ALB のアクセスログを出力する S3バケットは ALB と同じリージョンに存在する必要がある

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  CRR verification - Tokyo (ap-northeast-1) SOURCE bucket.
  Receives ALB access logs (same-region requirement satisfied) and replicates
  ALL objects to the Osaka destination bucket via S3 Cross-Region Replication.
  Source objects are expired quickly by a lifecycle rule to minimize cost.

Parameters:
  DestinationBucketArn:
    Type: String
    Description: ARN of the Osaka destination bucket (from the crr-osaka-dest stack output).
  SourceExpireDays:
    Type: Number
    Default: 7
    Description: Days after which current-version objects in the Tokyo source bucket expire.

Resources:
  SourceBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName: !Sub "devio-iwaki-s3-tokyo-${AWS::AccountId}"
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      LifecycleConfiguration:
        Rules:
          # Keep the source lean: expire current objects quickly (they are already
          # replicated to Osaka), and clean up old versions and stale uploads.
          - Id: expire-current-objects
            Status: Enabled
            ExpirationInDays: !Ref SourceExpireDays
          - Id: expire-noncurrent-versions
            Status: Enabled
            NoncurrentVersionExpiration:
              NoncurrentDays: 3
          - Id: abort-incomplete-multipart
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 3
      ReplicationConfiguration:
        Role: !GetAtt ReplicationRole.Arn
        Rules:
          - Id: replicate-all-to-osaka
            Status: Enabled
            Priority: 0
            Filter: {}            # empty filter = ALL objects
            DeleteMarkerReplication:
              Status: Disabled    # keep objects on destination even if deleted at source
            Destination:
              Bucket: !Ref DestinationBucketArn

  # Bucket policy for ALB access log delivery (same as the same-region setup).
  SourceBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref SourceBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowELBLogDelivery
            Effect: Allow
            Principal:
              Service: logdelivery.elasticloadbalancing.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub "arn:aws:s3:::${SourceBucket}/AWSLogs/${AWS::AccountId}/*"

  # IAM role assumed by S3 to perform replication.
  ReplicationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "devio-iwaki-role-crr-${AWS::AccountId}"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: devio-iwaki-crr-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              # Read source objects + replication metadata
              - Effect: Allow
                Action:
                  - s3:GetReplicationConfiguration
                  - s3:ListBucket
                Resource: !Sub "arn:aws:s3:::devio-iwaki-s3-tokyo-${AWS::AccountId}"
              - Effect: Allow
                Action:
                  - s3:GetObjectVersionForReplication
                  - s3:GetObjectVersionAcl
                  - s3:GetObjectVersionTagging
                Resource: !Sub "arn:aws:s3:::devio-iwaki-s3-tokyo-${AWS::AccountId}/*"
              # Write replicas to the destination bucket
              - Effect: Allow
                Action:
                  - s3:ReplicateObject
                  - s3:ReplicateDelete
                  - s3:ReplicateTags
                Resource: !Sub "${DestinationBucketArn}/*"

Outputs:
  SourceBucketName:
    Description: Name of the Tokyo source bucket (set this as the ALB access log bucket)
    Value: !Ref SourceBucket
  ReplicationRoleArn:
    Description: ARN of the replication IAM role
    Value: !GetAtt ReplicationRole.Arn

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  CRR verification - Osaka (ap-northeast-3) DESTINATION bucket.
  Receives replicated objects from the Tokyo source bucket via S3 Cross-Region
  Replication. Versioning enabled (required for replication target).

Resources:
  DestinationBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      BucketName: !Sub "devio-iwaki-s3-osaka-repl-${AWS::AccountId}"
      VersioningConfiguration:
        Status: Enabled
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced
      LifecycleConfiguration:
        Rules:
          # Keep costs low: expire noncurrent versions quickly on the destination.
          - Id: expire-noncurrent-versions
            Status: Enabled
            NoncurrentVersionExpiration:
              NoncurrentDays: 7
          - Id: abort-incomplete-multipart
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 3

Outputs:
  DestinationBucketName:
    Description: Name of the Osaka destination bucket
    Value: !Ref DestinationBucket
  DestinationBucketArn:
    Description: ARN of the Osaka destination bucket (use as ReplicationDestinationArn in the Tokyo stack)
    Value: !GetAtt DestinationBucket.Arn