# Path: stacker_blueprints/policies.py
# def s3_arn(bucket):
#     if isinstance(bucket, AWSHelperFn):
#         return Sub('arn:aws:s3:::${Bucket}', Bucket=bucket)
#     else:
#         return 'arn:aws:s3:::%s' % bucket
# 
# def read_only_s3_bucket_policy(buckets):
#     return Policy(Statement=read_only_s3_bucket_policy_statements(buckets))
# 
# def read_write_s3_bucket_policy(buckets):
#     return Policy(Statement=read_write_s3_bucket_policy_statements(buckets))
# 
# def static_website_bucket_policy(bucket):
#     """
#     Attach this policy directly to an S3 bucket to make it a static website.
#     This policy grants read access to **all unauthenticated** users.
#     """
#     return Policy(
#         Statement=[
#             Statement(
#                 Effect=Allow,
#                 Principal=Principal("*"),
#                 Action=[s3.GetObject],
#                 Resource=[s3_objects_arn(bucket)],
#             )
#         ]
#     )


from stacker.blueprints.base import Blueprint
from troposphere import (
    FindInMap,
    GetAtt,
    Output,
    Sub,
    Ref,
    Region,
    s3,
    iam,
)
from .policies import (
    s3_arn,
    read_only_s3_bucket_policy,
    read_write_s3_bucket_policy,
    static_website_bucket_policy,
)
                t.add_resource(
                    s3.BucketPolicy(
                        title + "BucketPolicy",
                        Bucket=bucket_id,
                        PolicyDocument=static_website_bucket_policy(bucket_id),
                    )
                )
                t.add_output(
                    Output(
                        title + "WebsiteUrl",
                        Value=GetAtt(title, "WebsiteURL")
                    )
                )
                t.add_output(
                    Output(
                        title + "WebsiteEndpoint",
                        Value=FindInMap(
                            "WebsiteEndpoints", Region, "endpoint"
                        )
                    )
                )

            bucket_ids.append(bucket_id)

        read_write_roles = variables["ReadWriteRoles"]
        if read_write_roles:
            t.add_resource(
                iam.PolicyType(
                    "ReadWritePolicy",
                    PolicyName=Sub("${AWS::StackName}ReadWritePolicy"),

# Path: stacker_blueprints/policies.py
# def s3_arn(bucket):
#     if isinstance(bucket, AWSHelperFn):
#         return Sub('arn:aws:s3:::${Bucket}', Bucket=bucket)
#     else:
#         return 'arn:aws:s3:::%s' % bucket
# 
# def read_only_s3_bucket_policy(buckets):
#     return Policy(Statement=read_only_s3_bucket_policy_statements(buckets))
# 
# def read_write_s3_bucket_policy(buckets):
#     return Policy(Statement=read_write_s3_bucket_policy_statements(buckets))
# 
# def static_website_bucket_policy(bucket):
#     """
#     Attach this policy directly to an S3 bucket to make it a static website.
#     This policy grants read access to **all unauthenticated** users.
#     """
#     return Policy(
#         Statement=[
#             Statement(
#                 Effect=Allow,
#                 Principal=Principal("*"),
#                 Action=[s3.GetObject],
#                 Resource=[s3_objects_arn(bucket)],
#             )
#         ]
#     )


# Path: stacker_blueprints/s3.py
from stacker.blueprints.base import Blueprint
from troposphere import (
    FindInMap,
    GetAtt,
    Output,
    Sub,
    Ref,
    Region,
    s3,
    iam,
)
from .policies import (
    s3_arn,
    read_only_s3_bucket_policy,
    read_write_s3_bucket_policy,
    static_website_bucket_policy,
)

                t.add_resource(
                    s3.BucketPolicy(
                        title + "BucketPolicy",
                        Bucket=bucket_id,
                        PolicyDocument=static_website_bucket_policy(bucket_id),
                    )
                )
                t.add_output(
                    Output(
                        title + "WebsiteUrl",
                        Value=GetAtt(title, "WebsiteURL")
                    )
                )
                t.add_output(
                    Output(
                        title + "WebsiteEndpoint",
                        Value=FindInMap(
                            "WebsiteEndpoints", Region, "endpoint"
                        )
                    )
                )

            bucket_ids.append(bucket_id)

        read_write_roles = variables["ReadWriteRoles"]
        if read_write_roles:
            t.add_resource(
                iam.PolicyType(
                    "ReadWritePolicy",
                    PolicyName=Sub("${AWS::StackName}ReadWritePolicy"),

                    PolicyDocument=read_write_s3_bucket_policy(