Skip to content

Update AWS Account Id using CloudFormation

0

Hi AWS, I want to create the Amazon S3 bucket but with a condition that it should be created in a specific AWS account as this bucket is intended to store the reports generated across multiple accounts. Here is the sample code:

# version: 1.0
AWSTemplateFormatVersion: 2010-09-09
Description: Create CloudFormation Template to run control scripts

Parameters:
  BucketName:
    Type: String
    Description: Name of the S3 bucket
  KMSKeyArn:
    Type: String
    Description: KMS Key Arn to encrypt S3 bucket
    Default: ""
  SSEAlgorithm:
    Type: String
    Description: Encryption algorithm for KMS
    AllowedValues:
      - aws:kms
      - AES256
  accessControl:
    Description: Set bucket to private
    Type: String
    Default: Private
    AllowedValues:
    - Private
    - Public
  versioningConfiguration:
    Description: Bucket Name
    Type: String
    Default: Enabled
    AllowedValues:
    - Enabled
    - Suspended
  loggingBucket:
    Description: 'Optional: The name of an Amazon S3 bucket where Amazon S3 store
      server access log files. You can store log files in any bucket that you own'
    Type: String
  logFilePrefix:
    Description: 'Optional: A prefix for the all log object keys. If you store log
      files from multiple Amazon S3 buckets in a single bucket, you can use a prefix
      to distinguish which log files came from which bucket'
    Type: String
  s3PrimaryOwner:
    Description: Enter the client for the bucket
    Type: String
  s3SecondaryOwner:
    Description: Enter the client for the bucket
    Type: String
  dataResidency:
    Description: Is the data restricted to reside in a specifc country/region?
    Type: String
    AllowedValues:
    - United Kingdom
    - Canada
    - United States
    - Not Applicable
  S3BucketAWSAccountId:
    Type: String
    Description: Specific AWS account id to create S3 bucket
    Default: ""

Conditions:
  AES256: !Equals [!Ref SSEAlgorithm, "AES256"]
  IsAccountIDMatch: !Equals [!Ref S3BucketAWSAccountId, "123456789012"]
  logging_enabled:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: loggingBucket
  prefix_enabled:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: logFilePrefix

Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Ref BucketName
      AccessControl:
        Ref: accessControl
      VersioningConfiguration:
        Status:
          Ref: versioningConfiguration
      LoggingConfiguration:
        Fn::If:
        - logging_enabled
        - DestinationBucketName:
            Ref: loggingBucket
          LogFilePrefix:
            Fn::If:
            - prefix_enabled
            - Ref: logFilePrefix
            - Ref: AWS::NoValue
        - Ref: AWS::NoValue
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - !If
          - AES256
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
            BucketKeyEnabled: true
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSKeyID: !Ref KMSKeyArn
            BucketKeyEnabled: true
      Tags:
      - Key: s3_primary_owner
        Value: !Ref s3PrimaryOwner
      - Key: s3_secondary_owner
        Value: !Ref s3SecondaryOwner
      - Key: data_residency
        Value: !Ref dataResidency

The condition will work but I want that I should pass this value dynamically instead of hardcoding the AWS Account Id 123456789012 while deploying the CloudFormation Template. Is there a way we can use Custom Resource or CloudFormation Macros? Please suggest

1 Answer
0

You can refer to usage of Psuedo parameters for CloudFormation to refer to dynamic values for your templates.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html#cfn-pseudo-param-accountid

You could also use Parameters and Resources section of your templates to use the account id dynamically. Example

Resources: Yourresource: Type: AWS::anyservice::someresources Properties: SomeProperty: !Sub 'arn:aws:anyservice:${AWS::Region}:${AWS::AccountId}:someresources

Then refer in parameters

Parameters: AccountId: Type: String Default: !Ref AWS::AccountId Description: AWS Account ID

Hope this helps !

AWS

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.