AWS S3 bucket Terraform module

Upstream version 5.14.0

11 controls from NIST Cybersecurity Framework v2.0 requirements

Terraform Module Source

nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws

Compliance Inputs Outputs Resources Diff (7)README

72 unique

Name	Type	Default	Description
Enforced · locked by active controls
attach_policys3_bucket_policy_restricts_cross_account_permission_changes	bool	true	Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)
block_public_aclss3_public_access_block_accounts3_public_access_block_bucket	bool	true	Whether Amazon S3 should block public ACLs for this bucket.
block_public_policys3_public_access_block_accounts3_public_access_block_bucket	bool	true	Whether Amazon S3 should block public bucket policies for this bucket.
ignore_public_aclss3_public_access_block_accounts3_public_access_block_bucket	bool	true	Whether Amazon S3 should ignore public ACLs for this bucket.
lifecycle_rules3_bucket_versioning_and_lifecycle_policy_enabled	any	[{"status":"Enabled"}]	List of maps containing configuration of object lifecycle management.
loggings3_bucket_logging_enabled	any	{}	Map containing access bucket logging configuration.
object_lock_enableds3_bucket_object_lock_enabled	bool	true	Whether S3 bucket should have an Object Lock configuration enabled.
object_ownerships3_bucket_acls_should_prohibit_user_access	string	"BucketOwnerEnforced"	Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL.
replication_configurations3_bucket_cross_region_replication_enabled	any	{...}	Map containing cross-region replication configuration.
restrict_public_bucketss3_public_access_block_accounts3_public_access_block_bucket	bool	true	Whether Amazon S3 should restrict public bucket policies for this bucket.
server_side_encryption_configurations3_bucket_default_encryption_enabled_kms	any	{...}	Map containing server-side encryption configuration.
versionings3_bucket_versioning_enabled	map(string)	{"enabled":"Enabled"}	Map containing versioning configuration.
Optional
acceleration_status	string	null	(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended.
access_log_delivery_policy_source_accounts	list(string)	[]	(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket.
access_log_delivery_policy_source_buckets	list(string)	[]	(Optional) List of S3 bucket ARNs which should be allowed to deliver access logs to this bucket.
access_log_delivery_policy_source_organizations	list(string)	[]	(Optional) List of AWS Organization IDs should be allowed to deliver access logs to this bucket.
acl	string	null	(Optional) The canned ACL to apply. Conflicts with `grant`
allowed_kms_key_arn	string	null	The ARN of KMS key which should be allowed in PutObject
analytics_configuration	any	{}	Map containing bucket analytics configuration.
analytics_self_source_destination	bool	false	Whether or not the analytics source bucket is also the destination bucket.
analytics_source_account_id	string	null	The analytics source account id.
analytics_source_bucket_arn	string	null	The analytics source bucket ARN.
attach_access_log_delivery_policy	bool	false	Controls if S3 bucket should have S3 access log delivery policy attached
attach_analytics_destination_policy	bool	false	Controls if S3 bucket should have bucket analytics destination policy attached.
attach_cloudtrail_log_delivery_policy	bool	false	Controls if S3 bucket should have CloudTrail log delivery policy attached
attach_deny_incorrect_encryption_headers	bool	false	Controls if S3 bucket should deny incorrect encryption headers policy attached.
attach_deny_incorrect_kms_key_sse	bool	false	Controls if S3 bucket policy should deny usage of incorrect KMS key SSE.
attach_deny_insecure_transport_policy	bool	false	Controls if S3 bucket should have deny non-SSL transport policy attached
attach_deny_ssec_encrypted_object_uploads	bool	false	Controls if S3 bucket should deny SSEC encrypted object uploads.
attach_deny_unencrypted_object_uploads	bool	false	Controls if S3 bucket should deny unencrypted object uploads policy attached.
attach_elb_log_delivery_policy	bool	false	Controls if S3 bucket should have ELB log delivery policy attached
attach_inventory_destination_policy	bool	false	Controls if S3 bucket should have bucket inventory destination policy attached.
attach_lb_log_delivery_policy	bool	false	Controls if S3 bucket should have ALB/NLB log delivery policy attached
attach_public_policy	bool	true	Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)
attach_require_latest_tls_policy	bool	false	Controls if S3 bucket should require the latest version of TLS
attach_waf_log_delivery_policy	bool	false	Controls if S3 bucket should have WAF log delivery policy attached
availability_zone_id	string	null	Availability Zone ID or Local Zone ID
bucket	string	null	(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name.
bucket_namespace	string	null	Namespace for the bucket. Determines bucket naming scope. Valid values: account-regional, global. Defaults to global (AWS)
bucket_prefix	string	null	(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket.
control_object_ownership	bool	false	Whether to manage S3 Bucket Ownership Controls on this bucket.
cors_rule	any	[]	List of maps containing rules for Cross-Origin Resource Sharing.
create_bucket	bool	true	Controls if S3 bucket should be created
create_metadata_configuration	bool	false	Whether to create metadata configuration resource
data_redundancy	string	null	Data redundancy. Valid values: `SingleAvailabilityZone`
expected_bucket_owner	string	null	The account ID of the expected bucket owner
force_destroy	bool	false	(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable.
grant	any	[]	An ACL policy grant. Conflicts with `acl`
intelligent_tiering	any	{}	Map containing intelligent tiering configuration.
inventory_configuration	any	{}	Map containing S3 inventory configuration.
inventory_self_source_destination	bool	false	Whether or not the inventory source bucket is also the destination bucket.
inventory_source_account_id	string	null	The inventory source account id.
inventory_source_bucket_arn	string	null	The inventory source bucket ARN.
is_directory_bucket	bool	false	If the s3 bucket created is a directory bucket
lb_log_delivery_policy_source_organizations	list(string)	[]	(Optional) List of AWS Organization IDs should be allowed to deliver ALB/NLB logs to this bucket.
location_type	string	null	Location type. Valid values: `AvailabilityZone` or `LocalZone`
metadata_encryption_configuration	any	null	Encryption configuration block
metadata_inventory_table_configuration_state	string	null	Configuration state of the inventory table, indicating whether the inventory table is enabled or disabled. Valid values: ENABLED, DISABLED
metadata_journal_table_record_expiration	string	null	Whether journal table record expiration is enabled or disabled. Valid values: ENABLED, DISABLED
metadata_journal_table_record_expiration_days	number	null	Number of days to retain journal table records
metric_configuration	any	[]	Map containing bucket metric configuration.
object_lock_configuration	any	{}	Map containing S3 object locking configuration.
owner	map(string)	{}	Bucket owner's display name and ID. Conflicts with `acl`
policy	string	"{"Version":"2012-10-17","Statement":[{"Sid":"DenyCrossAccountPermissionChanges","Effect":"Deny","Principal":"","Action":["s3:DeleteBucketPolicy","s3:PutBucketAcl","s3:PutBucketPolicy","s3:PutBucketPublicAccessBlock","s3:PutEncryptionConfiguration","s3:PutObjectAcl"],"Resource":["_S3_BUCKET_ARN_","_S3_BUCKET_ARN_/"],"Condition":{"StringNotEquals":{"aws:PrincipalAccount":["_AWS_ACCOUNT_ID_"]}}}]}"	(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide.
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
region	string	null	Region where the resource(s) will be managed. Defaults to the region set in the provider configuration
request_payer	string	null	(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information.
skip_destroy_public_access_block	bool	true	Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true.
tags	map(string)	{}	(Optional) A mapping of tags to assign to the bucket.
transition_default_minimum_object_size	string	null	The default minimum object size behavior applied to the lifecycle configuration. Valid values: all_storage_classes_128K (default), varies_by_storage_class
type	string	"Directory"	Bucket type. Valid values: `Directory`
website	any	{}	Map containing static web-site hosting or redirect configuration.