# static-asset — S3 static asset

> **Module kind:** L2 composition  |  **Version:** 1.0.0

A composition that references the `s3` L1 primitive to deploy a single
S3 bucket for static asset hosting.

## Resources

The composition references this L1 primitive:

| L1 module | Purpose | README |
|-----------|---------|--------|
| `s3` | S3 bucket | [README](../l1/s3/README.md) |

## Inputs

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `bucket_name` | string | yes | Globally-unique S3 bucket name |
| `region` | string | yes | AWS region the bucket is created in |

## Outputs

| Name | Type | Description |
|------|------|-------------|
| `bucket_arn` | arn | The S3 bucket ARN |
| `bucket_name` | string | The bucket name (echoes the input) |

## Usage

Define a contract referencing this composition:

```yaml
uses: acdl/pipelines/deploy.yaml@v1
module: static-asset
environment: dev
inputs:
  bucket_name: my-static-assets
  region: us-east-1
```

See the [consumer guide](../../docs/CONSUMER_GUIDE.md) for a
step-by-step walkthrough, and the [s3 README](../l1/s3/README.md) for the
underlying L1 primitive.

## Compliance extension points

The composition can wire compliance resources when the compliance
milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:

- **KMS key** — shared encryption key for S3 SSE.
- **S3 access logs** — access logging to a separate audit bucket.
- **Object Lock** — 7-year immutable retention for evidence.
- **Public access block** — prevent data exfiltration.

See the [s3 README](../l1/s3/README.md) for per-module compliance extension
points.

## Versioning

`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.