This message was deleted.

sparse-intern-71089

05/10/2023, 9:52 PM

This message was deleted.

lemon-agent-27707

05/10/2023, 10:15 PM

How are you configuring your AWS credentials?

brief-car-60542

05/10/2023, 10:41 PM

With providers, I think my cert config is working, because I am able to generate all other resources, expect this ACL one. Unless there is special cred work needs to be done.

salmon-account-74572

05/10/2023, 11:20 PM

Can you share your code?

brief-car-60542

05/10/2023, 11:57 PM

Yes

brief-car-60542

05/10/2023, 11:57 PM

Copy code

const webBucket = new aws.s3.BucketV2(
    webS3Name,
    {
      tags: {
        Environment: configEnvironment,
        Name: webS3Name,
      },
    },
    { provider: config.providers[configEnvironment] as aws.Provider },
  );  
const bucketOwnershipControls = new aws.s3.BucketOwnershipControls(
    `${webS3Name}-OwnershipControls`,
    {
      bucket: webBucket.id,
      rule: {
        objectOwnership: 'BucketOwnerPreferred',
      },
    },
    { provider: config.providers[configEnvironment] as aws.Provider },
  );

  new aws.s3.BucketPolicy(
    `${webS3Name}-BucketPolicy`,
    {
      bucket: webBucket.id,
      policy: allowPulicAccessPolicyDocument.apply((allowPulicAccessPolicyDocument) => {
        return allowPulicAccessPolicyDocument.json;
      }),
    },
    { provider: config.providers[configEnvironment] as aws.Provider },
  );

  new aws.s3.BucketAclV2(
    `${webS3Name}-AclV2`,
    {
      acl: 'public-read',
      bucket: webBucket.id,
    },
    {
      dependsOn: [bucketOwnershipControls, bucketPublicAccessBlock],
      provider: config.providers[configEnvironment] as aws.Provider,
    },
  );

salmon-account-74572

05/11/2023, 12:01 AM

I see

bucketPublicAccessBlock

referenced in the

dependsOn

, but I don’t see it defined here…?

brief-car-60542

05/11/2023, 12:04 AM

Copy code

const bucketPublicAccessBlock = new aws.s3.BucketPublicAccessBlock(
    `${webS3Name}-accessBlock`,
    {
      blockPublicAcls: true,
      blockPublicPolicy: true,
      bucket: webBucket.id,
      ignorePublicAcls: true,
      restrictPublicBuckets: true,
    },
    { provider: config.providers[configEnvironment] as aws.Provider },
  );

brief-car-60542

05/11/2023, 12:04 AM

here

salmon-account-74572

05/11/2023, 4:11 AM

I think you need to change

blockPublicAcls: true

blockPublicAcls: false

salmon-account-74572

05/11/2023, 4:12 AM

And I think that

ignorePublicAcls

should also be

false

brief-car-60542

05/11/2023, 5:13 AM

Thanks!

salmon-account-74572

05/11/2023, 3:24 PM

Happy to help!

5 Views

Open in Slack

Previous Next

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.