AWS S3 bucket Terraform module

Upstream version 5.17.0

13 controls from SOC 2 requirements

Terraform Module Source

soc2.compliance.tf/terraform-aws-modules/s3-bucket/aws

Compliance Inputs Outputs Resources Rules Diff (3)README

78 unique

Name	Type	Default	Description
Enforced · locked by active controls
block_public_aclss3_bucket_restrict_public_read_access	bool	true	Whether Amazon S3 should block public ACLs for this bucket
block_public_policys3_bucket_policy_restrict_public_accesss3_bucket_restrict_public_read_access	bool	true	Whether Amazon S3 should block public bucket policies for this bucket
ignore_public_aclss3_bucket_restrict_public_read_access	bool	true	Whether Amazon S3 should ignore public ACLs for this bucket
lifecycle_rules3_bucket_versioning_and_lifecycle_policy_enabled	list({...})	[]	Object lifecycle management rules for the bucket
loggings3_bucket_logging_enabled	object({...})	null	Access log delivery configuration for the bucket
object_lock_enableds3_bucket_object_lock_enabled	bool	true	Whether S3 bucket should have an Object Lock configuration enabled
object_ownerships3_bucket_not_accessible_to_all_authenticated_user	string	"BucketOwnerEnforced"	Object ownership. Valid values: `BucketOwnerEnforced`, `BucketOwnerPreferred` or `ObjectWriter`. `BucketOwnerEnforced`: ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. `BucketOwnerPreferred`: Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the `bucket-owner-full-control` canned ACL. `ObjectWriter`: The uploading account will own the object if the object is uploaded with the `bucket-owner-full-control` canned ACL
replication_configurations3_bucket_cross_region_replication_enabled	object({...})	{}	Cross-region replication configuration for the bucket
restrict_public_bucketss3_bucket_policy_restrict_public_accesss3_bucket_restrict_public_read_access	bool	true	Whether Amazon S3 should restrict public bucket policies for this bucket
server_side_encryption_configurations3_bucket_default_encryption_enabled_kms	object({...})	{...}	Server-side encryption configuration for the bucket
versionings3_bucket_versioning_enabled	map(string)	{"enabled":"Enabled"}	Versioning configuration for the bucket
websites3_bucket_static_website_hosting_disabled	object({...})	{}	Static website hosting or redirect configuration for the bucket
Optional
acceleration_status	string	null	Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended
access_log_delivery_policy_source_accounts	list(string)	[]	List of AWS Account IDs should be allowed to deliver access logs to this bucket
access_log_delivery_policy_source_buckets	list(string)	[]	List of S3 bucket ARNs which should be allowed to deliver access logs to this bucket
access_log_delivery_policy_source_organizations	list(string)	[]	List of AWS Organization IDs should be allowed to deliver access logs to this bucket
acl	string	null	The canned ACL to apply. Conflicts with `grant`
allowed_kms_key_arn	string	null	The ARN of KMS key which should be allowed in PutObject
analytics_configuration	map({...})	{}	Analytics configurations for the bucket, keyed by configuration name
analytics_self_source_destination	bool	false	Whether or not the analytics source bucket is also the destination bucket
analytics_source_account_id	string	null	The analytics source account id
analytics_source_bucket_arn	string	null	The analytics source bucket ARN
attach_access_log_delivery_policy	bool	false	Controls if S3 bucket should have S3 access log delivery policy attached
attach_analytics_destination_policy	bool	false	Controls if S3 bucket should have bucket analytics destination policy attached
attach_cloudtrail_log_delivery_policy	bool	false	Controls if S3 bucket should have CloudTrail log delivery policy attached
attach_deny_incorrect_encryption_headers	bool	false	Controls if S3 bucket should deny incorrect encryption headers policy attached
attach_deny_incorrect_kms_key_sse	bool	false	Controls if S3 bucket policy should deny usage of incorrect KMS key SSE
attach_deny_insecure_transport_policy	bool	false	Controls if S3 bucket should have deny non-SSL transport policy attached
attach_deny_ssec_encrypted_object_uploads	bool	false	Controls if S3 bucket should deny SSEC encrypted object uploads
attach_deny_unencrypted_object_uploads	bool	false	Controls if S3 bucket should deny unencrypted object uploads policy attached
attach_elb_log_delivery_policy	bool	false	Controls if S3 bucket should have the log delivery policy for Application and Classic Load Balancer access logs attached
attach_inventory_destination_policy	bool	false	Controls if S3 bucket should have bucket inventory destination policy attached
attach_lb_log_delivery_policy	bool	false	Controls if S3 bucket should have the log delivery policy for Network Load Balancer access logs attached
attach_policy	bool	false	Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)
attach_public_policy	bool	true	Controls if the S3 Bucket Public Access Block is created (set to `false` to allow upstream to apply defaults to the bucket)
attach_require_latest_tls_policy	bool	false	Controls if S3 bucket should require the latest version of TLS
attach_waf_log_delivery_policy	bool	false	Controls if S3 bucket should have WAF log delivery policy attached
availability_zone_id	string	null	Availability Zone ID or Local Zone ID
bucket	string	null	The name of the bucket. If omitted, Terraform will assign a random, unique name
bucket_namespace	string	null	Namespace for the bucket. Determines bucket naming scope. Valid values: `account-regional`, `global`. Defaults to `global` (AWS)
bucket_prefix	string	null	Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket
control_object_ownership	bool	false	Whether to manage S3 Bucket Ownership Controls on this bucket
cors_rule	list({...})	[]	Rules for Cross-Origin Resource Sharing on the bucket
create_bucket	bool	true	Controls if S3 bucket should be created
create_file_system_security_group	bool	true	Whether each file system creates a security group for its mount targets. A file system can override it with its own `create_security_group`, and setting `security_groups` does not turn it off
create_metadata_configuration	bool	false	Whether to create metadata configuration resource
data_redundancy	string	null	Data redundancy. Valid values: `SingleAvailabilityZone`
expected_bucket_owner	string	null	The account ID of the expected bucket owner
file_system_security_group_egress_rules	map({...})	{}	Map of egress rules added to every file system security group this module creates. A file system can replace them with its own `security_group_egress_rules`
file_system_security_group_ingress_rules	map({...})	{}	Map of ingress rules added to every file system security group this module creates. A file system can replace them with its own `security_group_ingress_rules`
file_system_security_group_tags	map(string)	null	A map of additional tags added to every file system security group this module creates
file_system_security_group_vpc_id	string	null	ID of the VPC where the file system security groups are created. Must be the VPC of the mount target subnets
file_systems	map({...})	{}	Map of Amazon S3 Files file system definitions to create on the bucket. Requires versioning enabled through `versioning`, even when it is already enabled outside this module, and is not supported on a directory bucket
force_destroy	bool	false	A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable
grant	list({...})	[]	ACL policy grants for the bucket. Conflicts with `acl`
intelligent_tiering	map({...})	{}	Intelligent tiering configurations for the bucket, keyed by configuration name
inventory_configuration	map({...})	{}	Inventory configurations for the bucket, keyed by configuration name
inventory_self_source_destination	bool	false	Whether or not the inventory source bucket is also the destination bucket
inventory_source_account_id	string	null	The inventory source account id
inventory_source_bucket_arn	string	null	The inventory source bucket ARN
is_directory_bucket	bool	false	If the s3 bucket created is a directory bucket
lb_log_delivery_policy_source_organizations	list(string)	[]	List of AWS Organization IDs should be allowed to deliver ALB/NLB logs to this bucket
location_type	string	null	Location type. Valid values: `AvailabilityZone` or `LocalZone`
metadata_encryption_configuration	object({...})	null	Encryption configuration for the metadata inventory table
metadata_inventory_table_configuration_state	string	null	Configuration state of the inventory table, indicating whether the inventory table is enabled or disabled. Valid values: `ENABLED`, `DISABLED`
metadata_journal_table_record_expiration	string	null	Whether journal table record expiration is enabled or disabled. Valid values: `ENABLED`, `DISABLED`
metadata_journal_table_record_expiration_days	number	null	Number of days to retain journal table records
metric_configuration	list({...})	[]	Metric configurations for the bucket
object_lock_configuration	object({...})	{}	Object lock configuration for the bucket
owner	map(string)	{}	Bucket owner's display name and ID. Conflicts with `acl`
policy	string	null	A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide
putin_khuylo	bool	true	Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
region	string	null	Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration
request_payer	string	null	Specifies who should bear the cost of Amazon S3 data transfer. Can be either `BucketOwner` or `Requester`. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information
skip_destroy_public_access_block	bool	true	Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true
tags	map(string)	{}	A mapping of tags to assign to the bucket
transition_default_minimum_object_size	string	null	The default minimum object size behavior applied to the lifecycle configuration. Valid values: `all_storage_classes_128K` (default) or `varies_by_storage_class`
type	string	"Directory"	Bucket type. Valid values: `Directory`