Question 275697 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Amazon web services – CloudFormation S3 Bucket Policy

I am new to CloudFormation and am trying to create an S3 bucket as below for a CloudFront distribution. However, I get a NotStabilized error after a few minutes of deploying the yaml file. I am assuming that this is an error in my yaml declaration but I can’t figure out where I have gone wrong!

  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !FindInMap [AccountsMap, !Ref "AWS::AccountId", BucketName]
      PublicAccessBlockConfiguration:
        BlockPublicAcls: false
      OwnershipControls:
        Rules:
          - ObjectOwnership: ObjectWriter
      VersioningConfiguration:
        Status: Enabled
      CorsConfiguration:
        CorsRules:
        - AllowedMethods: [GET]
          AllowedOrigins: ['*']
          MaxAge: '3600'
      LifecycleConfiguration:
        Rules:
          - Id: non-current-versions-removal-rule
            Status: Enabled
            NoncurrentVersionExpirationInDays: 1
      Tags:
        - Key: Name
          Value: !FindInMap [AccountsMap, !Ref "AWS::AccountId", BucketName]
        - Key: project
          Value: !Ref ProjectId

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:GetObjectAcl
            Principal: "*"
            Resource: !Join [ '', ['arn:aws:s3::', !Ref S3Bucket, '/*']]
          - Effect: Allow
            Action:
              - s3:PutObject
              - s3:PutObjectAcl
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: !Join [ '', ['arn:aws:s3::', !Ref S3Bucket, '/*']]

where the we have

Mappings:
  AccountsMap:
    "<account number>":
      BucketName: my-s3-bucket

Parameters:
  ProjectId:
    Type: String
    Description: Name of the project
    Default: my-project

This fails with the following error:

Resource handler returned message: "Exceeded attempts to wait" (RequestToken: , HandlerErrorCode: NotStabilized)

Any ideas?

Tags:

2

Answers


  1. 0

    You are missing one colon in the S3 resource ARN:

    Resource: !Join [ '', ['arn:aws:s3:::', !Ref S3Bucket, '/*']]
                                    ^
    Login or Signup to reply.
  2. 0

    Bucket ARN can also be retrieved via Fn::GetAtt to avoid these errors:

    Resource: !Join [ '/', [{"Fn::GetAtt": [S3Bucket, Arn]}, '*']]
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search