IT-1295

[brucehoff]

This PR modifies the S3 bucket template to meet the requirements listed in IT-1295, i.e.:

• Can upload from Synapse;
• Can upload from the S3 console, when logged in as the bucket owner;
• Cannot upload from a different account without adding the bucket-owner-full-control ACL;
• CAN upload from a different account with the bucket-owner-full-control ACL. Bucket owner assumes ownership;
• A different account cannot change the ACL of an object in the bucket.

I created this policy interactively in S3, converted the JSON to YAML and mapped it back into the CFN template. It passes the CloudFormation Linter but we'll have to check it against the UAT bucket to ensure correctness.

There are six statements in the policy:
SynapseBucketAccess - gives Synapse access to the bucket
SynapseObjectAccess - gives Synapse access to objects in the bucket (R/O or R/W)
BucketAccess - gives grantees access to the bucket
ReadObjectAccess - give grantees read access to objects
InternalPutObjectAccess - gives bucket account grantees the ability to upload objects
ExternalPutObjectAccess - gives cross-account grantees the ability to upload objects

Note that the template has a boolean 'AllowWrite'. The *PutObjectAccess statements are conditioned on this boolean.

[zaro0508]

The policy looks pretty insane now. Would it make sense to add comments to this template describing what the policy is doing?

[zaro0508]

these if conditions look wrong. The docs provide example as !If [condition_name, value_if_true, value_if_false] which implies that valid inputs to If condition are 3 strings, not lists. Also you'll need to provide a 3rd parameter to the If construct, in this case i'm thinking you'll want a AWS::NoValue, https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html

[brucehoff]

valid inputs to If condition are 3 strings, not lists

Here's an an example that uses lists:
https://stackoverflow.com/questions/56970457/how-to-use-fnif-with-array-values-in-cloud-formation-templates

There's an example on this page too:
aws/serverless-application-model#1218

There's an example on this page that uses a nested IF in the else clause!
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/conditions-sample-templates.html

[brucehoff]

The policy looks pretty insane now. Would it make sense to add comments to this template describing what the policy is doing?

Done!