【AWS CloudFormation】S3レプリケーション用のロール・権限【IaC】【レイヤー1】

##########################################
# SourceFile: sample-AWSService-IAM-S3-Replication-001.yml
##########################################
AWSTemplateFormatVersion: '2010-09-09'
Description: IAM Role, IAM Policy
Parameters:
  SystemName:
   Type: String
   Description: SystemName
   Default: sample
  Env:
   Description: Environment
   Type: String
   AllowedValues:
     - prd
     - stg
     - dev

Resources:
###########################################
# IAMPolicy
###########################################
 S3ReplicationRolePolicy:
   Type: AWS::IAM::ManagedPolicy
   Properties:
     ManagedPolicyName: !Join [ "-", [ !Ref SystemName, !Ref Env, s3, replication, role, policy]]
     PolicyDocument:
       Version: "2012-10-17"
       Statement:
         - Sid: VisualEditor0
           Effect: Allow
           Action:
             - "s3:ListBucket"
             - "s3:GetReplicationConfiguration"
           Resource: "*"
         - Sid: VisualEditor1
           Effect: Allow
           Action:
             - "s3:GetObjectVersionTagging"
             - "s3:GetObjectVersionAcl"
             - "s3:GetObjectVersionForReplication"
           Resource: "*"
         - Sid: VisualEditor2
           Effect: Allow
           Action:
             - "s3:ReplicateObject"
             - "s3:ObjectOwnerOverrideToBucketOwner"
             - "s3:ReplicateTags"
             - "s3:ReplicateDelete"
           Resource: "*"
         - Sid: VisualEditor3
           Effect: Allow
           Action:
             - "s3:PutObject"
             - "s3:PutObjectAcl"
             - "s3:PutObjectTagging"
             - "s3:GetObject"
             - "s3:GetObjectVersion"
             - "s3:PutObjectVersionTagging"
             - "s3:DeleteObjectTagging"
             - "s3:DeleteObjectVersionTagging"
             - "s3:PutObjectVersionAcl"
             - "s3:RestoreObject"
             - "s3:GetBucketObjectLockConfiguration"
             - "s3:PutObjectRetention"
             - "s3:BypassGovernanceRetention"
             - "s3:PutObjectLegalHold"
             - "s3:InitiateReplication"
             - "s3:GetReplicationConfiguration"
             - "s3:PutInventoryConfiguration"
             - "s3:GetObjectRetention"
             - "s3:GetObjectLegalHold"
           Resource: "*"
         - Sid: VisualEditor4
           Effect: Allow
           Action:
             - "kms:Decrypt"
             - "kms:Encrypt"
             - "kms:GenerateDataKey"
           Resource: "*"
     Roles:
       - !Ref S3ReplicationRole

###########################################
#  IAM Role
###########################################
 S3ReplicationRole:
   Type: "AWS::IAM::Role"
   Properties:
     RoleName:  !Join [ "-", [ !Ref SystemName, !Ref Env, s3, replication, role]]
     AssumeRolePolicyDocument:
       Version: "2012-10-17"
       Statement:
         -
           Effect: "Allow"
           Principal:
             Service:
               - "s3.amazonaws.com"
           Action:
             - "sts:AssumeRole"
         - Sid: Statement1
           Effect: Allow
           Principal:
             Service: batchoperations.s3.amazonaws.com
           Action: "sts:AssumeRole"              
     Path: /
###########################################
# Outputs
###########################################  
Outputs:
 S3ReplicationRoleArn:
   Value: !GetAtt S3ReplicationRole.Arn
   Export:
     Name: !Join [ "-", [ !Ref SystemName, !Ref Env, s3, replication, role, arn]]