## # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. # SPDX-License-Identifier: MIT-0 # # Permission is hereby granted, free of charge, to any person obtaining a copy of this # software and associated documentation files (the "Software"), to deal in the Software # without restriction, including without limitation the rights to use, copy, modify, # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to # permit persons to whom the Software is furnished to do so. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ## AWSTemplateFormatVersion: 2010-09-09 Description: >- This AWS CloudFormation template creates an S3 bucket in a 2nd region for the AWS Lambda functions backing the AWS Config custom rules. Resources: ArtifactBucket2ndRegion: Type: "AWS::S3::Bucket" Metadata: cfn_nag: rules_to_suppress: - id: W51 reason: "Access intended only within the same account" Properties: AccessControl: Private VersioningConfiguration: Status: Enabled LoggingConfiguration: DestinationBucketName: !Ref LoggingBucket2ndRegion PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true IgnorePublicAcls: true RestrictPublicBuckets: true BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 LoggingBucket2ndRegion: Type: 'AWS::S3::Bucket' Metadata: cfn_nag: rules_to_suppress: - id: W51 reason: "Access intended only within the same account" - id: W35 reason: "This is a S3 bucket to store access logs from ArtifactBucket." Properties: AccessControl: LogDeliveryWrite VersioningConfiguration: Status: Enabled PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true IgnorePublicAcls: true RestrictPublicBuckets: true BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 Outputs: ArtifactBucket2ndRegion: Description: S3 bucket for the Lambda functions backing the Config custom rules. Value: !Ref ArtifactBucket2ndRegion Export: Name: ArtifactBucket2ndRegion