aws-backup-lambda-s3-bucket.yaml [26:108]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      VersioningConfiguration:
        Status: Enabled
      #      LoggingConfiguration:
      #        DestinationBucketName:
      #          Fn::ImportValue: !Sub <Destination Log Bucket>
      #        LogFilePrefix: <Logfile Prefix>
      LifecycleConfiguration:
        Rules:
          - Id: DeleteRule
            Status: Enabled
            ExpirationInDays: '90'

  DeploymentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref DeploymentBucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: SSEAndSSLPolicy
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [DeploymentBucket, Arn]
                  - '/*'
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: DenyS3PublicObjectACL
            Effect: Deny
            Principal: "*"
            Action: s3:PutObjectAcl
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [DeploymentBucket, Arn]
                  - '/*'
            Condition:
              StringEqualsIgnoreCaseIfExists:
                s3:x-amz-acl:
                  - public-read
                  - public-read-write
                  - authenticated-read
          - !If
            - OrgEnabledAccess
            - Sid: ''
              Effect: Allow
              Principal: "*"
              Action:
                - s3:ListBucket
              Resource: !GetAtt DeploymentBucket.Arn
              Condition:
                ForAnyValue:StringLike:
                  aws:PrincipalOrgPaths:
                    - !Sub "${OrganizationID}/*"
            - !Ref 'AWS::NoValue'

          - !If
            - OrgEnabledAccess
            - Sid: ''
              Effect: Allow
              Principal: "*"
              Action:
                - s3:Get*
              Resource:
                - !Join
                  - ''
                  - - Fn::GetAtt: [DeploymentBucket, Arn]
                    - '/*'
              Condition:
                ForAnyValue:StringLike:
                  aws:PrincipalOrgPaths:
                    - !Sub "${OrganizationID}/*"
            - !Ref 'AWS::NoValue'
Outputs:
  DeploymentBucketName:
    Value: !Ref DeploymentBucket
    Description: "S3 deployment bucket name for deployment support of packages and resources"
    Export:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-backup-s3-bucket.yaml [22:104]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      VersioningConfiguration:
        Status: Enabled
      #      LoggingConfiguration:
      #        DestinationBucketName:
      #          Fn::ImportValue: !Sub <Destination Log Bucket>
      #        LogFilePrefix: <Logfile Prefix>
      LifecycleConfiguration:
        Rules:
          - Id: DeleteRule
            Status: Enabled
            ExpirationInDays: '90'

  DeploymentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref DeploymentBucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: SSEAndSSLPolicy
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [DeploymentBucket, Arn]
                  - '/*'
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: DenyS3PublicObjectACL
            Effect: Deny
            Principal: "*"
            Action: s3:PutObjectAcl
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [DeploymentBucket, Arn]
                  - '/*'
            Condition:
              StringEqualsIgnoreCaseIfExists:
                s3:x-amz-acl:
                  - public-read
                  - public-read-write
                  - authenticated-read
          - !If
            - OrgEnabledAccess
            - Sid: ''
              Effect: Allow
              Principal: "*"
              Action:
                - s3:ListBucket
              Resource: !GetAtt DeploymentBucket.Arn
              Condition:
                ForAnyValue:StringLike:
                  aws:PrincipalOrgPaths:
                    - !Sub "${OrganizationID}/*"
            - !Ref 'AWS::NoValue'

          - !If
            - OrgEnabledAccess
            - Sid: ''
              Effect: Allow
              Principal: "*"
              Action:
                - s3:Get*
              Resource:
                - !Join
                  - ''
                  - - Fn::GetAtt: [DeploymentBucket, Arn]
                    - '/*'
              Condition:
                ForAnyValue:StringLike:
                  aws:PrincipalOrgPaths:
                    - !Sub "${OrganizationID}/*"
            - !Ref 'AWS::NoValue'
Outputs:
  DeploymentBucketName:
    Value: !Ref DeploymentBucket
    Description: "S3 deployment bucket name for deployment support of packages and resources"
    Export:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



