CtrlK
BlogDocsLog inGet started
Tessl Logo

giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

89

Quality

89%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

Overview
Quality
Evals
Security
Files

examples.mdplugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-s3/references/

AWS CloudFormation S3 - Examples

This file contains comprehensive examples for Amazon S3 patterns with CloudFormation.

Example 1: Static Website Hosting

Complete static website with custom domain and CloudFront.

AWSTemplateFormatVersion: 2010-09-09
Description: Static website hosting on S3 with CloudFront distribution

Parameters:
  DomainName:
    Type: String
    Description: Your domain name (e.g., example.com)
    AllowedPattern: "[a-z0-9-]+\\.[a-z]+"

  HostedZoneName:
    Type: String
    Description: Route 53 hosted zone name
    Default: example.com

  CertificateArn:
    Type: String
    Description: ACM certificate ARN for HTTPS

Conditions:
  IsRootDomain: !Equals [!Ref DomainName, !Ref HostedZoneName]

Resources:
  # S3 Buckets
  WebsiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref DomainName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
        BlockPublicPolicy: false
        IgnorePublicAcls: false
        RestrictPublicBuckets: false
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: error.html
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - GET
            AllowedOrigins:
              - "*"
            MaxAge: 3600
      Tags:
        - Key: Website
          Value: !Ref DomainName

  WWWRedirectBucket:
    Type: AWS::S3::Bucket
    Condition: IsRootDomain
    Properties:
      BucketName: !Sub www.${DomainName}
      AccessControl: Private
      WebsiteConfiguration:
        RedirectAllRequestsTo:
          HostName: !Ref DomainName
          Protocol: https

  # Bucket Policies
  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WebsiteBucket
      PolicyDocument:
        Statement:
          - Sid: CloudFrontOAI
            Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub ${WebsiteBucket.Arn}/*

  # CloudFront
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub OAI for ${DomainName}

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !GetAtt WebsiteBucket.RegionalDomainName
            Id: S3Origin
            S3OriginConfig:
              OriginAccessIdentity: !Sub origin-access-identity/cloudfront/${CloudFrontOAI}
        Enabled: true
        IPV6Enabled: true
        DefaultRootObject: index.html
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
          TargetOriginId: S3Origin
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
          Compress: true
        CustomErrorResponses:
          - ErrorCode: 404
            ResponseCode: 200
            ResponsePagePath: /error.html
          - ErrorCode: 403
            ResponseCode: 200
            ResponsePagePath: /error.html
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

  # Route 53 Records
  DNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Sub ${HostedZoneName}.
      Name: !Ref DomainName
      Type: A
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: !GetAtt CloudFrontDistribution.HostedZoneId

  DNSRecordIPv6:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneName: !Sub ${HostedZoneName}.
      Name: !Ref DomainName
      Type: AAAA
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: !GetAtt CloudFrontDistribution.HostedZoneId

Outputs:
  WebsiteURL:
    Description: URL of the website
    Value: !Sub https://${DomainName}
    Export:
      Name: !Sub ${AWS::StackName}-WebsiteURL

  DistributionID:
    Description: CloudFront distribution ID
    Value: !Ref CloudFrontDistribution
    Export:
      Name: !Sub ${AWS::StackName}-DistributionID

Example 2: Data Lake with Lifecycle Management

S3 bucket configured for data lake storage with tiered lifecycle.

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket for data lake with tiered lifecycle management

Parameters:
  BucketName:
    Type: String
    Description: Name of the data lake bucket
    Default: my-data-lake

  RawDataRetention:
    Type: Number
    Description: Days to retain raw data
    Default: 90

  ProcessedDataRetention:
    Type: Number
    Description: Days to retain processed data
    Default: 365

  ArchiveDataRetention:
    Type: Number
    Description: Days before archiving to Glacier
    Default: 30

Resources:
  DataLakeBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID: !Ref DataLakeKey
            BucketKeyEnabled: true
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          # Raw data: move to Glacier after 30 days, delete after 90
          - Id: RawDataLifecycle
            Status: Enabled
            PrefixFilter:
              Prefix: raw/
            Transitions:
              - Days: !Ref ArchiveDataRetention
                StorageClass: GLACIER
              - Days: !Ref RawDataRetention
                StorageClass: DEEP_ARCHIVE
            NoncurrentVersionExpirationInDays: 30
            NoncurrentVersionTransitions:
              - NoncurrentDays: 7
                StorageClass: GLACIER
          # Processed data: move to IA after 30 days, archive after 180
          - Id: ProcessedDataLifecycle
            Status: Enabled
            PrefixFilter:
              Prefix: processed/
            Transitions:
              - Days: 30
                StorageClass: STANDARD_IA
              - Days: 180
                StorageClass: GLACIER
            ExpirationInDays: !Ref ProcessedDataRetention
          # Analytics output: delete after 90 days
          - Id: AnalyticsOutputLifecycle
            Status: Enabled
            PrefixFilter:
              Prefix: analytics/
            ExpirationInDays: 90
          # Incomplete multipart uploads cleanup
          - Id: AbortIncompleteUploads
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
      Tags:
        - Key: DataClassification
          Value: confidential
        - Key: Environment
          Value: production

  DataLakeKey:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS key for data lake encryption
      EnableKeyRotation: true
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
          - Sid: Enable IAM policies
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: "*"
          - Sid: Allow data lake access
            Effect: Allow
            Principal:
              AWS: !Ref DataLakeRole
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:GenerateDataKey
            Resource: "*"

  DataLakeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: glue.amazonaws.com
            Action: sts:AssumeRole

Outputs:
  BucketName:
    Description: Name of the data lake bucket
    Value: !Ref DataLakeBucket
    Export:
      Name: !Sub ${AWS::StackName}-BucketName

  BucketArn:
    Description: ARN of the data lake bucket
    Value: !GetAtt DataLakeBucket.Arn
    Export:
      Name: !Sub ${AWS::StackName}-BucketArn

Example 3: Event-Driven Processing Pipeline

S3 bucket with event notifications triggering Lambda functions.

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with Lambda processing pipeline

Parameters:
  BucketName:
    Type: String
    Description: Name of the processing bucket
    Default: my-processing-bucket

  ProcessingFunctionName:
    Type: String
    Description: Name of the Lambda function
    Default: process-data

Resources:
  ProcessingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      NotificationConfiguration:
        LambdaConfigurations:
          - Event: s3:ObjectCreated:*
            Function: !GetAtt ProcessingFunction.Arn
            Filter:
              S3Key:
                Rules:
                  - Name: prefix
                    Value: uploads/
          - Event: s3:ObjectRemoved:*
            Function: !GetAtt CleanupFunction.Arn
            Filter:
              S3Key:
                Rules:
                  - Name: suffix
                    Value: .tmp
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - PUT
              - POST
            AllowedOrigins:
              - "*"
            MaxAge: 3600

  ProcessingFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Ref ProcessingFunctionName
      Handler: index.handler
      Runtime: python3.9
      Code:
        S3Bucket: !Ref ProcessingBucket
        S3Key: functions/process.zip
      Timeout: 300
      Role: !GetAtt LambdaRole.Arn
      Environment:
        Variables:
          OUTPUT_BUCKET: !Ref OutputBucket

  CleanupFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${ProcessingFunctionName}-cleanup
      Handler: cleanup.handler
      Runtime: python3.9
      Code:
        S3Bucket: !Ref ProcessingBucket
        S3Key: functions/cleanup.zip
      Timeout: 60
      Role: !GetAtt LambdaRole.Arn

  OutputBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${BucketName}-output
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: CleanOldOutput
            Status: Enabled
            ExpirationInDays: 7

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: S3Access
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - !Sub ${ProcessingBucket.Arn}
                  - !Sub ${ProcessingBucket.Arn}/*
                  - !Sub ${OutputBucket.Arn}
                  - !Sub ${OutputBucket.Arn}/*

  BucketPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref ProcessingFunction
      Action: lambda:InvokeFunction
      Principal: s3.amazonaws.com
      SourceArn: !GetAtt ProcessingBucket.Arn

Outputs:
  ProcessingBucketName:
    Description: Name of the processing bucket
    Value: !Ref ProcessingBucket
    Export:
      Name: !Sub ${AWS::StackName}-ProcessingBucketName

Example 4: Multi-Environment S3 Configuration

Template with conditions for different environments.

AWSTemplateFormatVersion: 2010-09-09
Description: Multi-environment S3 bucket configuration

Parameters:
  Environment:
    Type: String
    Description: Deployment environment
    Default: development
    AllowedValues:
      - development
      - staging
      - production

  BucketSuffix:
    Type: String
    Description: Optional suffix for bucket name
    Default: ""

  EnableVersioning:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false

  EnableLogging:
    Type: String
    Default: true
    AllowedValues:
      - true
      - false

  RetentionDays:
    Type: Number
    Description: Data retention period in days
    Default: 30

Mappings:
  EnvironmentConfig:
    development:
      EnableVersioning: false
      EnableLogging: false
      RetentionDays: 7
      AccessLevel: private
    staging:
      EnableVersioning: true
      EnableLogging: true
      RetentionDays: 30
      AccessLevel: private
    production:
      EnableVersioning: true
      EnableLogging: true
      RetentionDays: 90
      AccessLevel: private-log-delivery

Conditions:
  ShouldEnableVersioning: !Equals [!Ref EnableVersioning, true]
  ShouldEnableLogging: !Equals [!Ref EnableLogging, true]
  HasBucketSuffix: !Not [!Equals [!Ref BucketSuffix, ""]]
  IsDevelopment: !Equals [!Ref Environment, development]

Resources:
  DataBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !If
        - HasBucketSuffix
        - !Sub ${Environment}-${BucketSuffix}
        - !Sub ${Environment}-data
      VersioningConfiguration:
        Status: !If [ShouldEnableVersioning, Enabled, Suspended]
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LoggingConfiguration: !If
        - ShouldEnableLogging
        - DestinationBucketName: !Ref AccessLogBucket
          LogFilePrefix: !Sub ${Environment}/
        - !Ref AWS::NoValue
      LifecycleConfiguration:
        Rules:
          - Id: DataRetention
            Status: Enabled
            ExpirationInDays: !Ref RetentionDays
            NoncurrentVersionExpirationInDays: 7
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: ManagedBy
          Value: CloudFormation

  AccessLogBucket:
    Type: AWS::S3::Bucket
    Condition: ShouldEnableLogging
    Properties:
      BucketName: !Sub ${Environment}-access-logs
      AccessControl: LogDeliveryWrite
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: CleanLogs
            Status: Enabled
            ExpirationInDays: 30

Outputs:
  BucketName:
    Description: Name of the data bucket
    Value: !Ref DataBucket
    Export:
      Name: !Sub ${AWS::StackName}-BucketName

  Environment:
    Description: Deployment environment
    Value: !Ref Environment

Example 5: S3 Bucket with Object Lock

Bucket configured for compliance with Object Lock.

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with Object Lock for compliance

Parameters:
  BucketName:
    Type: String
    Description: Name of the bucket with Object Lock

  RetentionPeriodDays:
    Type: Number
    Description: Default retention period in days
    Default: 365

Resources:
  ObjectLockBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      ObjectLockEnabled: true
      ObjectLockConfiguration:
        ObjectLockEnabled: Enabled
        Rule:
          DefaultRetention:
            Mode: COMPLIANCE
            Days: !Ref RetentionPeriodDays
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: Compliance
          Value: enabled
        - Key: RetentionPeriod
          Value: !Ref RetentionPeriodDays

Outputs:
  BucketName:
    Description: Name of the Object Lock bucket
    Value: !Ref ObjectLockBucket
    Export:
      Name: !Sub ${AWS::StackName}-BucketName

  BucketArn:
    Description: ARN of the Object Lock bucket
    Value: !GetAtt ObjectLockBucket.Arn
    Export:
      Name: !Sub ${AWS::StackName}-BucketArn

Example 6: Cross-Region Replication

S3 bucket with cross-region replication configuration.

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with cross-region replication

Parameters:
  SourceBucketName:
    Type: String
    Description: Name of the source bucket

  DestinationBucketName:
    Type: String
    Description: Name of the destination bucket

  DestinationRegion:
    Type: String
    Description: Destination region
    Default: us-west-2

Resources:
  SourceBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref SourceBucketName
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      ReplicationConfiguration:
        Role: !GetAtt ReplicationRole.Arn
        Rules:
          - Id: ReplicateToDestRegion
            Status: Enabled
            Priority: 1
            Filter:
              Prefix: ""
            Destination:
              Bucket: !Sub arn:aws:s3:::${DestinationBucketName}
              StorageClass: STANDARD_IA
              EncryptionConfiguration:
                ReplicaKmsKeyID: !Ref DestKMSKey
              Account: !Ref DestinationAccountId

  ReplicationRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: ReplicationPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetReplicationConfiguration
                  - s3:GetObjectVersion
                  - s3:GetObjectVersionAcl
                  - s3:GetObjectVersionTagging
                Resource:
                  - !Sub ${SourceBucket.Arn}
                  - !Sub ${SourceBucket.Arn}/*
              - Effect: Allow
                Action:
                  - s3:ReplicateObject
                  - s3:ReplicateDelete
                  - s3:ObjectOwnerOverrideToBucketOwner
                  - s3:ReplicateTags
                Resource:
                  - !Sub arn:aws:s3:::${DestinationBucketName}
                  - !Sub arn:aws:s3:::${DestinationBucketName}/*
              - Effect: Allow
                Action:
                  - kms:Decrypt
                  - kms:Encrypt
                  - kms:GenerateDataKey
                Resource: !Ref SourceKMSKey
                Condition:
                  StringEquals:
                    kms:ViaService: !Sub s3.${AWS::Region}.amazonaws.com
              - Effect: Allow
                Action:
                  - kms:Decrypt
                  - kms:Encrypt
                  - kms:GenerateDataKey
                Resource: !Ref DestKMSKey
                Condition:
                  StringEquals:
                    kms:ViaService: !Sub s3.${DestinationRegion}.amazonaws.com

  SourceKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS key for source bucket encryption

  DestKMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: KMS key for destination bucket encryption

Outputs:
  SourceBucketName:
    Description: Name of the source bucket
    Value: !Ref SourceBucket
    Export:
      Name: !Sub ${AWS::StackName}-SourceBucketName

  DestinationBucketName:
    Description: Name of the destination bucket
    Value: !Ref DestinationBucketName

Example 7: S3 Inventory and Analytics

Bucket with analytics and inventory configurations.

AWSTemplateFormatVersion: 2010-09-09
Description: S3 bucket with analytics and inventory configurations

Parameters:
  BucketName:
    Type: String
    Description: Name of the bucket

Resources:
  AnalyticsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      AnalyticsConfigurations:
        - Id: AnalyticsConfig
          StorageClassAnalysis:
            DataExport:
              Destination:
                S3BucketDestination:
                  Bucket: !Ref AnalyticsReportBucket
                  BucketAccountId: !Ref AWS::AccountId
                  Format: CSV
                  Prefix: analytics/
      InventoryConfigurations:
        - Id: DailyInventory
          IncludedObjectVersions: Current
          Schedule:
            Frequency: Daily
          Destination:
            S3BucketDestination:
              Bucket: !Ref InventoryReportBucket
              BucketAccountId: !Ref AWS::AccountId
              Format: CSV
              Prefix: inventory/
          Filter:
            Prefix: data/
          OptionalFields:
            - Size
            - LastModifiedDate
            - StorageClass
            - ETag
            - IsMultipartUploaded

  AnalyticsReportBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${BucketName}-analytics-reports
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  InventoryReportBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${BucketName}-inventory-reports
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: CleanOldReports
            Status: Enabled
            ExpirationInDays: 90

Outputs:
  BucketName:
    Description: Name of the analytics bucket
    Value: !Ref AnalyticsBucket

plugins

developer-kit-aws

skills

aws-cloudformation

aws-cloudformation-s3

references

advanced-configuration.md

complete-examples.md

examples.md

reference.md

SKILL.md

README.md

CHANGELOG.md

context7.json

CONTRIBUTING.md

README_CN.md

README_ES.md

README_IT.md

README.md

tessl.json

tile.json