s3

Houses shared S3 utilities and the Pulumi project that provisions our document buckets.

Pulumi

The pulumi/ directory is a standalone Pulumi program (cfx-s3) that owns:

• cfx-customer-documents-<stack> — customer document uploads (customer + bank dashboard CORS).
• cfx-bank-documents-<stack> — bank document uploads (bank dashboard CORS only).

Each bucket is private, SSE-AES256, with an access-logs prefix into cfx-bucket-access-logs-<stack> and a bucket policy denying insecure transport.

Bucket names and ARNs are published as stack outputs:

• customerDocumentsBucketName, customerDocumentsBucketArn
• bankDocumentsBucketName, bankDocumentsBucketArn

Preview / Deploy

bun nx run s3:pulumi-preview        # dev (default)
bun nx run s3:pulumi-preview:prod
bun nx run s3:pulumi-up             # dev
bun nx run s3:pulumi-up:prod
Copy

Consumers resolve buckets by name, not by StackReference

The state migration out of the old shared-infrastructure stack is complete — this stack owns the buckets outright.

Consumers do not StackReference cfx-s3. An S3 ARN carries no account or region, so it is derivable from the bucket name alone; s3BucketArn(key) / s3BucketObjectsArn(key) in packages/pulumi-templates/src/s3Buckets.ts build it from a shared key. That keeps every consumer independent of whichever stack owns the bucket — the same reasoning as resolving KMS keys by alias (see packages/kms).

The legacyResourceName aliases on createBucket are retained so the original resource URNs stay attached under the new logical names. Do not remove them — without the alias, Pulumi reads the resource as new and replaces the bucket.