From ad4987af33f9b85f01963510344c60b3722c4fd7 Mon Sep 17 00:00:00 2001 From: badra001 Date: Thu, 25 Mar 2021 13:51:41 -0400 Subject: [PATCH] * v2.0.1 -- 20210325 - make bucket policies denying missing encryption header optional - add variable: `require_explicit_encryption` default = false --- CHANGELOG.md | 4 +++ common/README.md | 57 +++++++++++++++++------------------ common/resources.tf | 72 ++++++++++++++++++++++++++------------------- common/variables.tf | 6 ++++ common/version.tf | 2 +- standard/README.md | 63 ++++++++++++++++++++------------------- title26/README.md | 67 ++++++++++++++++++++--------------------- 7 files changed, 148 insertions(+), 123 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1f113dc..38e21b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,3 +24,7 @@ - versioning - explicit boc:authority tag - auto create encryption key + +* v2.0.1 -- 20210325 + - make bucket policies denying missing encryption header optional + - add variable: `require_explicit_encryption` default = false diff --git a/common/README.md b/common/README.md index 091b656..93e771d 100644 --- a/common/README.md +++ b/common/README.md @@ -6,47 +6,48 @@ No requirements. | Name | Version | |------|---------| -| aws | n/a | -| null | n/a | +| [aws](#provider\_aws) | n/a | +| [null](#provider\_null) | n/a | ## Modules -No Modules. +No modules. ## Resources -| Name | -|------| -| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | -| [aws_kms_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | -| [aws_kms_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | -| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | -| [aws_s3_bucket_object](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | -| [aws_s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | -| [aws_s3_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | -| [null_resource](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | +| Name | Type | +|------|------| +| [aws_kms_alias.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | +| [aws_kms_key.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | +| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_object.this_objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | resource | +| [aws_s3_bucket_policy.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | +| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [null_resource.policy_delay](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| access\_log\_bucket | Server Access Logging Bucket ID | `string` | n/a | yes | -| access\_log\_bucket\_prefix | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | -| allowed\_cidr | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | -| allowed\_endpoints | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | -| bucket\_folders | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | -| bucket\_name | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | -| force\_destroy | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | -| kms\_key\_id | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | -| metadata\_tags | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | -| tags | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | +| [access\_log\_bucket](#input\_access\_log\_bucket) | Server Access Logging Bucket ID | `string` | n/a | yes | +| [access\_log\_bucket\_prefix](#input\_access\_log\_bucket\_prefix) | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | +| [allowed\_cidr](#input\_allowed\_cidr) | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | +| [allowed\_endpoints](#input\_allowed\_endpoints) | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | +| [bucket\_folders](#input\_bucket\_folders) | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | +| [bucket\_name](#input\_bucket\_name) | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | +| [force\_destroy](#input\_force\_destroy) | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | +| [kms\_key\_id](#input\_kms\_key\_id) | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | +| [metadata\_tags](#input\_metadata\_tags) | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | +| [require\_explicit\_encryption](#input\_require\_explicit\_encryption) | When enabled, adds bucket policy to Deny unencrypted uploads and incorrect encryption header. Should not normally be needed. | `bool` | `false` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | ## Outputs | Name | Description | |------|-------------| -| kms\_key\_alias | Created KMS Key Alias name | -| kms\_key\_arn | Created KMS Key ARN | -| kms\_key\_id | Created KMS Key ID | -| s3\_bucket\_arn | Created S3 Bucket ARN | -| s3\_bucket\_id | Created S3 Bucket ID | +| [kms\_key\_alias](#output\_kms\_key\_alias) | Created KMS Key Alias name | +| [kms\_key\_arn](#output\_kms\_key\_arn) | Created KMS Key ARN | +| [kms\_key\_id](#output\_kms\_key\_id) | Created KMS Key ID | +| [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | Created S3 Bucket ARN | +| [s3\_bucket\_id](#output\_s3\_bucket\_id) | Created S3 Bucket ID | diff --git a/common/resources.tf b/common/resources.tf index 0405204..6d5394a 100644 --- a/common/resources.tf +++ b/common/resources.tf @@ -84,36 +84,7 @@ resource "aws_s3_bucket" "this" { } data "aws_iam_policy_document" "this" { - statement { - sid = "DenyIncorrectEncryptionHeader" - effect = "Deny" - actions = ["s3:PutObject"] - principals { - type = "AWS" - identifiers = ["*"] - } - resources = ["${aws_s3_bucket.this.arn}/*"] - condition { - test = "StringNotEquals" - variable = "s3:x-amz-server-side-encryption" - values = ["aws:kms"] - } - } - statement { - sid = "DenyUnEncryptedObjectUploads" - effect = "Deny" - actions = ["s3:PutObject"] - principals { - type = "AWS" - identifiers = ["*"] - } - resources = ["${aws_s3_bucket.this.arn}/*"] - condition { - test = "Null" - variable = "s3:x-amz-server-side-encryption" - values = ["true"] - } - } + # require SSL statement { sid = "enforceSSL" effect = "Deny" @@ -129,6 +100,47 @@ data "aws_iam_policy_document" "this" { values = ["false"] } } + # explicit encryption + dynamic "statement" { + for_each = var.require_explicit_encryption ? toset(["1"]) : toset([]) + iterator = s + content { + sid = "DenyIncorrectEncryptionHeader" + effect = "Deny" + actions = ["s3:PutObject"] + principals { + type = "AWS" + identifiers = ["*"] + } + resources = ["${aws_s3_bucket.this.arn}/*"] + condition { + test = "StringNotEquals" + variable = "s3:x-amz-server-side-encryption" + values = ["aws:kms"] + } + } + } + # explicit encryption + dynamic "statement" { + for_each = var.require_explicit_encryption ? toset(["1"]) : toset([]) + iterator = s + content { + sid = "DenyUnEncryptedObjectUploads" + effect = "Deny" + actions = ["s3:PutObject"] + principals { + type = "AWS" + identifiers = ["*"] + } + resources = ["${aws_s3_bucket.this.arn}/*"] + condition { + test = "Null" + variable = "s3:x-amz-server-side-encryption" + values = ["true"] + } + } + } + # remote access conditions dynamic "statement" { for_each = length(local.s3_bucket_conditions) > 0 ? toset(["1"]) : toset([]) iterator = s diff --git a/common/variables.tf b/common/variables.tf index 687d447..1e97786 100644 --- a/common/variables.tf +++ b/common/variables.tf @@ -56,3 +56,9 @@ variable "force_destroy" { type = bool default = false } + +variable "require_explicit_encryption" { + description = "When enabled, adds bucket policy to Deny unencrypted uploads and incorrect encryption header. Should not normally be needed." + type = bool + default = false +} diff --git a/common/version.tf b/common/version.tf index d09b354..100daf2 100644 --- a/common/version.tf +++ b/common/version.tf @@ -1,3 +1,3 @@ locals { - _module_version = "2.0" + _module_version = "2.0.1" } diff --git a/standard/README.md b/standard/README.md index 10391be..5536841 100644 --- a/standard/README.md +++ b/standard/README.md @@ -1,6 +1,6 @@ # About aws-s3 :: standard -This submodule allows you to create an S3 bucket using the standard prefixes and settings required for +This submodule allows you to create an S3 bucket using the standard prefixes and settings required for non-FTI Data. This includes - Server Access Logging @@ -27,49 +27,50 @@ No requirements. | Name | Version | |------|---------| -| aws | n/a | -| null | n/a | +| [aws](#provider\_aws) | n/a | +| [null](#provider\_null) | n/a | ## Modules -No Modules. +No modules. ## Resources -| Name | -|------| -| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | -| [aws_kms_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | -| [aws_kms_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | -| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | -| [aws_s3_bucket_object](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | -| [aws_s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | -| [aws_s3_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | -| [null_resource](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | +| Name | Type | +|------|------| +| [aws_kms_alias.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | +| [aws_kms_key.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | +| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_object.this_objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | resource | +| [aws_s3_bucket_policy.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | +| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [null_resource.policy_delay](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| access\_log\_bucket | Server Access Logging Bucket ID | `string` | n/a | yes | -| access\_log\_bucket\_prefix | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | -| allowed\_cidr | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | -| allowed\_endpoints | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | -| bucket\_folders | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | -| bucket\_name | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | -| data\_safeguards | Selected available safeguards which apply to the data in the bucket | `list(string)` | `[]` | no | -| enable\_title26 | Flag to enable bucket with Title 26 (FTI) settings | `bool` | `false` | no | -| force\_destroy | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | -| kms\_key\_id | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | -| metadata\_tags | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | -| tags | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | +| [access\_log\_bucket](#input\_access\_log\_bucket) | Server Access Logging Bucket ID | `string` | n/a | yes | +| [access\_log\_bucket\_prefix](#input\_access\_log\_bucket\_prefix) | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | +| [allowed\_cidr](#input\_allowed\_cidr) | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | +| [allowed\_endpoints](#input\_allowed\_endpoints) | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | +| [bucket\_folders](#input\_bucket\_folders) | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | +| [bucket\_name](#input\_bucket\_name) | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | +| [data\_safeguards](#input\_data\_safeguards) | Selected available safeguards which apply to the data in the bucket | `list(string)` | `[]` | no | +| [enable\_title26](#input\_enable\_title26) | Flag to enable bucket with Title 26 (FTI) settings | `bool` | `false` | no | +| [force\_destroy](#input\_force\_destroy) | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | +| [kms\_key\_id](#input\_kms\_key\_id) | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | +| [metadata\_tags](#input\_metadata\_tags) | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | +| [require\_explicit\_encryption](#input\_require\_explicit\_encryption) | When enabled, adds bucket policy to Deny unencrypted uploads and incorrect encryption header. Should not normally be needed. | `bool` | `false` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | ## Outputs | Name | Description | |------|-------------| -| kms\_key\_alias | Created KMS Key Alias name | -| kms\_key\_arn | Created KMS Key ARN | -| kms\_key\_id | Created KMS Key ID | -| s3\_bucket\_arn | Created S3 Bucket ARN | -| s3\_bucket\_id | Created S3 Bucket ID | +| [kms\_key\_alias](#output\_kms\_key\_alias) | Created KMS Key Alias name | +| [kms\_key\_arn](#output\_kms\_key\_arn) | Created KMS Key ARN | +| [kms\_key\_id](#output\_kms\_key\_id) | Created KMS Key ID | +| [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | Created S3 Bucket ARN | +| [s3\_bucket\_id](#output\_s3\_bucket\_id) | Created S3 Bucket ID | diff --git a/title26/README.md b/title26/README.md index f41a581..fbc2a0c 100644 --- a/title26/README.md +++ b/title26/README.md @@ -1,6 +1,6 @@ # About aws-s3 :: title26 -This submodule allows you to create an S3 bucket using the standard prefixes and settings required for +This submodule allows you to create an S3 bucket using the standard prefixes and settings required for FTI (Title26). This includes - Versioning (though the requirements are unclear on this, this may be removed) - Tag of boc:safeguade=title26 @@ -18,8 +18,8 @@ module "mybucket" { } ``` -This automatically enables the enable\_title26 flag, giving you a tag of `boc:safeguard=title26`. -It does all you to add other safeguards as necessary (title13, pii, etc), and these are joined together +This automatically enables the enable\_title26 flag, giving you a tag of `boc:safeguard=title26`. +It does all you to add other safeguards as necessary (title13, pii, etc), and these are joined together to make a comma separated list. This automaticaly creates an AWS KMS key used just for this bucket. @@ -32,49 +32,50 @@ No requirements. | Name | Version | |------|---------| -| aws | n/a | -| null | n/a | +| [aws](#provider\_aws) | n/a | +| [null](#provider\_null) | n/a | ## Modules -No Modules. +No modules. ## Resources -| Name | -|------| -| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | -| [aws_kms_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | -| [aws_kms_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | -| [aws_s3_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | -| [aws_s3_bucket_object](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | -| [aws_s3_bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | -| [aws_s3_bucket_public_access_block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | -| [null_resource](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | +| Name | Type | +|------|------| +| [aws_kms_alias.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | +| [aws_kms_key.key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | +| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_object.this_objects](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object) | resource | +| [aws_s3_bucket_policy.policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | +| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [null_resource.policy_delay](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | ## Inputs | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| access\_log\_bucket | Server Access Logging Bucket ID | `string` | n/a | yes | -| access\_log\_bucket\_prefix | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | -| allowed\_cidr | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | -| allowed\_endpoints | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | -| bucket\_folders | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | -| bucket\_name | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | -| data\_safeguards | Selected available safeguards which apply to the data in the bucket | `list(string)` | 
[
  "title26"
]
| no | -| enable\_title26 | Flag to enable bucket with Title 26 (FTI) settings | `bool` | `true` | no | -| force\_destroy | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | -| kms\_key\_id | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | -| metadata\_tags | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | -| tags | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | +| [access\_log\_bucket](#input\_access\_log\_bucket) | Server Access Logging Bucket ID | `string` | n/a | yes | +| [access\_log\_bucket\_prefix](#input\_access\_log\_bucket\_prefix) | Access log bucket prefix, to which the bucket name will be appended to make the target\_prefix | `string` | `"s3"` | no | +| [allowed\_cidr](#input\_allowed\_cidr) | List of allowed source IPs (NOT from within the VPC). If empty, there will be no restrictions on source IP. If provided, you must also use allowed\_endpoints for access within a VPC. | `list(string)` | `[]` | no | +| [allowed\_endpoints](#input\_allowed\_endpoints) | List of allowed VPC endpoint IDs. If used, it will enable access to the bucket from the specific VPC endpoints. | `list(string)` | `[]` | no | +| [bucket\_folders](#input\_bucket\_folders) | List of folders (keys) to create after creation of bucket. They will have object metadata provided based on metadata\_tags and data\_safeguard labels. | `list(string)` | `[]` | no | +| [bucket\_name](#input\_bucket\_name) | AWS Bucket Name. Standard prefix will be applied here, do not include here. | `string` | n/a | yes | +| [data\_safeguards](#input\_data\_safeguards) | Selected available safeguards which apply to the data in the bucket | `list(string)` | 
[
  "title26"
]
| no | +| [enable\_title26](#input\_enable\_title26) | Flag to enable bucket with Title 26 (FTI) settings | `bool` | `true` | no | +| [force\_destroy](#input\_force\_destroy) | Sets force\_destroy to allow the bucket and contents to be deleted. The deletion may take a very long time based on the number of objects. You normally want to update this to true, apply, and then destroy the resource. | `bool` | `false` | no | +| [kms\_key\_id](#input\_kms\_key\_id) | AWS KMS Key ID (one per bucket). This is currently ignored. | `string` | `""` | no | +| [metadata\_tags](#input\_metadata\_tags) | AWS S3 Custom metadata (prefix x-amzn-meta- automatically included, not needed here). If data\_safeguard labels are applied, they will be incorporated on any bucket objects created. | `map(string)` | `{}` | no | +| [require\_explicit\_encryption](#input\_require\_explicit\_encryption) | When enabled, adds bucket policy to Deny unencrypted uploads and incorrect encryption header. Should not normally be needed. | `bool` | `false` | no | +| [tags](#input\_tags) | AWS Tags to apply to appropriate resources (S3, KMS). Do not include safeguard tags here, use the data\_safeguard field for such things. | `map(string)` | `{}` | no | ## Outputs | Name | Description | |------|-------------| -| kms\_key\_alias | Created KMS Key Alias name | -| kms\_key\_arn | Created KMS Key ARN | -| kms\_key\_id | Created KMS Key ID | -| s3\_bucket\_arn | Created S3 Bucket ARN | -| s3\_bucket\_id | Created S3 Bucket ID | +| [kms\_key\_alias](#output\_kms\_key\_alias) | Created KMS Key Alias name | +| [kms\_key\_arn](#output\_kms\_key\_arn) | Created KMS Key ARN | +| [kms\_key\_id](#output\_kms\_key\_id) | Created KMS Key ID | +| [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | Created S3 Bucket ARN | +| [s3\_bucket\_id](#output\_s3\_bucket\_id) | Created S3 Bucket ID |