and s3:GetObjectVersion on the bucket's objects so that direct reads can succeed.
    static DirectS3Read
    enabledWithoutGrant()
    Enable direct S3 reads, bypassing the mount for higher throughput, without adding any S3 read permissions.

    Methods inherited from class software.amazon.jsii.JsiiObject

    jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface software.amazon.jsii.JsiiSerializable

    $jsii$toJson

  • Constructor Details

    • DirectS3Read

      protected DirectS3Read(software.amazon.jsii.JsiiObjectRef objRef)

    • DirectS3Read

      protected DirectS3Read(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

  • Method Details

    • auto

      @Stability(Stable) @NotNull public static DirectS3Read auto()
      Let the service decide whether to use direct S3 read based on the function's memory configuration: direct reads are active for functions with 512 MB or more of memory.

      No S3 read permissions are added; the execution role must already hold them for a service-initiated direct read to succeed, otherwise reads fall back to the mount.

    • disabled

      @Stability(Stable) @NotNull public static DirectS3Read disabled()
      Disable direct S3 read;

      all reads are routed through the S3 Files file system's high-performance storage.

    • enabled

      @Stability(Stable) @NotNull public static DirectS3Read enabled(@NotNull IBucket bucket)
      Enable direct S3 reads, bypassing the mount for higher throughput, and grant the function's execution role s3:GetObject and s3:GetObjectVersion on the bucket's objects so that direct reads can succeed.

      Unlike auto(), this enables direct reads regardless of the function's memory size, including functions with less than 512 MB of memory.

      If the bucket is encrypted with a customer-managed KMS key, also grant the execution role kms:Decrypt on that key yourself.

      Parameters:
      bucket - the S3 bucket backing the S3 Files file system. This parameter is required.

    • enabledWithoutGrant

      @Stability(Stable) @NotNull public static DirectS3Read enabledWithoutGrant()
      Enable direct S3 reads, bypassing the mount for higher throughput, without adding any S3 read permissions.

      Like enabled(), this enables direct reads regardless of the function's memory size, including functions with less than 512 MB of memory.

      Use this when the execution role already has s3:GetObject/s3:GetObjectVersion on the backing bucket (for example through a managed policy or a bucket policy). You are responsible for granting those permissions; without them, direct reads silently fall back to reading through the file system.