rgdeploy/rg_deploy_bucket.yml at main · RLOpenCatalyst/rgdeploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
AWSTemplateFormatVersion: 2010-09-09
Description: Create target bucket to store rg-deployment-docs
Parameters:
  S3NewBucketName:
    Type: String
    Description: "S3 bucket to create."
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9_-]*"
    Default: rg-newdeployment-docs
Resources:
  DeploymentAccessLogsBucketKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Key for Deployment Access logs bucket
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Sid: Enable IAM Policies
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: kms:*
            Resource: "*"

  DeploymentAccessLogsBucket:
    Type: AWS::S3::Bucket
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W35
            reason: S3 bucket hosting access logs shouldn't have access logging configured
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - BucketKeyEnabled: true
            ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !GetAtt DeploymentAccessLogsBucketKMSKey.Arn
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

  DeploymentAccessLogsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref DeploymentAccessLogsBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: S3ServerAccessLogsPolicy-DeploymentBucket
            Action:
              - "s3:PutObject"
            Effect: Allow
            Resource: !Sub "arn:aws:s3:::${DeploymentAccessLogsBucket}/deploymentbucket*"
            Principal:
              Service: logging.s3.amazonaws.com
            Condition:
              ArnLike:
                "aws:SourceArn":
                  - !GetAtt DeploymentBucket.Arn
              StringEquals:
                "aws:SourceAccount":
                  - !Sub "${AWS::AccountId}"
  DeploymentBucketKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: Key for Deployment bucket
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Sid: Enable IAM Policies
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: kms:*
            Resource: "*"
  DeploymentBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Ref S3NewBucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !GetAtt DeploymentBucketKMSKey.Arn
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      LoggingConfiguration:
        DestinationBucketName: !Ref DeploymentAccessLogsBucket
        LogFilePrefix: deploymentbucket/
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration: # Block all public access configuration for the S3 bucket
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  DeploymentBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DeploymentBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: EnforceTLS12
            Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !Sub '${DeploymentBucket.Arn}'
              - !Sub '${DeploymentBucket.Arn}/*'
            Condition:
              Bool:
                'aws:SecureTransport': 'false'
          - Sid: EnforceTLS12OrHigher
            Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !Sub '${DeploymentBucket.Arn}'
              - !Sub '${DeploymentBucket.Arn}/*'
            Condition:
              NumericLessThan:
                's3:TLSVersion': '1.2'
Outputs:
  DeploymentBucketCreated:
    Description: Name of the new S3 bucket to store RG Deployment Files
    Value: !Ref DeploymentBucket