add s3 block public access for account

terraform · Jun 24, 2025 · bd6fe57 · bd6fe57
1 parent 30d978f
commit bd6fe57
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/...l-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf b/...l-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf
@@ -0,0 +1,8 @@
+# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_account_public_access_block
+
+resource "aws_s3_account_public_access_block" "defaults" {
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
diff --git a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml
@@ -14,6 +14,7 @@ region_files:
   - INF.cloudtrail.tf
   - INF.dynamic-route53.tf
   - INF.ecs-default-settings.tf
+  - INF.s3-default-settings.tf
   - INF.preload-kms.tf
   - locals.tf
   - versions.tf