(bootstrap): Utilize Account Regional namespace suffix for default StagingBucket

[dehli]

Describe the feature

As described here, S3 now has an account regional namespace suffix. For the purposes of CDK, I think it just requires appending -an to the default StagingBucket's name (and handling the breaking change - which is more work).

https://github.com/aws/aws-cdk/blob/6903378baadb4fc0b14ce75b7ceb90ec14adf208/packages/%40aws-cdk/app-staging-synthesizer-alpha/lib/default-staging-stack.ts#L380

Use Case

I want to protect against bucket squatting for CDK buckets.

Proposed Solution

No response

Other Information

For my own personal accounts, I can customize the staging bucket name so no change is needed, but making this the default for future accounts could be a good idea.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

AWS CDK Library version (aws-cdk-lib)

2.243.0

AWS CDK CLI version

2.243.0

Environment details (OS name and version, etc.)

N/A

[pahud]

Hi @dehli,

Great to hear this new feature from S3!

┌──────────────────────────────────────────────────────┐
│ Feature Request                                      │
│ Append "-an" S3 Account Regional Namespace suffix    │
│ to DefaultStagingStack's default bucket name         │
└──────────────────────────────────────────────────────┘
                        │
                        v
┌──────────────────────────────────────────────────────┐
│ Affected code:                                       │
│ default-staging-stack.ts#L380                        │
│                                                      │
│ `cdk-${appId}-staging-${account}-${region}`          │
│  ──> add `-an` suffix                                │
└──────────────────────────────────────────────────────┘
                        │
                        v
┌──────────────────────────────────────────────────────┐
│ Challenge: Breaking change for existing deployments  │
│ Mitigation: opt-in flag OR alpha breaking change     │
│ with migration guide                                 │
└──────────────────────────────────────────────────────┘

The change is straightforward at the code level — it's the one-liner in getCreateBucket() that constructs the default bucket name. The main complexity is the migration story for existing users who already have a staging bucket deployed without the -an suffix.

From my view, two reasonable approaches are:

1. Add an opt-in useAccountRegionalNamespace?: boolean to DefaultStagingStackOptions — safe for all users, no migration needed.

2. Make it the new default (since this is an alpha package) with a clear changelog entry and migration note — users with existing stacks can pass their old bucket name explicitly via stagingBucketName.

I think 1st option is the way to go.

We welcome PRs.

[nehaaprasad]

Hello! @dehli
please check out this PR!