feat: Add S3 bucket public access block (#5)

Author: amontalban

main.tf

@@ -42,6 +42,20 @@ resource "aws_s3_bucket_policy" "lb_logs_access_policy" {
   policy = data.aws_iam_policy_document.lb_logs_access_policy_document.json
 }
 
+#------------------------------------------------------------------------------
+# S3 bucket block public access
+#------------------------------------------------------------------------------
+resource "aws_s3_bucket_public_access_block" "lb_logs_block_public_access" {
+  count = var.block_s3_bucket_public_access ? 1 : 0
+
+  bucket = aws_s3_bucket.logs.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
 #------------------------------------------------------------------------------
 # APPLICATION LOAD BALANCER
 #------------------------------------------------------------------------------

variables.tf

@@ -12,6 +12,15 @@ variable "vpc_id" {
   description = "ID of the VPC"
 }
 
+#------------------------------------------------------------------------------
+# S3 bucket
+#------------------------------------------------------------------------------
+variable "block_s3_bucket_public_access" {
+  description = "(Optional) If true, public access to the S3 bucket will be blocked."
+  type        = bool
+  default     = false
+}
+
 #------------------------------------------------------------------------------
 # APPLICATION LOAD BALANCER
 #------------------------------------------------------------------------------
@@ -78,7 +87,7 @@ variable "ip_address_type" {
 #------------------------------------------------------------------------------
 variable "http_ports" {
   description = "Map containing objects with two fields, listener_port and the target_group_port to redirect HTTP requests"
-  type        = map
+  type        = map(any)
   default = {
     default_http = {
       listener_port     = 80
@@ -89,7 +98,7 @@ variable "http_ports" {
 
 variable "https_ports" {
   description = "Map containing objects with two fields, listener_port and the target_group_port to redirect HTTPS requests"
-  type        = map
+  type        = map(any)
   default = {
     default_http = {
       listener_port     = 443
@@ -213,6 +222,6 @@ variable "default_certificate_arn" {
 
 variable "additional_certificates_arn_for_https_listeners" {
   description = "(Optional) List of SSL server certificate ARNs for HTTPS listener. Use it if you need to set additional certificates besides default_certificate_arn"
-  type        = list
+  type        = list(any)
   default     = []
 }