s3-bucket-acces-to-a-specific-role-use-principal-arn.yaml

s3-bucket-acces-to-a-specific-role-use-principal-arn.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Access Restricted S3 Bucket

Parameters:
  S3BucketName:
    Description: Type of this BacketName.
    Type: String
  SSHPublicKeySSMKey:
    Description: Type of this BacketName.
    Type: String
  SSHPublicKeySSMKeyRevision:
    Description: Type of this BacketName.
    Type: String
    Default: 1
Resources:
  AccessAllowRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      RoleName: !Sub "${S3BucketName}-access-allow-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: "sts:AssumeRole"
          - Effect: "Allow"
            Principal:
              Service:
                - "transfer.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      MaxSessionDuration: 3600
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  AccessDenyRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      RoleName: !Sub "${S3BucketName}-access-deny-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: "sts:AssumeRole"
          - Effect: "Allow"
            Principal:
              Service:
                - "transfer.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      MaxSessionDuration: 3600
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
  SftpServer:
    Type: AWS::Transfer::Server
    Properties:
      Protocols:
        - SFTP
  SftpAlloAccessUser:
    Type: AWS::Transfer::User
    Properties:
      UserName: !Sub sftp-${S3BucketName}-access-allow-user
      Role: !GetAtt AccessAllowRole.Arn
      ServerId: !GetAtt SftpServer.ServerId
      SshPublicKeys:
        - !Sub "{{resolve:ssm:${SSHPublicKeySSMKey}:${SSHPublicKeySSMKeyRevision}}}"
  SftpDenyAccessUser:
    Type: AWS::Transfer::User
    Properties:
      UserName: !Sub sftp-${S3BucketName}-access-deny-user
      Role: !GetAtt AccessDenyRole.Arn
      ServerId: !GetAtt SftpServer.ServerId
      SshPublicKeys:
        - !Sub "{{resolve:ssm:${SSHPublicKeySSMKey}:${SSHPublicKeySSMKeyRevision}}}"

  AccessCheckBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub ${S3BucketName}

  AccessCheckBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref AccessCheckBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
              - "s3:*"
            Effect: Deny
            Sid: MultiRestrictPolicy
            Resource:
              - !Sub "arn:aws:s3:::${AccessCheckBucket}"
              - !Sub "arn:aws:s3:::${AccessCheckBucket}/*"
            Principal: "*"
            Condition:
              StringNotEquals:
                "aws:PrincipalArn":
                  - !GetAtt AccessAllowRole.Arn
                "aws:CalledVia":
                  - "cloudformation.amazonaws.com"
  AccessAllowCheckLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: "index.lambda_handler"
      Role: !GetAtt [AccessAllowRole, Arn]
      Code:
        ZipFile: !Sub |
          import boto3


          def lambda_handler(event, context):
            s3 = boto3.client('s3')
            s3.download_file("${AccessCheckBucket}", 'Happy20thanniversarytoClassMethod.txt', '/tmp/Happy20thanniversarytoClassMethod.txt')
      Runtime: "python3.9"
      Timeout: 60
  AccessDenyCheckLambda:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: "index.lambda_handler"
      Role: !GetAtt [AccessDenyRole, Arn]
      Code:
        ZipFile: !Sub |
          import boto3


          def lambda_handler(event, context):
            s3 = boto3.client('s3')
            s3.download_file("${AccessCheckBucket}", 'Happy20thanniversarytoClassMethod.txt', '/tmp/Happy20thanniversarytoClassMethod.txt')
      Runtime: "python3.9"
      Timeout: 60

Outputs:
  AccessCheckBucket:
    Value: !Ref AccessCheckBucket
  AccessAllowRole:
    Value: !GetAtt [AccessAllowRole, Arn]
  AccessDenyRole:
    Value: !GetAtt [AccessDenyRole, Arn]