AWSTemplateFormatVersion: "2010-09-09"
Description: S3 Logging Bucket
Parameters:
  BucketName:
    Description: The Name The Bucket will have (universally unique, lowercase)
    Type: String
    Default: my-log-bucket
Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption: 
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Ref BucketName
      LifecycleConfiguration:
        Rules:
          - AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            ExpirationInDays: 365
            NoncurrentVersionExpirationInDays: 7
            Status: Enabled
      OwnershipControls: 
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      PublicAccessBlockConfiguration:
          BlockPublicAcls: True
          BlockPublicPolicy: True
          IgnorePublicAcls: True
          RestrictPublicBuckets: True
      VersioningConfiguration:
        Status: Enabled
  LoggingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:PutObject
            Effect: Allow
            Resource: 
              - !Sub arn:aws:s3:::${S3Bucket}/*
            Principal:
              CanonicalUser: c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0
Outputs:
  LogBucketName:
    Description: Bucket to send all logs to
    Value: !Ref S3Bucket