Configure Resources According to the CloudFormation File

Use the CloudFormation template to create the resources.

1. Access control:
   1. For our application, create the dedicated Role with External ID (OB_ROLE).
   2. For our application, create the dedicated Audit Role with the same External ID (OB_AUDIT_ROLE).
2. Bucket Configuration:
   1. Create a master key in KMS.
   2. Create a bucket for backup data encrypted with KMS.
   3. Create Server Access Logs dedicated to the bucket encrypted with the default key.
   4. Configure bucket events to be sent to Own AWS Account (SQS in OB AWS).
3. Role Policies:
   1. Grant OB_ROLE permissions to put, list, and delete objects in the bucket.
   2. Grant OB_AUDIT_ROLE permissions to retrieve bucket configuration and policies.
   3. The IAM OB tenant is the only user that can assume the OB_ROLE.
   4. The IAM OB tenant is the only users that can assume the OB_AUDIT_ROLE.
4. Bucket Policies:
   1. The OB_ROLE is the only role with the permission to put, list, and delete objects in the backup bucket.
   2. Access to objects within the backups bucket is only from OB VPC.