cfntemplates/workshop-config-prerequisites.yaml [57:103]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  S3LoggingBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub 's3serversideloggingbucket-${AWS::AccountId}'
      AccessControl : "LogDeliveryWrite"

  ConformancePackDeliveryBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub 'awsconfigconforms-delivery-bucket-${AWS::AccountId}'

  ConformancePackDeliveryBucketPolicy:
    DependsOn: ConformancePackServiceLinkedRole
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: 
        Ref: "ConformancePackDeliveryBucket"
      PolicyDocument: 
        Version: '2012-10-17'
        Statement:
          -
            Sid: AWSConfigConformsBucketPermissionsCheck
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:GetBucketAcl'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}'
          -
            Sid: AWSConfigConformsBucketDelivery
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:PutObject'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}/*'
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
          -
            Sid: ' AWSConfigConformsBucketReadAccess'
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:GetObject'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}/*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



operational_excellence/cfntemplates/workshop-config-prerequisites.yml [58:104]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  S3LoggingBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub 's3serversideloggingbucket-${AWS::AccountId}'
      AccessControl : "LogDeliveryWrite"

  ConformancePackDeliveryBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub 'awsconfigconforms-delivery-bucket-${AWS::AccountId}'

  ConformancePackDeliveryBucketPolicy:
    DependsOn: ConformancePackServiceLinkedRole
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: 
        Ref: "ConformancePackDeliveryBucket"
      PolicyDocument: 
        Version: '2012-10-17'
        Statement:
          -
            Sid: AWSConfigConformsBucketPermissionsCheck
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:GetBucketAcl'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}'
          -
            Sid: AWSConfigConformsBucketDelivery
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:PutObject'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}/*'
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
          -
            Sid: ' AWSConfigConformsBucketReadAccess'
            Effect: Allow
            Principal:
              AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms'
            Action: 's3:GetObject'
            Resource: !Sub 'arn:aws:s3:::awsconfigconforms-delivery-bucket-${AWS::AccountId}/*'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



