Inspecting Infrastructure

"use strict";
const pulumi = require("@pulumi/pulumi");
const aws = require("@pulumi/aws");

// Create an S3 bucket
const s3Bucket = new aws.s3.Bucket("myBucket");

// IAM Policy Document that allows the Lambda service to write to the S3 bucket
const s3BucketPolicyDocument = s3Bucket.arn.apply(arn =>
    JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: { Service: "lambda.amazonaws.com" },
                Action: ["s3:PutObject", "s3:PutObjectAcl"],
                Resource: `${arn}/*`,
            },
        ],
    }),
);

// Attach the policy to the bucket
const s3BucketPolicy = new aws.s3.BucketPolicy("myBucketPolicy", {
    bucket: s3Bucket.id,
    policy: s3BucketPolicyDocument,
});

// Export the names and ARNs of the created resources
exports.bucketName = s3Bucket.id;
exports.bucketArn = s3Bucket.arn;

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create an S3 bucket
const s3Bucket = new aws.s3.Bucket("myBucket");

// IAM Policy Document that allows the Lambda service to write to the S3 bucket
const s3BucketPolicyDocument = s3Bucket.arn.apply(arn =>
    JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: { Service: "lambda.amazonaws.com" },
                Action: ["s3:PutObject", "s3:PutObjectAcl"],
                Resource: `${arn}/*`,
            },
        ],
    }),
);

// Attach the policy to the bucket
const s3BucketPolicy = new aws.s3.BucketPolicy("myBucketPolicy", {
    bucket: s3Bucket.id,
    policy: s3BucketPolicyDocument,
});

// Export the names and ARNs of the created resources
export const bucketName = s3Bucket.id;
export const bucketArn = s3Bucket.arn;

import pulumi
import pulumi_aws as aws
import json

# Create an S3 bucket
s3_bucket = aws.s3.Bucket("myBucket")

# IAM Policy Document that allows the Lambda service to write to the S3 bucket
s3_bucket_policy_document = s3_bucket.arn.apply(
    lambda arn: json.dumps(
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {"Service": "lambda.amazonaws.com"},
                    "Action": ["s3:PutObject", "s3:PutObjectAcl"],
                    "Resource": f"{arn}/*",
                }
            ],
        }
    )
)

# Attach the policy to the bucket
s3_bucket_policy = aws.s3.BucketPolicy(
    "myBucketPolicy",
    bucket=s3_bucket.id,
    policy=s3_bucket_policy_document,
)

# Export the names and ARNs of the created resources
pulumi.export("bucket_name", s3_bucket.id)
pulumi.export("bucket_arn", s3_bucket.arn)

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-aws/sdk/v4/go/aws/s3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// Create an S3 bucket
		s3Bucket, err := s3.NewBucket(ctx, "myBucket", nil)
		if err != nil {
			return err
		}

		// IAM Policy Document that allows the Lambda service to write to the S3 bucket
		s3Bucket.Arn.ApplyT(func(arn string) (string, error) {
			policy := fmt.Sprintf(`{
				"Version": "2012-10-17",
				"Statement": [{
					"Effect": "Allow",
					"Principal": {"Service": "lambda.amazonaws.com"},
					"Action": ["s3:PutObject", "s3:PutObjectAcl"],
					"Resource": "%s/*"
				}]
			}`, arn)

			// Attach the policy to the bucket
			_, err := s3.NewBucketPolicy(ctx, "myBucketPolicy", &s3.BucketPolicyArgs{
				Bucket: s3Bucket.ID(),
				Policy: pulumi.String(policy),
			})
			if err != nil {
				return "", err
			}

			return "", nil
		})

		// Export the names and ARNs of the created resources
		ctx.Export("bucketName", s3Bucket.ID())
		ctx.Export("bucketArn", s3Bucket.Arn)

		return nil
	})
}

using Pulumi;
using Pulumi.Aws.Iam;
using Pulumi.Aws.S3;
using System.Collections.Generic;
using System.Text.Json;

return await Deployment.RunAsync(() =>
{
    var bucket = new Bucket("myBucket");

    var s3BucketPolicyDocument = bucket.Arn.Apply(arn => JsonSerializer.Serialize(new
    {
        Version = "2012-10-17",
        Statement = new[]
        {
            new
            {
                Effect = "Allow",
                Principal = new { Service = "lambda.amazonaws.com" },
                Action = new[] { "s3:PutObject", "s3:PutObjectAcl" },
                Resource = $"{arn}/*"
            }
        }
    }));

    var bucketPolicy = new BucketPolicy("myBucketPolicy", new BucketPolicyArgs
    {
        Bucket = bucket.Id,
        Policy = s3BucketPolicyDocument
    });

    return new Dictionary<string, object?>
    {
        ["bucketName"] = bucket.Id,
        ["bucketArn"] = bucket.Arn
    };
});

package myproject;

import com.pulumi.Pulumi;
import com.pulumi.aws.s3.Bucket;
import com.pulumi.aws.s3.BucketPolicy;
import com.pulumi.aws.s3.BucketPolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;

public class App {
    public static void main(String[] args) {
        Pulumi.run(ctx -> {
            var bucket = new Bucket("myBucket");

            var policyDocument = bucket.arn().applyValue(arn -> serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Action", jsonArray("s3:PutObject", "s3:PutObjectAcl")),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "lambda.amazonaws.com")
                        )),
                        jsonProperty("Resource", arn + "/*")
                    )))
                )
            ));

            var bucketPolicy = new BucketPolicy("myBucketPolicy", BucketPolicyArgs.builder()
                .bucket(bucket.id())
                .policy(policyDocument)
                .build());

            ctx.export("bucketName", bucket.id());
            ctx.export("bucketArn", bucket.arn());
        });
    }
}

name: aws-s3bucket-bucketpolicy-yaml
runtime: yaml
description: An example that deploys an S3 bucket and bucket policy on AWS.

resources:
  myBucket:
    type: aws:s3/bucket:Bucket

  myBucketPolicy:
    type: aws:s3/bucketPolicy:BucketPolicy
    properties:
      bucket: ${myBucket.id}
      policy:
        fn::toJSON:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service: "lambda.amazonaws.com"
              Action:
                - "s3:PutObject"
                - "s3:PutObjectAcl"
              Resource: "${myBucket.arn}/*"

outputs:
  bucket_name: ${myBucket.id}
  bucket_arn: ${myBucket.arn}