Skip to content

Commit 2cdab38

Browse files
renovate[bot]renovate[bot]
authored
Updates to current AWS provider, S3 defaults (#133)
* Update Terraform cloudposse/s3-log-storage/aws to v1 * Updates for S3 default ACL disabled
1 parent 0df67fb commit 2cdab38

File tree

5 files changed

+106
-48
lines changed

5 files changed

+106
-48
lines changed

‎README.md

+11-4
Original file line numberDiff line numberDiff line change
@@ -248,23 +248,23 @@ Available targets:
248248

249249
| Name | Version |
250250
|------|---------|
251-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
252-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.0 |
251+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.0 |
252+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9.0 |
253253
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.3 |
254254

255255
## Providers
256256

257257
| Name | Version |
258258
|------|---------|
259-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.0 |
259+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9.0 |
260260
| <a name="provider_local"></a> [local](#provider\_local) | >= 1.3 |
261261

262262
## Modules
263263

264264
| Name | Source | Version |
265265
|------|--------|---------|
266266
| <a name="module_dynamodb_table_label"></a> [dynamodb\_table\_label](#module\_dynamodb\_table\_label) | cloudposse/label/null | 0.25.0 |
267-
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 0.26.0 |
267+
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 1.1.0 |
268268
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
269269

270270
## Resources
@@ -277,7 +277,14 @@ Available targets:
277277
| [aws_iam_role.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
278278
| [aws_iam_role_policy_attachment.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
279279
| [aws_s3_bucket.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
280+
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
281+
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
282+
| [aws_s3_bucket_ownership_controls.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
283+
| [aws_s3_bucket_policy.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
280284
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
285+
| [aws_s3_bucket_replication_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_replication_configuration) | resource |
286+
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
287+
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
281288
| [local_file.terraform_backend_config](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
282289
| [aws_iam_policy_document.prevent_unencrypted_uploads](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
283290
| [aws_iam_policy_document.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎docs/terraform.md

+11-4
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,23 @@
33

44
| Name | Version |
55
|------|---------|
6-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.0 |
7-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.0 |
6+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.1.0 |
7+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9.0 |
88
| <a name="requirement_local"></a> [local](#requirement\_local) | >= 1.3 |
99

1010
## Providers
1111

1212
| Name | Version |
1313
|------|---------|
14-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 2.0 |
14+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9.0 |
1515
| <a name="provider_local"></a> [local](#provider\_local) | >= 1.3 |
1616

1717
## Modules
1818

1919
| Name | Source | Version |
2020
|------|--------|---------|
2121
| <a name="module_dynamodb_table_label"></a> [dynamodb\_table\_label](#module\_dynamodb\_table\_label) | cloudposse/label/null | 0.25.0 |
22-
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 0.26.0 |
22+
| <a name="module_log_storage"></a> [log\_storage](#module\_log\_storage) | cloudposse/s3-log-storage/aws | 1.1.0 |
2323
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.25.0 |
2424

2525
## Resources
@@ -32,7 +32,14 @@
3232
| [aws_iam_role.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
3333
| [aws_iam_role_policy_attachment.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3434
| [aws_s3_bucket.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
35+
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
36+
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
37+
| [aws_s3_bucket_ownership_controls.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
38+
| [aws_s3_bucket_policy.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
3539
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
40+
| [aws_s3_bucket_replication_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_replication_configuration) | resource |
41+
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
42+
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
3643
| [local_file.terraform_backend_config](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
3744
| [aws_iam_policy_document.prevent_unencrypted_uploads](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3845
| [aws_iam_policy_document.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎examples/complete/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 1.1.0"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 2.0"
7+
version = "= 4.9.0"
88
}
99
local = {
1010
source = "hashicorp/local"

‎main.tf

+80-36
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ data "aws_iam_policy_document" "prevent_unencrypted_uploads" {
140140

141141
module "log_storage" {
142142
source = "cloudposse/s3-log-storage/aws"
143-
version = "0.26.0"
143+
version = "1.1.0"
144144

145145
enabled = local.logging_bucket_enabled
146146
access_log_bucket_prefix = local.logging_prefix_default
@@ -158,53 +158,70 @@ resource "aws_s3_bucket" "default" {
158158

159159
#bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until Bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
160160
#bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` check due to issues operating with `mfa_delete` in terraform
161+
#bridgecrew:skip=BC_AWS_NETWORKING_52: Skipping `Ensure S3 Bucket has public access blocks` because we have chosen to make it configurable
162+
#bridgecrew:skip=BC_AWS_S3_16:Skipping `Ensure AWS S3 object versioning is enabled` because we have it enabled, but Bridgecrew doesn't recognize it
161163
bucket = substr(local.bucket_name, 0, 63)
162-
acl = var.acl
163164
force_destroy = var.force_destroy
164-
policy = local.policy
165165

166-
versioning {
167-
enabled = true
168-
mfa_delete = var.mfa_delete
169-
}
166+
tags = module.this.tags
167+
}
170168

171-
server_side_encryption_configuration {
172-
rule {
173-
apply_server_side_encryption_by_default {
174-
sse_algorithm = "AES256"
175-
}
176-
}
169+
resource "aws_s3_bucket_acl" "default" {
170+
count = local.bucket_enabled ? 1 : 0
171+
bucket = join("", aws_s3_bucket.default.*.id)
172+
173+
acl = var.acl
174+
175+
depends_on = [aws_s3_bucket_ownership_controls.default]
176+
}
177+
178+
# Per https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
179+
resource "aws_s3_bucket_ownership_controls" "default" {
180+
count = local.bucket_enabled ? 1 : 0
181+
bucket = join("", aws_s3_bucket.default.*.id)
182+
183+
rule {
184+
object_ownership = "BucketOwnerPreferred"
177185
}
186+
}
187+
188+
resource "aws_s3_bucket_policy" "default" {
189+
count = local.bucket_enabled ? 1 : 0
190+
bucket = join("", aws_s3_bucket.default.*.id)
191+
policy = local.policy
192+
depends_on = [aws_s3_bucket_public_access_block.default]
193+
}
178194

179-
dynamic "replication_configuration" {
180-
for_each = var.s3_replication_enabled ? toset([var.s3_replica_bucket_arn]) : []
181-
content {
182-
role = aws_iam_role.replication[0].arn
183-
184-
rules {
185-
id = module.this.id
186-
prefix = ""
187-
status = "Enabled"
188-
189-
destination {
190-
bucket = var.s3_replica_bucket_arn
191-
storage_class = "STANDARD"
192-
}
193-
}
195+
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
196+
count = local.bucket_enabled ? 1 : 0
197+
bucket = join("", aws_s3_bucket.default.*.id)
198+
199+
rule {
200+
apply_server_side_encryption_by_default {
201+
sse_algorithm = "AES256"
194202
}
195203
}
204+
}
196205

197-
dynamic "logging" {
198-
for_each = var.logging == null ? [] : [1]
199-
content {
200-
target_bucket = local.logging_bucket_name
201-
target_prefix = local.logging_prefix
202-
}
206+
resource "aws_s3_bucket_versioning" "default" {
207+
count = local.bucket_enabled ? 1 : 0
208+
bucket = join("", aws_s3_bucket.default.*.id)
209+
210+
versioning_configuration {
211+
status = "Enabled"
212+
mfa_delete = var.mfa_delete ? "Enabled" : "Disabled"
203213
}
214+
}
204215

205-
tags = module.this.tags
216+
resource "aws_s3_bucket_logging" "default" {
217+
count = local.bucket_enabled && var.logging != null ? 1 : 0
218+
bucket = join("", aws_s3_bucket.default.*.id)
219+
220+
target_bucket = local.logging_bucket_name
221+
target_prefix = local.logging_prefix
206222
}
207223

224+
208225
resource "aws_s3_bucket_public_access_block" "default" {
209226
count = local.bucket_enabled && var.enable_public_access_block ? 1 : 0
210227
bucket = join("", aws_s3_bucket.default.*.id)
@@ -214,6 +231,31 @@ resource "aws_s3_bucket_public_access_block" "default" {
214231
restrict_public_buckets = var.restrict_public_buckets
215232
}
216233

234+
resource "aws_s3_bucket_replication_configuration" "default" {
235+
count = local.bucket_enabled && var.s3_replication_enabled ? 1 : 0
236+
237+
bucket = join("", aws_s3_bucket.default.*.id)
238+
role = aws_iam_role.replication[0].arn
239+
240+
rule {
241+
id = module.this.id
242+
status = "Enabled"
243+
244+
destination {
245+
# Prefer newer system of specifying bucket in rule, but maintain backward compatibility with
246+
# s3_replica_bucket_arn to specify single destination for all rules
247+
bucket = var.s3_replica_bucket_arn
248+
storage_class = "STANDARD"
249+
}
250+
}
251+
252+
depends_on = [
253+
# versioning must be set before replication
254+
aws_s3_bucket_versioning.default
255+
]
256+
}
257+
258+
217259
module "dynamodb_table_label" {
218260
source = "cloudposse/label/null"
219261
version = "0.25.0"
@@ -223,6 +265,7 @@ module "dynamodb_table_label" {
223265
}
224266

225267
resource "aws_dynamodb_table" "with_server_side_encryption" {
268+
#bridgecrew:skip=BC_AWS_GENERAL_44:Skipping `Ensure DynamoDB Tables have Auto Scaling enabled` because we know this is low usage
226269
count = local.dynamodb_enabled && var.enable_server_side_encryption ? 1 : 0
227270
name = local.dynamodb_table_name
228271
billing_mode = var.billing_mode
@@ -249,7 +292,8 @@ resource "aws_dynamodb_table" "with_server_side_encryption" {
249292
}
250293

251294
resource "aws_dynamodb_table" "without_server_side_encryption" {
252-
count = local.dynamodb_enabled && ! var.enable_server_side_encryption ? 1 : 0
295+
#bridgecrew:skip=BC_AWS_GENERAL_44:Skipping `Ensure DynamoDB Tables have Auto Scaling enabled` because we know this is low usage
296+
count = local.dynamodb_enabled && !var.enable_server_side_encryption ? 1 : 0
253297
name = local.dynamodb_table_name
254298
billing_mode = var.billing_mode
255299
read_capacity = var.billing_mode == "PROVISIONED" ? var.read_capacity : null

‎versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
terraform {
2-
required_version = ">= 0.13.0"
2+
required_version = ">= 1.1.0"
33

44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 2.0"
7+
version = ">= 4.9.0"
88
}
99
local = {
1010
source = "hashicorp/local"

0 commit comments

Comments
 (0)