The Complete Production SOP: How to Deploy and Run AWS CDK v2 L3 Construct Development & CloudFormation in Autonomous AI Agents

---
name: "aws-cdk-construct-library"
description: "Synthesize deterministic AWS CloudFormation templates using object-oriented AWS CDK v2."
metadata:
  author: "AWS"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "create aws cdk l3 construct"
  - "run cdk diff"
  - "synthesize cloudformation cdk"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

import { Construct } from 'constructs';
import { RemovalPolicy, Duration } from 'aws-cdk-lib';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as kms from 'aws-cdk-lib/aws-kms';

export interface SecureBucketProps {
  readonly retentionPeriod?: Duration;
  readonly autoDeleteObjects?: boolean;
}

export class SecureBucket extends Construct {
  public readonly bucket: s3.Bucket;
  public readonly key: kms.Key;

  constructor(scope: Construct, id: string, props: SecureBucketProps = {}) {
    super(scope, id);

    this.key = new kms.Key(this, 'BucketKey', {
      enableKeyRotation: true,
      removalPolicy: RemovalPolicy.RETAIN,
    });

    this.bucket = new s3.Bucket(this, 'Resource', {
      encryption: s3.BucketEncryption.KMS,
      encryptionKey: this.key,
      enforceSSL: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      versioned: true,
      removalPolicy: props.autoDeleteObjects ? RemovalPolicy.DESTROY : RemovalPolicy.RETAIN,
      autoDeleteObjects: props.autoDeleteObjects ?? false,
    });
  }
}

import { App, Stack } from 'aws-cdk-lib';
import { Template, Match } from 'aws-cdk-lib/assertions';
import { SecureBucket } from '../lib/constructs/secure-bucket';

test('SecureBucket enforces KMS encryption and blocks public access', () => {
  const app = new App();
  const stack = new Stack(app, 'TestStack');
  new SecureBucket(stack, 'MySecureBucket');
  const template = Template.fromStack(stack);

  template.hasResourceProperties('AWS::S3::Bucket', {
    BucketEncryption: Match.objectLike({
      ServerSideEncryptionConfiguration: Match.arrayWith([
        Match.objectLike({
          ServerSideEncryptionByDefault: {
            SSEAlgorithm: 'aws:kms',
          },
        }),
      ]),
    }),
    PublicAccessBlockConfiguration: {
      BlockPublicAcls: true,
      BlockPublicPolicy: true,
      IgnorePublicAcls: true,
      RestrictPublicBuckets: true,
    },
  });
});