diff --git a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts index b09701d8e..de23bcc3d 100644 --- a/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts +++ b/source/patterns/@aws-solutions-constructs/core/lib/s3-bucket-helper.ts @@ -21,7 +21,7 @@ import * as lambda from 'aws-cdk-lib/aws-lambda'; import * as s3 from 'aws-cdk-lib/aws-s3'; import * as cdk from 'aws-cdk-lib'; import { DefaultS3Props } from './s3-bucket-defaults'; -import { overrideProps, addCfnSuppressRules, consolidateProps, CheckBooleanWithDefault } from './utils'; +import { overrideProps, addCfnSuppressRules, consolidateProps, CheckBooleanWithDefault, printWarning } from './utils'; import { StorageClass } from 'aws-cdk-lib/aws-s3'; import { Duration } from 'aws-cdk-lib'; // Note: To ensure CDKv2 compatibility, keep the import statement for Construct separate @@ -325,6 +325,13 @@ export function CheckS3Props(propsObject: S3Props | any) { errorFound = true; } + if (propsObject?.bucketProps?.encryption === s3.BucketEncryption.KMS_MANAGED) { + if (!propsObject.bucketProps.bucketKeyEnabled) { + printWarning("When using SSE-KMS Bucket Encryption, set bucketKeyEnabled to true to lower costs"); + printWarning('https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html'); + } + } + if (errorFound) { throw new Error(errorMessages); }