s3-signed-url-burnafterreading.yaml

AWSTemplateFormatVersion: 2010-09-09

Description: S3 - Signed url burn after reading mechanism

Parameters:

  BucketName:
    Description: Bucket name with objects for which we want to create signed urls
    Type: String
  ObjectKey:
    Description: Bucket objects key (path)
    Type: String
    Default: '/'
  CreateBucket:
    Description: If we want to use existing bucket or create a new one
    Type: String
    Default: no
    AllowedValues: [ yes, no ]
  BurnMethod:
    Description: S3 link invalidation by deletion of object or moving to different path
    Type: String
    Default: delete
    AllowedValues: [ delete, move ]

Conditions:
  CreateBucket: !Equals [ !Ref CreateBucket, true ]

Resources:

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: S3DeleteMove
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - !Sub 'arn:aws:s3:::${BucketName}${ObjectKey}/*'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  LambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Role: !GetAtt LambdaRole.Arn
      Handler: index.lambda_handler
      Runtime: python3.7
      Timeout: 25
      Code:
        ZipFile: |
          import os
          import json
          import boto3
          import logging
          from botocore.exceptions import ClientError

          bucket = os.environ['BUCKET']
          object_key = os.environ['OBJECT_KEY']
          burn_method = os.environ['BURN_METHOD']

          logger = logging.getLogger(__name__)
          logger.setLevel(logging.INFO)

          session = boto3.session.Session()
          client = session.client('s3')

          def getObject(_bucket, _key):
            try:
                client.head_object(Bucket=_bucket, Key=_key)
            except ClientError as e:
              logging.error(e)
              return False
            return True

          def invalidate(_burn_method, _bucket, _key):
            if _burn_method == "delete":
              try:
                response = client.delete_object(
                  Bucket=_bucket,
                  Key=_key
                )
                logger.info('Deleting object %s' % _key)
              except ClientError as e:
                logging.error(e)

            elif _burn_method == "move":

              try:
                response = client.copy_object(CopySource='%s/%s'% (_bucket, _key), Bucket=_bucket, Key='invalid/%s' % _key)
                logger.info('Deleting object %s' % _key)
              except ClientError as e:
                logging.error(e)

              try:
                response = client.delete_object(
                  Bucket=_bucket,
                  Key=_key
                )
                logger.info('Deleting object %s' % _key)
              except ClientError as e:
                logging.error(e)

            else:
              logger.error('Method %s not supported' % _burn_method)

          def lambda_handler(event, context):
            logger.debug(event)
            key = event['detail']['requestParameters']['key']

            if event['detail']['eventName'] == "GetObject":
              logger.debug('Deleting object %s' % key)

              if not getObject(bucket, key):
                return "Object does not exist on path %s" % key

              invalidate(burn_method, bucket, key)
      Environment:
        Variables:
          BUCKET: !Ref BucketName
          OBJECT_KEY: !Ref ObjectKey
          BURN_METHOD: !Ref BurnMethod

  Bucket:
    Condition: CreateBucket
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled

  BucketPolicy:
    Condition: CreateBucket
    DependsOn: LambdaRole
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          - Sid: Bucket policy
            Effect: Allow
            Principal:
              AWS:
                - !GetAtt LambdaRole.Arn
            Action:
              - s3:DeleteObject
              - s3:GetObject
              - s3:PutObject
            Resource:
              - !GetAtt Bucket.Arn
              - !Join [ '', [ !GetAtt Bucket.Arn, '/*'] ]

  CloudTrailBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'cloudtrail-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled

  CloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CloudTrailBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - s3:GetBucketAcl
            Resource: !GetAtt CloudTrailBucket.Arn
          - Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - s3:PutObject
            Resource: !Sub ${CloudTrailBucket.Arn}/AWSLogs/${AWS::AccountId}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  CloudTrail:
    DependsOn: CloudTrailBucketPolicy
    Type: AWS::CloudTrail::Trail
    Properties:
      EventSelectors:
      - DataResources:
        - Type: AWS::S3::Object
          Values:
            - !Sub ${Bucket.Arn}/
        IncludeManagementEvents: false
        ReadWriteType: ReadOnly
      IncludeGlobalServiceEvents: true
      IsLogging: true
      IsMultiRegionTrail: false
      S3BucketName: !Ref CloudTrailBucket

  Event:
    Type: AWS::Events::Rule
    Properties:
      Description: S3 event
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:
            - GetObject
          requestParameters:
            bucketName:
              - !Ref Bucket
      Name: S3SignedUrlLinkInvalidation
      State: ENABLED
      Targets:
        - Arn: !GetAtt LambdaFunction.Arn
          Id: LamdaFunction

  LambdaInvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref LambdaFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt Event.Arn