fix: prevent content deletion from artifact bucket (#1073)

* fix: prevent content deletion from artifact bucket

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>

* fix: add listBucket permission to s3 policy

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>

---------

Signed-off-by: Arjun Raja Yogidas <arjunry@amazon.com>

Author: coderbirju

lib/artifact-bucket-cloudfront.ts

@@ -24,7 +24,8 @@ export class ArtifactBucketCloudfrontStack extends cdk.Stack {
     // upload the file for integration testing puporse
     new s3Deployment.BucketDeployment(this, 'DeployTestFile', {
       sources: [s3Deployment.Source.asset('./assets')],
-      destinationBucket: artifactBucket
+      destinationBucket: artifactBucket,
+      prune: false
     });
 
     const cloudfrontCdn = new CloudfrontCdn(this, 'ArtifactCloudfrontCdn', {

lib/cloudfront_cdn.ts

@@ -20,8 +20,11 @@ export class CloudfrontCdn extends Construct {
 
     props.bucket.addToResourcePolicy(
       new iam.PolicyStatement({
-        actions: ['s3:GetObject'],
-        resources: [props.bucket.arnForObjects('*')],
+        actions: ['s3:GetObject', 's3:ListBucket'],
+        resources: [
+          props.bucket.bucketArn,           // arn:aws:s3:::bucket-name
+          props.bucket.arnForObjects('*')   // arn:aws:s3:::bucket-name/*
+        ],
         principals: [new iam.CanonicalUserPrincipal(cloudfrontOAI.cloudFrontOriginAccessIdentityS3CanonicalUserId)]
       })
     );

test/cloudfront_cdn.test.ts

@@ -46,28 +46,33 @@ describe('CloudfrontCdn', () => {
         Ref: bukcetLogicalId
       },
       PolicyDocument: {
-        Statement: [
+        Statement: Match.arrayWith([
           Match.objectLike({
-            Action: 's3:GetObject',
+            Action: ['s3:GetObject', 's3:ListBucket'],
             Effect: 'Allow',
             Principal: {
               CanonicalUser: {
                 'Fn::GetAtt': [Match.anyValue(), 'S3CanonicalUserId']
               }
             },
-            Resource: {
-              'Fn::Join': [
-                '',
-                [
-                  {
-                    'Fn::GetAtt': [bukcetLogicalId, 'Arn']
-                  },
-                  '/*'
+            Resource: [
+              {
+                'Fn::GetAtt': [bukcetLogicalId, 'Arn']
+              },
+              {
+                'Fn::Join': [
+                  '',
+                  [
+                    {
+                      'Fn::GetAtt': [bukcetLogicalId, 'Arn']
+                    },
+                    '/*'
+                  ]
                 ]
-              ]
-            }
+              }
+            ]
           })
-        ],
+        ]),
         Version: '2012-10-17'
       }
     });