1

I am trying to find a way to provide an additional level of protection to keep S3 Buckets from accidentally deleted. I want to implement bucket policies, but I want to do it through cloudformation so that if new buckets are added I can simply run the script again and have the same policy applied to new buckets.

I found this post serverfault post on how to create a bucket policy to prevent the deletion of a bucket, so it's simple enough to add the policy to a single bucket. How can I get this to work in a cloudformation script so that it applies to all S3 buckets? It would be easy enough to just add a statement for every bucket, but that doesn't seem very maintainable if additional buckets are added.

Would it be possible to create parameter that would show every bucket as a checkbox and apply the policy that way?

Thanks!

1 Answer 1

1

CloudFormation does not have functionality for dealing with wildcards and loops or "finding things". Everything in a CloudFormation template needs to be explicitly specified, one-by-one.

I think the closest you'll get is to have a bucket policy template with your bucket policy. The template would have a single bucket as a parameter.

Then, when you want to apply the bucket policy, you would create a new CloudFormation stack with your new bucket as the parameter.

Alternative 1:

You could create a CloudFormation stack which includes the S3 bucket + policy all-in-one. Then, whenever a new bucket is required, create a stack for it and then it will automatically get the policy applied.

Alternative 2:

You could use an automation tool to do the job. Tools like Skeddly can find and apply bucket policies.

Disclaimer: I am associated with the Skeddly service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .