Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Coalfire AWS s3 Terraform Module

License

NotificationsYou must be signed in to change notification settings

CiscoOpsStack/terraform-aws-s3-ops_stack-module

 
 

Repository files navigation

Coalfire

AWS S3 Terraform Module

Description

This module creates an S3 bucket with a bucket policy, versioning enabled, logging enabled, and a bucket lifecycle policy configured.

FedRAMP Compliance: Moderate, High

Dependencies

  • kms keys from ACE-AWS-Account

Resource List

  • S3 bucket
  • S3 bucket IAM policies

Deployment Steps

This module can be called as outlined below.

  • Change directories to thereponame directory.
  • From theterraform/aws/reponame directory runterraform init.
  • Runterraform plan to review the resources being created.
  • If everything looks correct in the plan output, runterraform apply.

Usage

Include example for how to call the module below with generic variables

provider"aws" {features {}}module"s3_bucket" {source="github.com/Coalfire-CF/terraform-aws-s3"name="s3-bucket-name"enable_lifecycle_configuration_rules=true#  lifecycle_configuration_rules = [#    {#      id      = string#      prefix  = optional(string, null)#      enabled = bool#      tags    = optional(map(string), null)##      enable_glacier_transition            = optional(bool, true)#      enable_deeparchive_transition        = optional(bool, false)#      enable_standard_ia_transition        = optional(bool, false)#      enable_current_object_expiration     = optional(bool, true)#      enable_noncurrent_version_expiration = optional(bool, true)##      abort_incomplete_multipart_upload_days         = optional(number, null)#      noncurrent_version_glacier_transition_days     = optional(number, null)#      noncurrent_version_deeparchive_transition_days = optional(number, null)#      noncurrent_version_expiration_days             = optional(number, null)##      standard_transition_days    = optional(number, null)#      glacier_transition_days     = optional(number, null)#      deeparchive_transition_days = optional(number, null)#      expiration_days             = optional(number, null)#    }#  ]enable_kms=trueenable_server_side_encryption=truekms_master_key_id=var.kms_master_key_id}

Requirements

NameVersion
terraform>=1.5.0
aws~> 5.0

Providers

NameVersion
aws~> 5.0

Modules

No modules.

Resources

NameType
aws_s3_bucket.s3_defaultresource
aws_s3_bucket_accelerate_configuration.exampleresource
aws_s3_bucket_cors_configuration.exampleresource
aws_s3_bucket_lifecycle_configuration.defaultresource
aws_s3_bucket_logging.exampleresource
aws_s3_bucket_object_lock_configuration.exampleresource
aws_s3_bucket_ownership_controls.thisresource
aws_s3_bucket_policy.s3_defaultresource
aws_s3_bucket_public_access_block.thisresource
aws_s3_bucket_request_payment_configuration.exampleresource
aws_s3_bucket_server_side_encryption_configuration.exampleresource
aws_s3_bucket_versioning.exampleresource
aws_s3_bucket_website_configuration.exampleresource

Inputs

NameDescriptionTypeDefaultRequired
acceleration_statusSets the accelerate configuration of an existing bucket. Can be Enabled or Suspendedboolfalseno
attach_deny_insecure_transport_policyControls if S3 bucket should have deny non-SSL transport policy attachedboolfalseno
attach_elb_log_delivery_policyControls if S3 bucket should have ELB log delivery policy attachedboolfalseno
attach_lb_log_delivery_policyControls if S3 bucket should have ALB/NLB log delivery policy attachedboolfalseno
attach_policyControls if S3 bucket should have bucket policy attached (set totrue to use value ofpolicy as bucket policy)boolfalseno
attach_public_policyControls if a user defined public bucket policy will be attached (set tofalse to allow upstream to apply defaults to the bucket)booltrueno
attach_require_latest_tls_policyControls if S3 bucket should require the latest version of TLSboolfalseno
aws_iam_policy_documentThe text of the policy. Although this is a bucket policy rather than an IAM policy, the aws_iam_policy_document data source may be used, so long as it specifies a principal. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. Note: Bucket policies are limited to 20 KB in size.string""no
block_public_aclsWhether Amazon S3 should block public ACLs for this bucket.boolfalseno
block_public_policyWhether Amazon S3 should block public bucket policies for this bucket.boolfalseno
bucket_policyConditionally create S3 bucket policy.boolfalseno
control_object_ownershipWhether to manage S3 Bucket Ownership Controls on this bucket.boolfalseno
cors_ruleCORS Configuration specification for this bucket
list(object({
    allowed_headers = list(string)
    allowed_methods = list(string)
    allowed_origins = list(string)
    expose_headers  = list(string)
    max_age_seconds = number
  }))
nullno
create_bucketConditionally create S3 bucket.booltrueno
enable_kmsEnable KMS key for enable_server_side_encryptionbooltrueno
enable_lifecycle_configuration_rulesenable or disable lifecycle_configuration_rulesbooltrueno
enable_server_side_encryptionEnable enable_server_side_encryptionbooltrueno
error_documenthe name of the error document for the websitestring"error.html"no
force_destroyA boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable.boolfalseno
ignore_public_aclsWhether Amazon S3 should ignore public ACLs for this bucket.boolfalseno
index_documentThe name of the index document for the websitestring"index.html"no
kms_master_key_idThe AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of sse_algorithm as aws:kms. The default aws/s3 AWS KMS master key is used if this element is absent while the sse_algorithm is aws:kms.stringnullno
lifecycle_configuration_rulesA list of lifecycle rules
list(object({
    id      = string
    prefix  = optional(string, null)
    enabled = bool
    tags    = optional(map(string), null)

    enable_glacier_transition            = optional(bool, true)
    enable_deeparchive_transition        = optional(bool, false)
    enable_standard_ia_transition        = optional(bool, false)
    enable_current_object_expiration     = optional(bool, true)
    enable_noncurrent_version_expiration = optional(bool, true)

    abort_incomplete_multipart_upload_days         = optional(number, null)
    noncurrent_version_glacier_transition_days     = optional(number, null)
    noncurrent_version_deeparchive_transition_days = optional(number, null)
    noncurrent_version_expiration_days             = optional(number, null)

    standard_transition_days    = optional(number, null)
    glacier_transition_days     = optional(number, null)
    deeparchive_transition_days = optional(number, null)
    expiration_days             = optional(number, null)
  }))
[
  {
    "abort_incomplete_multipart_upload_days": 1,
    "enable_current_object_expiration": true,
    "enable_glacier_transition": true,
    "enable_noncurrent_version_expiration": true,
    "enabled": true,
    "expiration_days": 365,
    "glacier_transition_days": 90,
    "id": "default",
    "noncurrent_version_expiration_days": 365,
    "noncurrent_version_glacier_transition_days": 90
  }
]
no
loggingLogging Object to enable and disable loggingboolfalseno
nameName of S3 bucketstringn/ayes
object_lock_configurationWith S3 Object Lock, you can store objects using a write-once-read-many (WORM) model. Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely.
object({
    mode  = string #Valid values are GOVERNANCE and COMPLIANCE.
    days  = number
    years = number
  })
nullno
object_ownershipObject ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL.string"ObjectWriter"no
redirectThe redirect behavior for every request to this bucket's website endpointstring"documents/"no
request_payerSpecifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transferboolfalseno
restrict_public_bucketsWhether Amazon S3 should restrict public bucket policies for this bucket.boolfalseno
routing_ruleList of rules that define when a redirect is applied and the redirect behaviorstring"docs/"no
sse_algorithmThe server-side encryption algorithm to use. Valid values are AES256 and aws:kms.string"AES256"no
tagsAdditional tags (e.g. map(BusinessUnit,XYZ).map(any){}no
target_bucketThe bucket where you want Amazon S3 to store server access logs.string""no
target_prefixA prefix for all log object keys.string""no
versioningEnable Versioning of S3.booltrueno
website_config_enableenable or disable aws_s3_bucket_website_configurationboolfalseno

Outputs

NameDescription
arnThe ARN of the s3 bucket.
bucket_domain_nameThe Domain of the s3 bucket.
idThe ID of the s3 bucket.

Contributing

Relative or absolute link to contributing.md

License

License

Coalfire Pages

Absolute link to any relevant Coalfire Pages

Copyright

Copyright © 2023 Coalfire Systems Inc.

About

Coalfire AWS s3 Terraform Module

Resources

License

Contributing

Stars

Watchers

Forks

Packages

No packages published

Languages

  • HCL100.0%
[8]ページ先頭
©2009-2025 Movatter.jp