s3-synapse-sync-bucket.j2

AWSTemplateFormatVersion: '2010-09-09'
Transform: S3Objects
Description: >-
  Synapse S3 Custom Storage
  (https://docs.synapse.org/articles/custom_storage_location.html)
Parameters:
  S3SynapseSyncFunctionArn:
    Type: String
    Description: The S3 Synapse sync lambda function ARN
    ConstraintDescription: >-
      Must be the lambda function ARN
      (i.e. arn:aws:lambda:us-east-1:787179373106:function:my-lambda-S3SynpaseSyncFunction)
  S3SynapseSyncFunctionRoleArn:
    Type: String
    Description: The S3 Synapse sync lambda function role ARN
    ConstraintDescription: >-
      Must be the lambda role ARN (i.e. arn:aws:iam::055273631518:role/s3-syanpase-sync-LambdaRole-JRQLRZDI9TMS)
  SynapseRootArn:
    Type: String
    Description: The Synapse root account ARN
    Default: "arn:aws:iam::325565585839:root"
    ConstraintDescription: >-
      Must be the ARN of the Synapse root account
  SynapseIDs:
    Type: CommaDelimitedList
    Description: >-
      List of Synapse bucket user or team owners
    ConstraintDescription: >-
      List of Synapse user or team IDs separated by commas
      (i.e. 1111111, 2222222)
  S3UserARNs:
    Type: CommaDelimitedList
    Description: >-
      (Optional) User ARNs allowed to access S3 Bucket,
      in addition to provisioning user
    ConstraintDescription: >-
      List of ARNs separated by commas (e.g.
      arn:aws:iam::011223344556:user/jdoe,arn:aws:iam::544332211006:user/rjones)
  DenyDeleteARNs:
    Type: CommaDelimitedList
    Description: >-
      (Optional) User ARNs NOT allowed to delelte objects in S3 Bucket
    ConstraintDescription: >-
      List of ARNs separated by commas (e.g.
      arn:aws:iam::011223344556:user/jdoe,arn:aws:iam::544332211006:user/rjones)
  S3AdminARNs:
    Type: CommaDelimitedList
    Description: >-
      (Optional) User ARNs of S3 bucket admins
    ConstraintDescription: >-
      List of ARNs separated by commas (e.g.
      arn:aws:iam::011223344556:user/jdoe,arn:aws:iam::544332211006:user/rjones)
  BucketName:
    Type: String
    Description: (Optional) Name of the created bucket.
    Default: ""
  EnableDataLifeCycle:
    Type: String
    Description: Enabled to enable bucket lifecycle rule, default is Disabled
    AllowedValues:
      - Enabled
      - Disabled
    Default: Disabled
  LifecycleDataTransition:
    Type: Number
    Description: Number of days until S3 objects are moved to LifecycleDataStorageClass
    Default: 30
    MaxValue: 360
    MinValue: 1
  LifecycleDataStorageClass:
    Type: String
    Description: S3 bucket objects will transition into this storage class
    AllowedValues:
      - DEEP_ARCHIVE
      - INTELLIGENT_TIERING
      - STANDARD_IA
      - ONEZONE_IA
      - GLACIER
    Default: GLACIER
  LifecycleDataExpiration:
    Type: Number
    Description: Number of days (from creation) when objects are deleted from S3 and the LifecycleDataStorageClass
    Default: 365000
    MaxValue: 365000
    MinValue: 360
Conditions:
  HasBucketName: !Not [!Equals [!Ref BucketName, ""]]
Resources:
  S3Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !If [HasBucketName, !Ref BucketName, !Ref 'AWS::NoValue']
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      CorsConfiguration:
        CorsRules:
          - Id: SynapseCORSRule
            AllowedHeaders: ['*']
            AllowedOrigins: ['*']
            AllowedMethods: [GET, POST, PUT, HEAD]
            MaxAge: 3000
      LifecycleConfiguration:
        Rules:
        - Id: DataLifecycleRule
          Status: !Ref EnableDataLifeCycle
          ExpirationInDays: !Ref LifecycleDataExpiration
          Transitions:
            - TransitionInDays: !Ref LifecycleDataTransition
              StorageClass: !Ref LifecycleDataStorageClass
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
       # LambdaBucketPermission must be setup before NotificationConfiguration
       # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html
    {% if sceptre_user_data.EnableNotificationConfiguration.lower() == 'true' %}
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: "s3:ObjectCreated:*"
            Function: !Ref S3SynapseSyncFunctionArn
          - Event: "s3:ObjectRemoved:*"
            Function: !Ref S3SynapseSyncFunctionArn
    {% endif %}
  LambdaBucketPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref S3SynapseSyncFunctionArn
      Principal: s3.amazonaws.com
      SourceAccount: !Ref "AWS::AccountId"
      SourceArn: !GetAtt S3Bucket.Arn
  S3BucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Sid: "ReadAccess"
            Effect: "Allow"
            Principal:
              AWS: !Split
                - ","
                - !Sub
                  - "${list},${SynapseRootArn}"
                  - list: !Join [",",!Ref "S3UserARNs"]
            Action:
              - "s3:ListBucket*"
              - "s3:GetBucketLocation"
            Resource: !GetAtt S3Bucket.Arn
          -
            Sid: "WriteAccess"
            Effect: "Allow"
            Principal:
              AWS: !Split
                - ","
                - !Sub
                  - "${list},${SynapseRootArn}"
                  - list: !Join [",",!Ref "S3UserARNs"]
            Action:
              - "s3:*Object*"
              - "s3:*MultipartUpload*"
            Resource: !Sub "${S3Bucket.Arn}/*"
          -
            Sid: "LambdaAccess"
            Effect: Allow
            Principal:
              AWS: !Ref S3SynapseSyncFunctionRoleArn
            Action:
              - s3:GetObject
              - s3:PutObject
              - s3:PutObjectAcl
            Resource: !Sub "${S3Bucket.Arn}/*"
          -
            Sid: "DenyDeleteObject"
            Effect: Deny
            Principal:
              AWS: !Ref DenyDeleteARNs
            Action:
              - s3:*Delete*
            Resource: !Sub "${S3Bucket.Arn}/*"
          -
            Sid: "AdminBucketObjectAccess"
            Effect: Allow
            Principal:
              AWS: !Ref S3AdminARNs
            Action:
              - s3:*
            Resource: !Sub "${S3Bucket.Arn}/*"
          -
            Sid: "AdminBucketAccess"
            Effect: "Allow"
            Principal:
              AWS: !Ref S3AdminARNs
            Action:
              - s3:*
            Resource: !GetAtt S3Bucket.Arn


  # Add owner file to the synapse bucket, requires the cloudformation S3 objects macro
  # https://github.com/Sage-Bionetworks-IT/cfn-s3objects-macro
  SynapseOwnerFile:
    Type: AWS::S3::Object
    DependsOn: "S3BucketPolicy"
    Metadata:
      cfn-lint:
        config:
          ignore_checks:
            - E3001
    Properties:
      Target:
        Bucket: !Ref S3Bucket
        Key: owner.txt
        ContentType: text
      Body: !Sub
        - "${list}"
        - list: !Join [",",!Ref "SynapseIDs"]

Outputs:
  BucketName:
    Description: 'The name of the S3 Bucket'
    Value: !Ref 'S3Bucket'
  BucketARN:
    Description: 'The ARN of the S3 Bucket'
    Value: !GetAtt 'S3Bucket.Arn'
  BucketUrl:
    Description: 'View the S3 Bucket in the AWS Console'
    Value: !Sub 'https://console.aws.amazon.com/s3/home?region=${AWS::Region}&bucket=${S3Bucket}'