terraform.aws-baseline-infra/modules/security_identity_compliance/cloudtrail_cwlogs/ct-s3-bucket.tf
2021-01-26 21:40:02 +08:00

76 lines
1.5 KiB
HCL

data "aws_iam_policy_document" "cloudtrail_bucket_policy" {
statement {
sid = "AWSCloudTrailAclCheck"
principals {
type = "Service"
identifiers = ["cloudtrail.amazonaws.com"]
}
actions = [
"s3:GetBucketAcl",
]
resources = [
"arn:aws:s3:::${local.ct-bucket-name}",
]
}
statement {
sid = "AWSCloudTrailWrite"
principals {
type = "Service"
identifiers = ["config.amazonaws.com", "cloudtrail.amazonaws.com"]
}
actions = [
"s3:PutObject",
]
resources = [
"arn:aws:s3:::${local.ct-bucket-name}/*",
]
}
}
resource "aws_s3_bucket" "ct-bucket" {
bucket = local.ct-bucket-name
policy = join("", data.aws_iam_policy_document.cloudtrail_bucket_policy.*.json)
versioning {
enabled = false
}
server_side_encryption_configuration {
rule {
apply_server_side_encryption_by_default {
kms_master_key_id = aws_kms_key.ctbucket-key.arn
sse_algorithm = "aws:kms"
}
}
}
tags = var.default-tags
lifecycle_rule {
enabled = false
transition {
days = 30
storage_class = "INTELLIGENT_TIERING"
}
expiration {
days = 90
}
}
}
resource "aws_s3_bucket_public_access_block" "s3-public-access-settings" {
bucket = aws_s3_bucket.ct-bucket.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}