Use object lock enabled #148
Conversation
|
/test all |
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_NETWORKING_52 Added /main.tf aws_s3_bucket.default
There was a problem hiding this comment.
This looks good, but before approving it, I want some extra testing, due to this note which says changing the value "Forces new resource". We want to be extra careful that we are not causing a change that could end up having Terraform destroy and replace an existing S3 bucket.
|
Tested with a config where object_lock_configuration = {
mode = var.object_lock_mode_archive
days = var.object_lock_days_archive
years = null
}This branch fixes perma drift. Also tested changing object_lock_configuration = nullThis did end up planning to delete the bucket. however this is if you change configuration. For those who have it configured this fixes consistency bugs, for those who don't it won't be a problem. It only becomes a problem when attempting to switch. from enabled -> disabled. |
mergify
bot
dismissed
Gowiem’s stale review
This Pull Request has been updated, so we're dismissing all reviews.
|
/test all |
| object_lock_enabled = "Enabled" | ||
| } | ||
| } | ||
| object_lock_enabled = local.object_lock_enabled |
There was a problem hiding this comment.
Ensure S3 Bucket has public access blocks
Resource: aws_s3_bucket.default | ID: BC_AWS_NETWORKING_52
How to Fix
resource "aws_s3_bucket" "bucket_good_1" {
bucket = "bucket_good"
}
resource "aws_s3_bucket_public_access_block" "access_good_1" {
bucket = aws_s3_bucket.bucket_good_1.id
block_public_acls = true
block_public_policy = true
}
Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_NETWORKING_52 Added /main.tf aws_s3_bucket.default
| object_lock_enabled = "Enabled" | ||
| } | ||
| } | ||
| object_lock_enabled = local.object_lock_enabled |
There was a problem hiding this comment.
Ensure S3 Bucket has public access blocks
Resource: aws_s3_bucket.default | ID: BC_AWS_NETWORKING_52
How to Fix
resource "aws_s3_bucket" "bucket_good_1" {
bucket = "bucket_good"
}
resource "aws_s3_bucket_public_access_block" "access_good_1" {
bucket = aws_s3_bucket.bucket_good_1.id
block_public_acls = true
block_public_policy = true
}
Description
When you create an S3 bucket, it is good practice to set the additional resource **aws_s3_bucket_public_access_block** to ensure the bucket is never accidentally public.We recommend you ensure S3 bucket has public access blocks. If the public access block is not attached it defaults to False.
There was a problem hiding this comment.
Change details
-
Error ID Change Path Resource BC_AWS_NETWORKING_52 Added /main.tf aws_s3_bucket.default
|
/test all |
what
why
object_lock_configurationforobject_lock_enabledreferences
object_lock_enabledinaws_s3_bucket#144 (this did not useobject_lock_enabledand only removed the dynamic)