{
  "typeName" : "AWS::S3Express::DirectoryBucket",
  "description" : "Resource Type definition for AWS::S3Express::DirectoryBucket.",
  "additionalProperties" : false,
  "properties" : {
    "BucketName" : {
      "description" : "Specifies a name for the bucket. The bucket name must contain only lowercase letters, numbers, and hyphens (-). A directory bucket name must be unique in the chosen Availability Zone or Local Zone. The bucket name must also follow the format 'bucket_base_name--zone_id--x-s3'. The zone_id can be the ID of an Availability Zone or a Local Zone. If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the bucket name.",
      "maxLength" : 63,
      "pattern" : "^[a-z0-9][a-z0-9//.//-]*[a-z0-9]$",
      "type" : "string"
    },
    "LocationName" : {
      "description" : "Specifies the Zone ID of the Availability Zone or Local Zone where the directory bucket will be created. An example Availability Zone ID value is 'use1-az5'.",
      "type" : "string"
    },
    "AvailabilityZoneName" : {
      "description" : "Returns the code for the Availability Zone or Local Zone where the directory bucket was created. An example for the code of an Availability Zone is 'us-east-1f'.",
      "examples" : [ "us-east-1f" ],
      "type" : "string"
    },
    "DataRedundancy" : {
      "description" : "Specifies the number of Availability Zone or Local Zone that's used for redundancy for the bucket.",
      "type" : "string",
      "enum" : [ "SingleAvailabilityZone", "SingleLocalZone" ]
    },
    "Arn" : {
      "$ref" : "#/definitions/Arn",
      "description" : "Returns the Amazon Resource Name (ARN) of the specified bucket.",
      "examples" : [ "arn:aws:s3express:us-west-2:123456789123:bucket/DOC-EXAMPLE-BUCKET--usw2-az1--x-s3" ]
    },
    "BucketEncryption" : {
      "$ref" : "#/definitions/BucketEncryption"
    },
    "LifecycleConfiguration" : {
      "$ref" : "#/definitions/LifecycleConfiguration",
      "description" : "Lifecycle rules that define how Amazon S3 Express manages objects during their lifetime."
    },
    "Tags" : {
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "MetricsConfigurations" : {
      "description" : "Specifies the metrics configurations for the Amazon S3 Express bucket.",
      "type" : "array",
      "uniqueItems" : true,
      "insertionOrder" : true,
      "items" : {
        "$ref" : "#/definitions/MetricsConfiguration"
      }
    }
  },
  "definitions" : {
    "Arn" : {
      "description" : "The Amazon Resource Name (ARN) of the specified bucket.",
      "type" : "string"
    },
    "BucketEncryption" : {
      "description" : "Specifies default encryption for a bucket using server-side encryption with Amazon S3 managed keys (SSE-S3) or AWS KMS keys (SSE-KMS).",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "ServerSideEncryptionConfiguration" : {
          "description" : "Specifies the default server-side-encryption configuration.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : true,
          "items" : {
            "$ref" : "#/definitions/ServerSideEncryptionRule"
          }
        }
      },
      "required" : [ "ServerSideEncryptionConfiguration" ]
    },
    "ServerSideEncryptionRule" : {
      "description" : "Specifies the default server-side encryption configuration.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "BucketKeyEnabled" : {
          "description" : "Specifies whether Amazon S3 should use an S3 Bucket Key with server-side encryption using KMS (SSE-KMS) for new objects in the bucket. Existing objects are not affected. Amazon S3 Express One Zone uses an S3 Bucket Key with SSE-KMS and S3 Bucket Key cannot be disabled. It's only allowed to set the BucketKeyEnabled element to true.",
          "type" : "boolean"
        },
        "ServerSideEncryptionByDefault" : {
          "$ref" : "#/definitions/ServerSideEncryptionByDefault"
        }
      }
    },
    "ServerSideEncryptionByDefault" : {
      "description" : "Specifies the default server-side encryption to apply to new objects in the bucket. If a PUT Object request doesn't specify any server-side encryption, this default encryption will be applied.",
      "type" : "object",
      "properties" : {
        "KMSMasterKeyID" : {
          "description" : "AWS Key Management Service (KMS) customer managed key ID to use for the default encryption. This parameter is allowed only if SSEAlgorithm is set to aws:kms. You can specify this parameter with the key ID or the Amazon Resource Name (ARN) of the KMS key",
          "type" : "string",
          "anyOf" : [ {
            "relationshipRef" : {
              "typeName" : "AWS::KMS::Key",
              "propertyPath" : "/properties/KeyId"
            }
          }, {
            "relationshipRef" : {
              "typeName" : "AWS::KMS::Key",
              "propertyPath" : "/properties/Arn"
            }
          } ]
        },
        "SSEAlgorithm" : {
          "type" : "string",
          "enum" : [ "aws:kms", "AES256" ]
        }
      },
      "additionalProperties" : false,
      "required" : [ "SSEAlgorithm" ]
    },
    "LifecycleConfiguration" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Rules" : {
          "description" : "A lifecycle rule for individual objects in an Amazon S3 Express bucket.",
          "type" : "array",
          "uniqueItems" : true,
          "insertionOrder" : true,
          "items" : {
            "$ref" : "#/definitions/Rule"
          }
        }
      },
      "required" : [ "Rules" ]
    },
    "Rule" : {
      "type" : "object",
      "description" : "You must specify at least one of the following properties: AbortIncompleteMultipartUpload, or ExpirationInDays.",
      "additionalProperties" : false,
      "properties" : {
        "AbortIncompleteMultipartUpload" : {
          "$ref" : "#/definitions/AbortIncompleteMultipartUpload"
        },
        "ExpirationInDays" : {
          "type" : "integer"
        },
        "Id" : {
          "type" : "string",
          "maxLength" : 255
        },
        "Prefix" : {
          "type" : "string"
        },
        "Status" : {
          "type" : "string",
          "enum" : [ "Enabled", "Disabled" ]
        },
        "ObjectSizeGreaterThan" : {
          "type" : "string",
          "maxLength" : 20,
          "pattern" : "[0-9]+"
        },
        "ObjectSizeLessThan" : {
          "type" : "string",
          "maxLength" : 20,
          "pattern" : "[0-9]+"
        }
      },
      "required" : [ "Status" ]
    },
    "AbortIncompleteMultipartUpload" : {
      "description" : "Specifies the days since the initiation of an incomplete multipart upload that Amazon S3 will wait before permanently removing all parts of the upload.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "DaysAfterInitiation" : {
          "description" : "Specifies the number of days after which Amazon S3 aborts an incomplete multipart upload.",
          "type" : "integer",
          "minimum" : 0
        }
      },
      "required" : [ "DaysAfterInitiation" ]
    },
    "Tag" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "minLength" : 1,
          "maxLength" : 128,
          "pattern" : "^(?!aws:.*)([\\p{L}\\p{Z}\\p{N}_.:=+\\/\\-@%]*)$"
        },
        "Value" : {
          "type" : "string",
          "minLength" : 0,
          "maxLength" : 256,
          "pattern" : "^([\\p{L}\\p{Z}\\p{N}_.:=+\\/\\-@%]*)$"
        }
      },
      "required" : [ "Key", "Value" ]
    },
    "MetricsConfiguration" : {
      "description" : "Specifies a metrics configuration for the CloudWatch request metrics from an Amazon S3 Express bucket.",
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Id" : {
          "description" : "The ID used to identify the metrics configuration.",
          "type" : "string"
        },
        "Prefix" : {
          "description" : "The prefix used when evaluating a metrics filter.",
          "type" : "string"
        },
        "AccessPointArn" : {
          "description" : "The access point ARN used when evaluating a metrics filter.",
          "type" : "string"
        }
      }
    }
  },
  "createOnlyProperties" : [ "/properties/BucketName", "/properties/LocationName", "/properties/DataRedundancy" ],
  "primaryIdentifier" : [ "/properties/BucketName" ],
  "readOnlyProperties" : [ "/properties/Arn", "/properties/AvailabilityZoneName" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "s3express:TagResource", "s3express:UntagResource" ]
  },
  "required" : [ "LocationName", "DataRedundancy" ],
  "handlers" : {
    "create" : {
      "permissions" : [ "kms:GenerateDataKey", "kms:Decrypt", "s3express:CreateBucket", "s3express:ListAllMyDirectoryBuckets", "s3express:PutEncryptionConfiguration", "s3express:PutLifecycleConfiguration", "s3express:PutMetricsConfiguration", "s3express:TagResource" ]
    },
    "read" : {
      "permissions" : [ "s3express:ListAllMyDirectoryBuckets", "ec2:DescribeAvailabilityZones", "s3express:GetEncryptionConfiguration", "s3express:GetLifecycleConfiguration", "s3express:GetMetricsConfiguration", "s3express:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "kms:GenerateDataKey", "kms:Decrypt", "s3express:PutEncryptionConfiguration", "s3express:PutLifecycleConfiguration", "s3express:PutMetricsConfiguration", "s3express:TagResource", "s3express:UntagResource" ]
    },
    "delete" : {
      "permissions" : [ "s3express:DeleteBucket", "s3express:ListAllMyDirectoryBuckets" ]
    },
    "list" : {
      "permissions" : [ "s3express:ListAllMyDirectoryBuckets" ]
    }
  }
}