Skip to content

Commit b5db54d

Browse files
egarbicursoragent
egarbi
and
cursoragent
committed
docs(examples): add custom website bucket policy example
Add a dedicated example showing how to provide website_bucket_policy and link the variable docs to it so consumers can discover the expected configuration faster. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent b85d40a commit b5db54d

File tree

5 files changed

+114
-3
lines changed

5 files changed

+114
-3
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ In order to run all checks at any point run the following command:
112112
| <a name="input_tags"></a> [tags](#input\_tags) | Resource tags | `map(string)` | `{}` | no |
113113
| <a name="input_website_bucket_acl"></a> [website\_bucket\_acl](#input\_website\_bucket\_acl) | (Optional) The canned ACL to apply. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, and log-delivery-write. Defaults to private. | `string` | `"private"` | no |
114114
| <a name="input_website_bucket_force_destroy"></a> [website\_bucket\_force\_destroy](#input\_website\_bucket\_force\_destroy) | (Optional, Default:false) A boolean that indicates all objects (including any locked objects) should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
115-
| <a name="input_website_bucket_policy"></a> [website\_bucket\_policy](#input\_website\_bucket\_policy) | (Optional) Map containing the IAM policy for the website bucket. Defaults to null and the policy will be generated automatically. | `any` | `null` | no |
115+
| <a name="input_website_bucket_policy"></a> [website\_bucket\_policy](#input\_website\_bucket\_policy) | (Optional) Map containing the IAM policy for the website bucket. Defaults to null and the policy will be generated automatically. See examples/custom-website-bucket-policy/main.tf for configuration example. | `any` | `null` | no |
116116
| <a name="input_website_cors_additional_allowed_origins"></a> [website\_cors\_additional\_allowed\_origins](#input\_website\_cors\_additional\_allowed\_origins) | (Optional) Specifies which origins are allowed besides the domain name specified | `list(string)` | `[]` | no |
117117
| <a name="input_website_cors_allowed_headers"></a> [website\_cors\_allowed\_headers](#input\_website\_cors\_allowed\_headers) | (Optional) Specifies which headers are allowed. Defaults to Authorization and Content-Length | `list(string)` | <pre>[<br/> "Authorization",<br/> "Content-Length"<br/>]</pre> | no |
118118
| <a name="input_website_cors_allowed_methods"></a> [website\_cors\_allowed\_methods](#input\_website\_cors\_allowed\_methods) | (Optional) Specifies which methods are allowed. Can be GET, PUT, POST, DELETE or HEAD. Defaults to GET and POST | `list(string)` | <pre>[<br/> "GET",<br/> "POST"<br/>]</pre> | no |

‎examples/custom-website-bucket-policy/main.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
module "test_website" {
2+
source = "../../"
3+
name_prefix = "test-website"
4+
5+
providers = {
6+
aws.main = aws.main
7+
aws.acm_provider = aws.acm_provider
8+
}
9+
10+
website_domain_name = "test.com"
11+
12+
create_acm_certificate = false
13+
acm_certificate_arn_to_use = "arn:aws:acm:us-east-1:123456789000:certificate/01234567-89a-bcde-f012-3456789abcde"
14+
15+
create_route53_hosted_zone = false
16+
route53_hosted_zone_id = "0123456789ABCDEFGHIJK"
17+
18+
aws_accounts_with_read_view_log_bucket = ["mock_account"]
19+
20+
website_bucket_policy = {
21+
Version = "2012-10-17"
22+
Statement = [
23+
{
24+
Sid = "AllowGetListFromSpecificAccount"
25+
Effect = "Allow"
26+
Principal = {
27+
AWS = "arn:aws:iam::123456789000:root"
28+
}
29+
Action = [
30+
"s3:GetObject",
31+
"s3:ListBucket"
32+
]
33+
Resource = [
34+
"arn:aws:s3:::test.com",
35+
"arn:aws:s3:::test.com/*"
36+
]
37+
}
38+
]
39+
}
40+
}

‎examples/custom-website-bucket-policy/mock_provider.tf‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
terraform {
2+
required_version = ">= 0.13"
3+
required_providers {
4+
aws = {
5+
source = "hashicorp/aws"
6+
version = ">= 4.0"
7+
}
8+
}
9+
}
10+
11+
provider "aws" {
12+
alias = "main"
13+
region = "us-east-1"
14+
skip_credentials_validation = true
15+
skip_requesting_account_id = true
16+
skip_metadata_api_check = true
17+
s3_use_path_style = true
18+
19+
endpoints {
20+
apigateway = "http://localstack:4566"
21+
cloudformation = "http://localstack:4566"
22+
cloudwatch = "http://localstack:4566"
23+
dynamodb = "http://localstack:4566"
24+
es = "http://localstack:4566"
25+
firehose = "http://localstack:4566"
26+
iam = "http://localstack:4566"
27+
kinesis = "http://localstack:4566"
28+
lambda = "http://localstack:4566"
29+
route53 = "http://localstack:4566"
30+
redshift = "http://localstack:4566"
31+
s3 = "http://localstack:4566"
32+
secretsmanager = "http://localstack:4566"
33+
ses = "http://localstack:4566"
34+
sns = "http://localstack:4566"
35+
sqs = "http://localstack:4566"
36+
ssm = "http://localstack:4566"
37+
stepfunctions = "http://localstack:4566"
38+
sts = "http://localstack:4566"
39+
}
40+
}
41+
42+
provider "aws" {
43+
alias = "acm_provider"
44+
region = "us-east-1"
45+
skip_credentials_validation = true
46+
skip_requesting_account_id = true
47+
skip_metadata_api_check = true
48+
s3_use_path_style = true
49+
50+
endpoints {
51+
apigateway = "http://localstack:4566"
52+
cloudformation = "http://localstack:4566"
53+
cloudwatch = "http://localstack:4566"
54+
dynamodb = "http://localstack:4566"
55+
es = "http://localstack:4566"
56+
firehose = "http://localstack:4566"
57+
iam = "http://localstack:4566"
58+
kinesis = "http://localstack:4566"
59+
lambda = "http://localstack:4566"
60+
route53 = "http://localstack:4566"
61+
redshift = "http://localstack:4566"
62+
s3 = "http://localstack:4566"
63+
secretsmanager = "http://localstack:4566"
64+
ses = "http://localstack:4566"
65+
sns = "http://localstack:4566"
66+
sqs = "http://localstack:4566"
67+
ssm = "http://localstack:4566"
68+
stepfunctions = "http://localstack:4566"
69+
sts = "http://localstack:4566"
70+
}
71+
}

‎variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ variable "website_server_side_encryption_configuration" {
119119
}
120120

121121
variable "website_bucket_policy" {
122-
description = "(Optional) Map containing the IAM policy for the website bucket. Defaults to null and the policy will be generated automatically."
122+
description = "(Optional) Map containing the IAM policy for the website bucket. Defaults to null and the policy will be generated automatically. See examples/custom-website-bucket-policy/main.tf for configuration example."
123123
type = any
124124
default = null
125125
}

‎website.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ resource "aws_cloudfront_origin_access_identity" "cf_oai" {
1010
#------------------------------------------------------------------------------
1111
# Website S3 Bucket
1212
#------------------------------------------------------------------------------
13-
#tfsec:ignore:aws-s3-enable-versioning tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging
13+
#tfsec:ignore:aws-s3-enable-versioning tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging tfsec:ignore:aws-s3-enable-bucket-encryption
1414
resource "aws_s3_bucket" "website" {
1515
# tfsec:ignore:AWS017
1616
provider = aws.main

0 commit comments

Comments
 (0)