Hi AWS, I want to create the Amazon S3 bucket but with a condition that it should be created in a specific AWS account as this bucket is intended to store the reports generated across multiple accounts. Here is the sample code:
# version: 1.0
AWSTemplateFormatVersion: 2010-09-09
Description: Create CloudFormation Template to run control scripts
Parameters:
BucketName:
Type: String
Description: Name of the S3 bucket
KMSKeyArn:
Type: String
Description: KMS Key Arn to encrypt S3 bucket
Default: ""
SSEAlgorithm:
Type: String
Description: Encryption algorithm for KMS
AllowedValues:
- aws:kms
- AES256
accessControl:
Description: Set bucket to private
Type: String
Default: Private
AllowedValues:
- Private
- Public
versioningConfiguration:
Description: Bucket Name
Type: String
Default: Enabled
AllowedValues:
- Enabled
- Suspended
loggingBucket:
Description: 'Optional: The name of an Amazon S3 bucket where Amazon S3 store
server access log files. You can store log files in any bucket that you own'
Type: String
logFilePrefix:
Description: 'Optional: A prefix for the all log object keys. If you store log
files from multiple Amazon S3 buckets in a single bucket, you can use a prefix
to distinguish which log files came from which bucket'
Type: String
s3PrimaryOwner:
Description: Enter the client for the bucket
Type: String
s3SecondaryOwner:
Description: Enter the client for the bucket
Type: String
dataResidency:
Description: Is the data restricted to reside in a specifc country/region?
Type: String
AllowedValues:
- United Kingdom
- Canada
- United States
- Not Applicable
S3BucketAWSAccountId:
Type: String
Description: Specific AWS account id to create S3 bucket
Default: ""
Conditions:
AES256: !Equals [!Ref SSEAlgorithm, "AES256"]
IsAccountIDMatch: !Equals [!Ref S3BucketAWSAccountId, "123456789012"]
logging_enabled:
Fn::Not:
- Fn::Equals:
- ''
- Ref: loggingBucket
prefix_enabled:
Fn::Not:
- Fn::Equals:
- ''
- Ref: logFilePrefix
Resources:
S3Bucket:
Type: 'AWS::S3::Bucket'
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
BucketName: !Ref BucketName
AccessControl:
Ref: accessControl
VersioningConfiguration:
Status:
Ref: versioningConfiguration
LoggingConfiguration:
Fn::If:
- logging_enabled
- DestinationBucketName:
Ref: loggingBucket
LogFilePrefix:
Fn::If:
- prefix_enabled
- Ref: logFilePrefix
- Ref: AWS::NoValue
- Ref: AWS::NoValue
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
BucketEncryption:
ServerSideEncryptionConfiguration:
- !If
- AES256
- ServerSideEncryptionByDefault:
SSEAlgorithm: !Ref SSEAlgorithm
BucketKeyEnabled: true
- ServerSideEncryptionByDefault:
SSEAlgorithm: !Ref SSEAlgorithm
KMSKeyID: !Ref KMSKeyArn
BucketKeyEnabled: true
Tags:
- Key: s3_primary_owner
Value: !Ref s3PrimaryOwner
- Key: s3_secondary_owner
Value: !Ref s3SecondaryOwner
- Key: data_residency
Value: !Ref dataResidency
The condition will work but I want that I should pass this value dynamically instead of hardcoding the AWS Account Id 123456789012 while deploying the CloudFormation Template. Is there a way we can use Custom Resource or CloudFormation Macros? Please suggest