Skip to content

Commit 41b7d76

Browse files
max-loburgithub-actions[bot]
max-lobur
and
github-actions[bot]
authored
Fix bucket settings (#130)
* Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Fix bucket ACL * Update main.tf Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * readme * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings * Fix bucket settings --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 0586277 commit 41b7d76

File tree

3 files changed

+77
-30
lines changed

3 files changed

+77
-30
lines changed

‎README.md

+7
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,13 @@ Available targets:
182182
| [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
183183
| [aws_iam_role_policy_attachment.default_cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
184184
| [aws_s3_bucket.cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
185+
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
186+
| [aws_s3_bucket_lifecycle_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
187+
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
188+
| [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
189+
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
190+
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
191+
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
185192
| [random_string.bucket_prefix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
186193
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
187194
| [aws_iam_policy_document.combined_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎docs/terraform.md

+7
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@
3232
| [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3333
| [aws_iam_role_policy_attachment.default_cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
3434
| [aws_s3_bucket.cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
35+
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
36+
| [aws_s3_bucket_lifecycle_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
37+
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
38+
| [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
39+
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
40+
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
41+
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
3542
| [random_string.bucket_prefix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
3643
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
3744
| [aws_iam_policy_document.combined_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

‎main.tf

+63-30
Original file line numberDiff line numberDiff line change
@@ -2,53 +2,86 @@ data "aws_caller_identity" "default" {}
22

33
data "aws_region" "default" {}
44

5-
resource "aws_s3_bucket" "cache_bucket" {
6-
#bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
7-
#bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
8-
#bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue in terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629).
9-
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
10-
bucket = local.cache_bucket_name_normalised
11-
acl = "private"
12-
force_destroy = true
13-
tags = module.this.tags
5+
resource "aws_s3_bucket_acl" "default" {
6+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
7+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
8+
acl = "private"
9+
depends_on = [aws_s3_bucket_ownership_controls.s3_bucket_acl_ownership]
10+
}
1411

15-
versioning {
16-
enabled = var.versioning_enabled
12+
resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
13+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
14+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
15+
rule {
16+
object_ownership = "BucketOwnerPreferred"
1717
}
18+
}
1819

19-
dynamic "logging" {
20-
for_each = var.access_log_bucket_name != "" ? [1] : []
21-
content {
22-
target_bucket = var.access_log_bucket_name
23-
target_prefix = "logs/${module.this.id}/"
24-
}
20+
resource "aws_s3_bucket_versioning" "default" {
21+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
22+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
23+
versioning_configuration {
24+
status = "Enabled"
2525
}
26+
}
2627

27-
lifecycle_rule {
28-
id = "codebuildcache"
29-
enabled = true
28+
resource "aws_s3_bucket_lifecycle_configuration" "default" {
29+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
30+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
3031

31-
prefix = "/"
32-
tags = module.this.tags
32+
rule {
33+
id = "codebuildcache"
34+
status = "Enabled"
35+
36+
filter {
37+
prefix = "/"
38+
}
3339

3440
expiration {
3541
days = var.cache_expiration_days
3642
}
3743
}
44+
}
3845

39-
dynamic "server_side_encryption_configuration" {
40-
for_each = var.encryption_enabled ? ["true"] : []
46+
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
47+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
48+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
4149

42-
content {
43-
rule {
44-
apply_server_side_encryption_by_default {
45-
sse_algorithm = "AES256"
46-
}
47-
}
50+
rule {
51+
apply_server_side_encryption_by_default {
52+
sse_algorithm = "AES256"
4853
}
4954
}
5055
}
5156

57+
resource "aws_s3_bucket_logging" "default" {
58+
count = module.this.enabled && local.create_s3_cache_bucket && var.access_log_bucket_name != "" ? 1 : 0
59+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
60+
61+
target_bucket = var.access_log_bucket_name
62+
target_prefix = "logs/${module.this.id}/"
63+
}
64+
65+
resource "aws_s3_bucket_public_access_block" "default" {
66+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
67+
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
68+
69+
block_public_acls = true
70+
block_public_policy = true
71+
ignore_public_acls = true
72+
restrict_public_buckets = true
73+
}
74+
75+
resource "aws_s3_bucket" "cache_bucket" {
76+
#bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
77+
#bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
78+
#bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue in terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629).
79+
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
80+
bucket = local.cache_bucket_name_normalised
81+
force_destroy = true
82+
tags = module.this.tags
83+
}
84+
5285
resource "random_string" "bucket_prefix" {
5386
count = module.this.enabled ? 1 : 0
5487
length = 12

0 commit comments

Comments
 (0)