AWSTemplateFormatVersion: "2010-09-09"
Description: S3 Web Content Bucket
Parameters:
  BucketName:
    Description: The Name the CONTENT Bucket will have (universally unique, lowercase)
    Type: String
    Default: my-web-bucket
  OriginAccessIdentity:
    Description: The Origin Access Identity from CloudFront
    Type: String
Resources:
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption: 
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      BucketName: !Ref BucketName
      LifecycleConfiguration:
        Rules:
          - AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
            NoncurrentVersionExpirationInDays: 7
            Status: Enabled
      OwnershipControls: 
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      PublicAccessBlockConfiguration:
          BlockPublicAcls: True
          BlockPublicPolicy: True
          IgnorePublicAcls: True
          RestrictPublicBuckets: True
      VersioningConfiguration:
        Status: Enabled
  LoggingBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          -
            Action:
              - s3:GetObject
            Effect: Allow
            Resource: 
              - !Sub arn:aws:s3:::${S3Bucket}/*
            Principal:
              "AWS": !Sub 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${OriginAccessIdentity}'
Outputs:
  LogBucketName:
    Description: Bucket to store web content
    Value: !Ref S3Bucket