git:20260323.935227a to git:20260324.a02e282

26 added, 15 removed. Audit A to A.

---

name: aws-cloudformation-s3

description: Provides AWS CloudFormation patterns for Amazon S3. Use when creating S3 buckets, policies, versioning, lifecycle rules, and implementing template structure with Parameters, Outputs, Mappings, Conditions, and cross-stack references.

allowed-tools: Read, Write, Bash

---

# AWS CloudFormation S3 Patterns

- Create production-ready Amazon S3 infrastructure using AWS CloudFormation templates.

- ## Overview

- Create production-ready Amazon S3 infrastructure using AWS CloudFormation templates. This skill covers S3 bucket configurations, bucket policies, versioning, lifecycle rules, and template structure best practices.

+ Provides S3 bucket configurations, policies, versioning, lifecycle rules, and CloudFormation template structure best practices for production-ready infrastructure.

## When to Use

- Use this skill when:

- Creating S3 buckets with custom configurations

- Implementing bucket policies for access control

- Configuring S3 versioning for data protection

- Setting up lifecycle rules for data management

- Creating Outputs for cross-stack references

- Using Parameters with AWS-specific types

- Organizing templates with Mappings and Conditions

- - Building reusable CloudFormation templates for S3

- ## Instructions

+ ## Overview

- Follow these steps to create S3 infrastructure with CloudFormation:

+ S3 bucket configurations, policies, versioning, lifecycle rules, and CloudFormation template structure for production-ready infrastructure.

- 1. **Define Bucket Parameters**: Specify bucket name, versioning, and encryption

+ ## Instructions

+ 1. **Define Bucket Resources**: Create `AWS::S3::Bucket` with versioning, encryption, PublicAccessBlock

2. **Configure Bucket Policy**: Set up IAM policies for access control

3. **Set Up Lifecycle Rules**: Define transitions and expiration policies

- 4. **Enable Versioning**: Protect against accidental deletions

- 5. **Configure CORS**: Allow cross-origin requests if needed

- 6. **Add Public Access Block**: Prevent accidental public exposure

- 7. **Set Up Logging**: Enable access logging for audit purposes

- 8. **Configure Replication**: Implement cross-region replication for DR

+ 4. **Configure CORS**: Allow cross-origin requests if needed

+ 5. **Add Outputs**: Export bucket names/ARNs for cross-stack references

+ **Validate before deploy:**

+ ```bash

+ aws cloudformation validate-template --template-body file://template.yaml

+ ```

+ **Deploy with rollback on failure:**

+ ```bash

+ aws cloudformation deploy \

+ --template-file template.yaml \

+ --stack-name my-s3-stack \

+ --capabilities CAPABILITY_IAM

+ ```

+ If deployment fails, CloudFormation automatically rolls back. Check failures with:

+ ```bash

+ aws cloudformation describe-stack-events --stack-name my-s3-stack

+ ```

## Quick Reference

| Resource Type | Purpose |

|---------------|---------|

| `AWS::S3::Bucket` | Create S3 bucket |

| `AWS::S3::BucketPolicy` | Set bucket-level policies |

| `AWS::S3::BucketReplication` | Cross-region replication |

| Parameters | Input values for customization |

| Mappings | Static configuration tables |

| Conditions | Conditional resource creation |

| Outputs | Return values for cross-stack references |

## Examples

### Basic S3 Bucket

```yaml

Resources:

DataBucket:

Type: AWS::S3::Bucket

Properties:

BucketName: my-data-bucket

```

### Bucket with Versioning and Encryption

```yaml

DataBucket:

Type: AWS::S3::Bucket

Properties:

BucketName: !Sub "${AWS::StackName}-data"

VersioningConfiguration:

Status: Enabled

BucketEncryption:

ServerSideEncryptionConfiguration:

- ServerSideEncryptionByDefault:

SSEAlgorithm: AES256

PublicAccessBlockConfiguration:

BlockPublicAcls: true

BlockPublicPolicy: true

```

### Lifecycle Rule

```yaml

DataBucket:

Type: AWS::S3::Bucket

Properties:

LifecycleConfiguration:

Rules:

- Id: ArchiveOldData

Status: Enabled

Transitions:

- StorageClass: GLACIER

TransitionInDays: 365

```

### Bucket Policy

```yaml

BucketPolicy:

Type: AWS::S3::BucketPolicy

Properties:

Bucket: !Ref DataBucket

PolicyDocument:

Statement:

- Effect: Allow

Principal:

AWS: !Ref RoleArn

Action:

- s3:GetObject

Resource: !Sub "${DataBucket.Arn}/*"

```

See [references/complete-examples.md](references/complete-examples.md) for more complete examples including CORS, static websites, replication, and production-ready configurations.

## Template Structure

### Template Sections

```yaml

AWSTemplateFormatVersion: 2010-09-09

Description: Template description

Mappings: {} # Static configuration tables

Metadata: {} # Additional information

Parameters: {} # Input values

Conditions: {} # Conditional creation

Transform: {} # Macro processing

Resources: {} # AWS resources (REQUIRED)

Outputs: {} # Return values

```

### Parameters

```yaml

Parameters:

BucketName:

Type: String

Description: S3 bucket name

Default: my-bucket

MinLength: 3

MaxLength: 63

AllowedPattern: '^[a-z0-9-]+$'

```

### Conditions

```yaml

Conditions:

IsProduction: !Equals [!Ref Environment, prod]

ShouldEnableVersioning: !Equals [!Ref EnableVersioning, 'true']

Resources:

DataBucket:

Type: AWS::S3::Bucket

Properties:

VersioningConfiguration:

Status: !If [ShouldEnableVersioning, Enabled, Suspended]

```

### Outputs

```yaml

Outputs:

BucketName:

Description: Name of the S3 bucket

Value: !Ref DataBucket

Export:

Name: !Sub '${AWS::StackName}-BucketName'

```

See [references/advanced-configuration.md](references/advanced-configuration.md) for detailed Mappings, Conditions, Parameters, and cross-stack references.

## Best Practices

1. **Public Access Block**: Always enable for non-static website buckets

2. **Versioning**: Enable for critical data to prevent accidental deletion

3. **Bucket Policies**: Use instead of ACLs for access control

4. **Lifecycle Rules**: Implement cost optimization with tiering

5. **Encryption**: Enable default encryption (SSE-KMS or AES256)

6. **Tags**: Tag all resources for organization and cost allocation

7. **Outputs**: Export bucket names/ARNs for cross-stack references

8. **Parameters**: Use parameters for reusability across environments

## Common Troubleshooting

**Bucket already exists**: Use unique bucket names with CloudFormation stack name

**Access denied**: Verify bucket policy and IAM permissions

**Versioning conflicts**: Cannot suspend versioning once objects exist

**Lifecycle not working**: Check rule status and prefix filters

**Cross-stack references**: Ensure outputs are exported before importing

## Related Skills

- [aws-cloudformation-security](../aws-cloudformation-security/) - Security best practices for S3

- [aws-cloudformation-lambda](../aws-cloudformation-lambda/) - Lambda triggers for S3 events

- [aws-cloudformation-iam](../aws-cloudformation-iam/) - IAM roles for S3 access

## References

### Complete Examples

- **[references/complete-examples.md](references/complete-examples.md)** - Basic buckets, versioning, lifecycle, CORS, policies, production stacks, event notifications, static websites, replication

### Advanced Configuration

- **[references/advanced-configuration.md](references/advanced-configuration.md)** - Parameters, Mappings, Conditions, Outputs, Metadata, DeletionPolicy, DependsOn, Transform

## Constraints and Warnings

- **Bucket names**: Must be globally unique (across all AWS accounts)

- **Versioning**: Cannot be suspended once objects exist in bucket

- **Lifecycle rules**: Minimum 1 day for expiration, 0 days for transitions

- **Bucket policies**: Limited to 20 KB in size

- **Public access**: Blocked by default; requires explicit configuration

- **CORS**: Limited to 100 rules per bucket

- **Replication**: Versioning must be enabled on both source and destination

- **Encryption**: KMS keys must be in same region as bucket

- **Tags**: Maximum 50 tags per resource

- **Stack limits**: CloudFormation limits resources per stack (200 default)