/
s3-backup-bucket-delete-previous.yml
143 lines (137 loc) · 3.46 KB
/
s3-backup-bucket-delete-previous.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
---
AWSTemplateFormatVersion: 2010-09-09
Description: Create S3 Backup Bucket Template v20170114-1130
Parameters:
# Ownership
Owner:
Type: String
Default: FirstName LastName
Project:
Type: String
Default: S3 Backup Bucket Creation
DeleteAfter:
Type: String
Default: 00/00/201x
# Deployment
VpcE:
Type: String
BucketName:
Type: String
PreviousLifeCycle:
Type: Number
Default: 30
Resources:
Bucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Ref BucketName
VersioningConfiguration:
Status: Enabled
LifecycleConfiguration:
Rules:
- Id: !Join [ "", [ "Delete Previous > ", !Ref PreviousLifeCycle, " Days" ] ]
NoncurrentVersionExpirationInDays: !Ref PreviousLifeCycle
Status: Enabled
Tags:
- Key: Owner
Value: !Ref Owner
- Key: Project
Value: !Ref Project
- Key: DeleteAfter
Value: !Ref DeleteAfter
BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref Bucket
PolicyDocument:
Version: '2008-10-17'
Statement:
-
Sid: "Deny Unencrypted Put Object"
Effect: Deny
Principal: "*"
Action:
- "s3:PutObject"
Resource: !Join [ "", [ "arn:aws:s3:::", !Ref Bucket, "/*" ] ]
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption:
- "AES256"
- "aws:kms"
-
Sid: "Deny Unencrypted Object Uploads"
Effect: Deny
Principal: "*"
Action:
- "s3:PutObject"
Resource: !Join [ "", [ "arn:aws:s3:::", !Ref Bucket, "/*" ] ]
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption: "true"
-
Sid: "Allow VPCe Read Bucket"
Effect: Allow
Principal: "*"
Action:
- "s3:ListBucket"
- "s3:ListBucketVersions"
Resource: !Join [ "", [ "arn:aws:s3:::", !Ref Bucket ] ]
Condition:
StringEquals:
aws:sourceVpce: !Ref VpcE
-
Sid: "Allow VPCe Read-Write Content"
Effect: Allow
Principal: "*"
Action:
- "s3:GetObject"
- "s3:GetObjectVersion"
- "s3:DeleteObject"
- "s3:DeleteObjectVersion"
- "s3:PutObject"
Resource: !Join [ "", [ "arn:aws:s3:::", !Ref Bucket, "/*" ] ]
Condition:
StringEquals:
aws:sourceVpce: !Ref VpcE
Outputs:
VpcE:
Description: VPC Endpoint
Value: !Ref VpcE
BucketName:
Description: S3 Bucket Name
Value: !Ref BucketName
PreviousLifeCycle:
Description: Previous Life Cycle
Value: !Ref PreviousLifeCycle
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
-
Label:
default: Ownership
Parameters:
- Owner
- Project
- DeleteAfter
-
Label:
default: Deployment
Parameters:
- VpcE
- BucketName
- PreviousLifeCycle
ParameterLabels:
# Ownership
Owner:
default: Contact Owner
Project:
default: ASV
DeleteAfter:
default: CMDB Environment
# Deployment
VpcE:
default: VPC Endpoint
BucketName:
default: Bucket Name
PreviousLifeCycle:
default: Previous LifeCycle (Days)