aws-cdk-constructs 2.26.1__tar.gz → 2.26.2__tar.gz

{aws_cdk_constructs-2.26.1 → aws_cdk_constructs-2.26.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws_cdk_constructs
-Version: 2.26.1
+Version: 2.26.2
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.26.1 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs/__init__.py

@@ -14,4 +14,4 @@ from .load_balancer import Alb, Nlb
 from .security_group import SecurityGroup
 from .windows_server import WindowsServer
 
-__version__ = '2.26.1'
+__version__ = '2.26.2'

{aws_cdk_constructs-2.26.1 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs/bucket/bucket.py

@@ -103,6 +103,7 @@ class Bucket(Construct):
 
         cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
 
+        bucket_policy_statements: List[_iam.PolicyStatement]: List of policy statements to be added to the Bucket policy. Default: []
     """
 
     @property
@@ -160,8 +161,9 @@ class Bucket(Construct):
         encryption_allowed_principals_arns: Union[str, List[str]] = None,
         enforce_ssl: bool = False,
         will_implement_cdn: str = 'false',
-        cdn_domain_names: [str] = [],
+        cdn_domain_names: List[str] = [],
         cdn_ssl_certificate_arn: str = None,
+        bucket_policy_statements: List[_iam.PolicyStatement] = [],
         **kwargs,
     ) -> aws_cdk.aws_s3.Bucket:
         """Create an S3 bucket
@@ -198,6 +200,8 @@ class Bucket(Construct):
 
             cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
 
+            bucket_policy_statements: List[_iam.PolicyStatement]: List of policy statements to be added to the Bucket policy. Default: []
+
         Returns:
             aws_s3.Bucket: the S3 bucket
         """
@@ -299,9 +303,10 @@ class Bucket(Construct):
         )
         # Create CloudFront distribution
         if create_cloudfront_distribution:
+            distribution_id = f'distribution_{bucket_name}'
             self._cloudfront_distribution = _cloudfront.Distribution(
                 self,
-                f'distribution_{bucket_name}',
+                distribution_id,
                 default_behavior=_cloudfront.BehaviorOptions(
                     origin=_cloudfront_origins.S3Origin(s3_bucket),
                     compress=True,
@@ -325,6 +330,104 @@ class Bucket(Construct):
                 domain_names=cdn_domain_names,
             )
 
+            self._origin_access_control = _cloudfront.CfnOriginAccessControl(
+                self,
+                f'oac_{bucket_name}',
+                origin_access_control_config=_cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
+                    name=f'oac_{bucket_name}',
+                    origin_access_control_origin_type='s3',
+                    signing_behavior='always',
+                    signing_protocol='sigv4',
+                ),
+            )
+
+            cloudfront_distribution_arn = (
+                f'arn:aws:cloudfront::'
+                + self.aws_account['id']
+                + f':distribution/{self._cloudfront_distribution.distribution_id}'
+            )
+            bucket_statement = _iam.PolicyStatement(
+                principals=[_iam.ServicePrincipal('cloudfront.amazonaws.com')],
+                actions=['s3:GetObject'],
+                resources=[f'{s3_bucket.bucket_arn}/*'],
+                conditions={
+                    'StringEquals': {
+                        'aws:sourceArn': cloudfront_distribution_arn
+                    }
+                },
+            )
+
+            s3_bucket.add_to_resource_policy(bucket_statement)
+
+            # Add custom policy statements to bucket policy
+            for statement in bucket_policy_statements:
+                s3_bucket.add_to_resource_policy(statement)
+
+            ## clean-up the OAI reference and associate the OAC with the cloudfront distribution
+            # query the site bucket policy as a document
+            bucket_policy = s3_bucket.policy
+            bucket_policy_document = bucket_policy.document
+
+            # remove the CloudFront Origin Access Identity permission from the bucket policy
+            if isinstance(bucket_policy_document, _iam.PolicyDocument):
+                bucket_policy_document_json = bucket_policy_document.to_json()
+                # create an updated policy without the OAI reference
+                bucket_policy_updated_json = {
+                    'Version': '2012-10-17',
+                    'Statement': [],
+                }
+                for statement in bucket_policy_document_json['Statement']:
+                    if 'CanonicalUser' not in statement['Principal']:
+                        bucket_policy_updated_json['Statement'].append(
+                            statement
+                        )
+
+            # apply the updated bucket policy to the bucket
+            bucket_policy_override = s3_bucket.node.find_child(
+                'Policy'
+            ).node.default_child
+            bucket_policy_override.add_override(
+                'Properties.PolicyDocument', bucket_policy_updated_json
+            )
+
+            # remove the created OAI reference (S3 Origin property) for the distribution
+            all_distribution_props = (
+                self._cloudfront_distribution.node.find_all()
+            )
+            for child in all_distribution_props:
+                if child.node.id == 'S3Origin':
+                    child.node.try_remove_child('Resource')
+
+            # associate the created OAC with the distribution
+            distribution_props = (
+                self._cloudfront_distribution.node.default_child
+            )
+            distribution_props.add_override(
+                'Properties.DistributionConfig.Origins.0.S3OriginConfig.OriginAccessIdentity',
+                '',
+            )
+            distribution_props.add_property_override(
+                'DistributionConfig.Origins.0.OriginAccessControlId',
+                self._origin_access_control.ref,
+            )
+
+            # Assign Origin Access Control
+            # indexes = ["0"]
+            # for index in indexes:
+            #     self._cloudfront_distribution.node.find_child(
+            #         "Resource"
+            #     ).add_property_override(
+            #         f"DistributionConfig.Origins.{index}.OriginAccessControlId",
+            #         self._origin_access_control.get_att("Id"),
+            #     )
+
+            #     self._cloudfront_distribution.node.find_child(
+            #         "Resource"
+            #     ).add_property_override(
+            #         f"DistributionConfig.Origins.{index}.S3OriginConfig.OriginAccessIdentity",
+            #         {},
+            #     )
+
         return s3_bucket
 
     def __init__(
@@ -351,6 +454,7 @@ class Bucket(Construct):
         will_implement_cdn: str = 'false',
         cdn_domain_names: [str] = [],
         cdn_ssl_certificate_arn: str = None,
+        bucket_policy_statements: List[_iam.PolicyStatement] = [],
         **kwargs,
     ) -> None:
         super().__init__(scope, id, **kwargs)
@@ -484,6 +588,7 @@ class Bucket(Construct):
             will_implement_cdn=will_implement_cdn,
             cdn_domain_names=cdn_domain_names,
             cdn_ssl_certificate_arn=cdn_ssl_certificate_arn,
+            bucket_policy_statements=bucket_policy_statements,
         )
 
         if bucket_is_privately_accessed_from_vpc_over_http:

{aws_cdk_constructs-2.26.1 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws-cdk-constructs
-Version: 2.26.1
+Version: 2.26.2
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author