Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IT-1295 #312

Merged
merged 4 commits into from
Jul 2, 2021
Merged

IT-1295 #312

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4417b36
IT-1295: Fix StringNotLike logic to change OR to AND
brucehoff Jun 25, 2021
d316f83
IT-1295: Fix StringNotLike logic to change OR to AND
brucehoff Jun 25, 2021
cc08063
IT-1295: S3 bucket template meets the requirements listed in IT-1295
brucehoff Jul 2, 2021
a419286
IT-1295: CR feedback
brucehoff Jul 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 60 additions & 23 deletions templates/s3-bucket-v2.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Parameters:
Default: false
BucketVersioning:
Type: String
Description: Enabled to enable bucket versionsing, default is Suspended
Description: Enabled to enable bucket versioning, default is Suspended
AllowedValues:
- Enabled
- Suspended
Expand Down Expand Up @@ -169,37 +169,74 @@ Resources:
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Sid: "ReadAccess"
Effect: "Allow"
Principal:
AWS: !Ref GrantAccess
- Sid: SynapseBucketAccess
# gives Synapse access to the bucket
Action:
- "s3:ListBucket*"
- "s3:GetBucketLocation"
Effect: Allow
Resource: !If [EnableEncryption, !GetAtt SynapseEncryptedExternalBucket.Arn, !GetAtt SynapseExternalBucket.Arn]
-
Sid: "RequireCanonicalIdOnObjectUpdates"
Effect: Deny
Principal: "*"
Action: s3:PutObject
Resource: !If [EnableEncryption, !Sub "${SynapseEncryptedExternalBucket.Arn}/*", !Sub "${SynapseExternalBucket.Arn}/*"]
Condition:
StringNotLike:
aws:userid:
- arn:aws:iam::325565585839:root
- !Ref AWS::AccountId
StringNotEquals:
s3:x-amz-acl: bucket-owner-full-control
-
Sid: "WriteAccess"
Effect: "Allow"
Principal:
AWS: !Ref GrantAccess
AWS: "325565585839"
- Sid: SynapseObjectAccess
# gives Synapse access to objects in the bucket (R/O or R/W, depending on AllowWrite)
Action:
- !If [AllowWrite, "s3:*Object*", "s3:GetObject*"]
- "s3:*MultipartUpload*"
Effect: Allow
Resource: !If [EnableEncryption, !Sub "${SynapseEncryptedExternalBucket.Arn}/*", !Sub "${SynapseExternalBucket.Arn}/*"]
Principal:
AWS: "325565585839"
- Sid: BucketAccess
# gives grantees access to the bucket
Effect: Allow
Principal:
AWS: !Ref GrantAccess
Action:
- "s3:ListBucket*"
- "s3:GetBucketLocation"
Resource: !If [EnableEncryption, !GetAtt SynapseEncryptedExternalBucket.Arn, !GetAtt SynapseExternalBucket.Arn]
- Sid: ReadObjectAccess
# give grantees read access to objects
Effect: Allow
Principal:
AWS: !Ref GrantAccess
Action:
- "s3:GetObject"
- "s3:GetObjectAcl"
- "s3:AbortMultipartUpload"
- "s3:ListMultipartUploadParts"
Resource: !If [EnableEncryption, !Sub "${SynapseEncryptedExternalBucket.Arn}/*", !Sub "${SynapseExternalBucket.Arn}/*"]
- !If
- AllowWrite
- Sid: InternalPutObjectAccess
# gives bucket-account grantees the ability to upload objects
Effect: Allow
Principal:
AWS: !Ref GrantAccess
Action:
- "s3:PutObject"
- "s3:PutObjectAcl"
Resource: !If [EnableEncryption, !Sub "${SynapseEncryptedExternalBucket.Arn}/*", !Sub "${SynapseExternalBucket.Arn}/*"]
Condition:
StringEquals:
"aws:PrincipalAccount": "055273631518"
- !Ref AWS::NoValue
- !If
- AllowWrite
- Sid: ExternalPutObjectAccess
# gives cross-account grantees the ability to upload objects
Effect: Allow
Principal:
AWS: !Ref GrantAccess
Action:
- "s3:PutObject"
- "s3:PutObjectAcl"
Resource: !If [EnableEncryption, !Sub "${SynapseEncryptedExternalBucket.Arn}/*", !Sub "${SynapseExternalBucket.Arn}/*"]
Condition:
StringEquals:
s3:x-amz-acl: bucket-owner-full-control
- !Ref AWS::NoValue

# Add owner file to the synapse bucket, requires the cloudformation S3 objects macro
# https://github.com/Sage-Bionetworks/aws-infra/tree/master/lambdas/cfn-s3objects-macro
Expand Down