cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09

Resources:

  LogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${AWS::StackName}-logs"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        IgnorePublicAcls: True
        BlockPublicPolicy: True
        RestrictPublicBuckets: True
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
            BucketKeyEnabled: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced

  LogBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LogBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: logging.s3.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub "${LogBucket.Arn}/*"
            Condition:
              ArnLike:
                "aws:SourceArn": !GetAtt ContentBucket.Arn
              StringEquals:
                "aws:SourceAccount": !Ref AWS::AccountId

  ContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref AWS::StackName
      LoggingConfiguration:
        DestinationBucketName: !Ref LogBucket
        LogFilePrefix: s3-access-logs/content-bucket/
      LifecycleConfiguration:
        Rules:
          - Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1
      MetricsConfigurations:
        - Id: EntireBucket
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        IgnorePublicAcls: True
        BlockPublicPolicy: False
        RestrictPublicBuckets: False
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ContentBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: "*"
            Action:
              - s3:ListBucket
              - s3:GetBucketLocation
            Resource: !GetAtt ContentBucket.Arn
          - Effect: Allow
            Principal: "*"
            Action:
              - s3:GetObject
              - s3:GetObjectTagging
            Resource: !Sub "${ContentBucket.Arn}/*"