aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance-v1.yml [133:198]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Effect: "Allow"
            Resource:
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}/*
            Principal:
              Service:
              - cloudtrail.amazonaws.com
          -
            Effect: Deny
            Principal: "*"
            Action: "*"
            Resource:
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'


# S3 Bucket to store CloudTrail logs
  SCS3CloudTrailBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "s3-sc-${AWS::AccountId}-${AWS::Region}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      AccessControl: BucketOwnerFullControl
      LifecycleConfiguration:
        Rules:
          -
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 3
            NoncurrentVersionExpirationInDays: 3
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        -
          Key: Description
          Value: S3 Bucket for CloudTrail Logs
      VersioningConfiguration:
        Status: Enabled


# SSM Automation Role
  SCAutomationAssumeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub servicecatalog-automationassumerole-${AWS::Region}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
                - events.amazonaws.com
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-prescriptivecompliance.yml [125:190]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            Effect: "Allow"
            Resource:
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}/*
            Principal:
              Service:
              - cloudtrail.amazonaws.com
          -
            Effect: Deny
            Principal: "*"
            Action: "*"
            Resource:
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}
              - !Sub arn:aws:s3:::${SCS3CloudTrailBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'


# S3 Bucket to store CloudTrail logs
  SCS3CloudTrailBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "s3-sc-${AWS::AccountId}-${AWS::Region}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      AccessControl: BucketOwnerFullControl
      LifecycleConfiguration:
        Rules:
          -
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 3
            NoncurrentVersionExpirationInDays: 3
            Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        -
          Key: Description
          Value: S3 Bucket for CloudTrail Logs
      VersioningConfiguration:
        Status: Enabled


# SSM Automation Role
  SCAutomationAssumeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub servicecatalog-automationassumerole-${AWS::Region}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ssm.amazonaws.com
                - events.amazonaws.com
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



