File size: 2,580 Bytes
2b395f2 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 |
AWSTemplateFormatVersion: '2010-09-09'
Description: 'S3 Bucket for FRED ML Reports and Visualizations'
Parameters:
BucketName:
Type: String
Default: fredmlv1
Description: Name of the S3 bucket for storing reports
Resources:
# S3 Bucket for Reports
FredMLBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Ref BucketName
VersioningConfiguration:
Status: Enabled
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
LifecycleConfiguration:
Rules:
- Id: DeleteOldReports
Status: Enabled
ExpirationInDays: 1095 # 3 years
NoncurrentVersionExpirationInDays: 30
AbortIncompleteMultipartUpload:
DaysAfterInitiation: 7
CorsConfiguration:
CorsRules:
- AllowedHeaders: ['*']
AllowedMethods: [GET, PUT, POST, DELETE]
AllowedOrigins: ['*']
MaxAge: 3000
# Bucket Policy
BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref FredMLBucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: DenyUnencryptedObjectUploads
Effect: Deny
Principal: '*'
Action: s3:PutObject
Resource: !Sub '${FredMLBucket}/*'
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption: AES256
- Sid: DenyIncorrectEncryptionHeader
Effect: Deny
Principal: '*'
Action: s3:PutObject
Resource: !Sub '${FredMLBucket}/*'
Condition:
StringNotEquals:
s3:x-amz-server-side-encryption: AES256
- Sid: DenyUnencryptedObjectUploads
Effect: Deny
Principal: '*'
Action: s3:PutObject
Resource: !Sub '${FredMLBucket}/*'
Condition:
Null:
s3:x-amz-server-side-encryption: 'true'
# CloudWatch Log Group for S3 Access Logs
S3AccessLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub '/aws/s3/${BucketName}'
RetentionInDays: 30
Outputs:
BucketName:
Description: Name of the S3 bucket
Value: !Ref FredMLBucket
Export:
Name: !Sub '${AWS::StackName}-BucketName'
BucketArn:
Description: ARN of the S3 bucket
Value: !GetAtt FredMLBucket.Arn
Export:
Name: !Sub '${AWS::StackName}-BucketArn' |