From bd6fe579ff9101e3155ce1981d8a946c52c4185b Mon Sep 17 00:00:00 2001 From: badra001 Date: Tue, 24 Jun 2025 13:39:27 -0400 Subject: [PATCH] add s3 block public access for account --- .../inf-infrastructure/files/INF.s3-default-settings.tf | 8 ++++++++ .../ansible/roles/inf-infrastructure/vars/main.yml | 1 + 2 files changed, 9 insertions(+) create mode 100644 local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf diff --git a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf new file mode 100644 index 00000000..6212371b --- /dev/null +++ b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf @@ -0,0 +1,8 @@ +# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_account_public_access_block + +resource "aws_s3_account_public_access_block" "defaults" { + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} diff --git a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml index 5480f530..4a6ef6c8 100644 --- a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml +++ b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml @@ -14,6 +14,7 @@ region_files: - INF.cloudtrail.tf - INF.dynamic-route53.tf - INF.ecs-default-settings.tf + - INF.s3-default-settings.tf - INF.preload-kms.tf - locals.tf - versions.tf