rubrik_cloudout.template

{
"AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Complete the AWS configuration process required for the Rubrik CloudOut which uses an S3 bucket for archiving to Amazon.",
    "Metadata": {
        "AWS::CloudFormation::Interface" : {
            "ParameterGroups" : [
              {
                "Label": { "default" : "Storage Configuration" },
                "Parameters": [ "CreateNewS3Bucket", "S3BucketName" ]
              },
              {
                "Label": { "default" : "IAM Users and Roles" },
                "Parameters": [ "CreateNewUser", "IAMUserName" ]
              },
              {
                "Label": { "default" : "Optional" },
                "Parameters": [ "UserPolicyName", "UseKMS" ]
              }
            ]
          }
    },
    "Parameters": {
    
        "CreateNewS3Bucket": {
            "Description": "Create a new S3 Bucket to use as a Rubrik archival location.",
            "Type": "String",
            "Default": "yes",
            "AllowedValues": [ "yes", "no" ],
            "ConstraintDescription": "Choose 'yes' to create a new S3 Bucket or 'no' to use an existing bucket."
        },

        "S3BucketName": {
            "Description": "The name of the S3 Bucket used as a Rubrik archival location.",
            "Type": "String",
            "MinLength": "3",
            "MaxLength": "63",
            "AllowedPattern" : "^([a-z]|(\\d(?!\\d{0,2}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})))([a-z\\d]|(\\.(?!(\\.|-)))|(-(?!\\.))){1,61}[a-z\\d\\.]$",
            "ConstraintDescription" : "Can only contain lowercase characters, numbers, periods, and dashes"
        },

        "CreateNewUser" : {
            "Description": "Create a new IAM user specific to Rubrik.",
            "Type": "String",
            "Default": "yes",
            "AllowedValues": [ "yes", "no" ],
            "ConstraintDescription"	: "Choose 'yes' to create a new IAM User specific to Rubrik or 'no' to use an existing IAM User."
          },

        "IAMUserName" : {
            "Description": "The name of the IAM User to assign the new CloudOut specific policies to.",
            "Type": "String",
            "Default": "rubrik"
        },

        "UseKMS": {
            "Description": "Create a new KMS key for encryption.",
            "Type": "String",
            "Default": "yes",
            "AllowedValues": [ "yes", "no" ],
            "ConstraintDescription": "Choose 'yes' to create a new KMS Key for encryption"
        },

        "UserPolicyName": {
            "Description": "S3 Security policy used for Rubrik CloudOut.",
            "Type": "String",
            "Default": "rubrik-cloudout"
        }
    },

    "Mappings": {
    },

    "Conditions": {
        "CreateBucket" : { "Fn::Equals" : [ {"Ref" : "CreateNewS3Bucket"}, "yes" ] },
        "CreateIAMuser" : { "Fn::Equals" : [ {"Ref" : "CreateNewUser"}, "yes" ] },
        "DontCreateIAMuser" : { "Fn::Equals" : [ {"Ref" : "CreateNewUser"}, "no" ] },
        "CreateKMS" : { "Fn::Equals" : [ {"Ref" : "UseKMS"}, "yes" ] }

    },

    "Resources": {
        "CreateS3Bucket": {
            "Type": "AWS::S3::Bucket",
            "Condition" : "CreateBucket",
            "DeletionPolicy" : "Retain",
            "Properties": {
                "AccessControl": "Private",
                "BucketName": { "Ref" : "S3BucketName" }
                
            }
        },    

        "CreateNewIAMUser": {
            "Type": "AWS::IAM::User",
            "Condition" : "CreateIAMuser",
            "DeletionPolicy" : "Retain",
            "Properties": {
                "UserName": { "Ref" : "IAMUserName" }
            }
        },
      
        "IAMUserAccessKeys": {
            "Type": "AWS::IAM::AccessKey",
            "Condition" : "CreateIAMuser",
            "DeletionPolicy" : "Retain",
            "DependsOn": "CreateNewIAMUser",
            "Properties": {
                "UserName": { "Ref" : "IAMUserName" }
            }
        },

        "CreatePolicy": {
            "Type": "AWS::IAM::Policy",
            "DeletionPolicy" : "Retain",
            "Properties": {
                "PolicyName": { "Ref" : "UserPolicyName" },
                "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:CreateBucket",
                            "s3:ListAllMyBuckets"
                        ],
                        "Resource": "arn:aws:s3:::*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:ListBucket",
                            "s3:GetBucketLocation",
                            "s3:GetBucketAcl"
                        ],
                        "Resource": { "Fn::Join" : [ "", [ "arn:aws:s3:::", { "Ref": "S3BucketName" } ] ] }
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:PutObject",
                            "s3:GetObject",
                            "s3:DeleteObject",
                            "s3:AbortMultipartUpload",
                            "s3:ListMultipartUploadParts",
                            "s3:RestoreObject"
                        ],
                        "Resource": { "Fn::Join" : [ "", [ "arn:aws:s3:::", { "Ref": "S3BucketName" }, "/*" ] ] }
                        
                    }
                ]
                },
                "Users": [ { "Fn::If": ["CreateIAMuser", { 
                    "Ref" : "CreateNewIAMUser"
                    }, { 
                        "Ref" : "IAMUserName" 
                    } ]
                } ]
            }
        },

       "CreateKMSKey" : {
            "Type" : "AWS::KMS::Key",
            "Condition" : "CreateKMS",
            "Properties" : {
                "Description" : "Rubrik archive location encryption",
                "KeyPolicy" : {
                    "Version": "2012-10-17",
                    "Id": { "Fn::Join" : [ "", [ "rubrik-encryption-", { "Ref": "S3BucketName" } ] ] },
                    "Statement": [
                         {
                            "Sid": "Enable IAM User Permissions",
                            "Effect": "Allow",
                            "Principal": {
                                
                                "AWS": { "Fn::Join" : [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] }
                            },
                            "Action": "kms:*",
                            "Resource": "*"
                        },
                        {
                            "Sid": "Allow use of the key",
                            "Effect": "Allow",
                            "Principal": { "AWS": { 
                                "Fn::If": ["CreateIAMuser", { 
                                        "Fn::GetAtt" : [ "CreateNewIAMUser", "Arn" ] 
                                    }, { 
                                        "Fn::Join" : [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":user/", {"Ref" : "IAMUserName"} ] ] 
                                    } ]
                                } 
                            },
                            "Action": [
                                "kms:Encrypt",
                                "kms:Decrypt",
                                "kms:ReEncrypt*",
                                "kms:GenerateDataKey*",
                                "kms:DescribeKey"
                            ], 
                            "Resource": "*"
                        }    
                    ]
                }
            }
        },

        "KMSKeyAlias" : {
            "Type" : "AWS::KMS::Alias",
            "DependsOn" : "CreateKMSKey",
            "Condition" : "CreateKMS",
            "Properties" : {
                "AliasName" : { "Fn::Join" : [ "", [ "alias/rubrik-encryption-", { "Ref": "S3BucketName" } ] ] },
                "TargetKeyId" : {"Ref":"CreateKMSKey"}
            }
        }

    },
    
    "Outputs": {
        "IAMUserAccessKey" : {
          "Condition": "CreateIAMuser",
          "Description": "Access Key for the new IAM User.",
          "Value" : { "Ref" : "IAMUserAccessKeys" }
        },
        "IAMUserSecretKey" : {
          "Condition": "CreateIAMuser",
          "Description": "Secret Key for the new IAM user.",
          "Value" : { "Fn::GetAtt" : [ "IAMUserAccessKeys", "SecretAccessKey" ] }
        },
        "AWSBucketName" : {
          "Description": "The S3 Bucket name.",
          "Value" : { "Ref" : "S3BucketName" }
        },
        "KMSKeyId" : {
          "Condition" : "CreateKMS",
          "Description": "The KMS Key ID used for encryption.",
          "Value" : { "Ref" : "CreateKMSKey" }
        },
        "Region": {
          "Description": "The AWS Region where the configuration took place.",
          "Value" : { "Ref" : "AWS::Region" } 
        }
    }
}