Interface MdaaTableBucketProps

Builder invoked to produce the additional statements (e.g. the deny-all baseline and least-privilege grant Allow statements) to append after the mandatory deny-non-TLS statement in the bucket policy. Its IMdaaTableBucketPolicyStatementsBuilder.buildStatements method receives the bucket ARN so callers can scope statements without having to re-derive the physical name / ARN. Only invoked when attachBucketPolicy is not false.

A builder (rather than a plain array) is used because the policy is created inside this constructor: the bucket ARN token is not available to the caller beforehand, but it is passed here so statements can be built against this.tableBucketArn.

Whether to attach the single MdaaTableBucketPolicy that this bucket owns. Defaults to true, which bakes in the mandatory deny-non-TLS (in-transit) control as compliance-by-default.

Setting this to false is a documented escape hatch that suppresses the bucket resource policy entirely — leaving the bucket with encryption-at-rest but NO in-transit (TLS) enforcement and NO deny-by-default protection. Only opt out when the caller intentionally manages the single allowed table-bucket policy elsewhere; otherwise leave this at its default to remain compliant.

KMS key for server-side encryption (mandatory).

Logical name for the table bucket (processed by naming.resourceName()).

Optional unreferenced file removal configuration. Omit for S3 Tables service defaults. Compaction and snapshot management are table properties, not bucket properties, so they are applied per-table by MdaaTable rather than here.