AWSTemplateFormatVersion: 2010-09-09
Description: Create resources needed to set up AWS Marketplace Seller Delivery Data Feeds (SDDS)

Parameters:
  SddsBucketName:
    Description: Bucket Name for SDDS feeds
    Type: String
  SddsSnsTopicName:
    Description: The name of the topic where the notification will be sent when there's new data
    Type: String
    Default: clazar-sdds-sns

Mappings:
  Configuration:
    ServicePrincipal:
      Value: "reports.marketplace.amazonaws.com"

Resources:
  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: "2012-10-17"
        Id: KMSKeyPolicy
        Statement:
          - Sid: Owner Access
            Effect: Allow
            Action:
              - kms:*
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root
            Resource: "*"
          - Sid: Aws Marketplace Data Feeds Access
            Effect: Allow
            Action:
              - "kms:Encrypt"
              - "kms:Decrypt"
              - "kms:DescribeKey"
              - "kms:GenerateDataKey"
            Principal:
              Service: !FindInMap [Configuration, ServicePrincipal, Value]
            Resource: "*"
            Condition:
              StringLike:
                "kms:EncryptionContext:aws:s3:arn":
                  Fn::Sub: "arn:aws:s3:::${SddsBucketName}/*"

  KMSKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName:
        Fn::Sub: "alias/AWSMarketplaceDataFeeds-${SddsBucketName}"
      TargetKeyId: !Ref 'KMSKey'

  SddsBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      BucketName: !Ref SddsBucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: aws:kms
              KMSMasterKeyID:
                Fn::GetAtt:
                  - KMSKey
                  - Arn
      VersioningConfiguration:
        Status: Enabled

  SddsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: SddsBucket
      PolicyDocument:
        Statement:
          - Sid: AwsMarketplaceDataFeedsAccess
            Effect: Allow
            Action:
              - "s3:ListBucket"
              - "s3:GetObject"
              - "s3:PutObject"
              - "s3:GetEncryptionConfiguration"
              - "s3:GetBucketAcl"
              - "s3:PutObjectAcl"
            Resource:
              - Fn::Sub: arn:aws:s3:::${SddsBucket}
              - Fn::Sub: arn:aws:s3:::${SddsBucket}/*
            Principal:
              Service: !FindInMap [Configuration, ServicePrincipal, Value]
          - Sid: DenyIncorrectEncryptionHeader
            Effect: Deny
            Principal: "*"
            Action: s3:PutObject
            Resource:
              Fn::Sub: arn:aws:s3:::${SddsBucket}/*
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: aws:kms
          - Sid: DenyUnencryptedObjectUploads
            Effect: Deny
            Principal: "*"
            Action: s3:PutObject
            Resource:
              Fn::Sub: arn:aws:s3:::${SddsBucket}/*
            Condition:
              Bool:
                s3:x-amz-server-side-encryption: true
          - Sid: DenyHttpRequest
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              Fn::Sub: arn:aws:s3:::${SddsBucket}/*
            Condition:
              Bool:
                aws:SecureTransport: false


  SddsSNSTopic:
    Type: 'AWS::SNS::Topic'
    Properties:
      TopicName: !Ref SddsSnsTopicName
      KmsMasterKeyId: alias/aws/sns

  SddsSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Sid: AwsMarketplaceDataFeedsAccess
            Effect: Allow
            Principal:
              AWS:
                - Fn::Sub: arn:aws:iam::${AWS::AccountId}:root
              Service: !FindInMap [Configuration, ServicePrincipal, Value]
            Action: 
              - 'sns:Publish'
              - 'sns:Subscribe'
            Resource: !Ref SddsSNSTopic
      Topics:
        - !Ref SddsSNSTopic

Outputs:
  SddsBucketName:
    Description: "Sdds Bucket Name"
    Value: !Ref SddsBucket
  SddsKmsKeyArn:
    Description: "Sdds KMS Key Arn"
    Value: !GetAtt KMSKey.Arn
  SddsSnsTopicArn:
    Description: "SDDS SNS Topic Arn"
    Value: !Ref SddsSNSTopic