s3-bucket.template

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "S3Bucket",
  "Parameters": {
    "ServiceName": {
      "Description": "The name of the service this belongs to",
      "AllowedPattern": "^[a-z0-9][a-z0-9-.]*$",
      "Type": "String"
    },
    "Environment": {
      "Description": "Environment we are deploying into",
      "Default": "sandbox",
      "Type": "String",
      "AllowedValues": [
        "admin",
        "prod",
        "stage",
        "sandbox"
      ],
      "ConstraintDescription": "Must specify prod, stage, or sandbox"
    },
    "BucketName": {
      "Description": "Name of S3 bucket to manage",
      "AllowedPattern": "^[a-z0-9][a-z0-9-.]*$",
      "Type": "String"
    },
    "TechnicalOwner": {
      "Description": "A valid LDAP email",
      "AllowedPattern": "^([a-zA-Z0-9_\\-\\.]+)@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.)|(([a-zA-Z0-9\\-]+\\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\\]?)$",
      "Type": "String"
    },
    "AccessControl": {
      "Description": "A canned access control list",
      "Type": "String",
      "AllowedValues": [
        "Private",
        "PublicRead",
        "PublicReadWrite",
        "AuthenticatedRead",
        "LogDeliveryWrite",
        "BucketOwnerRead",
        "BucketOwnerFullControl"
      ]
    },
    "VersioningConfiguration": {
      "Description": "Enables multiple variants of all objects in this bucket.",
      "Type": "String",
      "Default": "Suspended",
      "AllowedValues": [
        "Enabled",
        "Suspended"
      ]
    },
    "WithRole": {
      "Description": "Return an IAM Role that grants access to the bucket",
      "Type": "String",
      "Default": "false",
      "AllowedValues": [
        "true",
        "false"
      ]
    },
    "IamRole": {
      "Description": "Add policies to access the bucket to the provided IAM Role",
      "Type": "String",
      "Default": ""
    },
    "Encrypt": {
      "Description": "Enable encryption using server side encryption",
      "Type": "String",
      "Default": "false",
      "AllowedValues": [
        "true",
        "false"
      ]
    },
    "StacksVersion": {
      "Description": "Version of the Nubis Stacks",
      "Type": "String",
      "Default": "v1.4.0-dev"
    }
  },
  "Conditions": {
    "WithRoleEnable": {
      "Fn::Equals": [
        {
          "Ref": "WithRole"
        },
        "true"
      ]
    },
    "WithRoleDisable": {
      "Fn::Equals": [
        {
          "Ref": "WithRole"
        },
        "false"
      ]
    },
    "IamRole_Set": {
      "Fn::Not": [
        {
          "Fn::Equals": [
            {
              "Ref": "IamRole"
            },
            ""
          ]
        }
      ]
    },
    "CreateIAMPolicy": {
      "Fn::Or": [
        {
          "Condition": "WithRoleEnable"
        },
        {
          "Condition": "IamRole_Set"
        }
      ]
    },
    "EncryptEnable": {
      "Fn::Equals": [
        {
          "Ref": "Encrypt"
        },
        "true"
      ]
    }
  },
  "Resources": {
    "S3Bucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "AccessControl": {
          "Ref": "AccessControl"
        },
        "VersioningConfiguration": {
          "Status": {
            "Ref": "VersioningConfiguration"
          }
        },
        "BucketName": {
          "Ref": "BucketName"
        },
        "Tags": [
          {
            "Key": "ServiceName",
            "Value": {
              "Ref": "ServiceName"
            }
          },
          {
            "Key": "TechnicalOwner",
            "Value": {
              "Ref": "TechnicalOwner"
            }
          },
          {
            "Key": "Environment",
            "Value": {
              "Ref": "Environment"
            }
          },
          {
            "Key": "Purpose",
            "Value": "S3 Bucket"
          },
          {
            "Key": "Backups",
            "Value": "Never"
          },
          {
            "Key": "Shutdown",
            "Value": "Never"
          }
        ]
      }
    },
    "S3Encryption": {
      "Type": "AWS::S3::BucketPolicy",
      "Condition": "EncryptEnable",
      "Properties": {
        "Bucket": {
          "Ref": "S3Bucket"
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Deny",
              "Principal": "*",
              "Action": [
                "s3:PutObject"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "S3Bucket"
                    },
                    "/*"
                  ]
                ]
              },
              "Condition": {
                "StringNotEquals": {
                  "s3:x-amz-server-side-encryption": "AES256"
                }
              }
            }
          ]
        }
      }
    },
    "S3BackupIAMRole": {
      "Type": "AWS::IAM::Role",
      "Condition": "WithRoleEnable",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/"
      }
    },
    "S3BackupIAMPolicy": {
      "Type": "AWS::IAM::Policy",
      "Condition": "CreateIAMPolicy",
      "Properties": {
        "PolicyName": {
          "Fn::Join": [
            "-",
            [
              {
                "Ref": "AWS::StackName"
              },
              "backup",
              "policy"
            ]
          ]
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "s3:ListAllMyBuckets",
              "Resource": "arn:aws:s3:::*"
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:ListBucket"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "S3Bucket"
                    }
                  ]
                ]
              }
            },
            {
              "Effect": "Allow",
              "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "S3Bucket"
                    },
                    "/*"
                  ]
                ]
              }
            }
          ]
        },
        "Roles": [
          {
            "Fn::If": [
              "IamRole_Set",
              {
                "Ref": "IamRole"
              },
              {
                "Ref": "S3BackupIAMRole"
              }
            ]
          }
        ]
      }
    }
  },
  "Outputs": {
    "S3Bucket": {
      "Description": "Resource Name",
      "Value": {
        "Ref": "S3Bucket"
      }
    },
    "DomainName": {
      "Description": "The DNS name of the bucket",
      "Value": {
        "Fn::GetAtt": [
          "S3Bucket",
          "DomainName"
        ]
      }
    },
    "S3Role": {
      "Description": "IAM role for S3 Backup bucket",
      "Condition": "WithRoleEnable",
      "Value": {
        "Ref": "S3BackupIAMRole"
      }
    }
  }
}