CloudWatchAutoAlarms-S3.yaml

Description: S3 Bucket for Cross-Account deployment of amazon-cloudwatch-auto-alarms Lambda function
AWSTemplateFormatVersion: '2010-09-09'

Resources:
  LambdaDeploymentBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "cloudwatch-auto-alarms-${AWS::AccountId}-${AWS::Region}"
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: DeleteRule
            Status: Enabled
            ExpirationInDays: '90'

  LambdaDeploymentBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref LambdaDeploymentBucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: SSEAndSSLPolicy
        Statement:
          - Sid: DenyInsecureConnections
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [LambdaDeploymentBucket, Arn]
                  - '/*'
            Condition:
              Bool:
                aws:SecureTransport: 'false'
          - Sid: DenyS3PublicObjectACL
            Effect: Deny
            Principal: "*"
            Action: s3:PutObjectAcl
            Resource:
              - !Join
                - ''
                - - Fn::GetAtt: [LambdaDeploymentBucket, Arn]
                  - '/*'
            Condition:
              StringEqualsIgnoreCaseIfExists:
                s3:x-amz-acl:
                  - public-read
                  - public-read-write
                  - authenticated-read

Outputs:
  LambdaDeploymentBucketName:
    Value: !Ref LambdaDeploymentBucket
    Description: "Lambda S3 deployment bucket name for deployment support of amazon-cloudwatch-auto-alarms lambda function"
    Export:
      Name: !Sub "amazon-cloudwatch-auto-alarms-bucket-name"