AWSTemplateFormatVersion: "2010-09-09" Description: > Broken Labs - S3 Lab 05. A public S3 static site returns 403 Access Denied. Licensed under CC BY-NC-SA 4.0: https://creativecommons.org/licenses/by-nc-sa/4.0/ Developed by: Mark Schoonover Resources: LabBucket: Type: AWS::S3::Bucket Properties: BucketName: !Sub "brokenlabs-lab-05-${AWS::Region}-${AWS::AccountId}" PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: false IgnorePublicAcls: true RestrictPublicBuckets: false LabBucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref LabBucket PolicyDocument: Version: "2012-10-17" Statement: - Sid: PublicReadAccess Effect: Allow Principal: "*" Action: "s3:GetObject" Resource: !Sub "${LabBucket.Arn}/*" - Sid: DenyPublicAccess Effect: Deny Principal: "*" Action: "s3:GetObject" Resource: !Sub "${LabBucket.Arn}/*" LabSetupRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Principal: Service: lambda.amazonaws.com Action: sts:AssumeRole ManagedPolicyArns: - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Policies: - PolicyName: LabSetupPolicy PolicyDocument: Version: "2012-10-17" Statement: - Effect: Allow Action: - s3:PutObject - s3:DeleteObject - s3:ListBucket Resource: - !GetAtt LabBucket.Arn - !Sub "${LabBucket.Arn}/*" LabSetupFunction: Type: AWS::Lambda::Function Properties: Runtime: python3.12 Handler: index.handler Role: !GetAtt LabSetupRole.Arn Timeout: 60 Code: ZipFile: | import boto3 import cfnresponse HTML = ''' AWS Cloud Path Academy

AWS Broken Labs

If you can read this, the lab is fixed.

Lab 05 — Bucket Policy
www.cloudpathacademy.com
''' def handler(event, context): s3 = boto3.client('s3') bucket = event['ResourceProperties']['BucketName'] try: if event['RequestType'] in ('Create', 'Update'): s3.put_object( Bucket=bucket, Key='index.html', Body=HTML.strip().encode('utf-8'), ContentType='text/html', ) cfnresponse.send(event, context, cfnresponse.SUCCESS, {}) elif event['RequestType'] == 'Delete': paginator = s3.get_paginator('list_objects_v2') for page in paginator.paginate(Bucket=bucket): for obj in page.get('Contents', []): s3.delete_object(Bucket=bucket, Key=obj['Key']) cfnresponse.send(event, context, cfnresponse.SUCCESS, {}) except Exception as e: cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)}) LabSetup: Type: Custom::LabSetup DependsOn: LabBucketPolicy Properties: ServiceToken: !GetAtt LabSetupFunction.Arn BucketName: !Ref LabBucket Outputs: BucketName: Description: Name of the S3 bucket Value: !Ref LabBucket BucketURL: Description: URL to access the site Value: !Sub "https://${LabBucket}.s3.${AWS::Region}.amazonaws.com/index.html"