AWSTemplateFormatVersion: "2010-09-09"
Description: Enable AWS Config recorder to S3 Bucket
Resources:
  Bucket:
    Type: AWS::S3::Bucket

  RolePolicies: 
    Type: AWS::IAM::Policy
    Properties: 
      PolicyName: BucketAccess
      PolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - Effect: Allow
            Action: s3:PutObject
            Resource: !Sub "arn:aws:s3:::${Bucket}/AWSLogs/${AWS::AccountId}/*"
            Condition:
              StringLike:
                "s3:x-amz-acl": bucket-owner-full-control
          - Effect: Allow
            Action: s3:GetBucketAcl
            Resource: !GetAtt Bucket.Arn
      Roles: 
        - !Ref ConfigRole
    
  ConfigRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
      AssumeRolePolicyDocument: 
        Version: "2012-10-17"
        Statement: 
          - Effect: Allow
            Principal: 
              Service: 
                - config.amazonaws.com
            Action: 
              - sts:AssumeRole
  
  Recorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties: 
      Name: ExampleConfigRecorder
      RecordingGroup: 
        ResourceTypes:
          - AWS::ServiceCatalog::CloudFormationProvisionedProduct
          - AWS::CloudFormation::Stack
      RoleARN: !GetAtt ConfigRole.Arn
  
  DeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      S3BucketName: !Ref Bucket

Outputs:
  BucketName:
    Description: Bucket
    Value: !Ref Bucket