Creates a private S3 bucket with good defaults:

• Private only objects
• Encryption
• Versioning
• Access logging
• Storage analytics

The following policy rules are set:

• Deny uploading public objects.
• Deny updating policy to allow public objects.

The following ACL rules are set:

• Retroactively remove public access granted through public ACLs
• Deny updating ACL to public

The following lifecycle rules are set:

• Incomplete multipart uploads are deleted after 14 days.
• Expired object delete markers are deleted.
• Noncurrent object versions transition to the Standard - Infrequent Access storage class after 30 days.
• Noncurrent object versions expire after 365 days.

Terraform Versions

Terraform 0.13 and newer. Pin module version to ~> 3.X. Submit pull-requests to master branch.

Terraform 0.12. Pin module version to ~> 2.X. Submit pull-requests to terraform012 branch.

Usage

module "aws-s3-bucket" {
  source         = "trussworks/s3-private-bucket/aws"
  bucket         = "my-bucket-name"
  logging_bucket = "my-aws-logs"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }
}

Requirements

Providers

Modules

No modules.

Resources

Inputs

[
  {
    "expired_object_delete_marker": true
  }
]

[
  {
    "days": 30,
    "storage_class": "STANDARD_IA"
  }
]

Outputs

Developer Setup

Install dependencies (macOS)

brew install pre-commit go terraform terraform-docs

Testing

Terratest is being used for automated testing with this module. Tests in the test folder can be run locally by running the following command:

make test

Or with aws-vault:

AWS_VAULT_KEYCHAIN_NAME=<NAME> aws-vault exec <PROFILE> -- make test

CHANGELOG

This terraform module is undergoing an experiment where we keep a CHANGELOG for it. We're still trying to figure out how to automate this process and, for now, are manually running the command.

The changelog should be updated every time a new GitHub release is cut.

To do so, you should have a Github token with "repo" scope that can be loaded in as an environment variable. You can find more info here.

export CHANGELOG_GITHUB_TOKEN="«your-40-digit-github-token»"

The command to run on your terminal:

docker run --env CHANGELOG_GITHUB_TOKEN="$CHANGELOG_GITHUB_TOKEN" --rm -v "$(pwd)":/usr/local/src/your-app ferrarimarco/github-changelog-generator -u trussworks -p terraform-aws-s3-private-bucket