AWSTemplateFormatVersion: '2010-09-09'
Description: O11y access log bucket
Parameters:
  ELBAccountIdForS3BucketPolicy:
    Type: String
    Default: 'TMPL_ELB_ACCOUNT_ID_FOR_S3_BUCKET_POLICY'
Conditions:
  HasELBAccountId: !Not [!Equals [!Ref ELBAccountIdForS3BucketPolicy, '']]
Resources:
  AccessLogsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: TMPL_CLUSTER_NAME-ds-logs
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  AccessLogsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DeletionPolicy: Retain
    Properties:
      Bucket: !Ref AccessLogsBucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: AWSConsole-AccessLogs-Policy-1628794925198
        Statement:
          - !If 
            - HasELBAccountId
            - Sid: AWSConsoleStmt-1628794925198
              Effect: Allow
              Principal:
                AWS: !Sub 'arn:aws:iam::${ELBAccountIdForS3BucketPolicy}:root'
              Action: s3:PutObject
              Resource: !Sub 'arn:aws:s3:::${AccessLogsBucket}/*'
            - !Ref AWS::NoValue
          - Sid: AWSConsoleStmt-regions-after-202208
            Effect: Allow
            Principal:
              Service: logdelivery.elasticloadbalancing.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub 'arn:aws:s3:::${AccessLogsBucket}/*'
          - Sid: AWSLogDeliveryWrite
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub 'arn:aws:s3:::${AccessLogsBucket}/*'
            Condition:
              StringEquals:
                's3:x-amz-acl': bucket-owner-full-control
          - Sid: AWSLogDeliveryAclCheck
            Effect: Allow
            Principal:
              Service: delivery.logs.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !Sub 'arn:aws:s3:::${AccessLogsBucket}'