aws-cf-template.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Keboola Connection - Project Data Takeout S3 bucket and user",
  "Resources": {
    "S3FilesBucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "LifecycleConfiguration": {
          "Rules": [
            {
              "Id": "Delete after 2 days",
              "Prefix": "data-takeout",
              "ExpirationInDays": 2,
              "Status": "Enabled"
            }
          ]
        }
      }
    },
    "User": {
      "Type": "AWS::IAM::User",
      "Properties": {
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "S3Access",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Action": [
                    "s3:ListBucket",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    {
                      "Fn::Join": [
                        "", [ "arn:aws:s3:::", {
                          "Ref": "S3FilesBucket"
                        } , "/*" ]
                      ]
                    },
                    {
                      "Fn::Join": [
                        "", [ "arn:aws:s3:::", {
                          "Ref": "S3FilesBucket"
                        } ]
                      ]
                    }
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": "STSFederationToken",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Action": [
                    "sts:GetFederationToken"
                  ],
                  "Effect": "Allow",
                  "Resource": [
                    {
                      "Fn::Join": [
                        "", [ "arn:aws:sts::", {
                          "Ref": "AWS::AccountId"
                        } , ":federated-user/GetProjectBackupFile" ]
                      ]
                    }
                  ]
                }
              ]
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "region": {
      "Value": {
        "Ref": "AWS::Region"
      }
    },
    "filesBucket": {
      "Value": {
        "Ref": "S3FilesBucket"
      }
    },
    "user": {
      "Value": {
        "Ref": "User"
      }
    }

  }
}