-
Notifications
You must be signed in to change notification settings - Fork 0
/
s3-bucket-backup-reports.tf
51 lines (47 loc) · 1.42 KB
/
s3-bucket-backup-reports.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
locals {
bucket_name = "dfds-backup-reports"
lifecycle_configuration = [
{
id = "delete-after-90-days"
status = "Enabled"
expiration = {
days = 90
}
noncurrent_version_expiration = {
noncurrent_days = 90
}
}
]
}
module "reports_bucket" {
source = "git::https://github.com/dfds/aws-modules-s3.git?ref=v1.4.1"
bucket_name = local.bucket_name
bucket_versioning_configuration = "Enabled"
object_ownership = "BucketOwnerPreferred"
create_policy = true
create_logging_bucket = true
logging_bucket_name = "${local.bucket_name}-s3-logs"
source_policy_documents = [data.aws_iam_policy_document.bucket.json]
lifecycle_rules = local.lifecycle_configuration
logging_bucket_lifecycle_rules = local.lifecycle_configuration
}
resource "aws_iam_service_linked_role" "backup" {
aws_service_name = "reports.backup.amazonaws.com"
}
data "aws_iam_policy_document" "bucket" {
statement {
sid = "AllowPutObject"
effect = "Allow"
principals {
identifiers = [aws_iam_service_linked_role.backup.arn]
type = "AWS"
}
actions = ["s3:PutObject"]
resources = ["arn:aws:s3:::${local.bucket_name}/*"]
condition {
test = "StringEquals"
values = ["bucket-owner-full-control"]
variable = "s3:x-amz-acl"
}
}
}