aws-cloudformation-s3

# AWS CloudFormation S3 Patterns Provides S3 bucket configurations, policies, versioning, lifecycle rules, and CloudFormation template structure best practices for production-ready infrastructure. ## When to Use - Creating S3 buckets with custom configurations - Implementing bucket policies for access control - Configuring S3 versioning for data protection - Setting up lifecycle rules for data management - Creating Outputs for cross-stack references - Using Parameters with AWS-specific types - Organizing templates with Mappings and Conditions ## Overview S3 bucket configurations, policies, versioning, lifecycle rules, and CloudFormation template structure for production-ready infrastructure. ## Instructions 1. **Define Bucket Resources**: Create `AWS::S3::Bucket` with versioning, encryption, PublicAccessBlock 2. **Configure Bucket Policy**: Set up IAM policies for access control 3. **Set Up Lifecycle Rules**: Define transitions and expiration policies 4. **Configure CORS**: Allow cross-origin requests if needed 5. **Add Outputs**: Export bucket names/ARNs for cross-stack references **Validate before deploy:** ```bash aws cloudformation validate-template --template-body file://template.yaml ``` **Deploy with rollback on failure:** ```bash aws cloudformation deploy \ --template-file template.yaml \ --stack-name my-s3-stack \ --capabilities CAPABILITY_IAM ``` If deployment fails, CloudFormation automatically rolls back. Check failures with: ```bash aws cloudformation describe-stack-events --stack-name my-s3-stack ``` ## Quick Reference | Resource Type | Purpose | |---------------|---------| | `AWS::S3::Bucket` | Create S3 bucket | | `AWS::S3::BucketPolicy` | Set bucket-level policies | | `AWS::S3::BucketReplication` | Cross-region replication | | Parameters | Input values for customization | | Mappings | Static configuration tables | | Conditions | Conditional resource creation | | Outputs | Return values for cross-stack references | ## Examples ### Basic S3 Bucket ```yaml Resources: DataBucket: Type: AWS::S3::Bucket Properties: BucketName: my-data-bucket ``` ### Bucket with Versioning and Encryption ```yaml DataBucket: Type: AWS::S3::Bucket Properties: BucketName: !Sub "${AWS::StackName}-data" VersioningConfiguration: Status: Enabled BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: SSEAlgorithm: AES256 PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true ``` ### Lifecycle Rule ```yaml DataBucket: Type: AWS::S3::Bucket Properties: LifecycleConfiguration: Rules: - Id: ArchiveOldData Status: Enabled Transitions: - StorageClass: GLACIER TransitionInDays: 365 ``` ### Bucket Policy ```yaml BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref DataBucket PolicyDocument: Statement: - Effect: Allow Principal: AWS: !Ref RoleArn Action: - s3:GetObject Resource: !Sub "${DataBucket.Arn}/*" ``` See [references/complete-examples.md](references/complete-examples.md) for more complete examples including CORS, static websites, replication, and production-ready configurations. ## Template Structure ### Template Sections ```yaml AWSTemplateFormatVersion: 2010-09-09 Description: Template description Mappings: {} # Static configuration tables Metadata: {} # Additional information Parameters: {} # Input values Conditions: {} # Conditional creation Transform: {} # Macro processing Resources: {} # AWS resources (REQUIRED) Outputs: {} # Return values ``` ### Parameters ```yaml Parameters: BucketName: Type: String Description: S3 bucket name Default: my-bucket MinLength: 3 MaxLength: 63 AllowedPattern: '^[a-z0-9-]+$' ``` ### Conditions ```yaml Conditions: IsProduction: !Equals [!Ref Environment, prod] ShouldEnableVersioning: !Equals [!Ref EnableVersioning, 'true'] Resources: DataBucket: Type: AWS::S3::Bucket Properties: VersioningConfiguration: Status: !If [ShouldEnableVersioning, Enabled, Suspended] ``` ### Outputs ```yaml Outputs: BucketName: Description: Name of the S3 bucket Value: !Ref DataBucket Export: Name: !Sub '${AWS::StackName}-BucketName' ``` See [references/advanced-configuration.md](references/advanced-configuration.md) for detailed Mappings, Conditions, Parameters, and cross-stack references. ## Best Practices 1. **Public Access Block**: Always enable for non-static website buckets 2. **Versioning**: Enable for critical data to prevent accidental deletion 3. **Bucket Policies**: Use instead of ACLs for access control 4. **Lifecycle Rules**: Implement cost optimization with tiering 5. **Encryption**: Enable default encryption (SSE-KMS or AES256) 6. **Tags**: Tag all resources for organization and cost allocation 7. **Outputs**: Export bucket names/ARNs for cross-stack references 8. **Parameters**: Use parameters for reusability across environments ## Common Troubleshooting **Bucket already exists**: Use unique bucket names with CloudFormation stack name **Access denied**: Verify bucket policy and IAM permissions **Versioning conflicts**: Cannot suspend versioning once objects exist **Lifecycle not working**: Check rule status and prefix filters **Cross-stack references**: Ensure outputs are exported before importing ## Related Skills - [aws-cloudformation-security](../aws-cloudformation-security/) - Security best practices for S3 - [aws-cloudformation-lambda](../aws-cloudformation-lambda/) - Lambda triggers for S3 events - [aws-cloudformation-iam](../aws-cloudformation-iam/) - IAM roles for S3 access ## References ### Complete Examples - **[references/complete-examples.md](references/complete-examples.md)** - Basic buckets, versioning, lifecycle, CORS, policies, production stacks, event notifications, static websites, replication ### Advanced Configuration - **[references/advanced-configuration.md](references/advanced-configuration.md)** - Parameters, Mappings, Conditions, Outputs, Metadata, DeletionPolicy, DependsOn, Transform ## Constraints and Warnings - **Bucket names**: Must be globally unique (across all AWS accounts) - **Versioning**: Cannot be suspended once objects exist in bucket - **Lifecycle rules**: Minimum 1 day for expiration, 0 days for transitions - **Bucket policies**: Limited to 20 KB in size - **Public access**: Blocked by default; requires explicit configuration - **CORS**: Limited to 100 rules per bucket - **Replication**: Versioning must be enabled on both source and destination - **Encryption**: KMS keys must be in same region as bucket - **Tags**: Maximum 50 tags per resource - **Stack limits**: CloudFormation limits resources per stack (200 default)