feat: fixed intelligent tiering settings
This commit is contained in:
@@ -1,263 +1,68 @@
|
||||
# s3_bucket_2023 module
|
||||
This module creates s3 bucket, following new terraform standards.
|
||||
<!-- This readme file is generated with terraform-docs -->
|
||||
## Requirements
|
||||
|
||||
If lifecycle policy is enabled, provide the expiration days.
|
||||
Transition days are hard-coded with intelligent-tiering class to simplify administration.
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| terraform | >= 1.3.0 |
|
||||
| aws | >= 3.72.0 |
|
||||
|
||||
## Example
|
||||
```hcl
|
||||
module "bucket1" {
|
||||
source = "../../../../whk1-bea-sys-ss-prd-codecommit-sharedmodules/Storage/s3_bucket_2023"
|
||||
## Providers
|
||||
|
||||
bucket_name = var.bucket_name1
|
||||
bucket_policy_json = jsonencode(
|
||||
{
|
||||
"Version" : "2012-10-17",
|
||||
"Id" : "",
|
||||
"Statement" : [
|
||||
{
|
||||
"Sid" : "Set permissions for objects",
|
||||
"Effect" : "Allow",
|
||||
"Principal" : {
|
||||
"AWS" : "851239346925"
|
||||
},
|
||||
"Action" : ["s3:ReplicateObject", "s3:ReplicateDelete"],
|
||||
"Resource" : "arn:aws:s3:::${var.bucket_name1}/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
)
|
||||
enable_encryption = true
|
||||
encryption_key_arn = var.encryption_key_arn
|
||||
enable_versioning = false
|
||||
enable_bucket_logging = false
|
||||
enable_bucket_lifecycle = true
|
||||
current_version_expiration_days = 731
|
||||
noncurrent_version_expiration_days = 731
|
||||
}
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| aws | >= 3.72.0 |
|
||||
|
||||
```
|
||||
## Modules
|
||||
|
||||
## Note on bucket replication
|
||||
To securely replicate a bucket to a bucket in another aws account, kms key is required.
|
||||
No modules.
|
||||
|
||||
Steps to setup replication are:
|
||||
1. Create replication iam role on the source account, with an assume role policy trusting s3
|
||||
```json
|
||||
{
|
||||
"Effect":"Allow",
|
||||
"Principal":{
|
||||
"Service":"s3.amazonaws.com"
|
||||
},
|
||||
"Action":"sts:AssumeRole"
|
||||
}
|
||||
```
|
||||
The role needs permissions granted in the role iam policy. For example:
|
||||
```json
|
||||
{
|
||||
"Statement": [
|
||||
{
|
||||
"Action": [
|
||||
"s3:ListBucket",
|
||||
"s3:GetReplicationConfiguration"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": "arn:aws:s3:::whk1-bea-icc-mbk-prd-vpc01-flowlog-s3-accept",
|
||||
"Sid": ""
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"s3:GetObjectVersionTagging",
|
||||
"s3:GetObjectVersionForReplication",
|
||||
"s3:GetObjectVersionAcl"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": "arn:aws:s3:::whk1-bea-icc-mbk-prd-vpc01-flowlog-s3-accept/*",
|
||||
"Sid": ""
|
||||
},
|
||||
{
|
||||
"Action": [
|
||||
"s3:ReplicateTags",
|
||||
"s3:ReplicateObject",
|
||||
"s3:ReplicateDelete",
|
||||
"s3:ObjectOwnerOverrideToBucketOwner"
|
||||
],
|
||||
"Effect": "Allow",
|
||||
"Resource": "arn:aws:s3:::whk1-bea-icc-log-mbk-prd-vpc01-flowlog-s3-accept/*",
|
||||
"Sid": ""
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"kms:Decrypt",
|
||||
"kms:GenerateDataKey"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:kms:ap-east-1:851239346925:key/708b6ece-05f5-40ed-a91c-dbcf2af46407"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"kms:GenerateDataKey",
|
||||
"kms:Encrypt"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:kms:ap-east-1:894849410890:key/b555d9d6-d451-4ec8-8ca2-cb6849cadee4"
|
||||
]
|
||||
}
|
||||
],
|
||||
"Version": "2012-10-17"
|
||||
}
|
||||
```
|
||||
If bucket key is used, then additional permission needs to be granted
|
||||
```json
|
||||
{
|
||||
"Action":[
|
||||
"kms:Decrypt"
|
||||
],
|
||||
"Effect":"Allow",
|
||||
"Condition":{
|
||||
"StringLike":{
|
||||
"kms:ViaService":"s3.ap-east-1.amazonaws.com",
|
||||
"kms:EncryptionContext:aws:s3:arn":[
|
||||
"arn:aws:s3:::<source-bucket-name>/*"
|
||||
]
|
||||
}
|
||||
},
|
||||
"Resource":[
|
||||
"arn:aws:kms:ap-east-1:<source-account-id>:key/<source-account-key-id>"
|
||||
]
|
||||
},
|
||||
{
|
||||
"Action":[
|
||||
"kms:Encrypt"
|
||||
],
|
||||
"Effect":"Allow",
|
||||
"Condition":{
|
||||
"StringLike":{
|
||||
"kms:ViaService":"s3.ap-east-1.amazonaws.com",
|
||||
"kms:EncryptionContext:aws:s3:arn":[
|
||||
"arn:aws:s3:::<dest-bucket-name>/*"
|
||||
]
|
||||
}
|
||||
},
|
||||
"Resource":[
|
||||
"arn:aws:kms:ap-east-1:<dest-account-id>:key/<dest-account-key-id>"
|
||||
]
|
||||
}
|
||||
```
|
||||
## Resources
|
||||
|
||||
2. On the destination account, grant access in KMS key policy
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Id": "key-consolepolicy-3",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "Enable IAM User Permissions",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam::<dest-account-id>:root"
|
||||
},
|
||||
"Action": "kms:*",
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "Allow use of the key",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": [
|
||||
"arn:aws:iam::<src-account-id>:root",
|
||||
"arn:aws:iam::<dest-account-id>:root"
|
||||
]
|
||||
},
|
||||
"Action": [
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt",
|
||||
"kms:ReEncrypt*",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:DescribeKey"
|
||||
],
|
||||
"Resource": "*"
|
||||
},
|
||||
{
|
||||
"Sid": "Allow attachment of persistent resources",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": [
|
||||
"arn:aws:iam::<src-account-id>:root",
|
||||
"arn:aws:iam::<dest-account-id>:root"
|
||||
]
|
||||
},
|
||||
"Action": [
|
||||
"kms:CreateGrant",
|
||||
"kms:ListGrants",
|
||||
"kms:RevokeGrant"
|
||||
],
|
||||
"Resource": "*",
|
||||
"Condition": {
|
||||
"Bool": {
|
||||
"kms:GrantIsForAWSResource": "true"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"Sid": "Allow AWS Service to use the key",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": [
|
||||
"s3.amazonaws.com",
|
||||
"delivery.logs.amazonaws.com",
|
||||
"cloudtrail.amazonaws.com"
|
||||
]
|
||||
},
|
||||
"Action": [
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt",
|
||||
"kms:ReEncrypt*",
|
||||
"kms:GenerateDataKey*",
|
||||
"kms:DescribeKey"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
|
||||
| [aws_s3_bucket_intelligent_tiering_configuration.intel_tiering_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
|
||||
| [aws_s3_bucket_lifecycle_configuration.lifecycle](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
|
||||
| [aws_s3_bucket_logging.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
|
||||
| [aws_s3_bucket_policy.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
|
||||
| [aws_s3_bucket_public_access_block.block_public_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
|
||||
| [aws_s3_bucket_replication_configuration.replication](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_replication_configuration) | resource |
|
||||
| [aws_s3_bucket_server_side_encryption_configuration.encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
|
||||
| [aws_s3_bucket_versioning.versioning](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
|
||||
| [aws_iam_policy_document.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
|
||||
3. Edit destination bucket policy
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Id": "",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "Set permissions for objects",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam::<src-account-id>:root"
|
||||
},
|
||||
"Action": [
|
||||
"s3:ReplicateDelete",
|
||||
"s3:ReplicateObject",
|
||||
"s3:ReplicateTags",
|
||||
"s3:ObjectOwnerOverrideToBucketOwner"
|
||||
],
|
||||
"Resource": "arn:aws:s3:::<dest-bucket-name>/*"
|
||||
},
|
||||
{
|
||||
"Sid": "Set permissions on bucket",
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"AWS": "arn:aws:iam::<src-account-id>:root"
|
||||
},
|
||||
"Action": [
|
||||
"s3:List*",
|
||||
"s3:GetBucketVersioning",
|
||||
"s3:PutBucketVersioning"
|
||||
],
|
||||
"Resource": "arn:aws:s3:::<dest-bucket-name>"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| bucket\_name | Name of bucket | `string` | n/a | yes |
|
||||
| bucket\_policy\_json | Json-encoded bucket policy. The AllowSSLRequestsOnly policy is merged with this input. | `string` | `"{}"` | no |
|
||||
| current-version-archive-tier | Current version archive storage class. Valid values are GLACIER, STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, DEEP\_ARCHIVE, GLACIER\_IR | `string` | `null` | no |
|
||||
| current-version-transition-days | Days to transition current version to archive | `number` | `15` | no |
|
||||
| current\_version\_expiration\_days | 731 for flowlogs | `number` | `2560` | no |
|
||||
| enable\_bucket\_lifecycle | Enable s3 bucket lifecycle | `bool` | n/a | yes |
|
||||
| enable\_bucket\_logging | Enable bucket logging | `bool` | n/a | yes |
|
||||
| enable\_encryption | Enable encryption for s3 bucket | `bool` | n/a | yes |
|
||||
| enable\_intelligent\_tiering | Enable intelligent tiering | `bool` | `true` | no |
|
||||
| enable\_replication | Enable s3 bucket replication | `bool` | `false` | no |
|
||||
| enable\_versioning | Enable s3 bucket versioning | `bool` | n/a | yes |
|
||||
| encryption\_key\_arn | Leave blank to use AES256 | `string` | `""` | no |
|
||||
| logging\_bucket\_id | Logging bucket id | `string` | `null` | no |
|
||||
| noncurrent-version-archive-tier | Non-current version archive storage class. Valid values are GLACIER, STANDARD\_IA, ONEZONE\_IA, INTELLIGENT\_TIERING, DEEP\_ARCHIVE, GLACIER\_IR | `string` | `"GLACIER"` | no |
|
||||
| noncurrent-version-transition-days | Days to transition non-current version to archive | `number` | `15` | no |
|
||||
| noncurrent\_version\_expiration\_days | 731 for flowlogs | `number` | `2560` | no |
|
||||
| replication\_dest\_bucket\_name | Replica bucket name | `string` | `null` | no |
|
||||
| replication\_destination\_aws\_account\_id | AWS account id of replica bucket | `number` | `null` | no |
|
||||
| replication\_destination\_kms\_key\_arn | KMS key ARN of destination bucket | `string` | `null` | no |
|
||||
| replication\_role\_arn | IAM role of s3 bucket replication | `string` | `null` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
| Name | Description |
|
||||
|------|-------------|
|
||||
| bucket\_arn | n/a |
|
||||
| bucket\_name | n/a |
|
||||
|
||||
---
|
||||
## Authorship
|
||||
This module was developed by UPDATE_THIS.
|
||||
Reference in New Issue
Block a user