AWSTemplateFormatVersion: "2010-09-09" Description: > Broken Labs - S3 Lab 01. An S3 bucket hosts a public static page, but users can't access any files. Licensed under CC BY-NC-SA 4.0: https://creativecommons.org/licenses/by-nc-sa/4.0/ Developed by: Mark Schoonover Resources: LabBucket: Type: AWS::S3::Bucket Properties: BucketName: !Sub "brokenlabs-lab-01-${AWS::Region}-${AWS::AccountId}" PublicAccessBlockConfiguration: BlockPublicAcls: false BlockPublicPolicy: false IgnorePublicAcls: false RestrictPublicBuckets: false LabBucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref LabBucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: PublicReadGetObject Effect: Allow Principal: "*" Action: s3:GetObject Resource: !Sub "arn:aws:s3:::${LabBucket}/*" LabSetupRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: lambda.amazonaws.com Action: sts:AssumeRole ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Policies: - PolicyName: LabSetupPolicy PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - s3:PutObject - s3:DeleteObject - s3:ListBucket - s3:PutBucketPublicAccessBlock - s3:DeleteBucketPolicy Resource: - !GetAtt LabBucket.Arn - !Sub "${LabBucket.Arn}/*" LabSetupFunction: Type: AWS::Lambda::Function Properties: Runtime: python3.12 Handler: index.handler Role: !GetAtt LabSetupRole.Arn Timeout: 60 Code: ZipFile: | import boto3 import cfnresponse INDEX_HTML = ''' AWS Cloud Path Academy

AWS Broken Labs

If you can read this, the lab is fixed.

Lab 01 — S3 Access Troubleshooting
www.cloudpathacademy.com
''' def handler(event, context): s3 = boto3.client('s3') bucket = event['ResourceProperties']['BucketName'] try: if event['RequestType'] in ('Create', 'Update'): s3.put_object( Bucket=bucket, Key='index.html', Body=INDEX_HTML.strip().encode('utf-8'), ContentType='text/html', ) s3.put_public_access_block( Bucket=bucket, PublicAccessBlockConfiguration={ 'BlockPublicAcls': False, 'IgnorePublicAcls': False, 'BlockPublicPolicy': True, 'RestrictPublicBuckets': False, }, ) s3.delete_bucket_policy(Bucket=bucket) elif event['RequestType'] == 'Delete': s3.put_public_access_block( Bucket=bucket, PublicAccessBlockConfiguration={ 'BlockPublicAcls': False, 'IgnorePublicAcls': False, 'BlockPublicPolicy': False, 'RestrictPublicBuckets': False, }, ) paginator = s3.get_paginator('list_objects_v2') for page in paginator.paginate(Bucket=bucket): objects = page.get('Contents', []) if objects: s3.delete_objects( Bucket=bucket, Delete={'Objects': [{'Key': o['Key']} for o in objects]}, ) cfnresponse.send(event, context, cfnresponse.SUCCESS, {}) except Exception as e: cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)}) LabSetup: Type: Custom::LabSetup DependsOn: LabBucketPolicy Properties: ServiceToken: !GetAtt LabSetupFunction.Arn BucketName: !Ref LabBucket Outputs: BucketName: Description: Name of the S3 bucket Value: !Ref LabBucket BucketURL: Description: Regional S3 URL for testing public access Value: !Sub "https://${LabBucket}.s3.${AWS::Region}.amazonaws.com/index.html"