resources.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: AWS resources needed to use the CloudFormation controller for Flux

Parameters:
  EnableTemplateBucketAccessLogging:
    Description: Enable or disable configuring bucket access logging on the S3 bucket that stores your CloudFormation templates.
    Default: "false"
    Type: String
    AllowedValues: [true, false]

Conditions:
  TemplateBucketAccessLoggingCondition:
    !Equals
      - "true"
      - !Ref EnableTemplateBucketAccessLogging

Resources:

  # Bucket that the controller will use to upload CFN template files prior to syncing them to their CFN stack
  TemplateBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub flux-cfn-templates-${AWS::AccountId}-${AWS::Region}
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays : 1
            NoncurrentVersionExpiration:
              NewerNoncurrentVersions: 5
              NoncurrentDays: 1
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        !If
          - TemplateBucketAccessLoggingCondition
          - { DestinationBucketName: !Ref TemplateAccessLoggingBucket }
          - !Ref "AWS::NoValue"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    DeletionPolicy: Delete

  # Enforce HTTPS only on the template bucket
  TemplateBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref TemplateBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: 's3:*'
            Effect: Deny
            Principal:
              AWS: '*'
            Resource:
              - !Sub arn:aws:s3:::${TemplateBucket}/*
              - !Sub arn:aws:s3:::${TemplateBucket}
            Condition:
              Bool:
                'aws:SecureTransport': false

  # Send access logs from the template bucket to this bucket
  TemplateAccessLoggingBucket:
    Type: AWS::S3::Bucket
    Condition: TemplateBucketAccessLoggingCondition
    Properties:
      AccessControl: LogDeliveryWrite
      LifecycleConfiguration:
        Rules:
          - ExpirationInDays : 365
            NoncurrentVersionExpiration:
              NewerNoncurrentVersions: 5
              NoncurrentDays: 365
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 1
            Status: Enabled
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    DeletionPolicy: Delete

  TemplateAccessLoggingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: TemplateBucketAccessLoggingCondition
    Properties:
      Bucket: !Ref TemplateAccessLoggingBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: 's3:*'
            Effect: Deny
            Principal:
              AWS: '*'
            Resource:
              - !Sub arn:aws:s3:::${TemplateAccessLoggingBucket}/*
              - !Sub arn:aws:s3:::${TemplateAccessLoggingBucket}
            Condition:
              Bool:
                'aws:SecureTransport': false
          - Action: 's3:PutObject'
            Effect: Allow
            Principal:
              Service: 'logging.s3.amazonaws.com'
            Resource:
              - !Sub arn:aws:s3:::${TemplateAccessLoggingBucket}/*

  # Repository for storing CloudFormation templates
  TemplateRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: my-cloudformation-templates

  # Repository for storing Flux configuration
  FluxRepo:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: my-flux-configuration

  # User for Flux to use when interacting with CodeCommit repos
  GitUser:
    Type: AWS::IAM::User
    Properties:
      UserName: 'flux-git'
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AWSCodeCommitPowerUser"

  GitCredentials:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: flux-git-credentials
      # CloudFormation does not yet support creating service-specific credentials,
      # so this secret is a placeholder until the credentials are created manually.
      SecretString: |
        {
          "ServiceUserName":"TO-FILL-IN",
          "ServicePassword":"TO-FILL-IN"
        }