template.cfn.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Parameters:
    CreateObject:
        Type: String
        Default: false
        AllowedValues: [true, false]
    ObjectKey:
        Type: String
        Default: 'hello_world.txt'
    ObjectContent:
        Type: String
        Default: 'Hello World, I am Custom Resource!!!'
    ObjectACL:
        Type: String
        Default: bucket-owner-full-control
        AllowedValues: [private, public-read, public-read-write, aws-exec-read, authenticated-read, bucket-owner-read, bucket-owner-full-control, log-delivery-write]
    SSE:
        Type: String
        Description: S3 Object encryption
        AllowedValues: [ 'aws:kms', 'AES256' ]
        Default: 'aws:kms'
Conditions:
    CreateObject: !Equals [ !Ref CreateObject, true ]
    KMSEncryption: !Equals [ !Ref SSE, 'aws:kms' ]
Resources:
    Bucket:
        Type: AWS::S3::Bucket
        Properties:
            BucketName: !Sub "s3-object-custom-resource-${AWS::AccountId}.demo"
            BucketEncryption:
                ServerSideEncryptionConfiguration:
                    - ServerSideEncryptionByDefault: { SSEAlgorithm: AES256 }
    BackingLambdaRole:
        Type: AWS::IAM::Role
        Properties:
            ManagedPolicyArns:
                - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
            Policies:
                - PolicyName: AllowS3Put
                  PolicyDocument:
                      Version: "2012-10-17"
                      Statement:
                          - Effect: Allow
                            Action: [ s3:PutObject*, s3:DeleteObject* ]
                            Resource: !Sub "arn:aws:s3:::${Bucket}*"
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    - Effect: Allow
                      Principal:
                          Service: ["lambda.amazonaws.com"]
                      Action: ["sts:AssumeRole"]
    BackingLambda:
        Type: AWS::Serverless::Function
        Properties:
            CodeUri: build/src.zip
            Runtime: python3.8
            Handler: cr_s3object.handler
            Role: !GetAtt BackingLambdaRole.Arn

    MyS3Object:
        Type: Custom::S3Object
        Condition: CreateObject
        Properties:
            ServiceToken: !GetAtt BackingLambda.Arn
            Bucket: !Ref Bucket
            Key: !Ref ObjectKey
            Content: 
                Fn::Base64: !Ref ObjectContent
            ACL: !Ref ObjectACL
            SSE: !Ref SSE
            SSEKmsKeyId: !If [KMSEncryption, 'alias/aws/s3', !Ref AWS::NoValue ]
            ContentBase64: true
Outputs:
    S3Url:
        Value: !Ref MyS3Object