AWSTemplateFormatVersion: '2010-09-09'
Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    Properties:
      OwnershipControls:
        Rules:
        - ObjectOwnership: BucketOwnerPreferred
      BucketEncryption:
        ServerSideEncryptionConfiguration: 
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      ObjectLockEnabled: true
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled
        Rule:
          DefaultRetention:
            Days: 5
            Mode: COMPLIANCE
      LifecycleConfiguration:
        Rules:
          - Id: GlacierRule
            Prefix: glacier
            Status: Enabled
            ExpirationInDays: '365'
            Transitions:
              - TransitionInDays: '1'
                StorageClass: GLACIER
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LoggingConfiguration:
        DestinationBucketName: !Ref S3LoggingBucket
        LogFilePrefix: testing-logs

  S3LoggingBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      AccessControl: LogDeliveryWrite

  S3BucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:Get*'
            Effect: Allow
            Resource:
              'Fn::Join':
                - ''
                - - 'arn:aws:s3:::'
                  - Ref: S3Bucket
                  - /*
            Principal: {"Service": "s3.amazonaws.com"}
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref "AWS::AccountId"
  S3StorageLens: 
    Type: 'AWS::S3::StorageLens'
    Properties: 
      StorageLensConfiguration: 
        AccountLevel:
          ActivityMetrics:
            IsEnabled: true
          BucketLevel: 
            ActivityMetrics:
              IsEnabled: true
            PrefixLevel:
              StorageMetrics:
                IsEnabled: true
                SelectionCriteria:
                  Delimiter: /
                  MaxDepth: 2
        Id: sample-lens
        IsEnabled: true
  
Outputs:
  BucketName:
    Value:
      Ref: S3Bucket
    Description: Name of the sample Amazon S3 bucket