bucket.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Bucket for VPC flow logs
Parameters:
  BucketVersioning:
    Type: String
    Description: Enabled to enable bucket versioning, default is Suspended
    AllowedValues:
      - Enabled
      - Suspended
    Default: Suspended
  EnableDataLifeCycle:
    Type: String
    Description: Enabled to enable bucket lifecycle rule, default is Disabled
    AllowedValues:
      - Enabled
      - Disabled
    Default: Disabled
  LifecycleDataTransition:
    Type: Number
    Description: Number of days until S3 objects are moved to LifecycleDataStorageClass
    Default: 30
    MaxValue: 360
    MinValue: 1
  LifecycleDataStorageClass:
    Type: String
    Description: S3 bucket objects will transition into this storage class
    AllowedValues:
      - DEEP_ARCHIVE
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - ONEZONE_IA
      - GLACIER
    Default: GLACIER
  LifecycleDataExpiration:
    Type: Number
    Description: Number of days (from creation) when objects are deleted from S3 and the LifecycleDataStorageClass
    Default: 365000
    MaxValue: 365000
    MinValue: 360
  BucketName:
    Type: String
    Description: (Optional) Name of the created bucket.
    Default: ""
Conditions:
  HasBucketName: !Not [!Equals [!Ref BucketName, ""]]
Resources:
  Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !If [HasBucketName, !Ref BucketName, !Ref 'AWS::NoValue']
      VersioningConfiguration:
        Status: !Ref BucketVersioning
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      LifecycleConfiguration:
        Rules:
        - Id: DataLifecycleRule
          Status: !Ref EnableDataLifeCycle
          ExpirationInDays: !Ref LifecycleDataExpiration
          Transitions:
            - TransitionInDays: !Ref LifecycleDataTransition
              StorageClass: !Ref LifecycleDataStorageClass
  # this policy is from https://aws.amazon.com/blogs/mt/how-to-enable-vpc-flow-logs-automatically-using-aws-config-rules/
  BucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: delivery.logs.amazonaws.com
          Action: s3:PutObject
          Resource: [ !Sub "${Bucket.Arn}/*" ]
          Condition:
            StringEquals:
              s3:x-amz-acl: bucket-owner-full-control
        - Effect: Allow
          Principal:
            Service: delivery.logs.amazonaws.com
          Action: s3:GetBucketAcl
          Resource: [ !Sub "${Bucket.Arn}" ]
Outputs:
  BucketName:
    Value: !Ref Bucket
    Export:
      Name: !Sub '${AWS::StackName}-BucketName'
  BucketArn:
    Value: !GetAtt Bucket.Arn
    Export:
      Name: !Sub '${AWS::StackName}-BucketArn'