Skip to content

Commit 0131bd3

Browse files
posquit0posquit0
authored
Divide aws_s3_bucket_versioning resource (#17)
1 parent 62540ed commit 0131bd3

File tree

10 files changed

+315
-181
lines changed

10 files changed

+315
-181
lines changed

‎modules/s3-archive-bucket/README.md

+46-33
Large diffs are not rendered by default.

‎modules/s3-archive-bucket/acl.tf

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
data "aws_caller_identity" "this" {}
2+
data "aws_canonical_user_id" "this" {}
3+
4+
locals {
5+
cloudfront_canonical_user_id = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
6+
7+
default_grants = [
8+
{
9+
type = "CanonicalUser"
10+
id = data.aws_canonical_user_id.this.id
11+
permission = "FULL_CONTROL"
12+
}
13+
]
14+
cloudfront_grant = {
15+
type = "CanonicalUser"
16+
id = local.cloudfront_canonical_user_id
17+
permission = "FULL_CONTROL"
18+
}
19+
20+
grants = concat(
21+
local.default_grants,
22+
var.delivery_cloudfront_enabled ? [local.cloudfront_grant] : [],
23+
var.grants
24+
)
25+
}
26+
27+
28+
###################################################
29+
# Object Ownership for S3 Bucket
30+
###################################################
31+
32+
resource "aws_s3_bucket_ownership_controls" "this" {
33+
bucket = aws_s3_bucket.this.bucket
34+
35+
rule {
36+
object_ownership = var.object_ownership
37+
}
38+
}
39+
40+
41+
###################################################
42+
# ACL for S3 Bucket
43+
###################################################
44+
45+
# TODO: `expected_bucket_owner`
46+
# INFO: Not supported attributes
47+
# - `acl`
48+
# - `access_control_policy.owner.display_name`
49+
resource "aws_s3_bucket_acl" "this" {
50+
bucket = aws_s3_bucket.this.bucket
51+
52+
access_control_policy {
53+
dynamic "grant" {
54+
for_each = local.grants
55+
56+
content {
57+
grantee {
58+
type = grant.value.type
59+
id = try(grant.value.id, null)
60+
uri = try(grant.value.uri, null)
61+
email_address = try(grant.value.email, null)
62+
}
63+
permission = grant.value.permission
64+
}
65+
}
66+
67+
owner {
68+
id = data.aws_canonical_user_id.this.id
69+
}
70+
}
71+
}
72+
73+
74+
###################################################
75+
# Public Access Block for S3 Bucket
76+
###################################################
77+
78+
resource "aws_s3_bucket_public_access_block" "this" {
79+
bucket = aws_s3_bucket.this.bucket
80+
81+
# Block new public ACLs and uploading public objects
82+
block_public_acls = !var.public_access_enabled
83+
# Retroactively remove public access granted through public ACLs
84+
ignore_public_acls = !var.public_access_enabled
85+
# Block new public bucket policies
86+
block_public_policy = !var.public_access_enabled
87+
# Retroactivley block public and cross-account access if bucket has public policies
88+
restrict_public_buckets = !var.public_access_enabled
89+
90+
# To avoid OperationAborted: A conflicting conditional operation is currently in progress
91+
depends_on = [
92+
aws_s3_bucket_policy.this,
93+
]
94+
}

‎modules/s3-archive-bucket/logging.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
###################################################
2+
# Logging for S3 Bucket
3+
###################################################
4+
5+
# TODO: `expected_bucket_owner`
6+
# TODO: `target_grant`
7+
resource "aws_s3_bucket_logging" "this" {
8+
count = var.logging_enabled ? 1 : 0
9+
10+
bucket = aws_s3_bucket.this.bucket
11+
12+
target_bucket = var.logging_s3_bucket
13+
target_prefix = try(var.logging_s3_key_prefix, null)
14+
}

‎modules/s3-archive-bucket/main.tf

+25-100
Original file line numberDiff line numberDiff line change
@@ -14,32 +14,6 @@ locals {
1414
} : {}
1515
}
1616

17-
data "aws_caller_identity" "this" {}
18-
data "aws_canonical_user_id" "this" {}
19-
20-
locals {
21-
cloudfront_canonical_user_id = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
22-
23-
default_grants = [
24-
{
25-
type = "CanonicalUser"
26-
id = data.aws_canonical_user_id.this.id
27-
permissions = ["FULL_CONTROL"]
28-
}
29-
]
30-
cloudfront_grant = {
31-
type = "CanonicalUser"
32-
id = local.cloudfront_canonical_user_id
33-
permissions = ["FULL_CONTROL"]
34-
}
35-
36-
grants = concat(
37-
local.default_grants,
38-
var.delivery_cloudfront_enabled ? [local.cloudfront_grant] : [],
39-
var.grants
40-
)
41-
}
42-
4317

4418
###################################################
4519
# S3 Bucket for archive
@@ -50,24 +24,6 @@ resource "aws_s3_bucket" "this" {
5024
bucket = var.name
5125
force_destroy = var.force_destroy
5226

53-
acceleration_status = var.transfer_acceleration_enabled ? "Enabled" : "Suspended"
54-
55-
versioning {
56-
enabled = var.versioning_enabled
57-
mfa_delete = var.mfa_delete_enabled
58-
}
59-
60-
dynamic "grant" {
61-
for_each = length(local.grants) > 1 ? local.grants : []
62-
63-
content {
64-
type = try(grant.value.type, null)
65-
id = try(grant.value.id, null)
66-
uri = try(grant.value.uri, null)
67-
permissions = try(grant.value.permissions, [])
68-
}
69-
}
70-
7127
dynamic "lifecycle_rule" {
7228
for_each = var.lifecycle_rules
7329

@@ -113,23 +69,6 @@ resource "aws_s3_bucket" "this" {
11369
}
11470
}
11571

116-
dynamic "logging" {
117-
for_each = var.logging_s3_bucket != null ? ["go"] : []
118-
119-
content {
120-
target_bucket = var.logging_s3_bucket
121-
target_prefix = try(var.logging_s3_key_prefix, null)
122-
}
123-
}
124-
125-
server_side_encryption_configuration {
126-
rule {
127-
apply_server_side_encryption_by_default {
128-
sse_algorithm = "AES256"
129-
}
130-
}
131-
}
132-
13372
tags = merge(
13473
{
13574
"Name" = local.metadata.name
@@ -141,58 +80,44 @@ resource "aws_s3_bucket" "this" {
14180

14281

14382
###################################################
144-
# IAM Policy for S3 Bucket
83+
# Server Side Encryption for S3 Bucket
14584
###################################################
14685

147-
data "aws_iam_policy_document" "this" {
148-
source_policy_documents = concat(
149-
var.tls_required ? [data.aws_iam_policy_document.tls_required.json] : [],
150-
var.delivery_cloudtrail_enabled ? [data.aws_iam_policy_document.cloudtrail.json] : [],
151-
var.delivery_config_enabled ? [data.aws_iam_policy_document.config.json] : [],
152-
var.delivery_elb_enabled ? [data.aws_iam_policy_document.elb.json] : [],
153-
)
154-
}
155-
156-
resource "aws_s3_bucket_policy" "this" {
157-
bucket = aws_s3_bucket.this.id
158-
policy = data.aws_iam_policy_document.this.json
86+
locals {
87+
sse_algorithm = {
88+
"AES256" = "AES256"
89+
"AWS_KMS" = "aws:kms"
90+
}
15991
}
16092

161-
162-
###################################################
163-
# Object Ownership for S3 Bucket
164-
###################################################
165-
166-
resource "aws_s3_bucket_ownership_controls" "this" {
167-
bucket = aws_s3_bucket.this.id
93+
# TODO: `expected_bucket_owner`
94+
# TODO: `bucket_key_enabled`
95+
# TODO: `rule.apply_server_side_encryption_by_default.kms_master_key_id`
96+
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
97+
bucket = aws_s3_bucket.this.bucket
16898

16999
rule {
170-
object_ownership = var.object_ownership
100+
apply_server_side_encryption_by_default {
101+
sse_algorithm = local.sse_algorithm["AES256"]
102+
}
171103
}
172104
}
173105

174106

175107
###################################################
176-
# Public Access Block for S3 Bucket
108+
# IAM Policy for S3 Bucket
177109
###################################################
178110

179-
resource "aws_s3_bucket_public_access_block" "this" {
180-
count = var.public_access_block_enabled ? 1 : 0
111+
data "aws_iam_policy_document" "this" {
112+
source_policy_documents = concat(
113+
var.tls_required ? [data.aws_iam_policy_document.tls_required.json] : [],
114+
var.delivery_cloudtrail_enabled ? [data.aws_iam_policy_document.cloudtrail.json] : [],
115+
var.delivery_config_enabled ? [data.aws_iam_policy_document.config.json] : [],
116+
var.delivery_elb_enabled ? [data.aws_iam_policy_document.elb.json] : [],
117+
)
118+
}
181119

120+
resource "aws_s3_bucket_policy" "this" {
182121
bucket = aws_s3_bucket.this.id
183-
184-
# Block new public ACLs and uploading public objects
185-
block_public_acls = true
186-
# Retroactively remove public access granted through public ACLs
187-
ignore_public_acls = true
188-
# Block new public bucket policies
189-
block_public_policy = true
190-
# Retroactivley block public and cross-account access if bucket has public policies
191-
restrict_public_buckets = true
192-
193-
# To avoid OperationAborted: A conflicting conditional operation is currently in progress
194-
depends_on = [
195-
aws_s3_bucket.this,
196-
aws_s3_bucket_policy.this,
197-
]
122+
policy = data.aws_iam_policy_document.this.json
198123
}

‎modules/s3-archive-bucket/outputs.tf

+34-12
Original file line numberDiff line numberDiff line change
@@ -32,32 +32,54 @@ output "regional_domain_name" {
3232
value = aws_s3_bucket.this.bucket_regional_domain_name
3333
}
3434

35-
output "transfer_acceleration_enabled" {
36-
description = "Whether S3 Transfer Acceleration is enabled."
37-
value = var.transfer_acceleration_enabled
35+
output "transfer_acceleration" {
36+
description = "The configuration for the S3 Transfer Acceleration of the bucket."
37+
value = {
38+
enabled = var.transfer_acceleration_enabled
39+
}
3840
}
3941

4042
output "versioning" {
4143
description = "The versioning configuration for the bucket."
4244
value = {
43-
enabled = var.versioning_enabled
44-
mfa_delete_enabled = var.mfa_delete_enabled
45+
status = var.versioning_status
46+
mfa_deletion = var.versioning_mfa_deletion
47+
}
48+
}
49+
50+
output "server_side_encryption" {
51+
description = "The configuration for the S3 bucket server-side encryption."
52+
value = {
53+
enabled = true
54+
algorithm = "AES256"
4555
}
4656
}
4757

48-
output "object_ownership" {
49-
description = "The ownership of objects written to the bucket from other AWS accounts and granted using access control lists(ACLs)."
50-
value = aws_s3_bucket_ownership_controls.this.rule[0].object_ownership
58+
output "request_payment" {
59+
description = "The configuration for the S3 bucket request payment."
60+
value = {
61+
payer = aws_s3_bucket_request_payment_configuration.this.payer
62+
}
5163
}
5264

53-
output "public_access_block_enabled" {
54-
description = "Whether S3 bucket-level Public Access Block is enabled."
55-
value = var.public_access_block_enabled
65+
output "access_control" {
66+
description = "The configuration for the S3 bucket access control."
67+
value = {
68+
object_ownership = aws_s3_bucket_ownership_controls.this.rule[0].object_ownership
69+
acl = {
70+
enabled = aws_s3_bucket_ownership_controls.this.rule[0].object_ownership != "BucketOwnerEnforced"
71+
grants = local.grants
72+
}
73+
public_access = {
74+
enabled = var.public_access_enabled
75+
}
76+
}
5677
}
5778

5879
output "logging" {
59-
description = "The logging configuration for access to the bucket."
80+
description = "The logging configuration for the bucket."
6081
value = {
82+
enabled = var.logging_enabled
6183
s3 = {
6284
bucket = var.logging_s3_bucket
6385
key_prefix = var.logging_s3_key_prefix

‎modules/s3-archive-bucket/request-payment.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
###################################################
2+
# Request Payment for S3 Bucket
3+
###################################################
4+
5+
# TODO: `expected_bucket_owner`
6+
resource "aws_s3_bucket_request_payment_configuration" "this" {
7+
bucket = aws_s3_bucket.this.bucket
8+
payer = "BucketOwner"
9+
}

‎modules/s3-archive-bucket/transfer-acceleration.tf

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
###################################################
2+
# Transfer Acceleration for S3 Bucket
3+
###################################################
4+
5+
# TODO: `expected_bucket_owner`
6+
resource "aws_s3_bucket_accelerate_configuration" "this" {
7+
bucket = aws_s3_bucket.this.bucket
8+
status = var.transfer_acceleration_enabled ? "Enabled" : "Suspended"
9+
}

0 commit comments

Comments
 (0)