Skip to content

Latest commit

 

History

History
137 lines (114 loc) · 10.1 KB

README.md

File metadata and controls

137 lines (114 loc) · 10.1 KB
Raw

aws-terraform-s3

This module builds a s3 bucket with varying options.
It will not do s3 origin, which is in another module.

Basic Usage

module "s3_basic" {
  source = "[email protected]:rackspace-infrastructure-automation/aws-terraform-s3//?ref=v0.12.12"

  bucket_logging    = false
  environment       = "Development"
  name              = "${random_string.s3_rstring.result}-example-s3-bucket"
  versioning        = true
  lifecycle_enabled = true
  lifecycle_rule = [
    {
      id                                     = "Default MPU Cleanup Rule."
      enabled                                = true
      abort_incomplete_multipart_upload_days = 7
    }
  ]

  tags = {
    RightSaid = "Fred"
    LeftSaid  = "George"
  }
}

Full working references are available at examples

Terraform 0.12 upgrade

Several changes were required while adding terraform 0.12 compatibility. The following changes should be
made when upgrading from a previous release to version 0.12.0 or higher.

Module variables

The following module variables were updated to better meet current Rackspace style guides:

  • bucket_name -> name
  • kms_master_key_id -> kms_key_id
  • bucket_tags -> tags

Requirements

Name Version
terraform >= 0.13
aws ~> 4.0

Providers

Name Version
aws ~> 4.0

Modules

No Modules.

Resources

Name
aws_canonical_user_id
aws_s3_bucket
aws_s3_bucket_acl
aws_s3_bucket_cors_configuration
aws_s3_bucket_intelligent_tiering_configuration
aws_s3_bucket_lifecycle_configuration
aws_s3_bucket_logging
aws_s3_bucket_metric
aws_s3_bucket_object_lock_configuration
aws_s3_bucket_ownership_controls
aws_s3_bucket_public_access_block
aws_s3_bucket_server_side_encryption_configuration
aws_s3_bucket_versioning
aws_s3_bucket_website_configuration

Inputs

Name Description Type Default Required
acl (Optional) The canned ACL to apply. Conflicts with grant string null no
block_public_access Block various forms of public access on a per bucket level bool false no
block_public_access_acl Related to block_public_access. PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access. PUT Object calls will fail if the request includes an object ACL. bool true no
block_public_access_ignore_acl Related to block_public_access. Ignore public ACLs on this bucket and any objects that it contains. bool true no
block_public_access_policy Related to block_public_access. Reject calls to PUT Bucket policy if the specified bucket policy allows public access. bool true no
block_public_access_restrict_bucket Related to block_public_access. Only the bucket owner and AWS Services can access this buckets if it has a public policy. bool true no
bucket_key_enabled Whether or not to use Amazon S3 Bucket Keys for SSE-KMS. bool false no
bucket_logging Enable bucket logging. Will store logs in another existing bucket. You must give the log-delivery group WRITE and READ_ACP permissions to the target bucket. i.e. true | false bool false no
control_object_ownership Whether to manage S3 Bucket Ownership Controls on this bucket. bool false no
cors Enable CORS Rules. Rules must be defined in the variable cors_rules bool false no
cors_rule List of maps containing rules for Cross-Origin Resource Sharing. any [] no
enable_bucket_metrics Enable bucket metrics bool false no
enable_intelligent_tiering Enable intelligent tiering bool false no
environment Application environment for which this network is being created. must be one of ['Development', 'Integration', 'PreProduction', 'Production', 'QA', 'Staging', 'Test'] string "Development" no
expected_bucket_owner The account ID of the expected bucket owner string null no
force_destroy_bucket A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. bool false no
grant An ACL policy grant. Conflicts with acl any [] no
intelligent_tiering Map containing intelligent tiering configuration. any {} no
kms_key_id The AWS KMS master key ID used for the SSE-KMS encryption. This can only be used when you set the value of sse_algorithm as aws:kms. string null no
lifecycle_enabled Enable object lifecycle management. i.e. true | false bool false no
lifecycle_rule List of maps containing configuration of object lifecycle management. any [] no
logging_bucket_name Name of the existing bucket where the logs will be stored. string "" no
logging_bucket_prefix Prefix for all log object keys. i.e. logs/ string "" no
metric_configuration Map containing bucket metric configuration. any [] no
mfa_delete Specifies whether MFA delete is enabled in the bucket versioning configuration bool false no
name The name of the S3 bucket for the access logs. The bucket name can contain only lowercase letters, numbers, periods (.), and dashes (-). Must be globally unique. If changed, forces a new resource. string n/a yes
object_expiration_days Indicates after how many days we are deleting current version of objects. Set to 0 to disable or at least 365 days longer than TransitionInDaysGlacier. i.e. 0 to disable, otherwise 1-999 number 0 no
object_lock_enabled Indicates whether this bucket has an Object Lock configuration enabled. Disabled by default. You can only enable S3 Object Lock for new buckets. If you need to turn on S3 Object Lock for an existing bucket, please contact AWS Support. bool false no
object_lock_mode The default Object Lock retention mode you want to apply to new objects placed in this bucket. Valid values are GOVERNANCE and COMPLIANCE. Default is GOVERNANCE (allows administrative override). string "GOVERNANCE" no
object_lock_retention_days The retention of the object lock in days. Either days or years must be specified, but not both. number null no
object_lock_retention_years The retention of the object lock in years. Either days or years must be specified, but not both. number null no
object_lock_token A token to allow Object Lock to be enabled for an existing bucket. You must contact AWS support for the bucket's 'Object Lock token'. The token is generated in the back-end when versioning is enabled on a bucket. string null no
object_ownership Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL. string "ObjectWriter" no
owner Bucket owner's display name and ID. Conflicts with acl map(string) {} no
sse_algorithm The server-side encryption algorithm to use. Valid values are AES256, aws:kms, and none string "AES256" no
tags A map of tags to be applied to the Bucket. i.e {Environment='Development'} map(string) {} no
versioning Enable bucket versioning. bool false no
website Use bucket as a static website. i.e. true | false bool false no
website_config Map containing static web-site hosting or redirect configuration. any {} no

Outputs

Name Description
bucket_arn The ARN of the bucket. Will be of format arn:aws:s3:::bucketname.
bucket_domain_name The bucket domain name. Will be of format bucketname.s3.amazonaws.com.
bucket_hosted_zone_id The Route 53 Hosted Zone ID for this bucket's region.
bucket_id The name of the bucket.
bucket_region The AWS region this bucket resides in.
bucket_website_domain The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records.
bucket_website_endpoint The website endpoint, if the bucket is configured with a website. If not, this will be an empty string.