cloudformation.json

cloudformation.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Bobsled S3 Bucket Source Access Setup",
  "Parameters": {
    "BucketName": {
      "Description": "Name of the S3 bucket",
      "Type": "String",
      "Default": "tomasz-bobsled-bucket",
      "AllowedValues": [
        "tomasz-bobsled-bucket"
      ],
      "ConstraintDescription": "Only the default bucket name is allowed"
    },
    "Path": {
      "Description": "Optional path within the S3 bucket",
      "Type": "String",
      "Default": ""
    }
  },
  "Conditions": {
    "PathSpecified": {
      "Fn::Not": [
        {
          "Fn::Equals": [
            {
              "Ref": "Path"
            },
            ""
          ]
        }
      ]
    }
  },
  "Resources": {
    "BobsledAccessRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "BobsledAccessRole",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::343218184622:role/bobsled-read"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": "bobsled-reads-provider-017336"
                }
              }
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "BobsledTrustPolicy",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:GetObject",
                    "s3:GetObjectVersion"
                  ],
                  "Resource": {
                    "Fn::If": [
                      "PathSpecified",
                      {
                        "Fn::Sub": "arn:aws:s3:::${BucketName}/${Path}/*"
                      },
                      {
                        "Fn::Sub": "arn:aws:s3:::${BucketName}/*"
                      }
                    ]
                  }
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                  ],
                  "Resource": {
                    "Fn::Sub": "arn:aws:s3:::${BucketName}"
                  },
                  "Condition": {
                    "Fn::If": [
                      "PathSpecified",
                      {
                        "StringLike": {
                          "s3:prefix": [
                            {
                              "Fn::Sub": "${Path}/*"
                            }
                          ]
                        }
                      },
                      {
                        "Ref": "AWS::NoValue"
                      }
                    ]
                  }
                }
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "BobsledRoleARN": {
      "Description": "The ARN of the role created for Bobsled access",
      "Value": {
        "Fn::GetAtt": [
          "BobsledAccessRole",
          "Arn"
        ]
      }
    }
  }
}