s3-bucket

cloudposse/s3-bucket/aws

Terraform Module HCL AWS

Terraform module that creates an S3 bucket with an optional IAM user for external CI/CD systems

Install

module "s3-bucket" {

source = "cloudposse/s3-bucket/aws"

version = "4.11.0"

}

plain text: /constructs/tfmod-cloudposse-s3-bucket-aws/install.txt

⭐ Source on GitHub 📦 Registry page

README

This module creates an S3 bucket with support for versioning, lifecycles, object locks, replication, encryption, ACL, bucket object policies, and static website hosting. For backward compatibility, it sets the S3 bucket ACL to private and the s3_object_ownership to ObjectWriter. Moving forward, setting s3_object_ownership to BucketOwnerEnforced is recommended, and doing so automatically disables the ACL. This module blocks public access to the bucket by default. See block_public_acls, block_public_policy, ignore_public_acls, and restrict_public_buckets to change the settings. See AWS documentation for more details. This module can optionally create an IAM User with access to the S3 bucket. This is inherently insecure in that to enable anyone to become the User, access keys must be generate

Inputs (50)

Name	Type	Description	Default
intelligent_tiering_configuration	list(object({ name = str	A list of S3 Intelligent-Tiering configurations for the bucket. Each configurati	`[]`
tags	map(string)	Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the t	`{}`
id_length_limit	number	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length.	`null`
minimum_tls_version	string	Set the minimum TLS version for in-transit traffic	`null`
ignore_public_acls	bool	Set to `false` to disable the ignoring of public access lists on the bucket	`true`
stage	string	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'bu	`null`
label_key_case	string	Controls the letter case of the `tags` keys (label names) for tags generated by	`null`
user_permissions_boundary_arn	string	Permission boundary ARN for the IAM user created to access the bucket.	`null`
access_key_enabled	bool	Set to `true` to create an IAM Access Key for the created IAM user	`true`
force_destroy	bool	When `true`, permits a non-empty S3 bucket to be deleted by first deleting all o	`false`
kms_master_key_arn	string	The AWS KMS master key ARN used for the `SSE-KMS` encryption. This can only be u	`""`
s3_object_ownership	string	Specifies the S3 object ownership control. Valid values are `ObjectWriter`, `Buc	`"ObjectWriter"`
availability_zone_id	string	The ID of the availability zone.	`""`
enabled	bool	Set to false to prevent the module from creating any resources	`null`
label_order	list(string)	The order in which the labels (ID elements) appear in the `id`. Defaults to ["na	`null`
grants	list(object({ id	A list of policy grants for the bucket, taking a list of permissions. Conflicts	`[]`
sse_algorithm	string	The server-side encryption algorithm to use. Valid values are `AES256` and `aws:	`"AES256"`
store_access_key_in_ssm	bool	Set to `true` to store the created IAM user's access key in SSM Parameter Store,	`false`
allow_ssl_requests_only	bool	Set to `true` to require requests to use Secure Socket Layer (HTTPS/SSL). This w	`false`
transfer_acceleration_enabled	bool	Set this to `true` to enable S3 Transfer Acceleration for the bucket. Note: When	`false`
… and 10 more inputs

Outputs (17)

bucket_domain_name — FQDN of bucket

bucket_id — Bucket Name (aka ID)

bucket_arn — Bucket ARN

bucket_region — Bucket region

enabled — Is module enabled

user_name — Normalized IAM user name

secret_access_key_ssm_path — The SSM Path under which the S3 User's secret access key is stored

user_enabled — Is user creation enabled

user_arn — The ARN assigned by AWS for the user

user_unique_id — The user unique ID assigned by AWS

replication_role_arn — The ARN of the replication IAM Role

access_key_id_ssm_path — The SSM Path under which the S3 User's access key ID is stored

access_key_id — The access key ID, if `var.user_enabled && var.access_key_enabled`. While sensitive, it does not nee

bucket_regional_domain_name — The bucket region-specific domain name

bucket_website_endpoint — The bucket website endpoint, if website is enabled

bucket_website_domain — The bucket website domain, if website is enabled

secret_access_key — The secret access key will be output if created and not stored in SSM. However, the secret access ke

Resources (22)

aws_iam_policyaws_iam_roleaws_iam_role_policy_attachmentaws_s3_bucketaws_s3_bucket_accelerate_configurationaws_s3_bucket_aclaws_s3_bucket_cors_configurationaws_s3_bucket_intelligent_tiering_configurationaws_s3_bucket_lifecycle_configurationaws_s3_bucket_loggingaws_s3_bucket_notificationaws_s3_bucket_object_lock_configurationaws_s3_bucket_ownership_controlsaws_s3_bucket_policyaws_s3_bucket_public_access_blockaws_s3_bucket_replication_configurationaws_s3_bucket_request_payment_configurationaws_s3_bucket_server_side_encryption_configurationaws_s3_bucket_versioningaws_s3_bucket_website_configurationaws_s3_directory_buckettime_sleep

Topics & Tags

hcl2 circleci terraform cicd iam-user iam artifacts-repository artifacts codefresh s3 terraform-module travis-ci bucket

Details

FrameworkTerraform Module

LanguageHCL

Version4.11.0

Cloud AWS

★ Stars175

Forks868

Total downloads18.7M

Inputs50

Outputs17