The following is an example of setting a bucketpolicy in a cfn template for A bucket.
"mybucketpolicy" : {
"Type" : "AWS::S3::BucketPolicy",
"Properties" : {
"PolicyDocument" : {
"Id" : "MyPolicy",
"Statement" : [ {
"Sid" : "ReadAccess",
"Action" : [ "s3:GetObject" ],
"Effect" : "Allow",
"Resource" : { "Fn::Join" : [
"", [ "arn:aws:s3:::", { "Ref" : "mybucket" } , "/*" ]
] },
"Principal" : {
"AWS" : { "Fn::GetAtt" : [ "mygroup", "Arn" ] }
}
} ]
},
"Bucket" : { "Ref" : "mybucket" }
}
}
}
If I want to apply a policy to another bucket, in addition to mybucket, how would I do that?
Do I have to:
- create a brand new bucketpolicy lets say 'mybucketpolicy2' which would be very similar to the above?
- just add one more item to the 'Statement' array above with the new bucket name? If yes, then this would be in conflict with the "Bucket" key above, wont it?
- some other way?
PS: I have asked the same question on aws cfn forum but I have come to realize that I get answers quicker on SO than on aws forums.