source/repositories/compliant-framework-central-core/templates/logging/logging-assets.yml [284:349]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            SourceSelectionCriteria:
              SseKmsEncryptedObjects:
                Status: Enabled
            Id: ConsolidatedLogs
            Prefix: ""
            Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:${rLoggingS3BucketCmkAlias}
              SSEAlgorithm: aws:kms
      BucketName: !Sub config-${AWS::AccountId}-${AWS::Region}

  rConfigS3BucketPolicy:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F16
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rConfigS3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Action:
              - s3:*
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: AWSLogDeliveryWrite
            Effect: Allow
            Action:
              - s3:PutObject
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Sid: AWSLogDeliveryAclCheck
            Effect: Allow
            Action:
              - s3:GetBucketAcl
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}
          - Sid: AWSConfigBucketExistenceCheck
            Effect: Allow
            Action:
              - s3:ListBucket
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}

  rFlowLogsS3Bucket:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/repositories/compliant-framework-management-services-core/templates/management-services-logging-assets.yml [294:359]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            SourceSelectionCriteria:
              SseKmsEncryptedObjects:
                Status: Enabled
            Id: ConsolidatedLogs
            Prefix: ""
            Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !Sub arn:${AWS::Partition}:kms:${AWS::Region}:${AWS::AccountId}:${rLoggingS3BucketCmkAlias}
              SSEAlgorithm: aws:kms
      BucketName: !Sub config-${AWS::AccountId}-${AWS::Region}

  rConfigS3BucketPolicy:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F16
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref rConfigS3Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Action:
              - s3:*
            Principal: "*"
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false
          - Sid: AWSLogDeliveryWrite
            Effect: Allow
            Action:
              - s3:PutObject
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
          - Sid: AWSLogDeliveryAclCheck
            Effect: Allow
            Action:
              - s3:GetBucketAcl
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}
          - Sid: AWSConfigBucketExistenceCheck
            Effect: Allow
            Action:
              - s3:ListBucket
            Principal:
              Service:
                - config.amazonaws.com
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${rConfigS3Bucket}

  rFlowLogsS3Bucket:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



