AWSTemplateFormatVersion: '2010-09-09'

Description: State bucket for Pulumi

Resources:
  PulumiStateS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: Private
      BucketName: !Sub ${AWS::StackName}-pulumi-state-${AWS::AccountId}
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      VersioningConfiguration:
        Status: Enabled

  PulumiStateS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref PulumiStateS3Bucket
      PolicyDocument:
        Statement:
          - Sid: AllowSSLRequestsOnly
            Effect: Deny
            Action: s3:*
            Resource:
              - !Sub arn:aws:s3:::${PulumiStateS3Bucket}
              - !Sub arn:aws:s3:::${PulumiStateS3Bucket}/*
            Condition:
              Bool:
                aws:SecureTransport: 'false'
            Principal: '*'

Outputs:
  PulumiStateS3Bucket:
    Description: Bucket for Pulumi state files
    Value: !Ref PulumiStateS3Bucket
    Export:
      Name: !Sub ${AWS::StackName}-PulumiStateS3Bucket