bucket.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "S3 Bucket and User account and credentials for file storage",
  "Outputs": {
    "BucketName": {
      "Description": "Name of the bucket",
      "Value": {
        "Ref": "Bucket"
      },
      "Export" : {
        "Name" : {"Fn::Sub": "${ApplicationName}-bucket" }
      }
    },
    "BucketUserAccessKeyId": {
      "Description": "Access Key ID for the user",
      "Value": {
        "Ref": "BucketUserAccessKey"
      },
      "Export" : {
        "Name" : {"Fn::Sub": "${ApplicationName}-bucket-user-access-key-id" }
      }
    }
  },
  "Parameters": {
    "ApplicationName": {
      "Description": "Name of the application (snake-case, will be prepended to make internal reference names)",
      "Type": "String",
      "Default": "app"
    },
    "DomainName": {
      "Description": "Host domain name that should have access to the bucket through CORS",
      "Type": "String"
    }
  },
  "Resources": {
    "Bucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "CorsConfiguration": {
          "CorsRules": [
            {
              "AllowedHeaders": ["*"],
              "AllowedMethods": ["GET", "PUT"],
              "AllowedOrigins": [
                {
                  "Fn::Sub": "https://${DomainName}"
                }
              ]
            }
          ]
        },
        "LifecycleConfiguration": {
          "Rules": [
            {
              "Id": "DeleteOrphanUploadsRule",
              "Prefix": "uploads/",
              "Status": "Enabled",
              "ExpirationInDays": 1
            }
          ]
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": "TRUE",
          "BlockPublicPolicy": "TRUE",
          "IgnorePublicAcls": "TRUE",
          "RestrictPublicBuckets": "TRUE"
        }
      },
      "DeletionPolicy": "Delete"
    },
    "BucketUser": {
      "Type": "AWS::IAM::User",
      "Properties": {
        "Policies": [
          {
            "PolicyName": {
              "Fn::Sub": "${ApplicationName}-bucket-policy"
            },
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject"],
                  "Resource": [
                    { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": "Bucket" }, "/*"]] },
                    { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": "Bucket" }]] }
                  ]
                }
              ]
            }
          }
        ],
        "UserName": {
          "Fn::Sub": "${ApplicationName}-bucket-user"
        }
      }
    },
    "BucketUserAccessKey": {
      "Type": "AWS::IAM::AccessKey",
      "Properties": {
        "Status": "Active",
        "UserName": {
          "Ref": "BucketUser"
        }
      }
    },
    "BucketUserSecretAccessKeyParameter": {
      "Type" : "Custom::SSMSecureStringParam",
      "Properties" : {
        "Name" :  {
          "Fn::Sub": "/iam/user/${ApplicationName}-bucket-user/secret-access-key"
        },
        "ServiceToken": {
          "Fn::ImportValue": "ssm-securestring-cfn-macro-function-arn"
        },
        "Type": "SecureString",
        "Value" : {
          "Fn::GetAtt": ["BucketUserAccessKey", "SecretAccessKey"]
        }
      }
    }
  }
}