terraform/10_aws_s3 at main · ajainops/terraform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
Step 1: To make this separate - For this task I have created a separate directory
mkdir s3


Step 2: Add entry for the required variables

vars.tf
variable "aws_region" {
  description = "AWS region"
  type        = string
  default     = "us-east-1"
}

variable "bucket_name" {
  description = "S3 bucket name"
  type        = string
  default     = "amity01"
}

Step 3: I have added resource to create bucket with few features

main.tf
provider "aws" {
  region = "us-east-1"
}

########################
# Bucket creation
########################
resource "aws_s3_bucket" "amity01" {
  bucket = var.bucket_name
}

##########################
# Bucket private access
##########################
#resource "aws_s3_bucket_acl" "amity01-acl" {
#  bucket = aws_s3_bucket.amity01.id
#  acl    = "private"
#}

#resource "aws_s3_bucket_ownership_controls" "amity01-acl-ownership" {
#  bucket = aws_s3_bucket.amity01.id
#  rule {
#    object_ownership = "BucketOwnerEnforced"
#  }
  # Add just this depends_on condition
#  depends_on = [aws_s3_bucket_acl.amity01-acl]
#}

#############################
# Enable bucket versioning
#############################
resource "aws_s3_bucket_versioning" "amity01_versioning" {
  bucket = aws_s3_bucket.amity01.id
  versioning_configuration {
    status = "Enabled"
  }
}

############################
# Creating Lifecycle Rule
############################
resource "aws_s3_bucket_lifecycle_configuration" "amity01_lifecycle_rule" {
  # Must have bucket versioning enabled first
  depends_on = [aws_s3_bucket_versioning.amity01_versioning]

  bucket = aws_s3_bucket.amity01.bucket

  rule {
    id = "basic_config"
    status = "Enabled"

    filter {
      prefix = "config/"
    }

    noncurrent_version_transition {
      noncurrent_days = 30
      storage_class   = "STANDARD_IA"
    }

    noncurrent_version_transition {
      noncurrent_days = 60
      storage_class   = "GLACIER"
    }

    noncurrent_version_expiration {
      noncurrent_days = 90
    }
  }
}
# Enable Encryption on Bucket
resource "aws_s3_bucket_server_side_encryption_configuration" "amity01-encryption" {
  bucket = aws_s3_bucket.amity01.bucket

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

# Server side Encryption
resource "aws_kms_key" "demokey" {
  description             = "key to encrypt bucket objects"
  deletion_window_in_days = 7
}

resource "aws_s3_bucket_server_side_encryption_configuration" "demo_encryption" {
  bucket = aws_s3_bucket.amity01.bucket

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.demokey.arn
      sse_algorithm     = "aws:kms"
    }
  }
}
#Prevent objects from becoming public
resource "aws_s3_bucket_public_access_block" "amity_public_block" {
  bucket = aws_s3_bucket.amity01.bucket

  block_public_acls   = true
  block_public_policy = true
  ignore_public_acls = true
  restrict_public_buckets = true
}

Step 4: terraform init
Step 5: terraform plan
Step 6: terraform apply --auto-approve
Step 7 :  terraform state list