Inspecting Infrastructure

import * as pulumi from "@pulumi/pulumi"
import * as aws from "@pulumi/aws"

// Create an S3 bucket
const s3Bucket = new aws.s3.Bucket("myBucket")

// IAM Policy Document that allows the Lambda service to write to the S3 bucket
const s3BucketPolicyDocument = s3Bucket.arn.apply((arn) =>
  JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "lambda.amazonaws.com" },
        Action: ["s3:PutObject", "s3:PutObjectAcl"],
        Resource: `${arn}/*`,
      },
    ],
  })
)

// Attach the policy to the bucket
const s3BucketPolicy = new aws.s3.BucketPolicy("myBucketPolicy", {
  bucket: s3Bucket.id,
  policy: s3BucketPolicyDocument,
})

// Export the names and ARNs of the created resources
export const bucketName = s3Bucket.id
export const bucketArn = s3Bucket.arn

import pulumi
import pulumi_aws as aws
import json

# Create an S3 bucket
s3_bucket = aws.s3.Bucket("myBucket")

# IAM Policy Document that allows the Lambda service to write to the S3 bucket
s3_bucket_policy_document = s3_bucket.arn.apply(
    lambda arn: json.dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": "lambda.amazonaws.com"},
                    "Action": ["s3:PutObject", "s3:PutObjectAcl"],
                    "Resource": f"{arn}/*",
                }
            ],
        }
    )
)

# Attach the policy to the bucket
s3_bucket_policy = aws.s3.BucketPolicy(
    "myBucketPolicy",
    bucket=s3_bucket.id,
    policy=s3_bucket_policy_document,
)

# Export the names and ARNs of the created resources
pulumi.export("bucket_name", s3_bucket.id)
pulumi.export("bucket_arn", s3_bucket.arn)

package main

import (
  "fmt"

  "github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
  "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
  pulumi.Run(func(ctx *pulumi.Context) error {
    // Create an S3 bucket
    s3Bucket, err := s3.NewBucket(ctx, "myBucket", nil)
    if err != nil {
      return err
    }

    // IAM Policy Document that allows the Lambda service to write to the S3 bucket
    s3Bucket.Arn.ApplyT(func(arn string) (string, error) {
      policy := fmt.Sprintf(`{
        "Version": "2012-10-17",
        "Statement": [{
          "Effect": "Allow",
          "Principal": {"Service": "lambda.amazonaws.com"},
          "Action": ["s3:PutObject", "s3:PutObjectAcl"],
          "Resource": "%s/*"
        }]
      }`, arn)

      // Attach the policy to the bucket
      _, err := s3.NewBucketPolicy(ctx, "myBucketPolicy", &s3.BucketPolicyArgs{
        Bucket: s3Bucket.ID(),
        Policy: pulumi.String(policy),
      })
      if err != nil {
        return "", err
      }

      return "", nil
    })

    // Export the names and ARNs of the created resources
    ctx.Export("bucketName", s3Bucket.ID())
    ctx.Export("bucketArn", s3Bucket.Arn)

    return nil
  })
}

using System.Collections.Generic;
using Pulumi;
using Pulumi.Aws.S3;

return await Deployment.RunAsync(() =>
{
    var bucket = new Bucket("myBucket");

    var bucketPolicy = new BucketPolicy("myBucketPolicy", new BucketPolicyArgs
    {
        Bucket = bucket.Id,
        Policy = Output.JsonSerialize(Output.Create(
            new
            {
                Version = "2012-10-17",
                Statement = new[]
                {
                    new
                    {
                        Effect = "Allow",
                        Principal = new { Service = "lambda.amazonaws.com" },
                        Action = new[] { "s3:PutObject", "s3:PutObjectAcl" },
                        Resource = Output.Format($"{bucket.Arn}/*"),
                    }
                }
            }
        ))
    });

    return new Dictionary<string, object?>
    {
        ["bucketName"] = bucket.Id,
        ["bucketArn"] = bucket.Arn
    };
});

package myproject;

import com.pulumi.Pulumi;
import com.pulumi.core.Either;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            var bucket = new Bucket("myBucket");

            var policyDocument = bucket.arn().applyValue(arn -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Action", jsonArray("s3:PutObject", "s3:PutObjectAcl")),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "lambda.amazonaws.com")
                        )),
                        jsonProperty("Resource", arn + "/*")
                    )))
                )
            ));

            var bucketPolicy = new BucketPolicy("myBucketPolicy", BucketPolicyArgs.builder()
                .bucket(bucket.id())
                .policy(policyDocument.applyValue(Either::ofLeft))
                .build());

            ctx.export("bucketName", bucket.id());
            ctx.export("bucketArn", bucket.arn());
        });
    }
}

name: aws-s3bucket-bucketpolicy-yaml
runtime: yaml
description: An example that deploys an S3 bucket and bucket policy on AWS.

resources:
  myBucket:
    type: aws:s3:Bucket
  myBucketPolicy:
    type: aws:s3/bucketPolicy:BucketPolicy
    properties:
      bucket: ${myBucket.id}
      policy:
        fn::toJSON:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service: "lambda.amazonaws.com"
              Action:
                - "s3:PutObject"
                - "s3:PutObjectAcl"
              Resource: "${myBucket.arn}/*"

outputs:
  bucket_name: ${myBucket.id}
  bucket_arn: ${myBucket.arn}