---
AWSTemplateFormatVersion: "2010-09-09"
Description: 'Create S3 bucket and enforce the bucket owner owns all the objects uploaded by another account'

Parameters:

  SourceS3Bucket:
    Type: String
    Description: 'The bucket name where the object will be stored and uploaded'

  AnotherAccountARN:
    Type: String
    Description: 'ARN of another account role that you would like to give access to upload objects e.g arn:aws:iam::XXXAccountBXX:role/roleX'

Resources:
    S3Bucket:
      Type: 'AWS::S3::Bucket'
      Properties:
        BucketName:  !Ref 'SourceS3Bucket'
        OwnershipControls:
          Rules:
            - ObjectOwnership: BucketOwnerPreferred

    SampleBucketPolicy:
      Type: 'AWS::S3::BucketPolicy'
      Properties:
        Bucket: !Ref 'SourceS3Bucket'
        PolicyDocument:
          Statement:
            - Effect: Allow
              Principal:
                AWS:
                  - !Ref 'AnotherAccountARN'
              Action: 's3:PutObject'
              Resource: !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref 'SourceS3Bucket'
                  - /*
              Condition:
                StringEquals:
                  's3:x-amz-acl': bucket-owner-full-control

Outputs:
  BucketName:
    Value: !Ref 'S3Bucket'
    Description: Name of the sample Amazon S3 bucket to store the objects.
