
# (c) 2019 Amazon Web Services, Inc. or its affiliates. All Rights Reserved. 
# This AWS Content is provided subject to the terms of the AWS Customer 
# Agreement available at https://aws.amazon.com/agreement or other written 
# agreement between Customer and Amazon Web Services, Inc. 
AWSTemplateFormatVersion: "2010-09-09" 
Description: This template creates the cross account access to a specific folder within an org 



##################################################### 
# 
# Parameters 
# 
##################################################### 
Parameters:

  pAccessPointName: 
    Type: String  
    Description: Access Point Name.
    Default: ops-audit

  pFoldertoAccess: 
    Type: String  
    Description: Folder to Access Name.
    Default: audit

  pAuditAccountID: 
    Type: String  
    Description: Account ID requiring access.

  pRoleName: 
    Type: String  
    Description: S3 Access Point role Name.
    Default: S3AccessPointRole
  
    
##################################################### 
# 
# Resources 
# 
##################################################### 
Resources: 

  rAccessPoint: 
    DependsOn: 
    - rS3Bucket 
    - rCrossAccountRole
    Type: AWS::S3::AccessPoint
    Properties: 
      Bucket: !Ref rS3Bucket
      Name: !Ref pAccessPointName
      NetworkOrigin: Internet
      Policy:
        Version: "2012-10-17" 
        Statement: 
            - 
                Action: 
                    - "s3:GetObject"
                Effect: "Allow"
                Resource: 
                    Fn::Join: 
                    - ""
                    - 
                        - "arn:aws:s3:"
                        - 
                          !Ref AWS::Region
                        - ":"
                        - 
                          !Ref AWS::AccountId
                        - ":accesspoint/"
                        -
                          !Ref pAccessPointName
                        - "/object/"
                        -
                          !Ref pFoldertoAccess
                        - "/*"
                Principal: 
                    AWS: !GetAtt
                      - rCrossAccountRole
                      - Arn
     

  rS3Bucket:  
   Type: AWS::S3::Bucket
   
   
  rS3BucketPolicy:
   DependsOn: 
   - rS3Bucket 
   - rCrossAccountRole
   Type: AWS::S3::BucketPolicy
   Properties: 
    Bucket: !Ref rS3Bucket
    PolicyDocument: 
      Statement: 
        - 
          Action: 
            - "s3:GetObject"
          Effect: "Allow"
          Resource: 
            Fn::Join: 
              - ""
              - 
                - "arn:aws:s3:::"
                - 
                 !Ref rS3Bucket
                - "/"
                -
                 !Ref pFoldertoAccess
                - "/*"
          Principal: 
            AWS: !GetAtt
               - rCrossAccountRole
               - Arn
          Condition: 
            StringEquals: 
              s3:DataAccessPointAccount: 
                - 
                  !Ref AWS::AccountId

  rCrossAccountRole:
   Type: AWS::IAM::Role
   Properties:
      RoleName: !Ref pRoleName 
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement:
              - Effect: Allow
                Principal:
                  AWS:
                      Fn::Join: 
                      - ""
                      - 
                          - "arn:aws:iam::"
                          - 
                            !Ref pAuditAccountID
                          - ":root"
                     
                Action:
                  - 'sts:AssumeRole'

  rCrossAccountRolePolicy:
    DependsOn: 
    - rCrossAccountRole
    - rS3Bucket
    Type: AWS::IAM::Policy
    Properties: 
      PolicyDocument: 
         Version: '2012-10-17'
         Statement:
              Effect: Allow
              Action: 
                - 's3:GetAccessPoint'
                - 's3:ListAllMyBuckets'
                - 's3:ListAccessPoints'
                - 's3:ListBucket'
                - 's3:HeadBucket'
              Resource: '*'
      PolicyName: !Sub ${AWS::StackName}-crossaccountpolicy
      Roles: 
       - 
        !Ref pRoleName 



  
        
          



       