thinknimble / tn-aws-cloud-formations

A cloud formation for adding new aws s3 buckets for projects

ThinkNimble AWS CloudFormations

This repository provides AWS CloudFormation configs that streamline the process of creating application resources on AWS that we commonly use in our applications. For instance, it is best practice to create a unique IAM user per app and follow the Principle of Least Privilege, meaning that user's permissions should be limited to only what is needed for the app.

There are currently two configurations and instructions below.

• Create S3 Bucket
• Create Bedrock Permissions Policy

These configurations require the AWS CLI. Follow these instructions to get started

Create S3 Bucket

Our apps use S3 to store user-uploaded files and other static media. Use this cloud formaiton to quickly spin up a Bucket, IAM User, and secure Bucket Policies.

Please note if you have multiple aws accounts configured you will need to pass the profile key and if a region is not set the region key

aws <command> --profile <profile-name> --region <aws-region>

CLI Command Using the YAML File

For this to work, you will need to download the YAML file or clone this repository.

aws cloudformation create-stack --stack-name <STACK-NAME> --template-body file://<FILE-PATH>  --region us-east-1 --parameters ParameterKey=BucketNameParameter,ParameterValue=<BUCKET-NAME> --capabilities CAPABILITY_NAMED_IAM

CLI Command Using the URL

For convenience, the configs are also available on a public S3 bucket, so that you do not need to download them.

aws cloudformation create-stack --stack-name <STACK-NAME> --template-url 'https://tn-s3-cloud-formation.s3.amazonaws.com/aws-s3-cloud-formation.yaml'  --region us-east-1 --parameters ParameterKey=BucketNameParameter,ParameterValue=<BUCKET-NAME> --capabilities CAPABILITY_NAMED_IAM

The following arguments are required:

• --stack-name <STACK-NAME> this must be unique
• --parameters ParameterKey=BucketNameParameter,ParameterValue=<BUCKET-NAME> BUCKET-NAME must be unique and lowercased
• --capabilities CAPABILITY_NAMED_IAM
• --template-body file://<FILE-PATH> path should start with file:// one of --template-body or --template-url
• --template-url <FILE-URL> one of --template-body or --template-url

Using the AWS Console

You can also run the "stack" from the AWS Console:

• Visit the console, sign in and navigate to the CloudFormation Dashboard
• Click create stack (with new resources)
• select Template is ready
• Select Amazon S3 URL and provide the yaml file from this repo uploaded to S3 as the link
• Click next and pass in the required parameter value (S3 Bucket Name)

Get the appropriate output variables

When the cloud formation is done you can get the Access Key ID, Secret, and Bucket name from the outputs

Using the cli

aws cloudformation describe-stacks --stack-name <STACK-NAME> from the previously create command

This will return a json object to retrieve the variables tab down to the Outputs key

Using the console

Visit the CloudFormation Dashboard, click into the new stack you created and then tap the Outputs Tab

Instructions for manual creation (No Cloud Formation)

If you do not want to use the cloud formation here are instructions for manually creating the appropriate resources

Read on Notion

Create an AWS Bedrock Permissions Policy

Our apps use AWS Bedrock for fast and low-cost LLM features. An IAM User with the proper permissions is required.

Setup

First, an AWS Administrator will need to enable Amazon Bedrock organization-wide. They will have to request access to the models we want to use. To do this: Go to AWS Bedrock in the console and follow the instructions there. I've done this for our TN Staging and Production AWS orgs

With File

aws cloudformation create-stack --stack-name <STACK-NAME> --template-body file://bedrock-user-permissions.yaml  --region us-east-1 --parameters ParameterKey=ProjectName,ParameterValue=<PROJECTNAME> ParameterKey=<SOME_MODEL_ARN_OR_*_FOR_DEFAULT_ALL>  --capabilities CAPABILITY_NAMED_IAM

With URL

aws cloudformation create-stack --stack-name <STACK-NAME> --template-url 'https://tn-s3-cloud-formation.s3.amazonaws.com/bedrock-user-permissions.yaml' --region us-east-1 --parameters ParameterKey=ProjectName,ParameterValue=<PROJECTNAME> ParameterKey=<SOME_MODEL_ARN_OR_*_FOR_DEFAULT_ALL>  --capabilities CAPABILITY_NAMED_IAM

Check Status & Outputs with File

aws cloudformation describe-stacks --stack-name <STACK-NAME>

tn-aws-cloud-formations's Issues

AWS changed rules/behavior for ACL

Currently following the vanilla instructions on this repo will throw an error

Error you'll get:

You'll see a ROLLBACK_COMPLETE on your bucket creation status when running aws cloudformation describe-stacks.
If you poke around on cloudformation on the AWS console you'll find this error:

Bucket cannot have ACLs set with ObjectOwnership's BucketOwnerEnforced setting (Service: Amazon S3; Status Code: 400; Error Code: InvalidBucketAclWithObjectOwnership

Hotfix:

Remove AccessControl: PublicRead

Better fix:

We need to research and update our access control settings as AWS has changed things to make things "easier".

Resources/Context:

Starting in April 2023, Amazon S3 will change the default settings for S3 Block Public Access and Object Ownership (ACLs disabled) for all new S3 buckets. For new buckets created after this update, all S3 Block Public Access settings will be enabled, and S3 access control lists (ACLs) will be disabled. These defaults are the recommended best practices for securing data in Amazon S3. You can adjust these settings after creating your bucket. For more information, see Default settings for new S3 buckets FAQ and Heads-Up: Amazon S3 Security Changes Are Coming in April of 2023 in the AWS News Blog.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html