I am trying to find a way to provide an additional level of protection to keep S3 Buckets from accidentally deleted. I want to implement bucket policies, but I want to do it through cloudformation so that if new buckets are added I can simply run the script again and have the same policy applied to new buckets.

I found this post serverfault post on how to create a bucket policy to prevent the deletion of a bucket, so it's simple enough to add the policy to a single bucket. How can I get this to work in a cloudformation script so that it applies to all S3 buckets? It would be easy enough to just add a statement for every bucket, but that doesn't seem very maintainable if additional buckets are added.

Would it be possible to create parameter that would show every bucket as a checkbox and apply the policy that way?



CloudFormation does not have functionality for dealing with wildcards and loops or "finding things". Everything in a CloudFormation template needs to be explicitly specified, one-by-one.

I think the closest you'll get is to have a bucket policy template with your bucket policy. The template would have a single bucket as a parameter.

Then, when you want to apply the bucket policy, you would create a new CloudFormation stack with your new bucket as the parameter.

Alternative 1:

You could create a CloudFormation stack which includes the S3 bucket + policy all-in-one. Then, whenever a new bucket is required, create a stack for it and then it will automatically get the policy applied.

Alternative 2:

You could use an automation tool to do the job. Tools like Skeddly can find and apply bucket policies.

Disclaimer: I am associated with the Skeddly service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.