Parameters:
  BucketNameParameter:
    Type: String
    Description: "Enter a name for the bucket, note that buckets must have unique names and should be lowercased"
Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      # AccessControl: PublicRead
      BucketName: !Ref BucketNameParameter
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - 'Authorization'
            AllowedMethods:
              - GET
            AllowedOrigins:
              - '*'
            MaxAge: 3600
            ExposedHeaders: ["x-amz-server-side-encryption","x-amz-request-id","x-amz-id-2"]
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties: 
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:DeleteObject'
              - 's3:GetObject'
              - 's3:ListBucket'
              - 's3:PutObject'
            Effect: Allow
            Principal:
              AWS: !GetAtt IAMUser.Arn
            Resource:
              - !GetAtt S3Bucket.Arn
              - !Join ["", [ !GetAtt S3Bucket.Arn ,"/*" ] ]
            Sid: webapp-upload
        Version: '2012-10-17'
    DependsOn : ["S3Bucket","IAMUser"]
  IAMPolicy:
    DependsOn : ["S3Bucket"]
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: 
        Fn::Sub:
          - "user-bucket-policy-${name}"
          - name: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:ListBucketMultipartUploads'
              - 's3:DeleteObjectVersion'
              - 's3:ListBucketVersions'
              - 's3:GetObjectAttributes'
              - 's3:RestoreObject'
              - 's3:ListBucket'
              - 's3:GetBucketAcl'
              - 's3:GetBucketPolicy'
              - 's3:ReplicateObject'
              - 's3:PutObject'
              - 's3:GetObjectAcl'
              - 's3:GetObject'
              - 's3:AbortMultipartUpload'
              - 's3:PutObjectRetention'
              - 's3:GetBucketCORS'
              - 's3:GetObjectVersionAcl'
              - 's3:GetObjectTagging'
              - 's3:DeleteObject'
              - 's3:GetBucketLocation'
              - 's3:PutBucketVersioning'
              - 's3:ReplicateDelete'
              - 's3:GetObjectVersion'
            Effect: Allow
            Resource: !GetAtt S3Bucket.Arn
        Version: '2012-10-17'
  IAMUser:
    Type: AWS::IAM::User
    Properties:        
      UserName: 
        Fn::Sub:  
          - "default-user-${name}"
          - name: !Ref S3Bucket
      ManagedPolicyArns:
        - !Ref IAMPolicy
  IAMUserCreds:
    Type: AWS::IAM::AccessKey
    Properties: 
      UserName: !Ref IAMUser
Outputs:
  BucketName: 
    Description: value for env var AWS_STORAGE_BUCKET_NAME
    Value: !Ref S3Bucket
  BucketRegionalDomain: 
    Description: This domain name includes the region so we can see what region the bucket was created in for the variable AWS_S3_REGION_NAME
    Value: !GetAtt S3Bucket.RegionalDomainName
  IAMUser:
    Description: the arn of the user for quick access and look up
    Value: !GetAtt  IAMUser.Arn
  IAMUserAccessKey:
    Description: Temporarily Showing this until we create a bucket to push to AWS_ACCESS_KEY_ID 
    Value: !Ref IAMUserCreds
  IAMUserAccessSecret:
    Description: Temporarily Showing this until we create a bucket to push to AWS_SECRET_ACCESS_KEY
    Value: !GetAtt  IAMUserCreds.SecretAccessKey


  
