From 93159b3845cad497e1bfeb7fa024c1d2688674ca Mon Sep 17 00:00:00 2001 From: lshindelman Date: Sun, 5 Oct 2025 18:48:39 +0300 Subject: [PATCH 1/6] compute the longest common prefix between two optional module --- .../terraform/graph_builder/local_graph.py | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/checkov/terraform/graph_builder/local_graph.py b/checkov/terraform/graph_builder/local_graph.py index 372d2a038c..7c7b90b545 100644 --- a/checkov/terraform/graph_builder/local_graph.py +++ b/checkov/terraform/graph_builder/local_graph.py @@ -612,10 +612,7 @@ def _find_vertex_with_best_match(self, relevant_vertices_indexes: List[int], ori if origin_vertex_index is not None: vertex_module_name = vertex.attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') origin_module_name = self.vertices[origin_vertex_index].attributes.get(CustomAttributes.TF_RESOURCE_ADDRESS, '') - if vertex_module_name.startswith(BlockType.MODULE) and origin_module_name.startswith(BlockType.MODULE): - split_module_name = vertex_module_name.split('.')[1] - if origin_module_name.startswith(f'{BlockType.MODULE}.{split_module_name}'): - common_prefix = f"{common_prefix} {BlockType.MODULE}.{split_module_name}" + common_prefix = self._get_common_prefix_name(origin_module_name, vertex_module_name, common_prefix) if len(common_prefix) > len(longest_common_prefix): vertex_index_with_longest_common_prefix = vertex_index @@ -633,6 +630,24 @@ def _find_vertex_with_best_match(self, relevant_vertices_indexes: List[int], ori vertex_index_with_longest_common_prefix) return vertex_index_with_longest_common_prefix + @staticmethod + def _get_common_prefix_name(origin_module_name: str, vertex_module_name: str, common_prefix: str) -> str: + if vertex_module_name.startswith(BlockType.MODULE) and origin_module_name.startswith(BlockType.MODULE): + origin_parts = origin_module_name.split('.') + vertex_parts = vertex_module_name.split('.') + + common_parts = [] + for o, v in zip(origin_parts, vertex_parts): + if o == v: + common_parts.append(o) + else: + break + + if common_parts: + common_prefix = f"{common_prefix} {'.'.join(common_parts)}" + + return common_prefix.strip() + def _find_best_match_based_on_foreach_key( self, origin_vertex_index: int, From 90897555db09d815c1c06b42681afe242fcb1a51 Mon Sep 17 00:00:00 2001 From: lshindelman Date: Sun, 5 Oct 2025 19:06:17 +0300 Subject: [PATCH 2/6] compute the longest common prefix between two optional module --- checkov/terraform/graph_builder/local_graph.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checkov/terraform/graph_builder/local_graph.py b/checkov/terraform/graph_builder/local_graph.py index 7c7b90b545..8906d954d6 100644 --- a/checkov/terraform/graph_builder/local_graph.py +++ b/checkov/terraform/graph_builder/local_graph.py @@ -637,7 +637,7 @@ def _get_common_prefix_name(origin_module_name: str, vertex_module_name: str, co vertex_parts = vertex_module_name.split('.') common_parts = [] - for o, v in zip(origin_parts, vertex_parts): + for o, v in zip(origin_parts, vertex_parts): # noqa: B905 if o == v: common_parts.append(o) else: From f459d057dc4c9ed7fa1b209fda6dd6c11656cfb3 Mon Sep 17 00:00:00 2001 From: lshindelman Date: Wed, 8 Oct 2025 16:41:06 +0300 Subject: [PATCH 3/6] add test to _get_common_prefix_name --- .../graph/graph_builder/test_graph_builder.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/terraform/graph/graph_builder/test_graph_builder.py b/tests/terraform/graph/graph_builder/test_graph_builder.py index 882ae9208d..52ed445149 100644 --- a/tests/terraform/graph/graph_builder/test_graph_builder.py +++ b/tests/terraform/graph/graph_builder/test_graph_builder.py @@ -6,6 +6,7 @@ from checkov.common.graph.db_connectors.rustworkx.rustworkx_db_connector import RustworkxConnector from checkov.terraform.graph_builder.graph_components.block_types import BlockType from checkov.terraform.graph_builder.graph_to_tf_definitions import convert_graph_vertices_to_tf_definitions +from checkov.terraform.graph_builder.local_graph import TerraformLocalGraph from checkov.terraform.graph_manager import TerraformGraphManager from checkov.common.graph.graph_builder import CustomAttributes from checkov.terraform.modules.module_utils import external_modules_download_path @@ -381,6 +382,20 @@ def test_multiple_modules_with_connected_resources(self): tf_plan_local_graph = graph_manager.build_graph_from_definitions(definitions, render_variables=False) self.assertTrue(tf_plan_local_graph.in_edges[3]) + def test_best_match_multiple_modules_with_connected_resources(self): + valid_plan_path = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules_edges_tfplan/tfplan.json')) + definitions, definitions_raw = create_definitions(root_folder=None, files=[valid_plan_path]) + graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) + tf_plan_local_graph = graph_manager.build_graph_from_definitions(definitions, render_variables=False) + origin_module_name = 'module.test.test.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]' + vertex_module_name_1 = 'module.test.test.s3-bucket-1.aws_s3_bucket.this[0]' + vertex_module_name_2 = 'module.test.s3-bucket-2.aws_s3_bucket.this[0]' + origin_path = 'modules_edges_tfplan/tfplan.json' + common_prefix_1 = tf_plan_local_graph._get_common_prefix_name(origin_module_name, vertex_module_name_1, origin_path) + common_prefix_2 = tf_plan_local_graph._get_common_prefix_name(origin_module_name, vertex_module_name_2, origin_path) + assert(common_prefix_1 == 'modules_edges_tfplan/tfplan.json module.test.test.s3-bucket-1') + assert(common_prefix_2 == 'modules_edges_tfplan/tfplan.json module.test') + def build_new_key_for_tf_definition(key): key = key.tf_source_modules From f8cbdc3fef1f0b6ff9a6f1c053686575e54d7b82 Mon Sep 17 00:00:00 2001 From: lshindelman Date: Wed, 8 Oct 2025 18:03:17 +0300 Subject: [PATCH 4/6] edit tfplan to have nested_module --- .../modules_edges_tfplan/tfplan.json | 7949 +++++++++-------- 1 file changed, 3984 insertions(+), 3965 deletions(-) diff --git a/tests/terraform/graph/resources/modules_edges_tfplan/tfplan.json b/tests/terraform/graph/resources/modules_edges_tfplan/tfplan.json index 4db9d4c8a9..d5f5be04f1 100644 --- a/tests/terraform/graph/resources/modules_edges_tfplan/tfplan.json +++ b/tests/terraform/graph/resources/modules_edges_tfplan/tfplan.json @@ -1,156 +1,29 @@ { - "format_version": "0.2", - "terraform_version": "1.0.7", - "planned_values": { - "root_module": { - "child_modules": [ - { - "resources": [ - { - "address": "module.s3-bucket-1.aws_s3_bucket.this[0]", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "force_destroy": false, - "object_lock_enabled": false, - "tags": null, - "timeouts": null - }, - "sensitive_values": { - "cors_rule": [], - "grant": [], - "lifecycle_rule": [], - "logging": [], - "object_lock_configuration": [], - "replication_configuration": [], - "server_side_encryption_configuration": [], - "tags_all": {}, - "versioning": [], - "website": [] - } - }, - { - "address": "module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "block_public_acls": true, - "block_public_policy": true, - "ignore_public_acls": true, - "restrict_public_buckets": true - }, - "sensitive_values": {} - } - ], - "address": "module.s3-bucket-1" - }, - { - "resources": [ - { - "address": "module.s3-bucket-2.aws_s3_bucket.this[0]", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "force_destroy": false, - "object_lock_enabled": false, - "tags": null, - "timeouts": null - }, - "sensitive_values": { - "cors_rule": [], - "grant": [], - "lifecycle_rule": [], - "logging": [], - "object_lock_configuration": [], - "replication_configuration": [], - "server_side_encryption_configuration": [], - "tags_all": {}, - "versioning": [], - "website": [] - } - }, - { - "address": "module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "block_public_acls": true, - "block_public_policy": true, - "ignore_public_acls": true, - "restrict_public_buckets": true - }, - "sensitive_values": {} - } - ], - "address": "module.s3-bucket-2" - } - ] - } - }, - "resource_changes": [ + "format_version": "0.2", + "terraform_version": "1.0.7", + "planned_values": { + "root_module": { + "child_modules": [ { - "address": "module.s3-bucket-1.aws_s3_bucket.this[0]", - "module_address": "module.s3-bucket-1", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "change": { - "actions": [ - "create" - ], - "before": null, - "after": { + "address": "module.test", + "child_modules": [ + { + "resources": [ + { + "address": "module.test.module.s3-bucket-1.aws_s3_bucket.this[0]", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null - }, - "after_unknown": { - "acceleration_status": true, - "acl": true, - "arn": true, - "bucket": true, - "bucket_domain_name": true, - "bucket_prefix": true, - "bucket_regional_domain_name": true, - "cors_rule": true, - "grant": true, - "hosted_zone_id": true, - "id": true, - "lifecycle_rule": true, - "logging": true, - "object_lock_configuration": true, - "policy": true, - "region": true, - "replication_configuration": true, - "request_payer": true, - "server_side_encryption_configuration": true, - "tags_all": true, - "versioning": true, - "website": true, - "website_domain": true, - "website_endpoint": true - }, - "before_sensitive": false, - "after_sensitive": { + }, + "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], @@ -161,83 +34,44 @@ "tags_all": {}, "versioning": [], "website": [] - } - } - }, - { - "address": "module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", - "module_address": "module.s3-bucket-1", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "change": { - "actions": [ - "create" - ], - "before": null, - "after": { + } + }, + { + "address": "module.test.module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true - }, - "after_unknown": { - "bucket": true, - "id": true - }, - "before_sensitive": false, - "after_sensitive": {} - } - }, - { - "address": "module.s3-bucket-2.aws_s3_bucket.this[0]", - "module_address": "module.s3-bucket-2", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "change": { - "actions": [ - "create" - ], - "before": null, - "after": { + }, + "sensitive_values": {} + } + ], + "address": "module.test.module.s3-bucket-1" + }, + { + "resources": [ + { + "address": "module.test.module.s3-bucket-2.aws_s3_bucket.this[0]", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { "force_destroy": false, "object_lock_enabled": false, "tags": null, "timeouts": null - }, - "after_unknown": { - "acceleration_status": true, - "acl": true, - "arn": true, - "bucket": true, - "bucket_domain_name": true, - "bucket_prefix": true, - "bucket_regional_domain_name": true, - "cors_rule": true, - "grant": true, - "hosted_zone_id": true, - "id": true, - "lifecycle_rule": true, - "logging": true, - "object_lock_configuration": true, - "policy": true, - "region": true, - "replication_configuration": true, - "request_payer": true, - "server_side_encryption_configuration": true, - "tags_all": true, - "versioning": true, - "website": true, - "website_domain": true, - "website_endpoint": true - }, - "before_sensitive": false, - "after_sensitive": { + }, + "sensitive_values": { "cors_rule": [], "grant": [], "lifecycle_rule": [], @@ -248,3876 +82,4061 @@ "tags_all": {}, "versioning": [], "website": [] - } - } - }, - { - "address": "module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", - "module_address": "module.s3-bucket-2", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "index": 0, - "provider_name": "registry.terraform.io/hashicorp/aws", - "change": { - "actions": [ - "create" - ], - "before": null, - "after": { + } + }, + { + "address": "module.test.module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { "block_public_acls": true, "block_public_policy": true, "ignore_public_acls": true, "restrict_public_buckets": true - }, - "after_unknown": { - "bucket": true, - "id": true - }, - "before_sensitive": false, - "after_sensitive": {} + }, + "sensitive_values": {} + } + ], + "address": "module.test.module.s3-bucket-2" } + ] + } + ] + } + }, + "resource_changes": [ + { + "address": "module.test.module.s3-bucket-1.aws_s3_bucket.this[0]", + "module_address": "module.test.module.s3-bucket-1", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "change": { + "actions": [ + "create" + ], + "before": null, + "after": { + "force_destroy": false, + "object_lock_enabled": false, + "tags": null, + "timeouts": null + }, + "after_unknown": { + "acceleration_status": true, + "acl": true, + "arn": true, + "bucket": true, + "bucket_domain_name": true, + "bucket_prefix": true, + "bucket_regional_domain_name": true, + "cors_rule": true, + "grant": true, + "hosted_zone_id": true, + "id": true, + "lifecycle_rule": true, + "logging": true, + "object_lock_configuration": true, + "policy": true, + "region": true, + "replication_configuration": true, + "request_payer": true, + "server_side_encryption_configuration": true, + "tags_all": true, + "versioning": true, + "website": true, + "website_domain": true, + "website_endpoint": true + }, + "before_sensitive": false, + "after_sensitive": { + "cors_rule": [], + "grant": [], + "lifecycle_rule": [], + "logging": [], + "object_lock_configuration": [], + "replication_configuration": [], + "server_side_encryption_configuration": [], + "tags_all": {}, + "versioning": [], + "website": [] + } + } + }, + { + "address": "module.test.module.s3-bucket-1.aws_s3_bucket_public_access_block.this[0]", + "module_address": "module.test.module.s3-bucket-1", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "change": { + "actions": [ + "create" + ], + "before": null, + "after": { + "block_public_acls": true, + "block_public_policy": true, + "ignore_public_acls": true, + "restrict_public_buckets": true + }, + "after_unknown": { + "bucket": true, + "id": true + }, + "before_sensitive": false, + "after_sensitive": {} + } + }, + { + "address": "module.test.module.s3-bucket-2.aws_s3_bucket.this[0]", + "module_address": "module.test.module.s3-bucket-2", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "change": { + "actions": [ + "create" + ], + "before": null, + "after": { + "force_destroy": false, + "object_lock_enabled": false, + "tags": null, + "timeouts": null + }, + "after_unknown": { + "acceleration_status": true, + "acl": true, + "arn": true, + "bucket": true, + "bucket_domain_name": true, + "bucket_prefix": true, + "bucket_regional_domain_name": true, + "cors_rule": true, + "grant": true, + "hosted_zone_id": true, + "id": true, + "lifecycle_rule": true, + "logging": true, + "object_lock_configuration": true, + "policy": true, + "region": true, + "replication_configuration": true, + "request_payer": true, + "server_side_encryption_configuration": true, + "tags_all": true, + "versioning": true, + "website": true, + "website_domain": true, + "website_endpoint": true + }, + "before_sensitive": false, + "after_sensitive": { + "cors_rule": [], + "grant": [], + "lifecycle_rule": [], + "logging": [], + "object_lock_configuration": [], + "replication_configuration": [], + "server_side_encryption_configuration": [], + "tags_all": {}, + "versioning": [], + "website": [] + } + } + }, + { + "address": "module.test.module.s3-bucket-2.aws_s3_bucket_public_access_block.this[0]", + "module_address": "module.test.module.s3-bucket-2", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "index": 0, + "provider_name": "registry.terraform.io/hashicorp/aws", + "change": { + "actions": [ + "create" + ], + "before": null, + "after": { + "block_public_acls": true, + "block_public_policy": true, + "ignore_public_acls": true, + "restrict_public_buckets": true + }, + "after_unknown": { + "bucket": true, + "id": true + }, + "before_sensitive": false, + "after_sensitive": {} + } + } + ], + "prior_state": { + "format_version": "0.2", + "terraform_version": "1.0.7", + "values": { + "root_module": { + "child_modules": [ + { + "address": "module.test", + "child_modules": [ + { + "resources": [ + { + "address": "module.test.module.s3-bucket-1.data.aws_caller_identity.current", + "mode": "data", + "type": "aws_caller_identity", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "account_id": "101860328116", + "arn": "arn:aws:iam::101860328116:user/atlantis", + "id": "101860328116", + "user_id": "AIDARPN2ZIK2PHMJSNYXG" + }, + "sensitive_values": {} + }, + { + "address": "module.test.module.s3-bucket-1.data.aws_partition.current", + "mode": "data", + "type": "aws_partition", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "dns_suffix": "amazonaws.com", + "id": "aws", + "partition": "aws", + "reverse_dns_prefix": "com.amazonaws" + }, + "sensitive_values": {} + }, + { + "address": "module.test.module.s3-bucket-1.data.aws_region.current", + "mode": "data", + "type": "aws_region", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "description": "Europe (Frankfurt)", + "endpoint": "ec2.eu-central-1.amazonaws.com", + "id": "eu-central-1", + "name": "eu-central-1" + }, + "sensitive_values": {} + } + ], + "address": "module.test.module.s3-bucket-1" + }, + { + "resources": [ + { + "address": "module.test.module.s3-bucket-2.data.aws_caller_identity.current", + "mode": "data", + "type": "aws_caller_identity", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "account_id": "101860328116", + "arn": "arn:aws:iam::101860328116:user/atlantis", + "id": "101860328116", + "user_id": "AIDARPN2ZIK2PHMJSNYXG" + }, + "sensitive_values": {} + }, + { + "address": "module.test.module.s3-bucket-2.data.aws_partition.current", + "mode": "data", + "type": "aws_partition", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "dns_suffix": "amazonaws.com", + "id": "aws", + "partition": "aws", + "reverse_dns_prefix": "com.amazonaws" + }, + "sensitive_values": {} + }, + { + "address": "module.test.module.s3-bucket-2.data.aws_region.current", + "mode": "data", + "type": "aws_region", + "name": "current", + "provider_name": "registry.terraform.io/hashicorp/aws", + "schema_version": 0, + "values": { + "description": "Europe (Frankfurt)", + "endpoint": "ec2.eu-central-1.amazonaws.com", + "id": "eu-central-1", + "name": "eu-central-1" + }, + "sensitive_values": {} + } + ], + "address": "module.test.module.s3-bucket-2" + } + ] + } + ] + } + } + }, + "configuration": { + "provider_config": { + "aws": { + "name": "aws", + "expressions": { + "profile": { + "constant_value": "razorpay-stage" + }, + "region": { + "constant_value": "eu-central-1" + } } - ], - "prior_state": { - "format_version": "0.2", - "terraform_version": "1.0.7", - "values": { - "root_module": { - "child_modules": [ + }, + "module.s3-bucket-1:aws": { + "name": "aws", + "version_constraint": ">= 5.27.0", + "module_address": "module.s3-bucket-1" + }, + "module.s3-bucket-2:aws": { + "name": "aws", + "version_constraint": ">= 5.27.0", + "module_address": "module.s3-bucket-2" + } + }, + "root_module": { + "module_calls": { + "test": { + "source": "./modules/test", + "module": { + "module_calls": { + "s3-bucket-1": { + "source": "terraform-aws-modules/s3-bucket/aws", + "module": { + "outputs": { + "s3_bucket_arn": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." + }, + "s3_bucket_bucket_domain_name": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].bucket_domain_name", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." + }, + "s3_bucket_bucket_regional_domain_name": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].bucket_regional_domain_name", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." + }, + "s3_bucket_hosted_zone_id": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].hosted_zone_id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The Route 53 Hosted Zone ID for this bucket's region." + }, + "s3_bucket_id": { + "expression": { + "references": [ + "aws_s3_bucket_policy.this[0].id", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The name of the bucket." + }, + "s3_bucket_lifecycle_configuration_rules": { + "expression": { + "references": [ + "aws_s3_bucket_lifecycle_configuration.this[0].rule", + "aws_s3_bucket_lifecycle_configuration.this[0]", + "aws_s3_bucket_lifecycle_configuration.this" + ] + }, + "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." + }, + "s3_bucket_policy": { + "expression": { + "references": [ + "aws_s3_bucket_policy.this[0].policy", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this" + ] + }, + "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." + }, + "s3_bucket_region": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].region", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The AWS region this bucket resides in." + }, + "s3_bucket_website_domain": { + "expression": { + "references": [ + "aws_s3_bucket_website_configuration.this[0].website_domain", + "aws_s3_bucket_website_configuration.this[0]", + "aws_s3_bucket_website_configuration.this" + ] + }, + "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." + }, + "s3_bucket_website_endpoint": { + "expression": { + "references": [ + "aws_s3_bucket_website_configuration.this[0].website_endpoint", + "aws_s3_bucket_website_configuration.this[0]", + "aws_s3_bucket_website_configuration.this" + ] + }, + "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." + } + }, + "resources": [ { - "resources": [ - { - "address": "module.s3-bucket-1.data.aws_caller_identity.current", - "mode": "data", - "type": "aws_caller_identity", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "account_id": "101860328116", - "arn": "arn:aws:iam::101860328116:user/atlantis", - "id": "101860328116", - "user_id": "AIDARPN2ZIK2PHMJSNYXG" + "address": "aws_s3_bucket.this", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "var.bucket" + ] + }, + "bucket_prefix": { + "references": [ + "var.bucket_prefix" + ] + }, + "force_destroy": { + "references": [ + "var.force_destroy" + ] + }, + "object_lock_enabled": { + "references": [ + "var.object_lock_enabled" + ] + }, + "tags": { + "references": [ + "var.tags" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_accelerate_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_accelerate_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "status": { + "references": [ + "var.acceleration_status" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.acceleration_status" + ] + } + }, + { + "address": "aws_s3_bucket_acl.this", + "mode": "managed", + "type": "aws_s3_bucket_acl", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "acl": { + "references": [ + "var.acl", + "var.acl" + ] + }, + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.create_bucket_acl" + ] + }, + "depends_on": [ + "aws_s3_bucket_ownership_controls.this" + ] + }, + { + "address": "aws_s3_bucket_analytics_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_analytics_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.key" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "var.analytics_configuration", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_cors_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_cors_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.cors_rules" + ] + } + }, + { + "address": "aws_s3_bucket_intelligent_tiering_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_intelligent_tiering_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.key" + ] + }, + "status": { + "references": [ + "each.value.status", + "each.value", + "each.value.status", + "each.value" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "local.intelligent_tiering", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_inventory.this", + "mode": "managed", + "type": "aws_s3_bucket_inventory", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "each.value.bucket", + "each.value", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "destination": [ + { + "bucket": [ + { + "account_id": { + "references": [ + "each.value.destination.account_id", + "each.value.destination", + "each.value" + ] }, - "sensitive_values": {} - }, - { - "address": "module.s3-bucket-1.data.aws_partition.current", - "mode": "data", - "type": "aws_partition", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "dns_suffix": "amazonaws.com", - "id": "aws", - "partition": "aws", - "reverse_dns_prefix": "com.amazonaws" + "bucket_arn": { + "references": [ + "each.value.destination.bucket_arn", + "each.value.destination", + "each.value", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] }, - "sensitive_values": {} - }, - { - "address": "module.s3-bucket-1.data.aws_region.current", - "mode": "data", - "type": "aws_region", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "description": "Europe (Frankfurt)", - "endpoint": "ec2.eu-central-1.amazonaws.com", - "id": "eu-central-1", - "name": "eu-central-1" + "format": { + "references": [ + "each.value.destination.format", + "each.value.destination", + "each.value" + ] }, - "sensitive_values": {} - } + "prefix": { + "references": [ + "each.value.destination.prefix", + "each.value.destination", + "each.value" + ] + } + } + ] + } ], - "address": "module.s3-bucket-1" + "enabled": { + "references": [ + "each.value.enabled", + "each.value" + ] + }, + "included_object_versions": { + "references": [ + "each.value.included_object_versions", + "each.value" + ] + }, + "name": { + "references": [ + "each.key" + ] + }, + "optional_fields": { + "references": [ + "each.value.optional_fields", + "each.value" + ] + }, + "schedule": [ + { + "frequency": { + "references": [ + "each.value.frequency", + "each.value" + ] + } + } + ] + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "var.inventory_configuration", + "local.create_bucket" + ] + } }, { - "resources": [ - { - "address": "module.s3-bucket-2.data.aws_caller_identity.current", - "mode": "data", - "type": "aws_caller_identity", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "account_id": "101860328116", - "arn": "arn:aws:iam::101860328116:user/atlantis", - "id": "101860328116", - "user_id": "AIDARPN2ZIK2PHMJSNYXG" + "address": "aws_s3_bucket_lifecycle_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_lifecycle_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.lifecycle_rules" + ] + }, + "depends_on": [ + "aws_s3_bucket_versioning.this" + ] + }, + { + "address": "aws_s3_bucket_logging.this", + "mode": "managed", + "type": "aws_s3_bucket_logging", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "target_bucket": { + "references": [ + "var.logging[\"target_bucket\"]", + "var.logging" + ] + }, + "target_prefix": { + "references": [ + "var.logging[\"target_prefix\"]", + "var.logging" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.logging" + ] + } + }, + { + "address": "aws_s3_bucket_metric.this", + "mode": "managed", + "type": "aws_s3_bucket_metric", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.value.name", + "each.value" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "local.metric_configuration", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_object_lock_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_object_lock_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "rule": [ + { + "default_retention": [ + { + "days": { + "references": [ + "var.object_lock_configuration.rule.default_retention.days", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] }, - "sensitive_values": {} - }, - { - "address": "module.s3-bucket-2.data.aws_partition.current", - "mode": "data", - "type": "aws_partition", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "dns_suffix": "amazonaws.com", - "id": "aws", - "partition": "aws", - "reverse_dns_prefix": "com.amazonaws" + "mode": { + "references": [ + "var.object_lock_configuration.rule.default_retention.mode", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] }, - "sensitive_values": {} - }, - { - "address": "module.s3-bucket-2.data.aws_region.current", - "mode": "data", - "type": "aws_region", - "name": "current", - "provider_name": "registry.terraform.io/hashicorp/aws", - "schema_version": 0, - "values": { - "description": "Europe (Frankfurt)", - "endpoint": "ec2.eu-central-1.amazonaws.com", - "id": "eu-central-1", - "name": "eu-central-1" + "years": { + "references": [ + "var.object_lock_configuration.rule.default_retention.years", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] + } + } + ] + } + ], + "token": { + "references": [ + "var.object_lock_configuration.token", + "var.object_lock_configuration" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.object_lock_enabled", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] + } + }, + { + "address": "aws_s3_bucket_ownership_controls.this", + "mode": "managed", + "type": "aws_s3_bucket_ownership_controls", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "local.attach_policy", + "aws_s3_bucket_policy.this[0].id", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "rule": [ + { + "object_ownership": { + "references": [ + "var.object_ownership" + ] + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.control_object_ownership" + ] + }, + "depends_on": [ + "aws_s3_bucket_policy.this", + "aws_s3_bucket_public_access_block.this", + "aws_s3_bucket.this" + ] + }, + { + "address": "aws_s3_bucket_policy.this", + "mode": "managed", + "type": "aws_s3_bucket_policy", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "policy": { + "references": [ + "data.aws_iam_policy_document.combined[0].json", + "data.aws_iam_policy_document.combined[0]", + "data.aws_iam_policy_document.combined" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.attach_policy" + ] + }, + "depends_on": [ + "aws_s3_bucket_public_access_block.this" + ] + }, + { + "address": "aws_s3_bucket_public_access_block.this", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "block_public_acls": { + "references": [ + "var.block_public_acls" + ] + }, + "block_public_policy": { + "references": [ + "var.block_public_policy" + ] + }, + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "ignore_public_acls": { + "references": [ + "var.ignore_public_acls" + ] + }, + "restrict_public_buckets": { + "references": [ + "var.restrict_public_buckets" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_public_policy" + ] + } + }, + { + "address": "aws_s3_bucket_replication_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_replication_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "role": { + "references": [ + "var.replication_configuration[\"role\"]", + "var.replication_configuration" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.replication_configuration" + ] + }, + "depends_on": [ + "aws_s3_bucket_versioning.this" + ] + }, + { + "address": "aws_s3_bucket_request_payment_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_request_payment_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "payer": { + "references": [ + "var.request_payer" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.request_payer" + ] + } + }, + { + "address": "aws_s3_bucket_server_side_encryption_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_server_side_encryption_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.server_side_encryption_configuration" + ] + } + }, + { + "address": "aws_s3_bucket_versioning.this", + "mode": "managed", + "type": "aws_s3_bucket_versioning", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "mfa": { + "references": [ + "var.versioning[\"mfa\"]", + "var.versioning" + ] + }, + "versioning_configuration": [ + { + "mfa_delete": { + "references": [ + "var.versioning[\"mfa_delete\"]", + "var.versioning", + "var.versioning[\"mfa_delete\"]", + "var.versioning" + ] + }, + "status": { + "references": [ + "var.versioning[\"enabled\"]", + "var.versioning", + "var.versioning[\"status\"]", + "var.versioning", + "var.versioning[\"status\"]", + "var.versioning" + ] + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.versioning" + ] + } + }, + { + "address": "aws_s3_bucket_website_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_website_configuration", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.website" + ] + } + }, + { + "address": "data.aws_caller_identity.current", + "mode": "data", + "type": "aws_caller_identity", + "name": "current", + "provider_config_key": "s3-bucket-1:aws", + "schema_version": 0 + }, + { + "address": "data.aws_canonical_user_id.this", + "mode": "data", + "type": "aws_canonical_user_id", + "name": "this", + "provider_config_key": "s3-bucket-1:aws", + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.create_bucket_acl", + "var.owner[\"id\"]", + "var.owner" + ] + } + }, + { + "address": "data.aws_iam_policy_document.access_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "access_log_delivery", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logging.s3.amazonaws.com" + ] }, - "sensitive_values": {} + "type": { + "constant_value": "Service" + } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSAccessLogDeliveryWrite" } - ], - "address": "module.s3-bucket-2" - } - ] - } - } - }, - "configuration": { - "provider_config": { - "aws": { - "name": "aws", - "expressions": { - "profile": { - "constant_value": "razorpay-stage" - }, - "region": { - "constant_value": "eu-central-1" - } - } - }, - "module.s3-bucket-1:aws": { - "name": "aws", - "version_constraint": ">= 5.27.0", - "module_address": "module.s3-bucket-1" - }, - "module.s3-bucket-2:aws": { - "name": "aws", - "version_constraint": ">= 5.27.0", - "module_address": "module.s3-bucket-2" - } - }, - "root_module": { - "module_calls": { - "s3-bucket-1": { - "source": "terraform-aws-modules/s3-bucket/aws", - "module": { - "outputs": { - "s3_bucket_arn": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + }, + { + "actions": { + "constant_value": [ + "s3:GetBucketAcl" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logging.s3.amazonaws.com" + ] }, - "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." - }, - "s3_bucket_bucket_domain_name": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].bucket_domain_name", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + "type": { + "constant_value": "Service" + } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSAccessLogDeliveryAclCheck" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_access_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.combined", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "combined", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "source_policy_documents": { + "references": [ + "var.attach_elb_log_delivery_policy", + "data.aws_iam_policy_document.elb_log_delivery[0].json", + "data.aws_iam_policy_document.elb_log_delivery[0]", + "data.aws_iam_policy_document.elb_log_delivery", + "var.attach_lb_log_delivery_policy", + "data.aws_iam_policy_document.lb_log_delivery[0].json", + "data.aws_iam_policy_document.lb_log_delivery[0]", + "data.aws_iam_policy_document.lb_log_delivery", + "var.attach_access_log_delivery_policy", + "data.aws_iam_policy_document.access_log_delivery[0].json", + "data.aws_iam_policy_document.access_log_delivery[0]", + "data.aws_iam_policy_document.access_log_delivery", + "var.attach_require_latest_tls_policy", + "data.aws_iam_policy_document.require_latest_tls[0].json", + "data.aws_iam_policy_document.require_latest_tls[0]", + "data.aws_iam_policy_document.require_latest_tls", + "var.attach_deny_insecure_transport_policy", + "data.aws_iam_policy_document.deny_insecure_transport[0].json", + "data.aws_iam_policy_document.deny_insecure_transport[0]", + "data.aws_iam_policy_document.deny_insecure_transport", + "var.attach_deny_unencrypted_object_uploads", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads", + "var.attach_deny_incorrect_kms_key_sse", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", + "var.attach_deny_incorrect_encryption_headers", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers", + "var.attach_inventory_destination_policy", + "var.attach_analytics_destination_policy", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", + "var.attach_policy", + "var.policy" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.attach_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_incorrect_encryption_headers", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringNotEquals" }, - "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." - }, - "s3_bucket_bucket_regional_domain_name": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].bucket_regional_domain_name", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + "values": { + "references": [ + "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", + "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", + "var.server_side_encryption_configuration.rule", + "var.server_side_encryption_configuration" + ] }, - "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." - }, - "s3_bucket_hosted_zone_id": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].hosted_zone_id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption" + } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "description": "The Route 53 Hosted Zone ID for this bucket's region." - }, - "s3_bucket_id": { - "expression": { - "references": [ - "aws_s3_bucket_policy.this[0].id", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + "type": { + "constant_value": "*" + } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyIncorrectEncryptionHeaders" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_incorrect_encryption_headers" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_incorrect_kms_key_sse", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringNotEquals" }, - "description": "The name of the bucket." - }, - "s3_bucket_lifecycle_configuration_rules": { - "expression": { - "references": [ - "aws_s3_bucket_lifecycle_configuration.this[0].rule", - "aws_s3_bucket_lifecycle_configuration.this[0]", - "aws_s3_bucket_lifecycle_configuration.this" - ] + "values": { + "references": [ + "var.allowed_kms_key_arn" + ] }, - "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." - }, - "s3_bucket_policy": { - "expression": { - "references": [ - "aws_s3_bucket_policy.this[0].policy", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" + } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." - }, - "s3_bucket_region": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].region", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] + "type": { + "constant_value": "*" + } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyIncorrectKmsKeySse" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_incorrect_kms_key_sse" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_insecure_transport", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_insecure_transport", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:*" + ] + }, + "condition": [ + { + "test": { + "constant_value": "Bool" }, - "description": "The AWS region this bucket resides in." - }, - "s3_bucket_website_domain": { - "expression": { - "references": [ - "aws_s3_bucket_website_configuration.this[0].website_domain", - "aws_s3_bucket_website_configuration.this[0]", - "aws_s3_bucket_website_configuration.this" - ] + "values": { + "constant_value": [ + "false" + ] }, - "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." - }, - "s3_bucket_website_endpoint": { - "expression": { - "references": [ - "aws_s3_bucket_website_configuration.this[0].website_endpoint", - "aws_s3_bucket_website_configuration.this[0]", - "aws_s3_bucket_website_configuration.this" - ] + "variable": { + "constant_value": "aws:SecureTransport" + } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." + "type": { + "constant_value": "*" + } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyInsecureTransport" } - }, - "resources": [ - { - "address": "aws_s3_bucket.this", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "var.bucket" - ] - }, - "bucket_prefix": { - "references": [ - "var.bucket_prefix" - ] - }, - "force_destroy": { - "references": [ - "var.force_destroy" - ] - }, - "object_lock_enabled": { - "references": [ - "var.object_lock_enabled" - ] - }, - "tags": { - "references": [ - "var.tags" - ] - } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_insecure_transport_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_unencrypted_object_uploads", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "Null" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_accelerate_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_accelerate_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "status": { - "references": [ - "var.acceleration_status" - ] - } + "values": { + "constant_value": [ + true + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.acceleration_status" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption" } - }, - { - "address": "aws_s3_bucket_acl.this", - "mode": "managed", - "type": "aws_s3_bucket_acl", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "acl": { - "references": [ - "var.acl", - "var.acl" - ] - }, - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.create_bucket_acl" - ] - }, - "depends_on": [ - "aws_s3_bucket_ownership_controls.this" - ] - }, - { - "address": "aws_s3_bucket_analytics_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_analytics_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.key" - ] - } - }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "var.analytics_configuration", - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_cors_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_cors_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.cors_rules" - ] - } - }, - { - "address": "aws_s3_bucket_intelligent_tiering_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_intelligent_tiering_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.key" - ] - }, - "status": { - "references": [ - "each.value.status", - "each.value", - "each.value.status", - "each.value" - ] - } - }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "local.intelligent_tiering", - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_inventory.this", - "mode": "managed", - "type": "aws_s3_bucket_inventory", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "each.value.bucket", - "each.value", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "destination": [ - { - "bucket": [ - { - "account_id": { - "references": [ - "each.value.destination.account_id", - "each.value.destination", - "each.value" - ] - }, - "bucket_arn": { - "references": [ - "each.value.destination.bucket_arn", - "each.value.destination", - "each.value", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "format": { - "references": [ - "each.value.destination.format", - "each.value.destination", - "each.value" - ] - }, - "prefix": { - "references": [ - "each.value.destination.prefix", - "each.value.destination", - "each.value" - ] - } - } - ] - } - ], - "enabled": { - "references": [ - "each.value.enabled", - "each.value" - ] - }, - "included_object_versions": { - "references": [ - "each.value.included_object_versions", - "each.value" - ] - }, - "name": { - "references": [ - "each.key" - ] - }, - "optional_fields": { - "references": [ - "each.value.optional_fields", - "each.value" - ] - }, - "schedule": [ - { - "frequency": { - "references": [ - "each.value.frequency", - "each.value" - ] - } - } - ] - }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "var.inventory_configuration", - "local.create_bucket" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "aws_s3_bucket_lifecycle_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_lifecycle_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.lifecycle_rules" - ] - }, - "depends_on": [ - "aws_s3_bucket_versioning.this" - ] - }, - { - "address": "aws_s3_bucket_logging.this", - "mode": "managed", - "type": "aws_s3_bucket_logging", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "target_bucket": { - "references": [ - "var.logging[\"target_bucket\"]", - "var.logging" - ] - }, - "target_prefix": { - "references": [ - "var.logging[\"target_prefix\"]", - "var.logging" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyUnencryptedObjectUploads" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_unencrypted_object_uploads" + ] + } + }, + { + "address": "data.aws_iam_policy_document.elb_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "elb_log_delivery", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logdelivery.elasticloadbalancing.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.logging" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "aws_s3_bucket_metric.this", - "mode": "managed", - "type": "aws_s3_bucket_metric", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.value.name", - "each.value" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_elb_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "inventory_and_analytics_destination_policy", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "ArnLike" }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "local.metric_configuration", - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_object_lock_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_object_lock_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "rule": [ - { - "default_retention": [ - { - "days": { - "references": [ - "var.object_lock_configuration.rule.default_retention.days", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - }, - "mode": { - "references": [ - "var.object_lock_configuration.rule.default_retention.mode", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - }, - "years": { - "references": [ - "var.object_lock_configuration.rule.default_retention.years", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - } - } - ] - } - ], - "token": { - "references": [ - "var.object_lock_configuration.token", - "var.object_lock_configuration" - ] - } + "values": { + "references": [ + "var.inventory_self_source_destination", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "var.inventory_source_bucket_arn", + "var.analytics_self_source_destination", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "var.analytics_source_bucket_arn" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.object_lock_enabled", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] + "variable": { + "constant_value": "aws:SourceArn" } - }, - { - "address": "aws_s3_bucket_ownership_controls.this", - "mode": "managed", - "type": "aws_s3_bucket_ownership_controls", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "local.attach_policy", - "aws_s3_bucket_policy.this[0].id", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "rule": [ - { - "object_ownership": { - "references": [ - "var.object_ownership" - ] - } - } - ] - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.control_object_ownership" - ] - }, - "depends_on": [ - "aws_s3_bucket_policy.this", - "aws_s3_bucket_public_access_block.this", - "aws_s3_bucket.this" - ] - }, - { - "address": "aws_s3_bucket_policy.this", - "mode": "managed", - "type": "aws_s3_bucket_policy", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "policy": { - "references": [ - "data.aws_iam_policy_document.combined[0].json", - "data.aws_iam_policy_document.combined[0]", - "data.aws_iam_policy_document.combined" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.attach_policy" - ] + }, + { + "test": { + "constant_value": "StringEquals" }, - "depends_on": [ - "aws_s3_bucket_public_access_block.this" - ] - }, - { - "address": "aws_s3_bucket_public_access_block.this", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "block_public_acls": { - "references": [ - "var.block_public_acls" - ] - }, - "block_public_policy": { - "references": [ - "var.block_public_policy" - ] - }, - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "ignore_public_acls": { - "references": [ - "var.ignore_public_acls" - ] - }, - "restrict_public_buckets": { - "references": [ - "var.restrict_public_buckets" - ] - } + "values": { + "references": [ + "var.inventory_self_source_destination", + "data.aws_caller_identity.current.id", + "data.aws_caller_identity.current", + "var.inventory_source_account_id", + "var.analytics_self_source_destination", + "data.aws_caller_identity.current.id", + "data.aws_caller_identity.current", + "var.analytics_source_account_id" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_public_policy" - ] + "variable": { + "constant_value": "aws:SourceAccount" } - }, - { - "address": "aws_s3_bucket_replication_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_replication_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "role": { - "references": [ - "var.replication_configuration[\"role\"]", - "var.replication_configuration" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.replication_configuration" - ] + }, + { + "test": { + "constant_value": "StringEquals" }, - "depends_on": [ - "aws_s3_bucket_versioning.this" - ] - }, - { - "address": "aws_s3_bucket_request_payment_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_request_payment_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "payer": { - "references": [ - "var.request_payer" - ] - } + "values": { + "constant_value": [ + "bucket-owner-full-control" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.request_payer" - ] + "variable": { + "constant_value": "s3:x-amz-acl" } - }, - { - "address": "aws_s3_bucket_server_side_encryption_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_server_side_encryption_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + } + ], + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "s3.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.server_side_encryption_configuration" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "aws_s3_bucket_versioning.this", - "mode": "managed", - "type": "aws_s3_bucket_versioning", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "mfa": { - "references": [ - "var.versioning[\"mfa\"]", - "var.versioning" - ] - }, - "versioning_configuration": [ - { - "mfa_delete": { - "references": [ - "var.versioning[\"mfa_delete\"]", - "var.versioning", - "var.versioning[\"mfa_delete\"]", - "var.versioning" - ] - }, - "status": { - "references": [ - "var.versioning[\"enabled\"]", - "var.versioning", - "var.versioning[\"status\"]", - "var.versioning", - "var.versioning[\"status\"]", - "var.versioning" - ] - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "destinationInventoryAndAnalyticsPolicy" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_inventory_destination_policy", + "var.attach_analytics_destination_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.lb_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "lb_log_delivery", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringEquals" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.versioning" - ] - } - }, - { - "address": "aws_s3_bucket_website_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_website_configuration", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + "values": { + "constant_value": [ + "bucket-owner-full-control" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.website" - ] - } - }, - { - "address": "data.aws_caller_identity.current", - "mode": "data", - "type": "aws_caller_identity", - "name": "current", - "provider_config_key": "s3-bucket-1:aws", - "schema_version": 0 - }, - { - "address": "data.aws_canonical_user_id.this", - "mode": "data", - "type": "aws_canonical_user_id", - "name": "this", - "provider_config_key": "s3-bucket-1:aws", - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.create_bucket_acl", - "var.owner[\"id\"]", - "var.owner" - ] + "variable": { + "constant_value": "s3:x-amz-acl" } - }, - { - "address": "data.aws_iam_policy_document.access_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "access_log_delivery", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logging.s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSAccessLogDeliveryWrite" - } - }, - { - "actions": { - "constant_value": [ - "s3:GetBucketAcl" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logging.s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSAccessLogDeliveryAclCheck" - } - } - ] + } + ], + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "delivery.logs.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_access_log_delivery_policy" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "data.aws_iam_policy_document.combined", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "combined", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "source_policy_documents": { - "references": [ - "var.attach_elb_log_delivery_policy", - "data.aws_iam_policy_document.elb_log_delivery[0].json", - "data.aws_iam_policy_document.elb_log_delivery[0]", - "data.aws_iam_policy_document.elb_log_delivery", - "var.attach_lb_log_delivery_policy", - "data.aws_iam_policy_document.lb_log_delivery[0].json", - "data.aws_iam_policy_document.lb_log_delivery[0]", - "data.aws_iam_policy_document.lb_log_delivery", - "var.attach_access_log_delivery_policy", - "data.aws_iam_policy_document.access_log_delivery[0].json", - "data.aws_iam_policy_document.access_log_delivery[0]", - "data.aws_iam_policy_document.access_log_delivery", - "var.attach_require_latest_tls_policy", - "data.aws_iam_policy_document.require_latest_tls[0].json", - "data.aws_iam_policy_document.require_latest_tls[0]", - "data.aws_iam_policy_document.require_latest_tls", - "var.attach_deny_insecure_transport_policy", - "data.aws_iam_policy_document.deny_insecure_transport[0].json", - "data.aws_iam_policy_document.deny_insecure_transport[0]", - "data.aws_iam_policy_document.deny_insecure_transport", - "var.attach_deny_unencrypted_object_uploads", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads", - "var.attach_deny_incorrect_kms_key_sse", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", - "var.attach_deny_incorrect_encryption_headers", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers", - "var.attach_inventory_destination_policy", - "var.attach_analytics_destination_policy", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", - "var.attach_policy", - "var.policy" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSLogDeliveryWrite" + } + }, + { + "actions": { + "constant_value": [ + "s3:GetBucketAcl", + "s3:ListBucket" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "delivery.logs.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.attach_policy" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_incorrect_encryption_headers", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringNotEquals" - }, - "values": { - "references": [ - "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", - "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", - "var.server_side_encryption_configuration.rule", - "var.server_side_encryption_configuration" - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyIncorrectEncryptionHeaders" - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSLogDeliveryAclCheck" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_lb_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.require_latest_tls", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "require_latest_tls", + "provider_config_key": "s3-bucket-1:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:*" + ] + }, + "condition": [ + { + "test": { + "constant_value": "NumericLessThan" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_incorrect_encryption_headers" - ] - } - }, - { - "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_incorrect_kms_key_sse", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringNotEquals" - }, - "values": { - "references": [ - "var.allowed_kms_key_arn" - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyIncorrectKmsKeySse" - } - } - ] + "values": { + "constant_value": [ + "1.2" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_incorrect_kms_key_sse" - ] + "variable": { + "constant_value": "s3:TlsVersion" } - }, - { - "address": "data.aws_iam_policy_document.deny_insecure_transport", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_insecure_transport", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:*" - ] - }, - "condition": [ - { - "test": { - "constant_value": "Bool" - }, - "values": { - "constant_value": [ - "false" - ] - }, - "variable": { - "constant_value": "aws:SecureTransport" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyInsecureTransport" - } - } - ] + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_insecure_transport_policy" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_unencrypted_object_uploads", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "Null" - }, - "values": { - "constant_value": [ - true - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyUnencryptedObjectUploads" - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyOutdatedTLS" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_require_latest_tls_policy" + ] + } + }, + { + "address": "data.aws_partition.current", + "mode": "data", + "type": "aws_partition", + "name": "current", + "provider_config_key": "s3-bucket-1:aws", + "schema_version": 0 + }, + { + "address": "data.aws_region.current", + "mode": "data", + "type": "aws_region", + "name": "current", + "provider_config_key": "s3-bucket-1:aws", + "schema_version": 0 + } + ], + "variables": { + "acceleration_status": { + "default": null, + "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." + }, + "access_log_delivery_policy_source_accounts": { + "default": [], + "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." + }, + "access_log_delivery_policy_source_buckets": { + "default": [], + "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." + }, + "acl": { + "default": null, + "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" + }, + "allowed_kms_key_arn": { + "default": null, + "description": "The ARN of KMS key which should be allowed in PutObject" + }, + "analytics_configuration": { + "default": {}, + "description": "Map containing bucket analytics configuration." + }, + "analytics_self_source_destination": { + "default": false, + "description": "Whether or not the analytics source bucket is also the destination bucket." + }, + "analytics_source_account_id": { + "default": null, + "description": "The analytics source account id." + }, + "analytics_source_bucket_arn": { + "default": null, + "description": "The analytics source bucket ARN." + }, + "attach_access_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have S3 access log delivery policy attached" + }, + "attach_analytics_destination_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket analytics destination policy attached." + }, + "attach_deny_incorrect_encryption_headers": { + "default": false, + "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." + }, + "attach_deny_incorrect_kms_key_sse": { + "default": false, + "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." + }, + "attach_deny_insecure_transport_policy": { + "default": false, + "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" + }, + "attach_deny_unencrypted_object_uploads": { + "default": false, + "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." + }, + "attach_elb_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have ELB log delivery policy attached" + }, + "attach_inventory_destination_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket inventory destination policy attached." + }, + "attach_lb_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" + }, + "attach_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" + }, + "attach_public_policy": { + "default": true, + "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" + }, + "attach_require_latest_tls_policy": { + "default": false, + "description": "Controls if S3 bucket should require the latest version of TLS" + }, + "block_public_acls": { + "default": true, + "description": "Whether Amazon S3 should block public ACLs for this bucket." + }, + "block_public_policy": { + "default": true, + "description": "Whether Amazon S3 should block public bucket policies for this bucket." + }, + "bucket": { + "default": null, + "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." + }, + "bucket_prefix": { + "default": null, + "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." + }, + "control_object_ownership": { + "default": false, + "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." + }, + "cors_rule": { + "default": [], + "description": "List of maps containing rules for Cross-Origin Resource Sharing." + }, + "create_bucket": { + "default": true, + "description": "Controls if S3 bucket should be created" + }, + "expected_bucket_owner": { + "default": null, + "description": "The account ID of the expected bucket owner" + }, + "force_destroy": { + "default": false, + "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." + }, + "grant": { + "default": [], + "description": "An ACL policy grant. Conflicts with `acl`" + }, + "ignore_public_acls": { + "default": true, + "description": "Whether Amazon S3 should ignore public ACLs for this bucket." + }, + "intelligent_tiering": { + "default": {}, + "description": "Map containing intelligent tiering configuration." + }, + "inventory_configuration": { + "default": {}, + "description": "Map containing S3 inventory configuration." + }, + "inventory_self_source_destination": { + "default": false, + "description": "Whether or not the inventory source bucket is also the destination bucket." + }, + "inventory_source_account_id": { + "default": null, + "description": "The inventory source account id." + }, + "inventory_source_bucket_arn": { + "default": null, + "description": "The inventory source bucket ARN." + }, + "lifecycle_rule": { + "default": [], + "description": "List of maps containing configuration of object lifecycle management." + }, + "logging": { + "default": {}, + "description": "Map containing access bucket logging configuration." + }, + "metric_configuration": { + "default": [], + "description": "Map containing bucket metric configuration." + }, + "object_lock_configuration": { + "default": {}, + "description": "Map containing S3 object locking configuration." + }, + "object_lock_enabled": { + "default": false, + "description": "Whether S3 bucket should have an Object Lock configuration enabled." + }, + "object_ownership": { + "default": "BucketOwnerEnforced", + "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." + }, + "owner": { + "default": {}, + "description": "Bucket owner's display name and ID. Conflicts with `acl`" + }, + "policy": { + "default": null, + "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." + }, + "replication_configuration": { + "default": {}, + "description": "Map containing cross-region replication configuration." + }, + "request_payer": { + "default": null, + "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." + }, + "restrict_public_buckets": { + "default": true, + "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." + }, + "server_side_encryption_configuration": { + "default": {}, + "description": "Map containing server-side encryption configuration." + }, + "tags": { + "default": {}, + "description": "(Optional) A mapping of tags to assign to the bucket." + }, + "versioning": { + "default": {}, + "description": "Map containing versioning configuration." + }, + "website": { + "default": {}, + "description": "Map containing static web-site hosting or redirect configuration." + } + }, + "address": "module.test.module.s3-bucket-1" + }, + "version_constraint": "4.0.1" + }, + "s3-bucket-2": { + "source": "terraform-aws-modules/s3-bucket/aws", + "module": { + "outputs": { + "s3_bucket_arn": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." + }, + "s3_bucket_bucket_domain_name": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].bucket_domain_name", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." + }, + "s3_bucket_bucket_regional_domain_name": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].bucket_regional_domain_name", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." + }, + "s3_bucket_hosted_zone_id": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].hosted_zone_id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The Route 53 Hosted Zone ID for this bucket's region." + }, + "s3_bucket_id": { + "expression": { + "references": [ + "aws_s3_bucket_policy.this[0].id", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The name of the bucket." + }, + "s3_bucket_lifecycle_configuration_rules": { + "expression": { + "references": [ + "aws_s3_bucket_lifecycle_configuration.this[0].rule", + "aws_s3_bucket_lifecycle_configuration.this[0]", + "aws_s3_bucket_lifecycle_configuration.this" + ] + }, + "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." + }, + "s3_bucket_policy": { + "expression": { + "references": [ + "aws_s3_bucket_policy.this[0].policy", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this" + ] + }, + "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." + }, + "s3_bucket_region": { + "expression": { + "references": [ + "aws_s3_bucket.this[0].region", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "description": "The AWS region this bucket resides in." + }, + "s3_bucket_website_domain": { + "expression": { + "references": [ + "aws_s3_bucket_website_configuration.this[0].website_domain", + "aws_s3_bucket_website_configuration.this[0]", + "aws_s3_bucket_website_configuration.this" + ] + }, + "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." + }, + "s3_bucket_website_endpoint": { + "expression": { + "references": [ + "aws_s3_bucket_website_configuration.this[0].website_endpoint", + "aws_s3_bucket_website_configuration.this[0]", + "aws_s3_bucket_website_configuration.this" + ] + }, + "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." + } + }, + "resources": [ + { + "address": "aws_s3_bucket.this", + "mode": "managed", + "type": "aws_s3_bucket", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "var.bucket" + ] + }, + "bucket_prefix": { + "references": [ + "var.bucket_prefix" + ] + }, + "force_destroy": { + "references": [ + "var.force_destroy" + ] + }, + "object_lock_enabled": { + "references": [ + "var.object_lock_enabled" + ] + }, + "tags": { + "references": [ + "var.tags" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_accelerate_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_accelerate_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "status": { + "references": [ + "var.acceleration_status" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.acceleration_status" + ] + } + }, + { + "address": "aws_s3_bucket_acl.this", + "mode": "managed", + "type": "aws_s3_bucket_acl", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "acl": { + "references": [ + "var.acl", + "var.acl" + ] + }, + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.create_bucket_acl" + ] + }, + "depends_on": [ + "aws_s3_bucket_ownership_controls.this" + ] + }, + { + "address": "aws_s3_bucket_analytics_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_analytics_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.key" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "var.analytics_configuration", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_cors_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_cors_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.cors_rules" + ] + } + }, + { + "address": "aws_s3_bucket_intelligent_tiering_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_intelligent_tiering_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.key" + ] + }, + "status": { + "references": [ + "each.value.status", + "each.value", + "each.value.status", + "each.value" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "local.intelligent_tiering", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_inventory.this", + "mode": "managed", + "type": "aws_s3_bucket_inventory", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "each.value.bucket", + "each.value", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "destination": [ + { + "bucket": [ + { + "account_id": { + "references": [ + "each.value.destination.account_id", + "each.value.destination", + "each.value" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_unencrypted_object_uploads" - ] - } - }, - { - "address": "data.aws_iam_policy_document.elb_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "elb_log_delivery", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logdelivery.elasticloadbalancing.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "" - } - } - ] + "bucket_arn": { + "references": [ + "each.value.destination.bucket_arn", + "each.value.destination", + "each.value", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_elb_log_delivery_policy" - ] - } - }, - { - "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "inventory_and_analytics_destination_policy", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "ArnLike" - }, - "values": { - "references": [ - "var.inventory_self_source_destination", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "var.inventory_source_bucket_arn", - "var.analytics_self_source_destination", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "var.analytics_source_bucket_arn" - ] - }, - "variable": { - "constant_value": "aws:SourceArn" - } - }, - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "references": [ - "var.inventory_self_source_destination", - "data.aws_caller_identity.current.id", - "data.aws_caller_identity.current", - "var.inventory_source_account_id", - "var.analytics_self_source_destination", - "data.aws_caller_identity.current.id", - "data.aws_caller_identity.current", - "var.analytics_source_account_id" - ] - }, - "variable": { - "constant_value": "aws:SourceAccount" - } - }, - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "constant_value": [ - "bucket-owner-full-control" - ] - }, - "variable": { - "constant_value": "s3:x-amz-acl" - } - } - ], - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "destinationInventoryAndAnalyticsPolicy" - } - } - ] + "format": { + "references": [ + "each.value.destination.format", + "each.value.destination", + "each.value" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_inventory_destination_policy", - "var.attach_analytics_destination_policy" - ] + "prefix": { + "references": [ + "each.value.destination.prefix", + "each.value.destination", + "each.value" + ] } - }, - { - "address": "data.aws_iam_policy_document.lb_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "lb_log_delivery", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "constant_value": [ - "bucket-owner-full-control" - ] - }, - "variable": { - "constant_value": "s3:x-amz-acl" - } - } - ], - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "delivery.logs.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSLogDeliveryWrite" - } - }, - { - "actions": { - "constant_value": [ - "s3:GetBucketAcl", - "s3:ListBucket" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "delivery.logs.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSLogDeliveryAclCheck" - } - } - ] + } + ] + } + ], + "enabled": { + "references": [ + "each.value.enabled", + "each.value" + ] + }, + "included_object_versions": { + "references": [ + "each.value.included_object_versions", + "each.value" + ] + }, + "name": { + "references": [ + "each.key" + ] + }, + "optional_fields": { + "references": [ + "each.value.optional_fields", + "each.value" + ] + }, + "schedule": [ + { + "frequency": { + "references": [ + "each.value.frequency", + "each.value" + ] + } + } + ] + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "var.inventory_configuration", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_lifecycle_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_lifecycle_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.lifecycle_rules" + ] + }, + "depends_on": [ + "aws_s3_bucket_versioning.this" + ] + }, + { + "address": "aws_s3_bucket_logging.this", + "mode": "managed", + "type": "aws_s3_bucket_logging", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "target_bucket": { + "references": [ + "var.logging[\"target_bucket\"]", + "var.logging" + ] + }, + "target_prefix": { + "references": [ + "var.logging[\"target_prefix\"]", + "var.logging" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.logging" + ] + } + }, + { + "address": "aws_s3_bucket_metric.this", + "mode": "managed", + "type": "aws_s3_bucket_metric", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "name": { + "references": [ + "each.value.name", + "each.value" + ] + } + }, + "schema_version": 0, + "for_each_expression": { + "references": [ + "local.metric_configuration", + "local.create_bucket" + ] + } + }, + { + "address": "aws_s3_bucket_object_lock_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_object_lock_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "rule": [ + { + "default_retention": [ + { + "days": { + "references": [ + "var.object_lock_configuration.rule.default_retention.days", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_lb_log_delivery_policy" - ] - } - }, - { - "address": "data.aws_iam_policy_document.require_latest_tls", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "require_latest_tls", - "provider_config_key": "s3-bucket-1:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:*" - ] - }, - "condition": [ - { - "test": { - "constant_value": "NumericLessThan" - }, - "values": { - "constant_value": [ - "1.2" - ] - }, - "variable": { - "constant_value": "s3:TlsVersion" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyOutdatedTLS" - } - } - ] + "mode": { + "references": [ + "var.object_lock_configuration.rule.default_retention.mode", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_require_latest_tls_policy" - ] + "years": { + "references": [ + "var.object_lock_configuration.rule.default_retention.years", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] } - }, - { - "address": "data.aws_partition.current", - "mode": "data", - "type": "aws_partition", - "name": "current", - "provider_config_key": "s3-bucket-1:aws", - "schema_version": 0 - }, - { - "address": "data.aws_region.current", - "mode": "data", - "type": "aws_region", - "name": "current", - "provider_config_key": "s3-bucket-1:aws", - "schema_version": 0 - } + } + ] + } ], - "variables": { - "acceleration_status": { - "default": null, - "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." - }, - "access_log_delivery_policy_source_accounts": { - "default": [], - "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." - }, - "access_log_delivery_policy_source_buckets": { - "default": [], - "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." - }, - "acl": { - "default": null, - "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" - }, - "allowed_kms_key_arn": { - "default": null, - "description": "The ARN of KMS key which should be allowed in PutObject" - }, - "analytics_configuration": { - "default": {}, - "description": "Map containing bucket analytics configuration." - }, - "analytics_self_source_destination": { - "default": false, - "description": "Whether or not the analytics source bucket is also the destination bucket." - }, - "analytics_source_account_id": { - "default": null, - "description": "The analytics source account id." - }, - "analytics_source_bucket_arn": { - "default": null, - "description": "The analytics source bucket ARN." - }, - "attach_access_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have S3 access log delivery policy attached" - }, - "attach_analytics_destination_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket analytics destination policy attached." - }, - "attach_deny_incorrect_encryption_headers": { - "default": false, - "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." - }, - "attach_deny_incorrect_kms_key_sse": { - "default": false, - "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." - }, - "attach_deny_insecure_transport_policy": { - "default": false, - "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" - }, - "attach_deny_unencrypted_object_uploads": { - "default": false, - "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." - }, - "attach_elb_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have ELB log delivery policy attached" - }, - "attach_inventory_destination_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket inventory destination policy attached." - }, - "attach_lb_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" - }, - "attach_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" - }, - "attach_public_policy": { - "default": true, - "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" - }, - "attach_require_latest_tls_policy": { - "default": false, - "description": "Controls if S3 bucket should require the latest version of TLS" - }, - "block_public_acls": { - "default": true, - "description": "Whether Amazon S3 should block public ACLs for this bucket." - }, - "block_public_policy": { - "default": true, - "description": "Whether Amazon S3 should block public bucket policies for this bucket." - }, - "bucket": { - "default": null, - "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." - }, - "bucket_prefix": { - "default": null, - "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." - }, - "control_object_ownership": { - "default": false, - "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." - }, - "cors_rule": { - "default": [], - "description": "List of maps containing rules for Cross-Origin Resource Sharing." - }, - "create_bucket": { - "default": true, - "description": "Controls if S3 bucket should be created" - }, - "expected_bucket_owner": { - "default": null, - "description": "The account ID of the expected bucket owner" - }, - "force_destroy": { - "default": false, - "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." - }, - "grant": { - "default": [], - "description": "An ACL policy grant. Conflicts with `acl`" - }, - "ignore_public_acls": { - "default": true, - "description": "Whether Amazon S3 should ignore public ACLs for this bucket." - }, - "intelligent_tiering": { - "default": {}, - "description": "Map containing intelligent tiering configuration." - }, - "inventory_configuration": { - "default": {}, - "description": "Map containing S3 inventory configuration." - }, - "inventory_self_source_destination": { - "default": false, - "description": "Whether or not the inventory source bucket is also the destination bucket." - }, - "inventory_source_account_id": { - "default": null, - "description": "The inventory source account id." - }, - "inventory_source_bucket_arn": { - "default": null, - "description": "The inventory source bucket ARN." - }, - "lifecycle_rule": { - "default": [], - "description": "List of maps containing configuration of object lifecycle management." - }, - "logging": { - "default": {}, - "description": "Map containing access bucket logging configuration." - }, - "metric_configuration": { - "default": [], - "description": "Map containing bucket metric configuration." - }, - "object_lock_configuration": { - "default": {}, - "description": "Map containing S3 object locking configuration." - }, - "object_lock_enabled": { - "default": false, - "description": "Whether S3 bucket should have an Object Lock configuration enabled." - }, + "token": { + "references": [ + "var.object_lock_configuration.token", + "var.object_lock_configuration" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.object_lock_enabled", + "var.object_lock_configuration.rule.default_retention", + "var.object_lock_configuration.rule", + "var.object_lock_configuration" + ] + } + }, + { + "address": "aws_s3_bucket_ownership_controls.this", + "mode": "managed", + "type": "aws_s3_bucket_ownership_controls", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "local.attach_policy", + "aws_s3_bucket_policy.this[0].id", + "aws_s3_bucket_policy.this[0]", + "aws_s3_bucket_policy.this", + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "rule": [ + { "object_ownership": { - "default": "BucketOwnerEnforced", - "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." - }, - "owner": { - "default": {}, - "description": "Bucket owner's display name and ID. Conflicts with `acl`" - }, - "policy": { - "default": null, - "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." - }, - "replication_configuration": { - "default": {}, - "description": "Map containing cross-region replication configuration." - }, - "request_payer": { - "default": null, - "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." - }, - "restrict_public_buckets": { - "default": true, - "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." - }, - "server_side_encryption_configuration": { - "default": {}, - "description": "Map containing server-side encryption configuration." - }, - "tags": { - "default": {}, - "description": "(Optional) A mapping of tags to assign to the bucket." - }, - "versioning": { - "default": {}, - "description": "Map containing versioning configuration." - }, - "website": { - "default": {}, - "description": "Map containing static web-site hosting or redirect configuration." + "references": [ + "var.object_ownership" + ] } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.control_object_ownership" + ] + }, + "depends_on": [ + "aws_s3_bucket_policy.this", + "aws_s3_bucket_public_access_block.this", + "aws_s3_bucket.this" + ] + }, + { + "address": "aws_s3_bucket_policy.this", + "mode": "managed", + "type": "aws_s3_bucket_policy", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "policy": { + "references": [ + "data.aws_iam_policy_document.combined[0].json", + "data.aws_iam_policy_document.combined[0]", + "data.aws_iam_policy_document.combined" + ] } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.attach_policy" + ] + }, + "depends_on": [ + "aws_s3_bucket_public_access_block.this" + ] }, - "version_constraint": "4.0.1" - }, - "s3-bucket-2": { - "source": "terraform-aws-modules/s3-bucket/aws", - "module": { - "outputs": { - "s3_bucket_arn": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname." - }, - "s3_bucket_bucket_domain_name": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].bucket_domain_name", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The bucket domain name. Will be of format bucketname.s3.amazonaws.com." - }, - "s3_bucket_bucket_regional_domain_name": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].bucket_regional_domain_name", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL." - }, - "s3_bucket_hosted_zone_id": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].hosted_zone_id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The Route 53 Hosted Zone ID for this bucket's region." - }, - "s3_bucket_id": { - "expression": { - "references": [ - "aws_s3_bucket_policy.this[0].id", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The name of the bucket." - }, - "s3_bucket_lifecycle_configuration_rules": { - "expression": { - "references": [ - "aws_s3_bucket_lifecycle_configuration.this[0].rule", - "aws_s3_bucket_lifecycle_configuration.this[0]", - "aws_s3_bucket_lifecycle_configuration.this" - ] - }, - "description": "The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules. If not, this will be an empty string." - }, - "s3_bucket_policy": { - "expression": { - "references": [ - "aws_s3_bucket_policy.this[0].policy", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this" - ] - }, - "description": "The policy of the bucket, if the bucket is configured with a policy. If not, this will be an empty string." - }, - "s3_bucket_region": { - "expression": { - "references": [ - "aws_s3_bucket.this[0].region", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "description": "The AWS region this bucket resides in." - }, - "s3_bucket_website_domain": { - "expression": { - "references": [ - "aws_s3_bucket_website_configuration.this[0].website_domain", - "aws_s3_bucket_website_configuration.this[0]", - "aws_s3_bucket_website_configuration.this" - ] - }, - "description": "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records." - }, - "s3_bucket_website_endpoint": { - "expression": { - "references": [ - "aws_s3_bucket_website_configuration.this[0].website_endpoint", - "aws_s3_bucket_website_configuration.this[0]", - "aws_s3_bucket_website_configuration.this" - ] - }, - "description": "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string." + { + "address": "aws_s3_bucket_public_access_block.this", + "mode": "managed", + "type": "aws_s3_bucket_public_access_block", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "block_public_acls": { + "references": [ + "var.block_public_acls" + ] + }, + "block_public_policy": { + "references": [ + "var.block_public_policy" + ] + }, + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "ignore_public_acls": { + "references": [ + "var.ignore_public_acls" + ] + }, + "restrict_public_buckets": { + "references": [ + "var.restrict_public_buckets" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_public_policy" + ] + } + }, + { + "address": "aws_s3_bucket_replication_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_replication_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "role": { + "references": [ + "var.replication_configuration[\"role\"]", + "var.replication_configuration" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.replication_configuration" + ] + }, + "depends_on": [ + "aws_s3_bucket_versioning.this" + ] + }, + { + "address": "aws_s3_bucket_request_payment_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_request_payment_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "payer": { + "references": [ + "var.request_payer" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.request_payer" + ] + } + }, + { + "address": "aws_s3_bucket_server_side_encryption_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_server_side_encryption_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.server_side_encryption_configuration" + ] + } + }, + { + "address": "aws_s3_bucket_versioning.this", + "mode": "managed", + "type": "aws_s3_bucket_versioning", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + }, + "mfa": { + "references": [ + "var.versioning[\"mfa\"]", + "var.versioning" + ] + }, + "versioning_configuration": [ + { + "mfa_delete": { + "references": [ + "var.versioning[\"mfa_delete\"]", + "var.versioning", + "var.versioning[\"mfa_delete\"]", + "var.versioning" + ] + }, + "status": { + "references": [ + "var.versioning[\"enabled\"]", + "var.versioning", + "var.versioning[\"status\"]", + "var.versioning", + "var.versioning[\"status\"]", + "var.versioning" + ] } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.versioning" + ] + } + }, + { + "address": "aws_s3_bucket_website_configuration.this", + "mode": "managed", + "type": "aws_s3_bucket_website_configuration", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "bucket": { + "references": [ + "aws_s3_bucket.this[0].id", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] }, - "resources": [ - { - "address": "aws_s3_bucket.this", - "mode": "managed", - "type": "aws_s3_bucket", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "var.bucket" - ] - }, - "bucket_prefix": { - "references": [ - "var.bucket_prefix" - ] - }, - "force_destroy": { - "references": [ - "var.force_destroy" - ] - }, - "object_lock_enabled": { - "references": [ - "var.object_lock_enabled" - ] - }, - "tags": { - "references": [ - "var.tags" - ] - } + "expected_bucket_owner": { + "references": [ + "var.expected_bucket_owner" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.website" + ] + } + }, + { + "address": "data.aws_caller_identity.current", + "mode": "data", + "type": "aws_caller_identity", + "name": "current", + "provider_config_key": "s3-bucket-2:aws", + "schema_version": 0 + }, + { + "address": "data.aws_canonical_user_id.this", + "mode": "data", + "type": "aws_canonical_user_id", + "name": "this", + "provider_config_key": "s3-bucket-2:aws", + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.create_bucket_acl", + "var.owner[\"id\"]", + "var.owner" + ] + } + }, + { + "address": "data.aws_iam_policy_document.access_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "access_log_delivery", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logging.s3.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "aws_s3_bucket_accelerate_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_accelerate_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "status": { - "references": [ - "var.acceleration_status" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSAccessLogDeliveryWrite" + } + }, + { + "actions": { + "constant_value": [ + "s3:GetBucketAcl" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logging.s3.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.acceleration_status" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "aws_s3_bucket_acl.this", - "mode": "managed", - "type": "aws_s3_bucket_acl", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "acl": { - "references": [ - "var.acl", - "var.acl" - ] - }, - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.create_bucket_acl" - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSAccessLogDeliveryAclCheck" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_access_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.combined", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "combined", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "source_policy_documents": { + "references": [ + "var.attach_elb_log_delivery_policy", + "data.aws_iam_policy_document.elb_log_delivery[0].json", + "data.aws_iam_policy_document.elb_log_delivery[0]", + "data.aws_iam_policy_document.elb_log_delivery", + "var.attach_lb_log_delivery_policy", + "data.aws_iam_policy_document.lb_log_delivery[0].json", + "data.aws_iam_policy_document.lb_log_delivery[0]", + "data.aws_iam_policy_document.lb_log_delivery", + "var.attach_access_log_delivery_policy", + "data.aws_iam_policy_document.access_log_delivery[0].json", + "data.aws_iam_policy_document.access_log_delivery[0]", + "data.aws_iam_policy_document.access_log_delivery", + "var.attach_require_latest_tls_policy", + "data.aws_iam_policy_document.require_latest_tls[0].json", + "data.aws_iam_policy_document.require_latest_tls[0]", + "data.aws_iam_policy_document.require_latest_tls", + "var.attach_deny_insecure_transport_policy", + "data.aws_iam_policy_document.deny_insecure_transport[0].json", + "data.aws_iam_policy_document.deny_insecure_transport[0]", + "data.aws_iam_policy_document.deny_insecure_transport", + "var.attach_deny_unencrypted_object_uploads", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", + "data.aws_iam_policy_document.deny_unencrypted_object_uploads", + "var.attach_deny_incorrect_kms_key_sse", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", + "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", + "var.attach_deny_incorrect_encryption_headers", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", + "data.aws_iam_policy_document.deny_incorrect_encryption_headers", + "var.attach_inventory_destination_policy", + "var.attach_analytics_destination_policy", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", + "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", + "var.attach_policy", + "var.policy" + ] + } + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "local.attach_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_incorrect_encryption_headers", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringNotEquals" }, - "depends_on": [ - "aws_s3_bucket_ownership_controls.this" - ] - }, - { - "address": "aws_s3_bucket_analytics_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_analytics_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.key" - ] - } + "values": { + "references": [ + "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", + "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", + "var.server_side_encryption_configuration.rule", + "var.server_side_encryption_configuration" + ] }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "var.analytics_configuration", - "local.create_bucket" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption" } - }, - { - "address": "aws_s3_bucket_cors_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_cors_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.cors_rules" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "aws_s3_bucket_intelligent_tiering_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_intelligent_tiering_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.key" - ] - }, - "status": { - "references": [ - "each.value.status", - "each.value", - "each.value.status", - "each.value" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyIncorrectEncryptionHeaders" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_incorrect_encryption_headers" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_incorrect_kms_key_sse", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringNotEquals" }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "local.intelligent_tiering", - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_inventory.this", - "mode": "managed", - "type": "aws_s3_bucket_inventory", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "each.value.bucket", - "each.value", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "destination": [ - { - "bucket": [ - { - "account_id": { - "references": [ - "each.value.destination.account_id", - "each.value.destination", - "each.value" - ] - }, - "bucket_arn": { - "references": [ - "each.value.destination.bucket_arn", - "each.value.destination", - "each.value", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "format": { - "references": [ - "each.value.destination.format", - "each.value.destination", - "each.value" - ] - }, - "prefix": { - "references": [ - "each.value.destination.prefix", - "each.value.destination", - "each.value" - ] - } - } - ] - } - ], - "enabled": { - "references": [ - "each.value.enabled", - "each.value" - ] - }, - "included_object_versions": { - "references": [ - "each.value.included_object_versions", - "each.value" - ] - }, - "name": { - "references": [ - "each.key" - ] - }, - "optional_fields": { - "references": [ - "each.value.optional_fields", - "each.value" - ] - }, - "schedule": [ - { - "frequency": { - "references": [ - "each.value.frequency", - "each.value" - ] - } - } - ] + "values": { + "references": [ + "var.allowed_kms_key_arn" + ] }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "var.inventory_configuration", - "local.create_bucket" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" } - }, - { - "address": "aws_s3_bucket_lifecycle_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_lifecycle_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.lifecycle_rules" - ] - }, - "depends_on": [ - "aws_s3_bucket_versioning.this" - ] - }, - { - "address": "aws_s3_bucket_logging.this", - "mode": "managed", - "type": "aws_s3_bucket_logging", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "target_bucket": { - "references": [ - "var.logging[\"target_bucket\"]", - "var.logging" - ] - }, - "target_prefix": { - "references": [ - "var.logging[\"target_prefix\"]", - "var.logging" - ] - } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.logging" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "aws_s3_bucket_metric.this", - "mode": "managed", - "type": "aws_s3_bucket_metric", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "name": { - "references": [ - "each.value.name", - "each.value" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyIncorrectKmsKeySse" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_incorrect_kms_key_sse" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_insecure_transport", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_insecure_transport", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:*" + ] + }, + "condition": [ + { + "test": { + "constant_value": "Bool" }, - "schema_version": 0, - "for_each_expression": { - "references": [ - "local.metric_configuration", - "local.create_bucket" - ] - } - }, - { - "address": "aws_s3_bucket_object_lock_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_object_lock_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "rule": [ - { - "default_retention": [ - { - "days": { - "references": [ - "var.object_lock_configuration.rule.default_retention.days", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - }, - "mode": { - "references": [ - "var.object_lock_configuration.rule.default_retention.mode", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - }, - "years": { - "references": [ - "var.object_lock_configuration.rule.default_retention.years", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] - } - } - ] - } - ], - "token": { - "references": [ - "var.object_lock_configuration.token", - "var.object_lock_configuration" - ] - } + "values": { + "constant_value": [ + "false" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.object_lock_enabled", - "var.object_lock_configuration.rule.default_retention", - "var.object_lock_configuration.rule", - "var.object_lock_configuration" - ] + "variable": { + "constant_value": "aws:SecureTransport" } - }, - { - "address": "aws_s3_bucket_ownership_controls.this", - "mode": "managed", - "type": "aws_s3_bucket_ownership_controls", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "local.attach_policy", - "aws_s3_bucket_policy.this[0].id", - "aws_s3_bucket_policy.this[0]", - "aws_s3_bucket_policy.this", - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "rule": [ - { - "object_ownership": { - "references": [ - "var.object_ownership" - ] - } - } - ] - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.control_object_ownership" - ] - }, - "depends_on": [ - "aws_s3_bucket_policy.this", - "aws_s3_bucket_public_access_block.this", - "aws_s3_bucket.this" - ] - }, - { - "address": "aws_s3_bucket_policy.this", - "mode": "managed", - "type": "aws_s3_bucket_policy", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "policy": { - "references": [ - "data.aws_iam_policy_document.combined[0].json", - "data.aws_iam_policy_document.combined[0]", - "data.aws_iam_policy_document.combined" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.attach_policy" - ] - }, - "depends_on": [ - "aws_s3_bucket_public_access_block.this" - ] - }, - { - "address": "aws_s3_bucket_public_access_block.this", - "mode": "managed", - "type": "aws_s3_bucket_public_access_block", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "block_public_acls": { - "references": [ - "var.block_public_acls" - ] - }, - "block_public_policy": { - "references": [ - "var.block_public_policy" - ] - }, - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "ignore_public_acls": { - "references": [ - "var.ignore_public_acls" - ] - }, - "restrict_public_buckets": { - "references": [ - "var.restrict_public_buckets" - ] - } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_public_policy" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "aws_s3_bucket_replication_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_replication_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "role": { - "references": [ - "var.replication_configuration[\"role\"]", - "var.replication_configuration" - ] - } - }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.replication_configuration" - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyInsecureTransport" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_insecure_transport_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "deny_unencrypted_object_uploads", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "Null" }, - "depends_on": [ - "aws_s3_bucket_versioning.this" - ] - }, - { - "address": "aws_s3_bucket_request_payment_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_request_payment_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "payer": { - "references": [ - "var.request_payer" - ] - } + "values": { + "constant_value": [ + true + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.request_payer" - ] + "variable": { + "constant_value": "s3:x-amz-server-side-encryption" } - }, - { - "address": "aws_s3_bucket_server_side_encryption_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_server_side_encryption_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.server_side_encryption_configuration" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "aws_s3_bucket_versioning.this", - "mode": "managed", - "type": "aws_s3_bucket_versioning", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - }, - "mfa": { - "references": [ - "var.versioning[\"mfa\"]", - "var.versioning" - ] - }, - "versioning_configuration": [ - { - "mfa_delete": { - "references": [ - "var.versioning[\"mfa_delete\"]", - "var.versioning", - "var.versioning[\"mfa_delete\"]", - "var.versioning" - ] - }, - "status": { - "references": [ - "var.versioning[\"enabled\"]", - "var.versioning", - "var.versioning[\"status\"]", - "var.versioning", - "var.versioning[\"status\"]", - "var.versioning" - ] - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyUnencryptedObjectUploads" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_deny_unencrypted_object_uploads" + ] + } + }, + { + "address": "data.aws_iam_policy_document.elb_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "elb_log_delivery", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "logdelivery.elasticloadbalancing.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.versioning" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "aws_s3_bucket_website_configuration.this", - "mode": "managed", - "type": "aws_s3_bucket_website_configuration", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "bucket": { - "references": [ - "aws_s3_bucket.this[0].id", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "expected_bucket_owner": { - "references": [ - "var.expected_bucket_owner" - ] - } + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_elb_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "inventory_and_analytics_destination_policy", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "ArnLike" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.website" - ] - } - }, - { - "address": "data.aws_caller_identity.current", - "mode": "data", - "type": "aws_caller_identity", - "name": "current", - "provider_config_key": "s3-bucket-2:aws", - "schema_version": 0 - }, - { - "address": "data.aws_canonical_user_id.this", - "mode": "data", - "type": "aws_canonical_user_id", - "name": "this", - "provider_config_key": "s3-bucket-2:aws", - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.create_bucket_acl", - "var.owner[\"id\"]", - "var.owner" - ] - } - }, - { - "address": "data.aws_iam_policy_document.access_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "access_log_delivery", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logging.s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSAccessLogDeliveryWrite" - } - }, - { - "actions": { - "constant_value": [ - "s3:GetBucketAcl" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logging.s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSAccessLogDeliveryAclCheck" - } - } - ] + "values": { + "references": [ + "var.inventory_self_source_destination", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "var.inventory_source_bucket_arn", + "var.analytics_self_source_destination", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "var.analytics_source_bucket_arn" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_access_log_delivery_policy" - ] + "variable": { + "constant_value": "aws:SourceArn" } - }, - { - "address": "data.aws_iam_policy_document.combined", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "combined", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "source_policy_documents": { - "references": [ - "var.attach_elb_log_delivery_policy", - "data.aws_iam_policy_document.elb_log_delivery[0].json", - "data.aws_iam_policy_document.elb_log_delivery[0]", - "data.aws_iam_policy_document.elb_log_delivery", - "var.attach_lb_log_delivery_policy", - "data.aws_iam_policy_document.lb_log_delivery[0].json", - "data.aws_iam_policy_document.lb_log_delivery[0]", - "data.aws_iam_policy_document.lb_log_delivery", - "var.attach_access_log_delivery_policy", - "data.aws_iam_policy_document.access_log_delivery[0].json", - "data.aws_iam_policy_document.access_log_delivery[0]", - "data.aws_iam_policy_document.access_log_delivery", - "var.attach_require_latest_tls_policy", - "data.aws_iam_policy_document.require_latest_tls[0].json", - "data.aws_iam_policy_document.require_latest_tls[0]", - "data.aws_iam_policy_document.require_latest_tls", - "var.attach_deny_insecure_transport_policy", - "data.aws_iam_policy_document.deny_insecure_transport[0].json", - "data.aws_iam_policy_document.deny_insecure_transport[0]", - "data.aws_iam_policy_document.deny_insecure_transport", - "var.attach_deny_unencrypted_object_uploads", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0].json", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads[0]", - "data.aws_iam_policy_document.deny_unencrypted_object_uploads", - "var.attach_deny_incorrect_kms_key_sse", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0].json", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse[0]", - "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", - "var.attach_deny_incorrect_encryption_headers", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0].json", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers[0]", - "data.aws_iam_policy_document.deny_incorrect_encryption_headers", - "var.attach_inventory_destination_policy", - "var.attach_analytics_destination_policy", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0].json", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy[0]", - "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", - "var.attach_policy", - "var.policy" - ] - } + }, + { + "test": { + "constant_value": "StringEquals" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "local.attach_policy" - ] - } - }, - { - "address": "data.aws_iam_policy_document.deny_incorrect_encryption_headers", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_incorrect_encryption_headers", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringNotEquals" - }, - "values": { - "references": [ - "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm", - "var.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default", - "var.server_side_encryption_configuration.rule", - "var.server_side_encryption_configuration" - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyIncorrectEncryptionHeaders" - } - } - ] + "values": { + "references": [ + "var.inventory_self_source_destination", + "data.aws_caller_identity.current.id", + "data.aws_caller_identity.current", + "var.inventory_source_account_id", + "var.analytics_self_source_destination", + "data.aws_caller_identity.current.id", + "data.aws_caller_identity.current", + "var.analytics_source_account_id" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_incorrect_encryption_headers" - ] + "variable": { + "constant_value": "aws:SourceAccount" } - }, - { - "address": "data.aws_iam_policy_document.deny_incorrect_kms_key_sse", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_incorrect_kms_key_sse", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringNotEquals" - }, - "values": { - "references": [ - "var.allowed_kms_key_arn" - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption-aws-kms-key-id" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyIncorrectKmsKeySse" - } - } - ] + }, + { + "test": { + "constant_value": "StringEquals" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_incorrect_kms_key_sse" - ] + "values": { + "constant_value": [ + "bucket-owner-full-control" + ] + }, + "variable": { + "constant_value": "s3:x-amz-acl" } - }, - { - "address": "data.aws_iam_policy_document.deny_insecure_transport", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_insecure_transport", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:*" - ] - }, - "condition": [ - { - "test": { - "constant_value": "Bool" - }, - "values": { - "constant_value": [ - "false" - ] - }, - "variable": { - "constant_value": "aws:SecureTransport" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyInsecureTransport" - } - } - ] + } + ], + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "s3.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_insecure_transport_policy" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "data.aws_iam_policy_document.deny_unencrypted_object_uploads", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "deny_unencrypted_object_uploads", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "Null" - }, - "values": { - "constant_value": [ - true - ] - }, - "variable": { - "constant_value": "s3:x-amz-server-side-encryption" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyUnencryptedObjectUploads" - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "destinationInventoryAndAnalyticsPolicy" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_inventory_destination_policy", + "var.attach_analytics_destination_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.lb_log_delivery", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "lb_log_delivery", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:PutObject" + ] + }, + "condition": [ + { + "test": { + "constant_value": "StringEquals" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_deny_unencrypted_object_uploads" - ] + "values": { + "constant_value": [ + "bucket-owner-full-control" + ] + }, + "variable": { + "constant_value": "s3:x-amz-acl" } - }, - { - "address": "data.aws_iam_policy_document.elb_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "elb_log_delivery", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "logdelivery.elasticloadbalancing.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "" - } - } - ] + } + ], + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "delivery.logs.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_elb_log_delivery_policy" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "data.aws_iam_policy_document.inventory_and_analytics_destination_policy", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "inventory_and_analytics_destination_policy", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "ArnLike" - }, - "values": { - "references": [ - "var.inventory_self_source_destination", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "var.inventory_source_bucket_arn", - "var.analytics_self_source_destination", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "var.analytics_source_bucket_arn" - ] - }, - "variable": { - "constant_value": "aws:SourceArn" - } - }, - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "references": [ - "var.inventory_self_source_destination", - "data.aws_caller_identity.current.id", - "data.aws_caller_identity.current", - "var.inventory_source_account_id", - "var.analytics_self_source_destination", - "data.aws_caller_identity.current.id", - "data.aws_caller_identity.current", - "var.analytics_source_account_id" - ] - }, - "variable": { - "constant_value": "aws:SourceAccount" - } - }, - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "constant_value": [ - "bucket-owner-full-control" - ] - }, - "variable": { - "constant_value": "s3:x-amz-acl" - } - } - ], - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "s3.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "destinationInventoryAndAnalyticsPolicy" - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSLogDeliveryWrite" + } + }, + { + "actions": { + "constant_value": [ + "s3:GetBucketAcl", + "s3:ListBucket" + ] + }, + "effect": { + "constant_value": "Allow" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "delivery.logs.amazonaws.com" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_inventory_destination_policy", - "var.attach_analytics_destination_policy" - ] + "type": { + "constant_value": "Service" } - }, - { - "address": "data.aws_iam_policy_document.lb_log_delivery", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "lb_log_delivery", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:PutObject" - ] - }, - "condition": [ - { - "test": { - "constant_value": "StringEquals" - }, - "values": { - "constant_value": [ - "bucket-owner-full-control" - ] - }, - "variable": { - "constant_value": "s3:x-amz-acl" - } - } - ], - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "delivery.logs.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSLogDeliveryWrite" - } - }, - { - "actions": { - "constant_value": [ - "s3:GetBucketAcl", - "s3:ListBucket" - ] - }, - "effect": { - "constant_value": "Allow" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "delivery.logs.amazonaws.com" - ] - }, - "type": { - "constant_value": "Service" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "AWSLogDeliveryAclCheck" - } - } - ] + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "AWSLogDeliveryAclCheck" + } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_lb_log_delivery_policy" + ] + } + }, + { + "address": "data.aws_iam_policy_document.require_latest_tls", + "mode": "data", + "type": "aws_iam_policy_document", + "name": "require_latest_tls", + "provider_config_key": "s3-bucket-2:aws", + "expressions": { + "statement": [ + { + "actions": { + "constant_value": [ + "s3:*" + ] + }, + "condition": [ + { + "test": { + "constant_value": "NumericLessThan" }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_lb_log_delivery_policy" - ] + "values": { + "constant_value": [ + "1.2" + ] + }, + "variable": { + "constant_value": "s3:TlsVersion" } - }, - { - "address": "data.aws_iam_policy_document.require_latest_tls", - "mode": "data", - "type": "aws_iam_policy_document", - "name": "require_latest_tls", - "provider_config_key": "s3-bucket-2:aws", - "expressions": { - "statement": [ - { - "actions": { - "constant_value": [ - "s3:*" - ] - }, - "condition": [ - { - "test": { - "constant_value": "NumericLessThan" - }, - "values": { - "constant_value": [ - "1.2" - ] - }, - "variable": { - "constant_value": "s3:TlsVersion" - } - } - ], - "effect": { - "constant_value": "Deny" - }, - "principals": [ - { - "identifiers": { - "constant_value": [ - "*" - ] - }, - "type": { - "constant_value": "*" - } - } - ], - "resources": { - "references": [ - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this", - "aws_s3_bucket.this[0].arn", - "aws_s3_bucket.this[0]", - "aws_s3_bucket.this" - ] - }, - "sid": { - "constant_value": "denyOutdatedTLS" - } - } - ] + } + ], + "effect": { + "constant_value": "Deny" + }, + "principals": [ + { + "identifiers": { + "constant_value": [ + "*" + ] }, - "schema_version": 0, - "count_expression": { - "references": [ - "local.create_bucket", - "var.attach_require_latest_tls_policy" - ] + "type": { + "constant_value": "*" } - }, - { - "address": "data.aws_partition.current", - "mode": "data", - "type": "aws_partition", - "name": "current", - "provider_config_key": "s3-bucket-2:aws", - "schema_version": 0 - }, - { - "address": "data.aws_region.current", - "mode": "data", - "type": "aws_region", - "name": "current", - "provider_config_key": "s3-bucket-2:aws", - "schema_version": 0 - } - ], - "variables": { - "acceleration_status": { - "default": null, - "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." - }, - "access_log_delivery_policy_source_accounts": { - "default": [], - "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." - }, - "access_log_delivery_policy_source_buckets": { - "default": [], - "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." - }, - "acl": { - "default": null, - "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" - }, - "allowed_kms_key_arn": { - "default": null, - "description": "The ARN of KMS key which should be allowed in PutObject" - }, - "analytics_configuration": { - "default": {}, - "description": "Map containing bucket analytics configuration." - }, - "analytics_self_source_destination": { - "default": false, - "description": "Whether or not the analytics source bucket is also the destination bucket." - }, - "analytics_source_account_id": { - "default": null, - "description": "The analytics source account id." - }, - "analytics_source_bucket_arn": { - "default": null, - "description": "The analytics source bucket ARN." - }, - "attach_access_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have S3 access log delivery policy attached" - }, - "attach_analytics_destination_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket analytics destination policy attached." - }, - "attach_deny_incorrect_encryption_headers": { - "default": false, - "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." - }, - "attach_deny_incorrect_kms_key_sse": { - "default": false, - "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." - }, - "attach_deny_insecure_transport_policy": { - "default": false, - "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" - }, - "attach_deny_unencrypted_object_uploads": { - "default": false, - "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." - }, - "attach_elb_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have ELB log delivery policy attached" - }, - "attach_inventory_destination_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket inventory destination policy attached." - }, - "attach_lb_log_delivery_policy": { - "default": false, - "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" - }, - "attach_policy": { - "default": false, - "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" - }, - "attach_public_policy": { - "default": true, - "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" - }, - "attach_require_latest_tls_policy": { - "default": false, - "description": "Controls if S3 bucket should require the latest version of TLS" - }, - "block_public_acls": { - "default": true, - "description": "Whether Amazon S3 should block public ACLs for this bucket." - }, - "block_public_policy": { - "default": true, - "description": "Whether Amazon S3 should block public bucket policies for this bucket." - }, - "bucket": { - "default": null, - "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." - }, - "bucket_prefix": { - "default": null, - "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." - }, - "control_object_ownership": { - "default": false, - "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." - }, - "cors_rule": { - "default": [], - "description": "List of maps containing rules for Cross-Origin Resource Sharing." - }, - "create_bucket": { - "default": true, - "description": "Controls if S3 bucket should be created" - }, - "expected_bucket_owner": { - "default": null, - "description": "The account ID of the expected bucket owner" - }, - "force_destroy": { - "default": false, - "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." - }, - "grant": { - "default": [], - "description": "An ACL policy grant. Conflicts with `acl`" - }, - "ignore_public_acls": { - "default": true, - "description": "Whether Amazon S3 should ignore public ACLs for this bucket." - }, - "intelligent_tiering": { - "default": {}, - "description": "Map containing intelligent tiering configuration." - }, - "inventory_configuration": { - "default": {}, - "description": "Map containing S3 inventory configuration." - }, - "inventory_self_source_destination": { - "default": false, - "description": "Whether or not the inventory source bucket is also the destination bucket." - }, - "inventory_source_account_id": { - "default": null, - "description": "The inventory source account id." - }, - "inventory_source_bucket_arn": { - "default": null, - "description": "The inventory source bucket ARN." - }, - "lifecycle_rule": { - "default": [], - "description": "List of maps containing configuration of object lifecycle management." - }, - "logging": { - "default": {}, - "description": "Map containing access bucket logging configuration." - }, - "metric_configuration": { - "default": [], - "description": "Map containing bucket metric configuration." - }, - "object_lock_configuration": { - "default": {}, - "description": "Map containing S3 object locking configuration." - }, - "object_lock_enabled": { - "default": false, - "description": "Whether S3 bucket should have an Object Lock configuration enabled." - }, - "object_ownership": { - "default": "BucketOwnerEnforced", - "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." - }, - "owner": { - "default": {}, - "description": "Bucket owner's display name and ID. Conflicts with `acl`" - }, - "policy": { - "default": null, - "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." - }, - "replication_configuration": { - "default": {}, - "description": "Map containing cross-region replication configuration." - }, - "request_payer": { - "default": null, - "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." - }, - "restrict_public_buckets": { - "default": true, - "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." - }, - "server_side_encryption_configuration": { - "default": {}, - "description": "Map containing server-side encryption configuration." - }, - "tags": { - "default": {}, - "description": "(Optional) A mapping of tags to assign to the bucket." - }, - "versioning": { - "default": {}, - "description": "Map containing versioning configuration." - }, - "website": { - "default": {}, - "description": "Map containing static web-site hosting or redirect configuration." + } + ], + "resources": { + "references": [ + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this", + "aws_s3_bucket.this[0].arn", + "aws_s3_bucket.this[0]", + "aws_s3_bucket.this" + ] + }, + "sid": { + "constant_value": "denyOutdatedTLS" } - } + } + ] + }, + "schema_version": 0, + "count_expression": { + "references": [ + "local.create_bucket", + "var.attach_require_latest_tls_policy" + ] + } }, - "version_constraint": "4.0.1" - } + { + "address": "data.aws_partition.current", + "mode": "data", + "type": "aws_partition", + "name": "current", + "provider_config_key": "s3-bucket-2:aws", + "schema_version": 0 + }, + { + "address": "data.aws_region.current", + "mode": "data", + "type": "aws_region", + "name": "current", + "provider_config_key": "s3-bucket-2:aws", + "schema_version": 0 + } + ], + "variables": { + "acceleration_status": { + "default": null, + "description": "(Optional) Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended." + }, + "access_log_delivery_policy_source_accounts": { + "default": [], + "description": "(Optional) List of AWS Account IDs should be allowed to deliver access logs to this bucket." + }, + "access_log_delivery_policy_source_buckets": { + "default": [], + "description": "(Optional) List of S3 bucket ARNs wich should be allowed to deliver access logs to this bucket." + }, + "acl": { + "default": null, + "description": "(Optional) The canned ACL to apply. Conflicts with `grant`" + }, + "allowed_kms_key_arn": { + "default": null, + "description": "The ARN of KMS key which should be allowed in PutObject" + }, + "analytics_configuration": { + "default": {}, + "description": "Map containing bucket analytics configuration." + }, + "analytics_self_source_destination": { + "default": false, + "description": "Whether or not the analytics source bucket is also the destination bucket." + }, + "analytics_source_account_id": { + "default": null, + "description": "The analytics source account id." + }, + "analytics_source_bucket_arn": { + "default": null, + "description": "The analytics source bucket ARN." + }, + "attach_access_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have S3 access log delivery policy attached" + }, + "attach_analytics_destination_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket analytics destination policy attached." + }, + "attach_deny_incorrect_encryption_headers": { + "default": false, + "description": "Controls if S3 bucket should deny incorrect encryption headers policy attached." + }, + "attach_deny_incorrect_kms_key_sse": { + "default": false, + "description": "Controls if S3 bucket policy should deny usage of incorrect KMS key SSE." + }, + "attach_deny_insecure_transport_policy": { + "default": false, + "description": "Controls if S3 bucket should have deny non-SSL transport policy attached" + }, + "attach_deny_unencrypted_object_uploads": { + "default": false, + "description": "Controls if S3 bucket should deny unencrypted object uploads policy attached." + }, + "attach_elb_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have ELB log delivery policy attached" + }, + "attach_inventory_destination_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket inventory destination policy attached." + }, + "attach_lb_log_delivery_policy": { + "default": false, + "description": "Controls if S3 bucket should have ALB/NLB log delivery policy attached" + }, + "attach_policy": { + "default": false, + "description": "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)" + }, + "attach_public_policy": { + "default": true, + "description": "Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket)" + }, + "attach_require_latest_tls_policy": { + "default": false, + "description": "Controls if S3 bucket should require the latest version of TLS" + }, + "block_public_acls": { + "default": true, + "description": "Whether Amazon S3 should block public ACLs for this bucket." + }, + "block_public_policy": { + "default": true, + "description": "Whether Amazon S3 should block public bucket policies for this bucket." + }, + "bucket": { + "default": null, + "description": "(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name." + }, + "bucket_prefix": { + "default": null, + "description": "(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket." + }, + "control_object_ownership": { + "default": false, + "description": "Whether to manage S3 Bucket Ownership Controls on this bucket." + }, + "cors_rule": { + "default": [], + "description": "List of maps containing rules for Cross-Origin Resource Sharing." + }, + "create_bucket": { + "default": true, + "description": "Controls if S3 bucket should be created" + }, + "expected_bucket_owner": { + "default": null, + "description": "The account ID of the expected bucket owner" + }, + "force_destroy": { + "default": false, + "description": "(Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable." + }, + "grant": { + "default": [], + "description": "An ACL policy grant. Conflicts with `acl`" + }, + "ignore_public_acls": { + "default": true, + "description": "Whether Amazon S3 should ignore public ACLs for this bucket." + }, + "intelligent_tiering": { + "default": {}, + "description": "Map containing intelligent tiering configuration." + }, + "inventory_configuration": { + "default": {}, + "description": "Map containing S3 inventory configuration." + }, + "inventory_self_source_destination": { + "default": false, + "description": "Whether or not the inventory source bucket is also the destination bucket." + }, + "inventory_source_account_id": { + "default": null, + "description": "The inventory source account id." + }, + "inventory_source_bucket_arn": { + "default": null, + "description": "The inventory source bucket ARN." + }, + "lifecycle_rule": { + "default": [], + "description": "List of maps containing configuration of object lifecycle management." + }, + "logging": { + "default": {}, + "description": "Map containing access bucket logging configuration." + }, + "metric_configuration": { + "default": [], + "description": "Map containing bucket metric configuration." + }, + "object_lock_configuration": { + "default": {}, + "description": "Map containing S3 object locking configuration." + }, + "object_lock_enabled": { + "default": false, + "description": "Whether S3 bucket should have an Object Lock configuration enabled." + }, + "object_ownership": { + "default": "BucketOwnerEnforced", + "description": "Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. 'BucketOwnerEnforced': ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. 'BucketOwnerPreferred': Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. 'ObjectWriter': The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL." + }, + "owner": { + "default": {}, + "description": "Bucket owner's display name and ID. Conflicts with `acl`" + }, + "policy": { + "default": null, + "description": "(Optional) A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide." + }, + "replication_configuration": { + "default": {}, + "description": "Map containing cross-region replication configuration." + }, + "request_payer": { + "default": null, + "description": "(Optional) Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information." + }, + "restrict_public_buckets": { + "default": true, + "description": "Whether Amazon S3 should restrict public bucket policies for this bucket." + }, + "server_side_encryption_configuration": { + "default": {}, + "description": "Map containing server-side encryption configuration." + }, + "tags": { + "default": {}, + "description": "(Optional) A mapping of tags to assign to the bucket." + }, + "versioning": { + "default": {}, + "description": "Map containing versioning configuration." + }, + "website": { + "default": {}, + "description": "Map containing static web-site hosting or redirect configuration." + } + }, + "address": "module.test.module.s3-bucket-2" + }, + "version_constraint": "4.0.1" + } } + } } + } } + } } \ No newline at end of file From 0f6789616b371a0b55005636eef95bbf8f3e382e Mon Sep 17 00:00:00 2001 From: lshindelman Date: Wed, 8 Oct 2025 18:04:04 +0300 Subject: [PATCH 5/6] edit tfplan to have nested_module --- tests/terraform/graph/graph_builder/test_graph_builder.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/terraform/graph/graph_builder/test_graph_builder.py b/tests/terraform/graph/graph_builder/test_graph_builder.py index 52ed445149..011c3032f1 100644 --- a/tests/terraform/graph/graph_builder/test_graph_builder.py +++ b/tests/terraform/graph/graph_builder/test_graph_builder.py @@ -375,7 +375,7 @@ def test_build_rustworkx_graph(self): self.check_edge(graph, provider_node, var_aws_profile_node, 'profile') self.check_edge(graph, local_node, var_bucket_name_node, 'bucket_name') - def test_multiple_modules_with_connected_resources(self): + def test_multiple_nested_module_with_connected_resources(self): valid_plan_path = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules_edges_tfplan/tfplan.json')) definitions, definitions_raw = create_definitions(root_folder=None, files=[valid_plan_path]) graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) From 9a7cc99cad85c8715f8c20d05f1ff73a4cdb0f28 Mon Sep 17 00:00:00 2001 From: lshindelman Date: Wed, 8 Oct 2025 18:07:44 +0300 Subject: [PATCH 6/6] edit tfplan to have nested_module --- tests/terraform/graph/graph_builder/test_graph_builder.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/terraform/graph/graph_builder/test_graph_builder.py b/tests/terraform/graph/graph_builder/test_graph_builder.py index 011c3032f1..88fc745d4e 100644 --- a/tests/terraform/graph/graph_builder/test_graph_builder.py +++ b/tests/terraform/graph/graph_builder/test_graph_builder.py @@ -380,6 +380,7 @@ def test_multiple_nested_module_with_connected_resources(self): definitions, definitions_raw = create_definitions(root_folder=None, files=[valid_plan_path]) graph_manager = TerraformGraphManager(db_connector=RustworkxConnector()) tf_plan_local_graph = graph_manager.build_graph_from_definitions(definitions, render_variables=False) + self.assertTrue(tf_plan_local_graph.in_edges[1]) self.assertTrue(tf_plan_local_graph.in_edges[3]) def test_best_match_multiple_modules_with_connected_resources(self):