Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix bucket settings #130

Merged
merged 30 commits into from
Nov 11, 2023
Merged

Fix bucket settings #130

Show file tree
Hide file tree
Changes from 21 commits
Commits
Show all changes
30 commits
Select commit Hold shift + click to select a range
6f1bc20
Fix bucket ACL
max-lobur Nov 10, 2023
422ffd1
Fix bucket ACL
max-lobur Nov 10, 2023
f21c8b0
Fix bucket ACL
max-lobur Nov 10, 2023
561400d
Fix bucket ACL
max-lobur Nov 10, 2023
3cb922b
Fix bucket ACL
max-lobur Nov 10, 2023
c79aaeb
Fix bucket ACL
max-lobur Nov 10, 2023
1b27e1f
Fix bucket ACL
max-lobur Nov 10, 2023
b7b4b66
Fix bucket ACL
max-lobur Nov 10, 2023
6b34fed
Update main.tf
max-lobur Nov 10, 2023
c11ad9e
readme
max-lobur Nov 10, 2023
3144d1f
Fix bucket settings
max-lobur Nov 10, 2023
10bff00
Fix bucket settings
max-lobur Nov 10, 2023
9cf5c84
Fix bucket settings
max-lobur Nov 10, 2023
cad59d2
Fix bucket settings
max-lobur Nov 10, 2023
5b829a5
Fix bucket settings
max-lobur Nov 10, 2023
ad0ed17
Fix bucket settings
max-lobur Nov 10, 2023
aa60b45
Fix bucket settings
max-lobur Nov 10, 2023
e25fb1f
Fix bucket settings
max-lobur Nov 10, 2023
bd2d9c1
Fix bucket settings
max-lobur Nov 10, 2023
721c67f
Fix bucket settings
max-lobur Nov 10, 2023
1d60396
Fix bucket settings
max-lobur Nov 10, 2023
8485afe
Fix bucket settings
max-lobur Nov 10, 2023
1625e64
Fix bucket settings
max-lobur Nov 10, 2023
3e33348
Fix bucket settings
max-lobur Nov 10, 2023
1a1bd20
Fix bucket settings
max-lobur Nov 10, 2023
e414b70
Fix bucket settings
max-lobur Nov 10, 2023
95c8743
Fix bucket settings
max-lobur Nov 10, 2023
2f55988
Fix bucket settings
max-lobur Nov 10, 2023
b46ea9d
Fix bucket settings
max-lobur Nov 10, 2023
a692265
Fix bucket settings
max-lobur Nov 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,12 @@ Available targets:
| [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.default_cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_s3_bucket.cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
| [aws_s3_bucket_lifecycle_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
| [random_string.bucket_prefix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.combined_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
Expand Down
6 changes: 6 additions & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,12 @@
| [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_iam_role_policy_attachment.default_cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
| [aws_s3_bucket.cache_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_acl.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
| [aws_s3_bucket_lifecycle_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
| [aws_s3_bucket_logging.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
| [aws_s3_bucket_public_access_block.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_versioning.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
| [random_string.bucket_prefix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
| [aws_caller_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_iam_policy_document.combined_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
Expand Down
84 changes: 54 additions & 30 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,53 +2,77 @@ data "aws_caller_identity" "default" {}

data "aws_region" "default" {}

resource "aws_s3_bucket" "cache_bucket" {
#bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
#bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
#bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue in terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629).
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = local.cache_bucket_name_normalised
acl = "private"
force_destroy = true
tags = module.this.tags
resource "aws_s3_bucket_acl" "default" {
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
acl = "private"
}

versioning {
enabled = var.versioning_enabled
resource "aws_s3_bucket_versioning" "default" {
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)
versioning_configuration {
status = "Enabled"
}
}

dynamic "logging" {
for_each = var.access_log_bucket_name != "" ? [1] : []
content {
target_bucket = var.access_log_bucket_name
target_prefix = "logs/${module.this.id}/"
}
}
resource "aws_s3_bucket_lifecycle_configuration" "default" {
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)

lifecycle_rule {
rule {
id = "codebuildcache"
max-lobur marked this conversation as resolved.
Show resolved Hide resolved
max-lobur marked this conversation as resolved.
Show resolved Hide resolved
enabled = true
status = "Enabled"

prefix = "/"
tags = module.this.tags
filter {
prefix = "/"
}

expiration {
days = var.cache_expiration_days
}
}
}

dynamic "server_side_encryption_configuration" {
for_each = var.encryption_enabled ? ["true"] : []
resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)

content {
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}

resource "aws_s3_bucket_logging" "default" {
count = module.this.enabled && local.create_s3_cache_bucket && var.access_log_bucket_name != "" ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)

target_bucket = var.access_log_bucket_name
target_prefix = "logs/${module.this.id}/"
}

resource "aws_s3_bucket_public_access_block" "default" {
max-lobur marked this conversation as resolved.
Show resolved Hide resolved
max-lobur marked this conversation as resolved.
Show resolved Hide resolved
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = join("", resource.aws_s3_bucket.cache_bucket[*].id)

block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}

resource "aws_s3_bucket" "cache_bucket" {
max-lobur marked this conversation as resolved.
Show resolved Hide resolved
#bridgecrew:skip=BC_AWS_S3_13:Skipping `Enable S3 Bucket Logging` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
#bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
#bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue in terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629).
count = module.this.enabled && local.create_s3_cache_bucket ? 1 : 0
bucket = local.cache_bucket_name_normalised
force_destroy = true
tags = module.this.tags
}

resource "random_string" "bucket_prefix" {
count = module.this.enabled ? 1 : 0
length = 12
Expand Down
Loading