AWSTemplateFormatVersion: 2010-09-09
Description: ScaleOps CUR S3 Bucket Stack

Parameters:
  s3BucketName:
    Type: String
    Description: Name of new S3 bucket to receive CUR data (recommended format - scaleops-cur-<your-aws-account-id>).

Resources:
  S3CURBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref s3BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  S3CURBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3CURBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - bcm-data-exports.amazonaws.com
            Action:
              - s3:PutObject
              - s3:GetBucketPolicy
            Resource:
              - !Sub ${S3CURBucket.Arn}
              - !Sub ${S3CURBucket.Arn}/*
            Condition:
              StringLike:
                aws:SourceArn:
                  - !Sub arn:aws:bcm-data-exports:us-east-1:${AWS::AccountId}:export/*
                aws:SourceAccount: !Sub ${AWS::AccountId}

