##################################################################################
#
#   Conformance Pack:
#     Operational Best Practices for S3
#
#   This conformance pack helps verify compliance with S3 requirements.
#
##################################################################################

Parameters:
  S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicAcls:
    Default: 'True'
    Type: String
  S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicPolicy:
    Default: 'True'
    Type: String
  S3AccountLevelPublicAccessBlocksPeriodicParamIgnorePublicAcls:
    Default: 'True'
    Type: String
  S3AccountLevelPublicAccessBlocksPeriodicParamRestrictPublicBuckets:
    Default: 'True'
    Type: String
  S3BucketBlacklistedActionsProhibitedParamBlacklistedActionPattern:
    Default: s3:DeleteBucketPolicy, s3:PutBucketAcl, s3:PutBucketPolicy, s3:PutEncryptionConfiguration, s3:PutObjectAcl
    Type: String
Resources:
  S3AccountLevelPublicAccessBlocksPeriodic:
    Properties:
      ConfigRuleName: s3-account-level-public-access-blocks-periodic
      InputParameters:
        BlockPublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicAcls
          - Ref: AWS::NoValue
        BlockPublicPolicy:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicPolicy
          - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicPolicy
          - Ref: AWS::NoValue
        IgnorePublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksPeriodicParamIgnorePublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamIgnorePublicAcls
          - Ref: AWS::NoValue
        RestrictPublicBuckets:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksPeriodicParamRestrictPublicBuckets
          - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamRestrictPublicBuckets
          - Ref: AWS::NoValue
      Source:
        Owner: AWS
        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS_PERIODIC
    Type: AWS::Config::ConfigRule
  S3BucketAclProhibited:
    Properties:
      ConfigRuleName: s3-bucket-acl-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_ACL_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketDefaultLockEnabled:
    Properties:
      ConfigRuleName: s3-bucket-default-lock-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketLevelPublicAccessProhibited:
    Properties:
      ConfigRuleName: s3-bucket-level-public-access-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketLoggingEnabled:
    Properties:
      ConfigRuleName: s3-bucket-logging-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketPublicReadProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketPublicWriteProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-write-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketReplicationEnabled:
    Properties:
      ConfigRuleName: s3-bucket-replication-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketBlacklistedActionsProhibited:
    Properties:
      ConfigRuleName: s3-bucket-blacklisted-actions-prohibited
      InputParameters:
        blacklistedActionPattern:
          Ref: S3BucketBlacklistedActionsProhibitedParamBlacklistedActionPattern
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_BLACKLISTED_ACTIONS_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketSslRequestsOnly:
    Properties:
      ConfigRuleName: s3-bucket-ssl-requests-only
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
    Type: AWS::Config::ConfigRule
  S3BucketVersioningEnabled:
    Properties:
      ConfigRuleName: s3-bucket-versioning-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED
    Type: AWS::Config::ConfigRule
  S3DefaultEncryptionKms:
    Properties:
      ConfigRuleName: s3-default-encryption-kms
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_DEFAULT_ENCRYPTION_KMS
    Type: AWS::Config::ConfigRule
  S3EventNotificationsEnabled:
    Properties:
      ConfigRuleName: s3-event-notifications-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_EVENT_NOTIFICATIONS_ENABLED
    Type: AWS::Config::ConfigRule
  S3VersionLifecyclePolicyCheck:
    Properties:
      ConfigRuleName: s3-version-lifecycle-policy-check
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_VERSION_LIFECYCLE_POLICY_CHECK
    Type: AWS::Config::ConfigRule
Conditions:
  s3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicAcls:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicAcls
  s3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicPolicy:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamBlockPublicPolicy
  s3AccountLevelPublicAccessBlocksPeriodicParamIgnorePublicAcls:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamIgnorePublicAcls
  s3AccountLevelPublicAccessBlocksPeriodicParamRestrictPublicBuckets:
    Fn::Not:
    - Fn::Equals:
      - ''
      - Ref: S3AccountLevelPublicAccessBlocksPeriodicParamRestrictPublicBuckets
