artifact-bucket.yaml

---
AWSTemplateFormatVersion: 2010-09-09

Description: >
  This template deploys an S3 bucket for storing artifacts from the build
  pipeline

Parameters:

  AppName:
      Type: String
      Description: Name of the application.
      MinLength: "1"
      MaxLength: "80"
      AllowedPattern: "[A-Za-z0-9-]+"
      ConstraintDescription: Malformed input parameter. AppName must only contain upper and lower case letters, numbers, and -.

  CodePipelineRoleName:
    Type: String
    Description: Role name the pipeline will use

  CodeBuildRoleName:
    Type: String
    Description: Role name for code build

  LambdaDeployRoleName:
    Type: String
    Description: Role name for code build

Resources:

  artifactS3Bucket:
    Description: Creating Amazon S3 bucket for AWS CodePipeline artifacts
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub "${AWS::AccountId}-${AWS::Region}-${AppName}"
      VersioningConfiguration:
        Status: Enabled

  artifactS3BucketPolicy:
    Description: Setting Amazon S3 bucket policy for AWS CodePipeline access
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref artifactS3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Id: SSEAndSSLPolicy
        Statement:
        - Sid: DenyInsecureConnections
          Effect: Deny
          Principal: "*"
          Action: s3:*
          Resource: !Sub "arn:aws:s3:::${artifactS3Bucket}/*"
          Condition:
            Bool:
              aws:SecureTransport: false

  artifactS3BucketAccessPolicy:
    Description: Setting IAM policy to allow full access to artifact bucket
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub  ${AppName}-Access${artifactS3Bucket}Bucket-${AWS::Region}
      PolicyDocument:
        Statement:
        - Effect: Allow
          Action:
          - s3:PutObject
          - s3:GetObject
          - S3:GetObjectVersion
          Resource:
          - !Sub "arn:aws:s3:::${artifactS3Bucket}/*"
      Roles:
      - !Ref CodePipelineRoleName
      - !Ref CodeBuildRoleName
      - !Ref LambdaDeployRoleName
 
Outputs:

  ArtifactS3BucketName:
    Value: !Ref artifactS3Bucket

  ArtifactS3BucketArn:
    Value: !GetAtt artifactS3Bucket.Arn