68 lines
1.8 KiB
HCL
68 lines
1.8 KiB
HCL
resource "aws_s3_bucket" "images" {
|
|
bucket = "${var.project}-${data.aws_caller_identity.current.account_id}"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_s3_bucket_server_side_encryption_configuration" "images" {
|
|
bucket = aws_s3_bucket.images.id
|
|
rule {
|
|
apply_server_side_encryption_by_default {
|
|
sse_algorithm = "aws:kms"
|
|
kms_master_key_id = local.kms_key_arn
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "images" {
|
|
bucket = aws_s3_bucket.images.id
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_lifecycle_configuration" "images" {
|
|
bucket = aws_s3_bucket.images.id
|
|
rule {
|
|
id = "delete-after-30-days"
|
|
status = "Enabled"
|
|
expiration { days = 30 }
|
|
}
|
|
}
|
|
|
|
resource "aws_s3_bucket_logging" "images" {
|
|
bucket = aws_s3_bucket.images.id
|
|
target_bucket = aws_s3_bucket.logs.id
|
|
target_prefix = "s3-access-logs/"
|
|
}
|
|
|
|
resource "aws_s3_bucket" "logs" {
|
|
bucket = "${var.project}-logs-${data.aws_caller_identity.current.account_id}"
|
|
tags = local.tags
|
|
}
|
|
|
|
resource "aws_s3_bucket_public_access_block" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
block_public_acls = true
|
|
block_public_policy = true
|
|
ignore_public_acls = true
|
|
restrict_public_buckets = true
|
|
}
|
|
|
|
resource "aws_s3_bucket_policy" "logs" {
|
|
bucket = aws_s3_bucket.logs.id
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
Sid = "S3LogDelivery"
|
|
Effect = "Allow"
|
|
Principal = { Service = "logging.s3.amazonaws.com" }
|
|
Action = "s3:PutObject"
|
|
Resource = "${aws_s3_bucket.logs.arn}/s3-access-logs/*"
|
|
Condition = {
|
|
StringEquals = { "aws:SourceAccount" = data.aws_caller_identity.current.account_id }
|
|
}
|
|
}]
|
|
})
|
|
}
|