Skip to content

Commit b9649c5

Browse files
snemetzsnemetz
committed
Initial commit
0 parents  commit b9649c5

File tree

8 files changed

+221
-0
lines changed

8 files changed

+221
-0
lines changed

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.terraform*
2+
!terraform.tfstate*
3+
terraform.*

‎README.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
AWS S3 Terraform Module
2+
=====================
3+
4+
Create AWS S3 bucket and set policy
5+
6+
Usage:
7+
------
8+
9+
module "s3" {
10+
source = "../tf_s3"
11+
name = "apps"
12+
environment = "dev01"
13+
}
14+
15+
16+
## Inputs
17+
18+
| Name | Description | Default | Required |
19+
|------|-------------|:-----:|:-----:|
20+
| environment | Environment (ex: dev, qa, stage, prod) | - | yes |
21+
| name | Name | - | yes |
22+
| namespaced | Namespace all resources (prefixed with the environment)? | `true` | no |
23+
| principal | principal | - | yes |
24+
| tags | A map of tags to add to all resources | `<map>` | no |
25+
26+
## Outputs
27+
28+
| Name | Description |
29+
|------|-------------|
30+
| s3_bucket_arn | AWS S3 Bucket ARN |
31+
| s3_bucket_domain_name | AWS S3 Bucket Domain Name |
32+
| s3_bucket_hosted_zone_id | AWS S3 Bucket Hosted Zone ID |
33+
| s3_bucket_id | AWS S3 Bucket ID |
34+
| s3_bucket_name | AWS S3 Bucket Name |
35+
| s3_bucket_region | AWS S3 Bucket Region |
36+
37+
38+
### Resource Graph
39+
40+
![Terraform Graph](graph.png)

‎files/policy_s3_bucket.json

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Sid": "Enable put/update/delete objects",
6+
"Effect": "Allow",
7+
"Principal": {"AWS": ${jsonencode(split(",", principal))}},
8+
"Action": [
9+
"s3:DeleteObject",
10+
"s3:GetObject",
11+
"s3:PutObject",
12+
"s3:ReplicateObject",
13+
"s3:RestoreObject",
14+
"s3:PutObjectAcl"
15+
],
16+
"Resource": "arn:aws:s3:::${name}/*"
17+
},
18+
{
19+
"Sid": "Enable list bucket",
20+
"Effect": "Allow",
21+
"Principal": {"AWS": ${jsonencode(split(",", principal))}},
22+
"Action": [
23+
"s3:ListBucket"
24+
],
25+
"Resource": "arn:aws:s3:::${name}"
26+
},
27+
{
28+
"Sid": "Prevent put objects without a kms key encryption",
29+
"Effect": "Deny",
30+
"Principal": "*",
31+
"Action": [
32+
"s3:PutObject",
33+
"s3:ReplicateObject"
34+
],
35+
"Resource": "arn:aws:s3:::${name}/*",
36+
"Condition": {
37+
"StringNotEquals": {
38+
"s3:x-amz-server-side-encryption": "aws:kms"
39+
}
40+
}
41+
},
42+
{
43+
"Sid": "Prevent creating objects that bucket owner (ourselves) that cannot access",
44+
"Effect": "Deny",
45+
"Principal": "*",
46+
"Action": "s3:PutObject",
47+
"Resource": "arn:aws:s3:::${name}/*",
48+
"Condition": {
49+
"StringNotEquals": {
50+
"s3:x-amz-acl": "bucket-owner-full-control"
51+
}
52+
}
53+
}
54+
]
55+
}

‎graph.dot

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
digraph {
2+
compound = "true"
3+
newrank = "true"
4+
subgraph "root" {
5+
"[root] aws_s3_bucket.bucket" [label = "aws_s3_bucket.bucket", shape = "box"]
6+
"[root] provider.aws" [label = "provider.aws", shape = "diamond"]
7+
"[root] aws_s3_bucket.bucket" -> "[root] provider.aws"
8+
"[root] aws_s3_bucket.bucket" -> "[root] var.environment"
9+
"[root] aws_s3_bucket.bucket" -> "[root] var.name"
10+
"[root] aws_s3_bucket.bucket" -> "[root] var.namespaced"
11+
"[root] aws_s3_bucket.bucket" -> "[root] var.tags"
12+
"[root] output.s3_bucket_arn" -> "[root] aws_s3_bucket.bucket"
13+
"[root] output.s3_bucket_domain_name" -> "[root] aws_s3_bucket.bucket"
14+
"[root] output.s3_bucket_hosted_zone_id" -> "[root] aws_s3_bucket.bucket"
15+
"[root] output.s3_bucket_id" -> "[root] aws_s3_bucket.bucket"
16+
"[root] output.s3_bucket_name" -> "[root] aws_s3_bucket.bucket"
17+
"[root] output.s3_bucket_region" -> "[root] aws_s3_bucket.bucket"
18+
"[root] root" -> "[root] output.s3_bucket_arn"
19+
"[root] root" -> "[root] output.s3_bucket_domain_name"
20+
"[root] root" -> "[root] output.s3_bucket_hosted_zone_id"
21+
"[root] root" -> "[root] output.s3_bucket_id"
22+
"[root] root" -> "[root] output.s3_bucket_name"
23+
"[root] root" -> "[root] output.s3_bucket_region"
24+
"[root] root" -> "[root] var.principal"
25+
}
26+
}
27+

‎graph.png

104 KB
Loading

‎main.tf

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* AWS S3 Terraform Module
3+
* =====================
4+
*
5+
* Create AWS S3 bucket and set policy
6+
*
7+
* Usage:
8+
* ------
9+
*
10+
* module "s3" {
11+
* source = "../tf_s3"
12+
* name = "apps"
13+
* environment = "dev01"
14+
* }
15+
**/
16+
17+
# TODO: Allow pass policy via variable. Default empty policy. If can be done, otherwise 2 modules
18+
# create s3 bucket and set policy
19+
resource "aws_s3_bucket" "bucket" {
20+
#bucket = "dmp-rpns-${var.s3_env_map[var.env]}"
21+
# TODO: Setup namespaced condition
22+
bucket = "${format("%s-%s", var.environment, var.name)}"
23+
acl = "private"
24+
versioning {
25+
enabled = true
26+
}
27+
tags = "${ merge(
28+
var.tags,
29+
map("Name", var.namespaced ?
30+
format("%s-%s-s3-bucket", var.environment, var.name) :
31+
format("%s-s3-bucket", var.name) ),
32+
map("Environment", var.environment),
33+
map("Terraform", "true") )}"
34+
}
35+
/*
36+
data "template_file" "policy_s3_bucket" {
37+
template = "${file("${path.module}/files/policy_s3_bucket.json")}"
38+
vars = {
39+
name = "${aws_s3_bucket.bucket.bucket}"
40+
principal = "${var.principal}"
41+
}
42+
}
43+
44+
resource "aws_s3_bucket_policy" "bucket_policy" {
45+
bucket = "${aws_s3_bucket.bucket.id}"
46+
policy = "${data.template_file.policy_s3_bucket.rendered}"
47+
}
48+
*/

‎outputs.tf

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
// AWS S3 Bucket Name
2+
output "s3_bucket_name" {
3+
value = "${aws_s3_bucket.bucket.id}"
4+
}
5+
6+
// AWS S3 Bucket ARN
7+
output "s3_bucket_arn" {
8+
value = "${aws_s3_bucket.bucket.arn}"
9+
}
10+
// AWS S3 Bucket Domain Name
11+
output "s3_bucket_domain_name" {
12+
value = "${aws_s3_bucket.bucket.bucket_domain_name}"
13+
}
14+
// AWS S3 Bucket Region
15+
output "s3_bucket_region" {
16+
value = "${aws_s3_bucket.bucket.region}"
17+
}
18+
// AWS S3 Bucket ID
19+
output "s3_bucket_id" {
20+
value = "${aws_s3_bucket.bucket.id}"
21+
}
22+
// AWS S3 Bucket Hosted Zone ID
23+
output "s3_bucket_hosted_zone_id" {
24+
value = "${aws_s3_bucket.bucket.hosted_zone_id}"
25+
}

‎variables.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
2+
// Standard Variables
3+
4+
variable "name" {
5+
description = "Name"
6+
}
7+
variable "environment" {
8+
description = "Environment (ex: dev, qa, stage, prod)"
9+
}
10+
variable "namespaced" {
11+
description = "Namespace all resources (prefixed with the environment)?"
12+
default = true
13+
}
14+
variable "tags" {
15+
description = "A map of tags to add to all resources"
16+
default = {}
17+
}
18+
19+
// Module specific Variables
20+
21+
variable "principal" {
22+
description = "principal"
23+
}

0 commit comments

Comments
 (0)