storage.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: VaultDB Create secure S3 bucket to store data

Parameters:
  ApplicationName:
    Type: String
    AllowedPattern: "^[a-z][a-z0-9-]{0,48}[a-z0-9]$"
    Description: Enter the name of your application with no spaces.

Metadata:
  Author: VaultDB.ai
  Url: https://www.vaultdb.ai

Rules:
  ApplicationNameIsRequired:
    Assertions:
      - AssertDescription: Application Name is required
        Assert: !Not [!Equals [!Ref ApplicationName, ""]]

Resources:
  DataBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName:
        !Join ["", [!Ref ApplicationName, "-data-", !Sub "${AWS::AccountId}"]]
      Tags:
        - Key: Purpose
          Value: "VaultDB"
        - Key: Project
          Value: !Ref ApplicationName
        - Key: createdBy
          Value: vaultdb.ai
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - Id: DeleteArchivedContentsAfter7Days
            Prefix: 'archived/'
            Status: Enabled
            ExpirationInDays: 7
          # - Id: GlacierRule
          #   Prefix: 'archived/'
          #   Status: Disabled
          #   ExpirationInDays: 7
          #   Transitions:
          #     - TransitionInDays: 1
          #       StorageClass: GLACIER

  PublicBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName:
        !Join [
          "",
          [!Ref ApplicationName, "-public-storage-", !Sub "${AWS::AccountId}"],
        ]
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - GET
              - PUT
              - POST
              - HEAD
            AllowedOrigins:
              - "*"
            MaxAge: 1800
            ExposedHeaders:
              - "x-amz-server-side-encryption"
              - "x-amz-request-id"
              - "x-amz-id-2"
              - "ETag"
      Tags:
        - Key: Purpose
          Value: "VaultDB"
        - Key: Project
          Value: !Ref ApplicationName
        - Key: createdBy
          Value: vaultdb.ai
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      WebsiteConfiguration:
        IndexDocument: "index.html"
        ErrorDocument: "error.html"
      PublicAccessBlockConfiguration:
        BlockPublicPolicy: false

  PublicBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref PublicBucket
      PolicyDocument:
        Id: PublicReadPolicy
        Version: 2012-10-17
        Statement:
          - Sid: PublicReadForGetBucketObjects
            Effect: Allow
            Principal: "*"
            Action: "s3:GetObject"
            Resource: !Sub arn:aws:s3:::${PublicBucket}/*
          - Sid: AddPermlist
            Effect: Allow
            Principal: "*"
            Action: "s3:ListBucket"
            Resource: !Sub arn:aws:s3:::${PublicBucket}
          #- Sid: AddPutObject
          #  Effect: Allow
          #  Principal: "*"
          #  Action: "s3:PutBucket"
          #  Resource: !Sub arn:aws:s3:::${PublicBucket}

  EFSFileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      BackupPolicy:
        Status: ENABLED
      Encrypted: true
      LifecyclePolicies:
        - TransitionToIA: AFTER_60_DAYS
      PerformanceMode: generalPurpose
      ThroughputMode: bursting
      FileSystemTags:
        - Key: Purpose
          Value: "VaultDB"
        - Key: Project
          Value: !Ref ApplicationName
        - Key: createdBy
          Value: vaultdb.ai

  EFSAccessPointResource:
    Type: AWS::EFS::AccessPoint
    Properties:
      FileSystemId: !Ref EFSFileSystem
      PosixUser:
        Uid: 1001
        Gid: 1001
      RootDirectory:
        CreationInfo:
          OwnerGid: 1001
          OwnerUid: 1001
          Permissions: 770
        Path: /commitlog

  EFSMountTarget:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref EFSFileSystem
      SecurityGroups:
        - Fn::ImportValue: !Sub "${ApplicationName}-DataSecurityGroup"
      SubnetId:
        Fn::ImportValue: !Sub "${ApplicationName}-VPCPrivateSubnet"

Outputs:
  DataBucketNameArn:
    Description: ANR of the main bucket
    Value: !GetAtt DataBucket.Arn
    Export:
      Name: !Sub ${ApplicationName}-DataBucket-arn
  DataBucketName:
    Description: Name of the main bucket
    Value: !Ref DataBucket
    Export:
      Name: !Sub ${ApplicationName}-DataBucket
  PublicBucketArn:
    Description: Name of the public bucket
    Value: !GetAtt PublicBucket.Arn
    Export:
      Name: !Sub ${ApplicationName}-PublicBucket-arn
  PublicBucket:
    Description: Name of the public bucket
    Value: !Ref PublicBucket
    Export:
      Name: !Sub ${ApplicationName}-PublicBucket
  WebsiteURL:
    Value: !GetAtt PublicBucket.WebsiteURL
    Description: URL for website hosted on S3
    Export:
      Name: !Sub ${ApplicationName}-WebsiteURL
  EFSFileSystem:
    Description: The created EFS
    Value: !Ref EFSFileSystem
    Export:
      Name: !Sub ${ApplicationName}-EFSFileSystem
  EFSMountTarget:
    Description: The EFS EFSMountTarget
    Value: !Ref EFSMountTarget
    Export:
      Name: !Sub ${ApplicationName}-EFSMountTarget
  EFSAccessPointResource:
    Description: EFS Access Point Resource
    Value: !GetAtt EFSAccessPointResource.Arn
    Export:
      Name: !Sub ${ApplicationName}-EFSAccessPointResource