Fix cfn-nag violations #204

aws-solutions · Mar 2, 2021 · 731124f · 731124f
1 parent bef6b7e
commit 731124f
Showing 1 changed file with 44 additions and 1 deletion.
diff --git a/source/web-cloudformation/msam-browser-app-release.template b/source/web-cloudformation/msam-browser-app-release.template
@@ -101,11 +101,23 @@
                     "ViewerCertificate": {
                         "CloudFrontDefaultCertificate": true,
                         "MinimumProtocolVersion": "TLSv1"
+                    },
+                    "Logging": {
+                        "Bucket": {
+                            "Fn::Join": [
+                                "", [{
+                                        "Ref": "MSAMBrowserAppLoggingBucket"
+                                    },
+                                    ".s3.amazonaws.com"
+                                ]
+                            ]
+                        },
+                        "Prefix": "cf/"
                     }
                 }
             }
         },
-        "MSAMAppBucketPolicy": {
+        "MSAMBrowserAppBucketPolicy": {
             "Type": "AWS::S3::BucketPolicy",
             "Properties": {
                 "Bucket": {
@@ -157,6 +169,37 @@
                             "*"
                         ]
                     }]
+                },
+                "BucketEncryption": {
+                    "ServerSideEncryptionConfiguration": [{
+                        "ServerSideEncryptionByDefault": {
+                            "SSEAlgorithm": "AES256"
+                        }
+                    }]
+                }
+            }
+        },
+        "MSAMBrowserAppLoggingBucket": {
+            "Type": "AWS::S3::Bucket",
+            "Properties": {
+                "AccessControl": "LogDeliveryWrite",
+                "BucketEncryption": {
+                    "ServerSideEncryptionConfiguration": [{
+                        "ServerSideEncryptionByDefault": {
+                            "SSEAlgorithm": "AES256"
+                        }
+                    }]
+                },
+                "LifecycleConfiguration": {
+                    "Rules": [{
+                        "AbortIncompleteMultipartUpload": {
+                            "DaysAfterInitiation": 5
+                        },
+                        "ExpirationInDays": 365,
+                        "Id": "Expire Objects After 1 Year",
+                        "NoncurrentVersionExpirationInDays": 365,
+                        "Status": "Enabled"
+                    }]
                 }
             }
         },