diff --git a/README.md b/README.md index 44b1485..9f78a83 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,7 @@ No requirements. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| access\_log\_bucket | Server Access Logging Bucket ID | `string` | n/a | yes | | access\_log\_bucket\_prefix | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | | bucket\_folders | List of folders (keys) to create after creation of bucket | `list(string)` | `[]` | no | | bucket\_name | AWS Bucket Name | `string` | n/a | yes | diff --git a/main.tf b/main.tf index 4c5ba29..b932d39 100644 --- a/main.tf +++ b/main.tf @@ -16,15 +16,15 @@ locals { #aws_region = data.aws_region.current.name #partition = data.aws_arn.current.partition #name = (var.name != "" && var.name != null) ? var.name : format("k-kms-%v-%v", var.bucket_name, local.aws_region) - name = var.bucket_name + name = var.bucket_name # kms_key_arn_exists = var.kms_key_arn != "" && var.kms_key_arn != null kms_key_arn = aws_kms_key.key.arn kms_key_name = format("%s%s", local._prefixes["kms"], var.bucket_name) base_tags = { - # "boc:tf_module_version" = var._module_version - "boc:created_by" = "terraform" + # "boc:tf_module_version" = var._module_version + "boc:created_by" = "terraform" } } @@ -41,7 +41,7 @@ resource "aws_s3_bucket" "this" { kms_master_key_id = aws_kms_key.key.key_id #kms_master_key_id = var.kms_key_id #kms_master_key_id = "k-kms-", var.bucket_name - sse_algorithm = "aws:kms" + sse_algorithm = "aws:kms" } } } @@ -98,30 +98,30 @@ data "aws_iam_policy_document" "this" { values = ["true"] } } - statement { - sid = "enforceSSL" - effect = "Deny" - actions = ["s3:*"] + statement { + sid = "enforceSSL" + effect = "Deny" + actions = ["s3:*"] principals { - type = "AWS" - identifiers = ["*"] + type = "AWS" + identifiers = ["*"] } - resources = [aws_s3_bucket.this.arn, "${aws_s3_bucket.this.arn}/*"] + resources = [aws_s3_bucket.this.arn, "${aws_s3_bucket.this.arn}/*"] condition { - test = "Bool" - variable = "aws:SecureTransport" - values = ["false"] + test = "Bool" + variable = "aws:SecureTransport" + values = ["false"] } } - +} #--- # apply policy to bucket and public access block policy to bucket #--- resource "aws_s3_bucket_policy" "policy" { - bucket = aws_s3_bucket.this.bucket - policy = data.aws_iam_policy_document.this.json -# depends_on = [null_resource.policy_delay] + bucket = aws_s3_bucket.this.bucket + policy = data.aws_iam_policy_document.this.json + # depends_on = [null_resource.policy_delay] } resource "aws_s3_bucket_public_access_block" "this" { @@ -184,4 +184,3 @@ resource "aws_kms_alias" "key" { name = "alias/${local.kms_key_name}" target_key_id = aws_kms_key.key.key_id } -}