From 8388b74b8058f9e296f3a319f594829a5bb53c85 Mon Sep 17 00:00:00 2001 From: Frank Avila Date: Tue, 4 Jun 2024 11:18:26 -0400 Subject: [PATCH 1/2] Removed duplicate output for domain id, cleaned up README. --- README.md | 89 +----------------------------------------------------- outputs.tf | 5 --- 2 files changed, 1 insertion(+), 93 deletions(-) diff --git a/README.md b/README.md index e18d1b0..aad3dfb 100644 --- a/README.md +++ b/README.md @@ -127,7 +127,6 @@ No modules. | [arn](#output\_arn) | The ARN of the s3 bucket. | | [bucket\_domain\_name](#output\_bucket\_domain\_name) | The Domain of the s3 bucket. | | [id](#output\_id) | The ID of the s3 bucket. | -| [key\_iam](#output\_key\_iam) | The Domain of the s3 bucket. | ## Contributing @@ -146,90 +145,4 @@ No modules. ### Copyright -Copyright © 2023 Coalfire Systems Inc. -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >=1.5.0 | -| [aws](#requirement\_aws) | ~> 5.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | ~> 5.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_s3_bucket.s3_default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_accelerate_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource | -| [aws_s3_bucket_cors_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource | -| [aws_s3_bucket_lifecycle_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | -| [aws_s3_bucket_logging.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource | -| [aws_s3_bucket_object_lock_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource | -| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource | -| [aws_s3_bucket_policy.s3_default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | -| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_request_payment_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_request_payment_configuration) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_s3_bucket_versioning.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | -| [aws_s3_bucket_website_configuration.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [acceleration\_status](#input\_acceleration\_status) | Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended | `bool` | `false` | no | -| [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no | -| [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no | -| [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no | -| [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no | -| [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no | -| [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no | -| [aws\_iam\_policy\_document](#input\_aws\_iam\_policy\_document) | The text of the policy. Although this is a bucket policy rather than an IAM policy, the aws\_iam\_policy\_document data source may be used, so long as it specifies a principal. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide. Note: Bucket policies are limited to 20 KB in size. | `string` | `""` | no | -| [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no | -| [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no | -| [bucket\_policy](#input\_bucket\_policy) | Conditionally create S3 bucket policy. | `bool` | `false` | no | -| [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no | -| [cors\_rule](#input\_cors\_rule) | CORS Configuration specification for this bucket | 
list(object({
    allowed_headers = list(string)
    allowed_methods = list(string)
    allowed_origins = list(string)
    expose_headers  = list(string)
    max_age_seconds = number
  }))
| `null` | no | -| [create\_bucket](#input\_create\_bucket) | Conditionally create S3 bucket. | `bool` | `true` | no | -| [enable\_kms](#input\_enable\_kms) | Enable KMS key for enable\_server\_side\_encryption | `bool` | `true` | no | -| [enable\_lifecycle\_configuration\_rules](#input\_enable\_lifecycle\_configuration\_rules) | enable or disable lifecycle\_configuration\_rules | `bool` | `false` | no | -| [enable\_server\_side\_encryption](#input\_enable\_server\_side\_encryption) | Enable enable\_server\_side\_encryption | `bool` | `true` | no | -| [error\_document](#input\_error\_document) | he name of the error document for the website | `string` | `"error.html"` | no | -| [force\_destroy](#input\_force\_destroy) | A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no | -| [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no | -| [index\_document](#input\_index\_document) | The name of the index document for the website | `string` | `"index.html"` | no | -| [kms\_master\_key\_id](#input\_kms\_master\_key\_id) | The AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of sse\_algorithm as aws:kms. The default aws/s3 AWS KMS master key is used if this element is absent while the sse\_algorithm is aws:kms. | `string` | `null` | no | -| [lifecycle\_configuration\_rules](#input\_lifecycle\_configuration\_rules) | A list of lifecycle rules | 
list(object({
    id      = string
    prefix  = string
    enabled = bool
    tags    = map(string)

    enable_glacier_transition            = bool
    enable_deeparchive_transition        = bool
    enable_standard_ia_transition        = bool
    enable_current_object_expiration     = bool
    enable_noncurrent_version_expiration = bool

    abort_incomplete_multipart_upload_days         = number
    noncurrent_version_glacier_transition_days     = number
    noncurrent_version_deeparchive_transition_days = number
    noncurrent_version_expiration_days             = number

    standard_transition_days    = number
    glacier_transition_days     = number
    deeparchive_transition_days = number
    expiration_days             = number
  }))
| `null` | no | -| [logging](#input\_logging) | Logging Object to enable and disable logging | `bool` | `false` | no | -| [name](#input\_name) | Name of S3 bucket | `string` | n/a | yes | -| [object\_lock\_configuration](#input\_object\_lock\_configuration) | With S3 Object Lock, you can store objects using a write-once-read-many (WORM) model. Object Lock can help prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. | 
object({
    mode  = string #Valid values are GOVERNANCE and COMPLIANCE.
    days  = number
    years = number
  })
| `null` | no | -| [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. | `string` | `"ObjectWriter"` | no | -| [redirect](#input\_redirect) | The redirect behavior for every request to this bucket's website endpoint | `string` | `"documents/"` | no | -| [request\_payer](#input\_request\_payer) | Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer | `bool` | `false` | no | -| [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket. | `bool` | `false` | no | -| [routing\_rule](#input\_routing\_rule) | List of rules that define when a redirect is applied and the redirect behavior | `string` | `"docs/"` | no | -| [sse\_algorithm](#input\_sse\_algorithm) | The server-side encryption algorithm to use. Valid values are AES256 and aws:kms. | `string` | `"AES256"` | no | -| [tags](#input\_tags) | Additional tags (e.g. map(`BusinessUnit`,`XYZ`). | `map(any)` | `{}` | no | -| [target\_bucket](#input\_target\_bucket) | The bucket where you want Amazon S3 to store server access logs. | `string` | `""` | no | -| [target\_prefix](#input\_target\_prefix) | A prefix for all log object keys. | `string` | `""` | no | -| [versioning](#input\_versioning) | Enable Versioning of S3. | `bool` | `true` | no | -| [website\_config\_enable](#input\_website\_config\_enable) | enable or disable aws\_s3\_bucket\_website\_configuration | `bool` | `false` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [arn](#output\_arn) | The ARN of the s3 bucket. | -| [bucket\_domain\_name](#output\_bucket\_domain\_name) | The Domain of the s3 bucket. | -| [id](#output\_id) | The ID of the s3 bucket. | -| [key\_iam](#output\_key\_iam) | The Domain of the s3 bucket. | - +Copyright © 2023 Coalfire Systems Inc. \ No newline at end of file diff --git a/outputs.tf b/outputs.tf index b11b42b..00771cc 100644 --- a/outputs.tf +++ b/outputs.tf @@ -11,9 +11,4 @@ output "arn" { output "bucket_domain_name" { value = join("", aws_s3_bucket.s3_default[*].bucket_domain_name) description = "The Domain of the s3 bucket." -} - -output "key_iam" { - value = join("", aws_s3_bucket.s3_default[*].bucket_domain_name) - description = "The Domain of the s3 bucket." } \ No newline at end of file From 118ad36ad08e1603d9088332d94ac87326b0ccd7 Mon Sep 17 00:00:00 2001 From: Frank Avila Date: Tue, 4 Jun 2024 12:53:32 -0400 Subject: [PATCH 2/2] Modified example code in README to include more options. --- README.md | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index aad3dfb..5df2b8b 100644 --- a/README.md +++ b/README.md @@ -37,8 +37,36 @@ provider "aws" { module "s3_bucket" { source = "github.com/Coalfire-CF/terraform-aws-s3" - - name = "s3-bucket-name" + + name = "s3-bucket-name" + enable_lifecycle_configuration_rules = true + # lifecycle_configuration_rules = [ + # { + # id = string + # prefix = optional(string, null) + # enabled = bool + # tags = optional(map(string), null) + # + # enable_glacier_transition = optional(bool, true) + # enable_deeparchive_transition = optional(bool, false) + # enable_standard_ia_transition = optional(bool, false) + # enable_current_object_expiration = optional(bool, true) + # enable_noncurrent_version_expiration = optional(bool, true) + # + # abort_incomplete_multipart_upload_days = optional(number, null) + # noncurrent_version_glacier_transition_days = optional(number, null) + # noncurrent_version_deeparchive_transition_days = optional(number, null) + # noncurrent_version_expiration_days = optional(number, null) + # + # standard_transition_days = optional(number, null) + # glacier_transition_days = optional(number, null) + # deeparchive_transition_days = optional(number, null) + # expiration_days = optional(number, null) + # } + # ] + enable_kms = true + enable_server_side_encryption = true + kms_master_key_id = var.kms_master_key_id } ```