-
Notifications
You must be signed in to change notification settings - Fork 0
/
s3.yml
76 lines (66 loc) · 2.74 KB
/
s3.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
---
AWSTemplateFormatVersion: "2010-09-09"
Description: "S3 Buckets"
Resources:
BucketForGeneralOperations:
# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
# this will be used for bootstrapping and various other scripts
Type: "AWS::S3::Bucket"
Properties:
BucketName: "<your bucket name>" # must be globally unique, add your initials plus perhaps birthdate to make unique
BucketPolicyForGeneralOperations:
# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref BucketForGeneralOperations
PolicyDocument:
Statement:
# allow the dev account to read from this bucket
- Action: "s3:GetObject"
Effect: "Allow"
Principal:
AWS: "<development account number>" # development account
Resource: "arn:aws:s3:::<your bucket name>/*"
# Create a bucket to hold configs *which may include credentials*
BucketForConfigs:
Type: "AWS::S3::Bucket"
Properties:
BucketName: "<your bucket name>-configs" # must be globally unique, add your initials plus perhaps birthdate to make unique
BucketPolicyForConfigs:
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref BucketForConfigs
PolicyDocument:
Statement:
# prevent uploads if server side encryption was not set
- Action: "s3:PutObject"
Effect: "Deny"
Principal: "*"
Resource: "arn:aws:s3:::<your bucket name>-configs/*"
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption: "AES256"
# allow the dev account to read from this bucket
- Action: "s3:GetObject"
Effect: "Allow"
Principal:
AWS: "<development account number>" # development account
Resource: "arn:aws:s3:::<your bucket name>-configs/*"
# Create a bucket to hold backups
BucketForBackups:
# http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
Type: "AWS::S3::Bucket"
Properties:
BucketName: "<your bucket name>-backups" # must be globally unique, add your initials plus perhaps birthdate to make unique
BucketPolicyForBackups:
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref BucketForBackups
PolicyDocument:
Statement:
# allow the dev account to upload to this bucket
- Action: "s3:PutObject"
Effect: "Allow"
Principal:
AWS: "<development account number>" # development account
Resource: "arn:aws:s3:::<your bucket name>-backups/*"