39 | > Watch demo of using Atmos with Terraform
40 | > 
41 | > Example of running atmos to manage infrastructure from our Quick Start tutorial.
42 | >
43 |
44 |
45 | ## Introduction
46 |
47 | The module will create:
48 |
49 | * S3 bucket with server side encryption
50 | * KMS key to encrypt flow logs files in the bucket
51 | * Optional VPC Flow Log backed by the S3 bucket (this can be disabled, e.g. in multi-account environments if you want to create an S3 bucket in one account and VPC Flow Logs in different accounts)
52 |
53 |
54 |
55 |
56 | ## Usage
57 |
58 | For a complete example, see [examples/complete](examples/complete).
59 |
60 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)
61 | (which tests and deploys the example on Datadog), see [test](test).
62 |
63 |
64 | ```hcl
65 | module "vpc" {
66 | source = "cloudposse/vpc/aws"
67 | version = "0.18.0"
68 |
69 | namespace = "eg"
70 | stage = "test"
71 | name = "flowlogs"
72 | cidr_block = "172.16.0.0/16"
73 | }
74 |
75 | module "flow_logs" {
76 | source = "cloudposse/vpc-flow-logs-s3-bucket/aws"
77 | version = "0.8.0"
78 |
79 | namespace = "eg"
80 | stage = "test"
81 | name = "flowlogs"
82 |
83 | vpc_id = module.vpc.vpc_id
84 | }
85 | ```
86 |
87 | > [!IMPORTANT]
88 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation
89 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version
90 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic
91 | > approach for updating versions to avoid unexpected changes.
92 |
93 |
94 |
95 |
96 |
97 |
98 |
99 |
100 |
101 | ## Makefile Targets
102 | ```text
103 | Available targets:
104 |
105 | help Help screen
106 | help/all Display help for all targets
107 | help/short This help short screen
108 | lint Lint terraform code
109 |
110 | ```
111 |
112 |
113 | ## Requirements
114 |
115 | | Name | Version |
116 | |------|---------|
117 | | [terraform](#requirement\_terraform) | >= 1.3.0 |
118 | | [aws](#requirement\_aws) | >= 4.9.0 |
119 |
120 | ## Providers
121 |
122 | | Name | Version |
123 | |------|---------|
124 | | [aws](#provider\_aws) | >= 4.9.0 |
125 |
126 | ## Modules
127 |
128 | | Name | Source | Version |
129 | |------|--------|---------|
130 | | [bucket\_name](#module\_bucket\_name) | cloudposse/label/null | 0.25.0 |
131 | | [kms\_key](#module\_kms\_key) | cloudposse/kms-key/aws | 0.12.2 |
132 | | [s3\_log\_storage\_bucket](#module\_s3\_log\_storage\_bucket) | cloudposse/s3-log-storage/aws | 1.4.2 |
133 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 |
134 |
135 | ## Resources
136 |
137 | | Name | Type |
138 | |------|------|
139 | | [aws_flow_log.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
140 | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
141 | | [aws_iam_policy_document.bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
142 | | [aws_iam_policy_document.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
143 | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
144 |
145 | ## Inputs
146 |
147 | | Name | Description | Type | Default | Required |
148 | |------|-------------|------|---------|:--------:|
149 | | [access\_log\_bucket\_name](#input\_access\_log\_bucket\_name) | Name of the S3 bucket where S3 access log will be sent to | `string` | `""` | no |
150 | | [access\_log\_bucket\_prefix](#input\_access\_log\_bucket\_prefix) | Prefix to prepend to the current S3 bucket name, where S3 access logs will be sent to | `string` | `"logs/"` | no |
151 | | [acl](#input\_acl) | The canned ACL to apply. We recommend log-delivery-write for compatibility with AWS services | `string` | `"log-delivery-write"` | no |
152 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
153 | | [allow\_ssl\_requests\_only](#input\_allow\_ssl\_requests\_only) | Set to `true` to require requests to use Secure Socket Layer (HTTPS/SSL). This will explicitly deny access to HTTP requests | `bool` | `true` | no |
154 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no |
155 | | [bucket\_key\_enabled](#input\_bucket\_key\_enabled) | Set this to true to use Amazon S3 Bucket Keys for SSE-KMS, which may reduce the number of AWS KMS requests.
For more information, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html | `bool` | `true` | no |
156 | | [bucket\_name](#input\_bucket\_name) | Bucket name. If not provided, the bucket will be created with a name generated from the context. | `string` | `""` | no |
157 | | [bucket\_notifications\_enabled](#input\_bucket\_notifications\_enabled) | Send notifications for the object created events. Used for 3rd-party log collection from a bucket | `bool` | `false` | no |
158 | | [bucket\_notifications\_prefix](#input\_bucket\_notifications\_prefix) | Prefix filter. Used to manage object notifications | `string` | `""` | no |
159 | | [bucket\_notifications\_type](#input\_bucket\_notifications\_type) | Type of the notification configuration. Only SQS is supported. | `string` | `"SQS"` | no |
160 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | {
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
} | no |
161 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
162 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
163 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
164 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
165 | | [expiration\_days](#input\_expiration\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days after which to expunge the objects | `number` | `null` | no |
166 | | [flow\_log\_enabled](#input\_flow\_log\_enabled) | Enable/disable the Flow Log creation. Useful in multi-account environments where the bucket is in one account, but VPC Flow Logs are in different accounts | `bool` | `true` | no |
167 | | [force\_destroy](#input\_force\_destroy) | A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | `bool` | `false` | no |
168 | | [glacier\_transition\_days](#input\_glacier\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days after which to move the data to the Glacier Flexible Retrieval storage tier | `number` | `null` | no |
169 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no |
170 | | [kms\_key\_arn](#input\_kms\_key\_arn) | ARN (or alias) of KMS that will be used for s3 bucket encryption. | `string` | `""` | no |
171 | | [kms\_policy\_source\_json](#input\_kms\_policy\_source\_json) | Additional IAM policy document that can optionally be merged with default created KMS policy | `string` | `""` | no |
172 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no |
173 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
174 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no |
175 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | [
"default"
]
| no |
176 | | [lifecycle\_configuration\_rules](#input\_lifecycle\_configuration\_rules) | A list of lifecycle V2 rules | list(object({
enabled = bool
id = string
abort_incomplete_multipart_upload_days = number
# `filter_and` is the `and` configuration block inside the `filter` configuration.
# This is the only place you should specify a prefix.
filter_and = optional(object({
object_size_greater_than = optional(number) # integer >= 0
object_size_less_than = optional(number) # integer >= 1
prefix = optional(string)
tags = optional(map(string))
}))
expiration = optional(object({
date = optional(string) # string, RFC3339 time format, GMT
days = optional(number) # integer > 0
expired_object_delete_marker = optional(bool)
}))
noncurrent_version_expiration = optional(object({
newer_noncurrent_versions = optional(number) # integer > 0
noncurrent_days = optional(number) # integer >= 0
}))
transition = optional(list(object({
date = optional(string) # string, RFC3339 time format, GMT
days = optional(number) # integer >= 0
storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
})), [])
noncurrent_version_transition = optional(list(object({
newer_noncurrent_versions = optional(number) # integer >= 0
noncurrent_days = optional(number) # integer >= 0
storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
})), [])
})) | `[]` | no |
177 | | [lifecycle\_prefix](#input\_lifecycle\_prefix) | (Deprecated, use `lifecycle_configuration_rules` instead)
Prefix filter. Used to manage object lifecycle events | `string` | `null` | no |
178 | | [lifecycle\_rule\_enabled](#input\_lifecycle\_rule\_enabled) | DEPRECATED: Use `lifecycle_configuration_rules` instead.
When `true`, configures lifecycle events on this bucket using individual (now deprecated) variables.
When `false`, lifecycle events are not configured using individual (now deprecated) variables, but `lifecycle_configuration_rules` still apply.
When `null`, lifecycle events are configured using individual (now deprecated) variables only if `lifecycle_configuration_rules` is empty. | `bool` | `null` | no |
179 | | [lifecycle\_tags](#input\_lifecycle\_tags) | (Deprecated, use `lifecycle_configuration_rules` instead)
Tags filter. Used to manage object lifecycle events | `map(string)` | `null` | no |
180 | | [log\_format](#input\_log\_format) | The fields to include in the flow log record, in the order in which they should appear. | `string` | `null` | no |
181 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
182 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
183 | | [noncurrent\_version\_expiration\_days](#input\_noncurrent\_version\_expiration\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Specifies when non-current object versions expire (in days) | `number` | `null` | no |
184 | | [noncurrent\_version\_transition\_days](#input\_noncurrent\_version\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Specifies (in days) when noncurrent object versions transition to Glacier Flexible Retrieval | `number` | `null` | no |
185 | | [object\_lock\_configuration](#input\_object\_lock\_configuration) | A configuration for [S3 object locking](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html). | object({
mode = string # Valid values are GOVERNANCE and COMPLIANCE.
days = number
years = number
}) | `null` | no |
186 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
187 | | [s3\_object\_ownership](#input\_s3\_object\_ownership) | Specifies the S3 object ownership control.
Valid values are `ObjectWriter`, `BucketOwnerPreferred`, and `BucketOwnerEnforced`."
Default of `BucketOwnerPreferred` is for backwards compatibility.
Recommended setting is `BucketOwnerEnforced`, which will be used if you pass in `null`. | `string` | `"BucketOwnerPreferred"` | no |
188 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
189 | | [standard\_transition\_days](#input\_standard\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days to persist in the standard storage tier before moving to the infrequent access tier | `number` | `null` | no |
190 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
191 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
192 | | [traffic\_type](#input\_traffic\_type) | The type of traffic to capture. Valid values: `ACCEPT`, `REJECT`, `ALL` | `string` | `"ALL"` | no |
193 | | [versioning\_enabled](#input\_versioning\_enabled) | Enable object versioning, keeping multiple variants of an object in the same bucket | `bool` | `false` | no |
194 | | [vpc\_id](#input\_vpc\_id) | VPC ID to create flow logs for | `string` | `null` | no |
195 |
196 | ## Outputs
197 |
198 | | Name | Description |
199 | |------|-------------|
200 | | [bucket\_arn](#output\_bucket\_arn) | Bucket ARN |
201 | | [bucket\_domain\_name](#output\_bucket\_domain\_name) | FQDN of bucket |
202 | | [bucket\_id](#output\_bucket\_id) | Bucket Name (aka ID) |
203 | | [bucket\_notifications\_sqs\_queue\_arn](#output\_bucket\_notifications\_sqs\_queue\_arn) | Notifications SQS queue ARN |
204 | | [bucket\_prefix](#output\_bucket\_prefix) | Bucket prefix configured for lifecycle rules |
205 | | [flow\_log\_arn](#output\_flow\_log\_arn) | Flow Log ARN |
206 | | [flow\_log\_id](#output\_flow\_log\_id) | Flow Log ID |
207 | | [kms\_alias\_arn](#output\_kms\_alias\_arn) | KMS Alias ARN |
208 | | [kms\_alias\_name](#output\_kms\_alias\_name) | KMS Alias name |
209 | | [kms\_key\_arn](#output\_kms\_key\_arn) | KMS Key ARN |
210 | | [kms\_key\_id](#output\_kms\_key\_id) | KMS Key ID |
211 |
212 |
213 |
214 | ## Related Projects
215 |
216 | Check out these related projects.
217 |
218 | - [terraform-aws-vpc](https://github.com/cloudposse/terraform-aws-vpc) - Terraform Module that defines a VPC with public/private subnets across multiple AZs with Internet Gateways
219 | - [CIS AWS Foundations Benchmark in the AWS Cloud](https://github.com/aws-quickstart/quickstart-compliance-cis-benchmark) - CIS Benchmarks are consensus-based configuration guidelines developed by experts in US government, business, industry, and academia to help organizations assess and improve security
220 |
221 |
222 | > [!TIP]
223 | > #### Use Terraform Reference Architectures for AWS
224 | >
225 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly.
226 | >
227 | > ✅ We build it together with your team.
228 | > ✅ Your team owns everything.
229 | > ✅ 100% Open Source and backed by fanatical support.
230 | >
231 | > 
232 | > 📚 Learn More
233 | >
234 | >
235 | >
236 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-vpc-flow-logs-s3-bucket&utm_content=commercial_support) for funded startups and enterprises.
237 | >
238 | > *Your team can operate like a pro today.*
239 | >
240 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed.
241 | > #### Day-0: Your Foundation for Success
242 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code.
243 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases.
244 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance.
245 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations.
246 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions.
247 | >
248 | >
249 | >
250 | > #### Day-2: Your Operational Mastery
251 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency.
252 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it.
253 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity.
254 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration.
255 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly.
256 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value.
257 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate.
258 | >
259 | >
260 | > 
272 |
273 |
274 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket/issues).
275 |
276 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.
277 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md).
278 | 2. **Fork** the repo on GitHub
279 | 3. **Clone** the project to your own machine
280 | 4. **Commit** changes to your own branch
281 | 5. **Push** your work back up to your fork
282 | 6. Submit a **Pull Request** so that we can review your changes
283 |
284 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request!
285 |
286 | ### 🌎 Slack Community
287 |
288 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-vpc-flow-logs-s3-bucket&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure.
289 |
290 | ### 📰 Newsletter
291 |
292 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-vpc-flow-logs-s3-bucket&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know.
293 | Dropped straight into your Inbox every week — and usually a 5-minute read.
294 |
295 | ### 📆 Office Hours 
296 |
297 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-vpc-flow-logs-s3-bucket&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else.
298 | It's **FREE** for everyone!
299 | ## License
300 |
301 | 
302 |
303 |
304 | Preamble to the Apache License, Version 2.0
305 |
306 |
307 |
308 | Complete license is available in the [`LICENSE`](LICENSE) file.
309 |
310 | ```text
311 | Licensed to the Apache Software Foundation (ASF) under one
312 | or more contributor license agreements. See the NOTICE file
313 | distributed with this work for additional information
314 | regarding copyright ownership. The ASF licenses this file
315 | to you under the Apache License, Version 2.0 (the
316 | "License"); you may not use this file except in compliance
317 | with the License. You may obtain a copy of the License at
318 |
319 | https://www.apache.org/licenses/LICENSE-2.0
320 |
321 | Unless required by applicable law or agreed to in writing,
322 | software distributed under the License is distributed on an
323 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
324 | KIND, either express or implied. See the License for the
325 | specific language governing permissions and limitations
326 | under the License.
327 | ```
328 |
329 |
330 | ## Trademarks
331 |
332 | All other trademarks referenced herein are the property of their respective owners.
333 |
334 |
335 | ---
336 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright)
337 |
338 |
339 | 
340 |
341 | 
342 |
--------------------------------------------------------------------------------
/README.yaml:
--------------------------------------------------------------------------------
1 | #
2 | # This is the canonical configuration for the `README.md`
3 | # Run `make readme` to rebuild the `README.md`
4 | #
5 |
6 | # Name of this project
7 | name: terraform-aws-vpc-flow-logs-s3-bucket
8 | # Logo for this project
9 | #logo: docs/logo.png
10 |
11 | # License of this project
12 | license: "APACHE2"
13 |
14 | # Canonical GitHub repo
15 | github_repo: cloudposse/terraform-aws-vpc-flow-logs-s3-bucket
16 |
17 | # Badges to display
18 | badges:
19 | - name: Latest Release
20 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket.svg?style=for-the-badge
21 | url: https://github.com/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket/releases/latest
22 | - name: Last Updated
23 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket.svg?style=for-the-badge
24 | url: https://github.com/cloudposse/terraform-aws-vpc-flow-logs-s3-bucket/commits
25 | - name: Slack Community
26 | image: https://slack.cloudposse.com/for-the-badge.svg
27 | url: https://slack.cloudposse.com
28 |
29 | # List any related terraform modules that this module may be used with or that this module depends on.
30 | related:
31 | - name: "terraform-aws-vpc"
32 | description: "Terraform Module that defines a VPC with public/private subnets across multiple AZs with Internet Gateways"
33 | url: "https://github.com/cloudposse/terraform-aws-vpc"
34 | - name: "CIS AWS Foundations Benchmark in the AWS Cloud"
35 | description: "CIS Benchmarks are consensus-based configuration guidelines developed by experts in US government, business, industry, and academia to help organizations assess and improve security"
36 | url: "https://github.com/aws-quickstart/quickstart-compliance-cis-benchmark"
37 |
38 | # Short description of this project
39 | description: |-
40 | Terraform module to create AWS [`VPC Flow logs`](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) backed by S3.
41 |
42 | introduction: |-
43 | The module will create:
44 |
45 | * S3 bucket with server side encryption
46 | * KMS key to encrypt flow logs files in the bucket
47 | * Optional VPC Flow Log backed by the S3 bucket (this can be disabled, e.g. in multi-account environments if you want to create an S3 bucket in one account and VPC Flow Logs in different accounts)
48 |
49 | # How to use this project
50 | usage: |-
51 | For a complete example, see [examples/complete](examples/complete).
52 |
53 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) and [Terratest](https://github.com/gruntwork-io/terratest)
54 | (which tests and deploys the example on Datadog), see [test](test).
55 |
56 |
57 | ```hcl
58 | module "vpc" {
59 | source = "cloudposse/vpc/aws"
60 | version = "0.18.0"
61 |
62 | namespace = "eg"
63 | stage = "test"
64 | name = "flowlogs"
65 | cidr_block = "172.16.0.0/16"
66 | }
67 |
68 | module "flow_logs" {
69 | source = "cloudposse/vpc-flow-logs-s3-bucket/aws"
70 | version = "0.8.0"
71 |
72 | namespace = "eg"
73 | stage = "test"
74 | name = "flowlogs"
75 |
76 | vpc_id = module.vpc.vpc_id
77 | }
78 | ```
79 |
80 | include:
81 | - "docs/targets.md"
82 | - "docs/terraform.md"
83 |
84 | # Contributors to this project
85 | contributors: []
86 |
--------------------------------------------------------------------------------
/context.tf:
--------------------------------------------------------------------------------
1 | #
2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3 | # All other instances of this file should be a copy of that one
4 | #
5 | #
6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7 | # and then place it in your Terraform module to automatically get
8 | # Cloud Posse's standard configuration inputs suitable for passing
9 | # to Cloud Posse modules.
10 | #
11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12 | #
13 | # Modules should access the whole context as `module.this.context`
14 | # to get the input variables with nulls for defaults,
15 | # for example `context = module.this.context`,
16 | # and access individual variables as `module.this.`,
17 | # with final values filled in.
18 | #
19 | # For example, when using defaults, `module.this.context.delimiter`
20 | # will be null, and `module.this.delimiter` will be `-` (hyphen).
21 | #
22 |
23 | module "this" {
24 | source = "cloudposse/label/null"
25 | version = "0.25.0" # requires Terraform >= 0.13.0
26 |
27 | enabled = var.enabled
28 | namespace = var.namespace
29 | tenant = var.tenant
30 | environment = var.environment
31 | stage = var.stage
32 | name = var.name
33 | delimiter = var.delimiter
34 | attributes = var.attributes
35 | tags = var.tags
36 | additional_tag_map = var.additional_tag_map
37 | label_order = var.label_order
38 | regex_replace_chars = var.regex_replace_chars
39 | id_length_limit = var.id_length_limit
40 | label_key_case = var.label_key_case
41 | label_value_case = var.label_value_case
42 | descriptor_formats = var.descriptor_formats
43 | labels_as_tags = var.labels_as_tags
44 |
45 | context = var.context
46 | }
47 |
48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here
49 |
50 | variable "context" {
51 | type = any
52 | default = {
53 | enabled = true
54 | namespace = null
55 | tenant = null
56 | environment = null
57 | stage = null
58 | name = null
59 | delimiter = null
60 | attributes = []
61 | tags = {}
62 | additional_tag_map = {}
63 | regex_replace_chars = null
64 | label_order = []
65 | id_length_limit = null
66 | label_key_case = null
67 | label_value_case = null
68 | descriptor_formats = {}
69 | # Note: we have to use [] instead of null for unset lists due to
70 | # https://github.com/hashicorp/terraform/issues/28137
71 | # which was not fixed until Terraform 1.0.0,
72 | # but we want the default to be all the labels in `label_order`
73 | # and we want users to be able to prevent all tag generation
74 | # by setting `labels_as_tags` to `[]`, so we need
75 | # a different sentinel to indicate "default"
76 | labels_as_tags = ["unset"]
77 | }
78 | description = <<-EOT
79 | Single object for setting entire context at once.
80 | See description of individual variables for details.
81 | Leave string and numeric variables as `null` to use default value.
82 | Individual variable settings (non-null) override settings in context object,
83 | except for attributes, tags, and additional_tag_map, which are merged.
84 | EOT
85 |
86 | validation {
87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88 | error_message = "Allowed values: `lower`, `title`, `upper`."
89 | }
90 |
91 | validation {
92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94 | }
95 | }
96 |
97 | variable "enabled" {
98 | type = bool
99 | default = null
100 | description = "Set to false to prevent the module from creating any resources"
101 | }
102 |
103 | variable "namespace" {
104 | type = string
105 | default = null
106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107 | }
108 |
109 | variable "tenant" {
110 | type = string
111 | default = null
112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113 | }
114 |
115 | variable "environment" {
116 | type = string
117 | default = null
118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119 | }
120 |
121 | variable "stage" {
122 | type = string
123 | default = null
124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125 | }
126 |
127 | variable "name" {
128 | type = string
129 | default = null
130 | description = <<-EOT
131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132 | This is the only ID element not also included as a `tag`.
133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134 | EOT
135 | }
136 |
137 | variable "delimiter" {
138 | type = string
139 | default = null
140 | description = <<-EOT
141 | Delimiter to be used between ID elements.
142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143 | EOT
144 | }
145 |
146 | variable "attributes" {
147 | type = list(string)
148 | default = []
149 | description = <<-EOT
150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151 | in the order they appear in the list. New attributes are appended to the
152 | end of the list. The elements of the list are joined by the `delimiter`
153 | and treated as a single ID element.
154 | EOT
155 | }
156 |
157 | variable "labels_as_tags" {
158 | type = set(string)
159 | default = ["default"]
160 | description = <<-EOT
161 | Set of labels (ID elements) to include as tags in the `tags` output.
162 | Default is to include all labels.
163 | Tags with empty values will not be included in the `tags` output.
164 | Set to `[]` to suppress all generated tags.
165 | **Notes:**
166 | The value of the `name` tag, if included, will be the `id`, not the `name`.
167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168 | changed in later chained modules. Attempts to change it will be silently ignored.
169 | EOT
170 | }
171 |
172 | variable "tags" {
173 | type = map(string)
174 | default = {}
175 | description = <<-EOT
176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177 | Neither the tag keys nor the tag values will be modified by this module.
178 | EOT
179 | }
180 |
181 | variable "additional_tag_map" {
182 | type = map(string)
183 | default = {}
184 | description = <<-EOT
185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186 | This is for some rare cases where resources want additional configuration of tags
187 | and therefore take a list of maps with tag key, value, and additional configuration.
188 | EOT
189 | }
190 |
191 | variable "label_order" {
192 | type = list(string)
193 | default = null
194 | description = <<-EOT
195 | The order in which the labels (ID elements) appear in the `id`.
196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198 | EOT
199 | }
200 |
201 | variable "regex_replace_chars" {
202 | type = string
203 | default = null
204 | description = <<-EOT
205 | Terraform regular expression (regex) string.
206 | Characters matching the regex will be removed from the ID elements.
207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208 | EOT
209 | }
210 |
211 | variable "id_length_limit" {
212 | type = number
213 | default = null
214 | description = <<-EOT
215 | Limit `id` to this many characters (minimum 6).
216 | Set to `0` for unlimited length.
217 | Set to `null` for keep the existing setting, which defaults to `0`.
218 | Does not affect `id_full`.
219 | EOT
220 | validation {
221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223 | }
224 | }
225 |
226 | variable "label_key_case" {
227 | type = string
228 | default = null
229 | description = <<-EOT
230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231 | Does not affect keys of tags passed in via the `tags` input.
232 | Possible values: `lower`, `title`, `upper`.
233 | Default value: `title`.
234 | EOT
235 |
236 | validation {
237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238 | error_message = "Allowed values: `lower`, `title`, `upper`."
239 | }
240 | }
241 |
242 | variable "label_value_case" {
243 | type = string
244 | default = null
245 | description = <<-EOT
246 | Controls the letter case of ID elements (labels) as included in `id`,
247 | set as tag values, and output by this module individually.
248 | Does not affect values of tags passed in via the `tags` input.
249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251 | Default value: `lower`.
252 | EOT
253 |
254 | validation {
255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257 | }
258 | }
259 |
260 | variable "descriptor_formats" {
261 | type = any
262 | default = {}
263 | description = <<-EOT
264 | Describe additional descriptors to be output in the `descriptors` output map.
265 | Map of maps. Keys are names of descriptors. Values are maps of the form
266 | `{
267 | format = string
268 | labels = list(string)
269 | }`
270 | (Type is `any` so the map values can later be enhanced to provide additional options.)
271 | `format` is a Terraform format string to be passed to the `format()` function.
272 | `labels` is a list of labels, in order, to pass to `format()` function.
273 | Label values will be normalized before being passed to `format()` so they will be
274 | identical to how they appear in `id`.
275 | Default is `{}` (`descriptors` output will be empty).
276 | EOT
277 | }
278 |
279 | #### End of copy of cloudposse/terraform-null-label/variables.tf
280 |
--------------------------------------------------------------------------------
/docs/targets.md:
--------------------------------------------------------------------------------
1 |
2 | ## Makefile Targets
3 | ```text
4 | Available targets:
5 |
6 | help Help screen
7 | help/all Display help for all targets
8 | help/short This help short screen
9 | lint Lint terraform code
10 |
11 | ```
12 |
13 |
--------------------------------------------------------------------------------
/docs/terraform.md:
--------------------------------------------------------------------------------
1 |
2 | ## Requirements
3 |
4 | | Name | Version |
5 | |------|---------|
6 | | [terraform](#requirement\_terraform) | >= 1.3.0 |
7 | | [aws](#requirement\_aws) | >= 4.9.0 |
8 |
9 | ## Providers
10 |
11 | | Name | Version |
12 | |------|---------|
13 | | [aws](#provider\_aws) | >= 4.9.0 |
14 |
15 | ## Modules
16 |
17 | | Name | Source | Version |
18 | |------|--------|---------|
19 | | [bucket\_name](#module\_bucket\_name) | cloudposse/label/null | 0.25.0 |
20 | | [kms\_key](#module\_kms\_key) | cloudposse/kms-key/aws | 0.12.2 |
21 | | [s3\_log\_storage\_bucket](#module\_s3\_log\_storage\_bucket) | cloudposse/s3-log-storage/aws | 1.4.2 |
22 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 |
23 |
24 | ## Resources
25 |
26 | | Name | Type |
27 | |------|------|
28 | | [aws_flow_log.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/flow_log) | resource |
29 | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
30 | | [aws_iam_policy_document.bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
31 | | [aws_iam_policy_document.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
32 | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
33 |
34 | ## Inputs
35 |
36 | | Name | Description | Type | Default | Required |
37 | |------|-------------|------|---------|:--------:|
38 | | [access\_log\_bucket\_name](#input\_access\_log\_bucket\_name) | Name of the S3 bucket where S3 access log will be sent to | `string` | `""` | no |
39 | | [access\_log\_bucket\_prefix](#input\_access\_log\_bucket\_prefix) | Prefix to prepend to the current S3 bucket name, where S3 access logs will be sent to | `string` | `"logs/"` | no |
40 | | [acl](#input\_acl) | The canned ACL to apply. We recommend log-delivery-write for compatibility with AWS services | `string` | `"log-delivery-write"` | no |
41 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no |
42 | | [allow\_ssl\_requests\_only](#input\_allow\_ssl\_requests\_only) | Set to `true` to require requests to use Secure Socket Layer (HTTPS/SSL). This will explicitly deny access to HTTP requests | `bool` | `true` | no |
43 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no |
44 | | [bucket\_key\_enabled](#input\_bucket\_key\_enabled) | Set this to true to use Amazon S3 Bucket Keys for SSE-KMS, which may reduce the number of AWS KMS requests.
For more information, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html | `bool` | `true` | no |
45 | | [bucket\_name](#input\_bucket\_name) | Bucket name. If not provided, the bucket will be created with a name generated from the context. | `string` | `""` | no |
46 | | [bucket\_notifications\_enabled](#input\_bucket\_notifications\_enabled) | Send notifications for the object created events. Used for 3rd-party log collection from a bucket | `bool` | `false` | no |
47 | | [bucket\_notifications\_prefix](#input\_bucket\_notifications\_prefix) | Prefix filter. Used to manage object notifications | `string` | `""` | no |
48 | | [bucket\_notifications\_type](#input\_bucket\_notifications\_type) | Type of the notification configuration. Only SQS is supported. | `string` | `"SQS"` | no |
49 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | {
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
} | no |
50 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
51 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
52 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
53 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
54 | | [expiration\_days](#input\_expiration\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days after which to expunge the objects | `number` | `null` | no |
55 | | [flow\_log\_enabled](#input\_flow\_log\_enabled) | Enable/disable the Flow Log creation. Useful in multi-account environments where the bucket is in one account, but VPC Flow Logs are in different accounts | `bool` | `true` | no |
56 | | [force\_destroy](#input\_force\_destroy) | A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | `bool` | `false` | no |
57 | | [glacier\_transition\_days](#input\_glacier\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days after which to move the data to the Glacier Flexible Retrieval storage tier | `number` | `null` | no |
58 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no |
59 | | [kms\_key\_arn](#input\_kms\_key\_arn) | ARN (or alias) of KMS that will be used for s3 bucket encryption. | `string` | `""` | no |
60 | | [kms\_policy\_source\_json](#input\_kms\_policy\_source\_json) | Additional IAM policy document that can optionally be merged with default created KMS policy | `string` | `""` | no |
61 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no |
62 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
63 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no |
64 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | [
"default"
]
| no |
65 | | [lifecycle\_configuration\_rules](#input\_lifecycle\_configuration\_rules) | A list of lifecycle V2 rules | list(object({
enabled = bool
id = string
abort_incomplete_multipart_upload_days = number
# `filter_and` is the `and` configuration block inside the `filter` configuration.
# This is the only place you should specify a prefix.
filter_and = optional(object({
object_size_greater_than = optional(number) # integer >= 0
object_size_less_than = optional(number) # integer >= 1
prefix = optional(string)
tags = optional(map(string))
}))
expiration = optional(object({
date = optional(string) # string, RFC3339 time format, GMT
days = optional(number) # integer > 0
expired_object_delete_marker = optional(bool)
}))
noncurrent_version_expiration = optional(object({
newer_noncurrent_versions = optional(number) # integer > 0
noncurrent_days = optional(number) # integer >= 0
}))
transition = optional(list(object({
date = optional(string) # string, RFC3339 time format, GMT
days = optional(number) # integer >= 0
storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
})), [])
noncurrent_version_transition = optional(list(object({
newer_noncurrent_versions = optional(number) # integer >= 0
noncurrent_days = optional(number) # integer >= 0
storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
})), [])
})) | `[]` | no |
66 | | [lifecycle\_prefix](#input\_lifecycle\_prefix) | (Deprecated, use `lifecycle_configuration_rules` instead)
Prefix filter. Used to manage object lifecycle events | `string` | `null` | no |
67 | | [lifecycle\_rule\_enabled](#input\_lifecycle\_rule\_enabled) | DEPRECATED: Use `lifecycle_configuration_rules` instead.
When `true`, configures lifecycle events on this bucket using individual (now deprecated) variables.
When `false`, lifecycle events are not configured using individual (now deprecated) variables, but `lifecycle_configuration_rules` still apply.
When `null`, lifecycle events are configured using individual (now deprecated) variables only if `lifecycle_configuration_rules` is empty. | `bool` | `null` | no |
68 | | [lifecycle\_tags](#input\_lifecycle\_tags) | (Deprecated, use `lifecycle_configuration_rules` instead)
Tags filter. Used to manage object lifecycle events | `map(string)` | `null` | no |
69 | | [log\_format](#input\_log\_format) | The fields to include in the flow log record, in the order in which they should appear. | `string` | `null` | no |
70 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
71 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
72 | | [noncurrent\_version\_expiration\_days](#input\_noncurrent\_version\_expiration\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Specifies when non-current object versions expire (in days) | `number` | `null` | no |
73 | | [noncurrent\_version\_transition\_days](#input\_noncurrent\_version\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Specifies (in days) when noncurrent object versions transition to Glacier Flexible Retrieval | `number` | `null` | no |
74 | | [object\_lock\_configuration](#input\_object\_lock\_configuration) | A configuration for [S3 object locking](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html). | object({
mode = string # Valid values are GOVERNANCE and COMPLIANCE.
days = number
years = number
}) | `null` | no |
75 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
76 | | [s3\_object\_ownership](#input\_s3\_object\_ownership) | Specifies the S3 object ownership control.
Valid values are `ObjectWriter`, `BucketOwnerPreferred`, and `BucketOwnerEnforced`."
Default of `BucketOwnerPreferred` is for backwards compatibility.
Recommended setting is `BucketOwnerEnforced`, which will be used if you pass in `null`. | `string` | `"BucketOwnerPreferred"` | no |
77 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
78 | | [standard\_transition\_days](#input\_standard\_transition\_days) | (Deprecated, use `lifecycle_configuration_rules` instead)
Number of days to persist in the standard storage tier before moving to the infrequent access tier | `number` | `null` | no |
79 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
80 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
81 | | [traffic\_type](#input\_traffic\_type) | The type of traffic to capture. Valid values: `ACCEPT`, `REJECT`, `ALL` | `string` | `"ALL"` | no |
82 | | [versioning\_enabled](#input\_versioning\_enabled) | Enable object versioning, keeping multiple variants of an object in the same bucket | `bool` | `false` | no |
83 | | [vpc\_id](#input\_vpc\_id) | VPC ID to create flow logs for | `string` | `null` | no |
84 |
85 | ## Outputs
86 |
87 | | Name | Description |
88 | |------|-------------|
89 | | [bucket\_arn](#output\_bucket\_arn) | Bucket ARN |
90 | | [bucket\_domain\_name](#output\_bucket\_domain\_name) | FQDN of bucket |
91 | | [bucket\_id](#output\_bucket\_id) | Bucket Name (aka ID) |
92 | | [bucket\_notifications\_sqs\_queue\_arn](#output\_bucket\_notifications\_sqs\_queue\_arn) | Notifications SQS queue ARN |
93 | | [bucket\_prefix](#output\_bucket\_prefix) | Bucket prefix configured for lifecycle rules |
94 | | [flow\_log\_arn](#output\_flow\_log\_arn) | Flow Log ARN |
95 | | [flow\_log\_id](#output\_flow\_log\_id) | Flow Log ID |
96 | | [kms\_alias\_arn](#output\_kms\_alias\_arn) | KMS Alias ARN |
97 | | [kms\_alias\_name](#output\_kms\_alias\_name) | KMS Alias name |
98 | | [kms\_key\_arn](#output\_kms\_key\_arn) | KMS Key ARN |
99 | | [kms\_key\_id](#output\_kms\_key\_id) | KMS Key ID |
100 |
101 |
--------------------------------------------------------------------------------
/examples/complete/context.tf:
--------------------------------------------------------------------------------
1 | #
2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label
3 | # All other instances of this file should be a copy of that one
4 | #
5 | #
6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf
7 | # and then place it in your Terraform module to automatically get
8 | # Cloud Posse's standard configuration inputs suitable for passing
9 | # to Cloud Posse modules.
10 | #
11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf
12 | #
13 | # Modules should access the whole context as `module.this.context`
14 | # to get the input variables with nulls for defaults,
15 | # for example `context = module.this.context`,
16 | # and access individual variables as `module.this.`,
17 | # with final values filled in.
18 | #
19 | # For example, when using defaults, `module.this.context.delimiter`
20 | # will be null, and `module.this.delimiter` will be `-` (hyphen).
21 | #
22 |
23 | module "this" {
24 | source = "cloudposse/label/null"
25 | version = "0.25.0" # requires Terraform >= 0.13.0
26 |
27 | enabled = var.enabled
28 | namespace = var.namespace
29 | tenant = var.tenant
30 | environment = var.environment
31 | stage = var.stage
32 | name = var.name
33 | delimiter = var.delimiter
34 | attributes = var.attributes
35 | tags = var.tags
36 | additional_tag_map = var.additional_tag_map
37 | label_order = var.label_order
38 | regex_replace_chars = var.regex_replace_chars
39 | id_length_limit = var.id_length_limit
40 | label_key_case = var.label_key_case
41 | label_value_case = var.label_value_case
42 | descriptor_formats = var.descriptor_formats
43 | labels_as_tags = var.labels_as_tags
44 |
45 | context = var.context
46 | }
47 |
48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here
49 |
50 | variable "context" {
51 | type = any
52 | default = {
53 | enabled = true
54 | namespace = null
55 | tenant = null
56 | environment = null
57 | stage = null
58 | name = null
59 | delimiter = null
60 | attributes = []
61 | tags = {}
62 | additional_tag_map = {}
63 | regex_replace_chars = null
64 | label_order = []
65 | id_length_limit = null
66 | label_key_case = null
67 | label_value_case = null
68 | descriptor_formats = {}
69 | # Note: we have to use [] instead of null for unset lists due to
70 | # https://github.com/hashicorp/terraform/issues/28137
71 | # which was not fixed until Terraform 1.0.0,
72 | # but we want the default to be all the labels in `label_order`
73 | # and we want users to be able to prevent all tag generation
74 | # by setting `labels_as_tags` to `[]`, so we need
75 | # a different sentinel to indicate "default"
76 | labels_as_tags = ["unset"]
77 | }
78 | description = <<-EOT
79 | Single object for setting entire context at once.
80 | See description of individual variables for details.
81 | Leave string and numeric variables as `null` to use default value.
82 | Individual variable settings (non-null) override settings in context object,
83 | except for attributes, tags, and additional_tag_map, which are merged.
84 | EOT
85 |
86 | validation {
87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"])
88 | error_message = "Allowed values: `lower`, `title`, `upper`."
89 | }
90 |
91 | validation {
92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"])
93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
94 | }
95 | }
96 |
97 | variable "enabled" {
98 | type = bool
99 | default = null
100 | description = "Set to false to prevent the module from creating any resources"
101 | }
102 |
103 | variable "namespace" {
104 | type = string
105 | default = null
106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique"
107 | }
108 |
109 | variable "tenant" {
110 | type = string
111 | default = null
112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for"
113 | }
114 |
115 | variable "environment" {
116 | type = string
117 | default = null
118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'"
119 | }
120 |
121 | variable "stage" {
122 | type = string
123 | default = null
124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'"
125 | }
126 |
127 | variable "name" {
128 | type = string
129 | default = null
130 | description = <<-EOT
131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
132 | This is the only ID element not also included as a `tag`.
133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.
134 | EOT
135 | }
136 |
137 | variable "delimiter" {
138 | type = string
139 | default = null
140 | description = <<-EOT
141 | Delimiter to be used between ID elements.
142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.
143 | EOT
144 | }
145 |
146 | variable "attributes" {
147 | type = list(string)
148 | default = []
149 | description = <<-EOT
150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
151 | in the order they appear in the list. New attributes are appended to the
152 | end of the list. The elements of the list are joined by the `delimiter`
153 | and treated as a single ID element.
154 | EOT
155 | }
156 |
157 | variable "labels_as_tags" {
158 | type = set(string)
159 | default = ["default"]
160 | description = <<-EOT
161 | Set of labels (ID elements) to include as tags in the `tags` output.
162 | Default is to include all labels.
163 | Tags with empty values will not be included in the `tags` output.
164 | Set to `[]` to suppress all generated tags.
165 | **Notes:**
166 | The value of the `name` tag, if included, will be the `id`, not the `name`.
167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
168 | changed in later chained modules. Attempts to change it will be silently ignored.
169 | EOT
170 | }
171 |
172 | variable "tags" {
173 | type = map(string)
174 | default = {}
175 | description = <<-EOT
176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
177 | Neither the tag keys nor the tag values will be modified by this module.
178 | EOT
179 | }
180 |
181 | variable "additional_tag_map" {
182 | type = map(string)
183 | default = {}
184 | description = <<-EOT
185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
186 | This is for some rare cases where resources want additional configuration of tags
187 | and therefore take a list of maps with tag key, value, and additional configuration.
188 | EOT
189 | }
190 |
191 | variable "label_order" {
192 | type = list(string)
193 | default = null
194 | description = <<-EOT
195 | The order in which the labels (ID elements) appear in the `id`.
196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"].
197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
198 | EOT
199 | }
200 |
201 | variable "regex_replace_chars" {
202 | type = string
203 | default = null
204 | description = <<-EOT
205 | Terraform regular expression (regex) string.
206 | Characters matching the regex will be removed from the ID elements.
207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.
208 | EOT
209 | }
210 |
211 | variable "id_length_limit" {
212 | type = number
213 | default = null
214 | description = <<-EOT
215 | Limit `id` to this many characters (minimum 6).
216 | Set to `0` for unlimited length.
217 | Set to `null` for keep the existing setting, which defaults to `0`.
218 | Does not affect `id_full`.
219 | EOT
220 | validation {
221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0
222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length."
223 | }
224 | }
225 |
226 | variable "label_key_case" {
227 | type = string
228 | default = null
229 | description = <<-EOT
230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
231 | Does not affect keys of tags passed in via the `tags` input.
232 | Possible values: `lower`, `title`, `upper`.
233 | Default value: `title`.
234 | EOT
235 |
236 | validation {
237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case)
238 | error_message = "Allowed values: `lower`, `title`, `upper`."
239 | }
240 | }
241 |
242 | variable "label_value_case" {
243 | type = string
244 | default = null
245 | description = <<-EOT
246 | Controls the letter case of ID elements (labels) as included in `id`,
247 | set as tag values, and output by this module individually.
248 | Does not affect values of tags passed in via the `tags` input.
249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation).
250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
251 | Default value: `lower`.
252 | EOT
253 |
254 | validation {
255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case)
256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`."
257 | }
258 | }
259 |
260 | variable "descriptor_formats" {
261 | type = any
262 | default = {}
263 | description = <<-EOT
264 | Describe additional descriptors to be output in the `descriptors` output map.
265 | Map of maps. Keys are names of descriptors. Values are maps of the form
266 | `{
267 | format = string
268 | labels = list(string)
269 | }`
270 | (Type is `any` so the map values can later be enhanced to provide additional options.)
271 | `format` is a Terraform format string to be passed to the `format()` function.
272 | `labels` is a list of labels, in order, to pass to `format()` function.
273 | Label values will be normalized before being passed to `format()` so they will be
274 | identical to how they appear in `id`.
275 | Default is `{}` (`descriptors` output will be empty).
276 | EOT
277 | }
278 |
279 | #### End of copy of cloudposse/terraform-null-label/variables.tf
280 |
--------------------------------------------------------------------------------
/examples/complete/fixtures.us-east-2.tfvars:
--------------------------------------------------------------------------------
1 | region = "us-east-2"
2 |
3 | namespace = "eg"
4 |
5 | stage = "test"
6 |
7 | name = "flowlogs"
8 |
--------------------------------------------------------------------------------
/examples/complete/main.tf:
--------------------------------------------------------------------------------
1 | provider "aws" {
2 | region = var.region
3 | }
4 |
5 | module "vpc" {
6 | source = "cloudposse/vpc/aws"
7 | version = "2.0.0"
8 |
9 | ipv4_primary_cidr_block = "172.16.0.0/16"
10 |
11 | context = module.this.context
12 | }
13 |
14 | module "flow_logs" {
15 | source = "../../"
16 |
17 | flow_log_enabled = var.flow_log_enabled
18 | lifecycle_prefix = var.lifecycle_prefix
19 | lifecycle_rule_enabled = var.lifecycle_rule_enabled
20 | noncurrent_version_expiration_days = var.noncurrent_version_expiration_days
21 | noncurrent_version_transition_days = var.noncurrent_version_transition_days
22 | standard_transition_days = var.standard_transition_days
23 | glacier_transition_days = var.glacier_transition_days
24 | expiration_days = var.expiration_days
25 | traffic_type = var.traffic_type
26 | allow_ssl_requests_only = var.allow_ssl_requests_only
27 | vpc_id = module.vpc.vpc_id
28 | kms_key_arn = var.kms_key_arn
29 |
30 | # For testing
31 | force_destroy = true
32 |
33 | context = module.this.context
34 | }
35 |
--------------------------------------------------------------------------------
/examples/complete/outputs.tf:
--------------------------------------------------------------------------------
1 | output "kms_key_arn" {
2 | value = module.flow_logs.kms_key_arn
3 | description = "KMS Key ARN"
4 | }
5 |
6 | output "kms_key_id" {
7 | value = module.flow_logs.kms_key_id
8 | description = "KMS Key ID"
9 | }
10 |
11 | output "kms_alias_arn" {
12 | value = module.flow_logs.kms_alias_arn
13 | description = "KMS Alias ARN"
14 | }
15 |
16 | output "kms_alias_name" {
17 | value = module.flow_logs.kms_alias_name
18 | description = "KMS Alias name"
19 | }
20 |
21 | output "bucket_domain_name" {
22 | value = module.flow_logs.bucket_domain_name
23 | description = "FQDN of bucket"
24 | }
25 |
26 | output "bucket_id" {
27 | value = module.flow_logs.bucket_id
28 | description = "Bucket Name (aka ID)"
29 | }
30 |
31 | output "bucket_arn" {
32 | value = module.flow_logs.bucket_arn
33 | description = "Bucket ARN"
34 | }
35 |
36 | output "bucket_prefix" {
37 | value = module.flow_logs.bucket_prefix
38 | description = "Bucket prefix configured for lifecycle rules"
39 | }
40 |
41 | output "flow_log_id" {
42 | value = module.flow_logs.flow_log_id
43 | description = "Flow Log ID"
44 | }
45 |
46 | output "flow_log_arn" {
47 | value = module.flow_logs.flow_log_arn
48 | description = "Flow Log ARN"
49 | }
50 |
--------------------------------------------------------------------------------
/examples/complete/variables.tf:
--------------------------------------------------------------------------------
1 | variable "region" {
2 | type = string
3 | description = "AWS Region"
4 | }
5 |
6 | variable "lifecycle_prefix" {
7 | type = string
8 | description = "Prefix filter. Used to manage object lifecycle events"
9 | default = ""
10 | }
11 |
12 | variable "lifecycle_tags" {
13 | type = map(string)
14 | description = "Tags filter. Used to manage object lifecycle events"
15 | default = {}
16 | }
17 |
18 | variable "lifecycle_rule_enabled" {
19 | type = bool
20 | description = "Enable lifecycle events on this bucket"
21 | default = true
22 | }
23 |
24 | variable "noncurrent_version_expiration_days" {
25 | type = number
26 | description = "Specifies when noncurrent object versions expire"
27 | default = 90
28 | }
29 |
30 | variable "noncurrent_version_transition_days" {
31 | type = number
32 | description = "Specifies when noncurrent object versions transitions"
33 | default = 30
34 | }
35 |
36 | variable "standard_transition_days" {
37 | type = number
38 | description = "Number of days to persist in the standard storage tier before moving to the infrequent access tier"
39 | default = 30
40 | }
41 |
42 | variable "glacier_transition_days" {
43 | type = number
44 | description = "Number of days after which to move the data to the glacier storage tier"
45 | default = 60
46 | }
47 |
48 | variable "expiration_days" {
49 | type = number
50 | description = "Number of days after which to expunge the objects"
51 | default = 90
52 | }
53 |
54 | variable "traffic_type" {
55 | type = string
56 | description = "The type of traffic to capture. Valid values: `ACCEPT`, `REJECT`, `ALL`"
57 | default = "ALL"
58 | }
59 |
60 | variable "allow_ssl_requests_only" {
61 | type = bool
62 | default = true
63 | description = "Set to `true` to require requests to use Secure Socket Layer (HTTPS/SSL). This will explicitly deny access to HTTP requests"
64 | }
65 |
66 | variable "flow_log_enabled" {
67 | type = bool
68 | default = true
69 | description = "Enable/disable the Flow Log creation. Useful in multi-account environments where the bucket is in one account, but VPC Flow Logs are in different accounts"
70 | }
71 |
72 | variable "kms_key_arn" {
73 | type = string
74 | default = ""
75 | description = "If provided will be used for the S3 bucket encryption. If not provided a KMS will be created for you."
76 | }
77 |
--------------------------------------------------------------------------------
/examples/complete/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.3.0"
3 |
4 | required_providers {
5 | aws = {
6 | source = "hashicorp/aws"
7 | version = ">= 4.9.0"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/main.tf:
--------------------------------------------------------------------------------
1 | locals {
2 | enabled = module.this.enabled
3 |
4 | bucket_name = length(var.bucket_name) > 0 ? var.bucket_name : module.bucket_name.id
5 |
6 | arn_format = "arn:${data.aws_partition.current.partition}"
7 | create_kms = local.enabled && (var.kms_key_arn == null || var.kms_key_arn == "")
8 | kms_key_arn = local.create_kms ? module.kms_key.alias_arn : var.kms_key_arn
9 |
10 | lifecycle_configuration_rules = (local.deprecated_lifecycle_rule.enabled ?
11 | tolist(concat(var.lifecycle_configuration_rules, [local.deprecated_lifecycle_rule])) : var.lifecycle_configuration_rules
12 | )
13 | }
14 |
15 | module "bucket_name" {
16 | source = "cloudposse/label/null"
17 | version = "0.25.0"
18 |
19 | enabled = local.enabled && length(var.bucket_name) == 0
20 |
21 | id_length_limit = 63 # https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
22 |
23 | context = module.this.context
24 | }
25 |
26 | data "aws_partition" "current" {}
27 |
28 | data "aws_caller_identity" "current" {}
29 |
30 | data "aws_iam_policy_document" "kms" {
31 | count = module.this.enabled ? 1 : 0
32 |
33 | source_policy_documents = [var.kms_policy_source_json]
34 |
35 | statement {
36 | sid = "Enable Root User Permissions"
37 | effect = "Allow"
38 |
39 | actions = [
40 | "kms:Create*",
41 | "kms:Describe*",
42 | "kms:Enable*",
43 | "kms:List*",
44 | "kms:Put*",
45 | "kms:Update*",
46 | "kms:Revoke*",
47 | "kms:Disable*",
48 | "kms:Get*",
49 | "kms:Delete*",
50 | "kms:Tag*",
51 | "kms:Untag*",
52 | "kms:ScheduleKeyDeletion",
53 | "kms:CancelKeyDeletion"
54 | ]
55 |
56 | #bridgecrew:skip=CKV_AWS_109:This policy applies only to the key it is attached to
57 | #bridgecrew:skip=CKV_AWS_111:This policy applies only to the key it is attached to
58 | resources = [
59 | "*"
60 | ]
61 |
62 | principals {
63 | type = "AWS"
64 |
65 | identifiers = [
66 | "${local.arn_format}:iam::${data.aws_caller_identity.current.account_id}:root"
67 | ]
68 | }
69 | }
70 |
71 | statement {
72 | sid = "Allow VPC Flow Logs to use the key"
73 | effect = "Allow"
74 |
75 | actions = [
76 | "kms:Encrypt*",
77 | "kms:Decrypt*",
78 | "kms:ReEncrypt*",
79 | "kms:GenerateDataKey*",
80 | "kms:Describe*"
81 | ]
82 |
83 | resources = [
84 | "*"
85 | ]
86 |
87 | principals {
88 | type = "Service"
89 |
90 | identifiers = [
91 | "delivery.logs.amazonaws.com"
92 | ]
93 | }
94 | }
95 | }
96 |
97 | # https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html
98 | data "aws_iam_policy_document" "bucket" {
99 | count = module.this.enabled ? 1 : 0
100 |
101 | statement {
102 | sid = "AWSLogDeliveryWrite"
103 |
104 | principals {
105 | type = "Service"
106 | identifiers = ["delivery.logs.amazonaws.com"]
107 | }
108 |
109 | actions = [
110 | "s3:PutObject"
111 | ]
112 |
113 | resources = [
114 | "${local.arn_format}:s3:::${local.bucket_name}/*"
115 | ]
116 |
117 | condition {
118 | test = "StringEquals"
119 | variable = "s3:x-amz-acl"
120 |
121 | values = [
122 | "bucket-owner-full-control"
123 | ]
124 | }
125 | }
126 |
127 | statement {
128 | sid = "AWSLogDeliveryAclCheck"
129 |
130 | principals {
131 | type = "Service"
132 | identifiers = ["delivery.logs.amazonaws.com"]
133 | }
134 |
135 | actions = [
136 | "s3:GetBucketAcl"
137 | ]
138 |
139 | resources = [
140 | "${local.arn_format}:s3:::${local.bucket_name}"
141 | ]
142 | }
143 |
144 | dynamic "statement" {
145 | for_each = var.allow_ssl_requests_only ? [1] : []
146 |
147 | content {
148 | sid = "ForceSSLOnlyAccess"
149 | effect = "Deny"
150 | actions = ["s3:*"]
151 | resources = [
152 | "${local.arn_format}:s3:::${local.bucket_name}/*",
153 | "${local.arn_format}:s3:::${local.bucket_name}"
154 | ]
155 |
156 | principals {
157 | identifiers = ["*"]
158 | type = "*"
159 | }
160 |
161 | condition {
162 | test = "Bool"
163 | values = ["false"]
164 | variable = "aws:SecureTransport"
165 | }
166 | }
167 | }
168 |
169 | lifecycle {
170 | # some form of name must be supplied.
171 | precondition {
172 | condition = try(length(local.bucket_name) > 0, false)
173 | error_message = <<-EOT
174 | Bucket name must be provided either directly via `bucket_name`
175 | or indirectly via `null-label` inputs such as `name` or `namespace`.
176 | EOT
177 | }
178 | }
179 | }
180 |
181 | module "kms_key" {
182 | enabled = local.create_kms
183 | source = "cloudposse/kms-key/aws"
184 | version = "0.12.2"
185 |
186 | alias = format("alias/%v", local.bucket_name)
187 |
188 | description = "KMS key for VPC Flow Logs"
189 | deletion_window_in_days = 10
190 | enable_key_rotation = true
191 | policy = join("", data.aws_iam_policy_document.kms.*.json)
192 |
193 | context = module.this.context
194 |
195 | # Depend on the data resource for error checking,
196 | # because we cannot have a precondition on a module.
197 | depends_on = [data.aws_iam_policy_document.bucket]
198 | }
199 |
200 | module "s3_log_storage_bucket" {
201 | source = "cloudposse/s3-log-storage/aws"
202 | version = "1.4.3"
203 |
204 | bucket_name = local.bucket_name
205 |
206 | kms_master_key_arn = local.kms_key_arn
207 | sse_algorithm = "aws:kms"
208 | bucket_key_enabled = var.bucket_key_enabled
209 |
210 | lifecycle_configuration_rules = local.lifecycle_configuration_rules
211 | object_lock_configuration = var.object_lock_configuration
212 |
213 | force_destroy = var.force_destroy
214 |
215 | acl = var.acl
216 | s3_object_ownership = var.s3_object_ownership == null ? "BucketOwnerEnforced" : var.s3_object_ownership
217 | source_policy_documents = data.aws_iam_policy_document.bucket.*.json
218 |
219 | bucket_notifications_enabled = var.bucket_notifications_enabled
220 | bucket_notifications_type = var.bucket_notifications_type
221 | bucket_notifications_prefix = var.bucket_notifications_prefix
222 |
223 | access_log_bucket_name = var.access_log_bucket_name
224 | access_log_bucket_prefix = var.access_log_bucket_prefix
225 |
226 | versioning_enabled = var.versioning_enabled
227 |
228 | context = module.this.context
229 | }
230 |
231 | resource "aws_flow_log" "default" {
232 | count = local.enabled && var.flow_log_enabled ? 1 : 0
233 | log_destination = module.s3_log_storage_bucket.bucket_arn
234 | log_destination_type = "s3"
235 | log_format = var.log_format
236 | traffic_type = var.traffic_type
237 | vpc_id = var.vpc_id
238 |
239 | tags = module.this.tags
240 | }
241 |
--------------------------------------------------------------------------------
/outputs.tf:
--------------------------------------------------------------------------------
1 | output "kms_key_arn" {
2 | value = module.kms_key.key_arn
3 | description = "KMS Key ARN"
4 | }
5 |
6 | output "kms_key_id" {
7 | value = module.kms_key.key_id
8 | description = "KMS Key ID"
9 | }
10 |
11 | output "kms_alias_arn" {
12 | value = module.kms_key.alias_arn
13 | description = "KMS Alias ARN"
14 | }
15 |
16 | output "kms_alias_name" {
17 | value = module.kms_key.alias_name
18 | description = "KMS Alias name"
19 | }
20 |
21 | output "bucket_domain_name" {
22 | value = module.s3_log_storage_bucket.bucket_domain_name
23 | description = "FQDN of bucket"
24 | }
25 |
26 | output "bucket_id" {
27 | value = module.s3_log_storage_bucket.bucket_id
28 | description = "Bucket Name (aka ID)"
29 | }
30 |
31 | output "bucket_arn" {
32 | value = module.s3_log_storage_bucket.bucket_arn
33 | description = "Bucket ARN"
34 | }
35 |
36 | output "bucket_prefix" {
37 | value = module.s3_log_storage_bucket.prefix
38 | description = "Bucket prefix configured for lifecycle rules"
39 | }
40 |
41 | output "flow_log_id" {
42 | value = join("", aws_flow_log.default.*.id)
43 | description = "Flow Log ID"
44 | }
45 |
46 | output "flow_log_arn" {
47 | value = join("", aws_flow_log.default.*.arn)
48 | description = "Flow Log ARN"
49 | }
50 |
51 | output "bucket_notifications_sqs_queue_arn" {
52 | value = module.s3_log_storage_bucket.bucket_notifications_sqs_queue_arn
53 | description = "Notifications SQS queue ARN"
54 | }
55 |
--------------------------------------------------------------------------------
/test/.gitignore:
--------------------------------------------------------------------------------
1 | .test-harness
2 |
--------------------------------------------------------------------------------
/test/Makefile:
--------------------------------------------------------------------------------
1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git
2 | TEST_HARNESS_BRANCH ?= master
3 | TEST_HARNESS_PATH = $(realpath .test-harness)
4 | BATS_ARGS ?= --tap
5 | BATS_LOG ?= test.log
6 |
7 | # Define a macro to run the tests
8 | define RUN_TESTS
9 | @echo "Running tests in $(1)"
10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS)))
11 | endef
12 |
13 | default: all
14 |
15 | -include Makefile.*
16 |
17 | ## Provision the test-harnesss
18 | .test-harness:
19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@
20 |
21 | ## Initialize the tests
22 | init: .test-harness
23 |
24 | ## Install all dependencies (OS specific)
25 | deps::
26 | @exit 0
27 |
28 | ## Clean up the test harness
29 | clean:
30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH)
31 |
32 | ## Run all tests
33 | all: module examples/complete
34 |
35 | ## Run basic sanity checks against the module itself
36 | module: export TESTS ?= installed lint module-pinning provider-pinning validate terraform-docs input-descriptions output-descriptions
37 | module: deps
38 | $(call RUN_TESTS, ../)
39 |
40 | ## Run tests against example
41 | examples/complete: export TESTS ?= installed lint validate
42 | examples/complete: deps
43 | $(call RUN_TESTS, ../$@)
44 |
--------------------------------------------------------------------------------
/test/Makefile.alpine:
--------------------------------------------------------------------------------
1 | ifneq (,$(wildcard /sbin/apk))
2 | ## Install all dependencies for alpine
3 | deps:: init
4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse
5 | endif
6 |
--------------------------------------------------------------------------------
/test/src/.gitignore:
--------------------------------------------------------------------------------
1 | .gopath
2 | vendor/
3 |
--------------------------------------------------------------------------------
/test/src/Makefile:
--------------------------------------------------------------------------------
1 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1)
2 |
3 | .DEFAULT_GOAL : all
4 |
5 | .PHONY: all
6 | ## Default target
7 | all: test
8 |
9 | .PHONY : init
10 | ## Initialize tests
11 | init:
12 | @exit 0
13 |
14 | .PHONY : test
15 | ## Run tests
16 | test: init
17 | go mod download
18 | go test -v -timeout 30m
19 |
20 | ## Run tests in docker container
21 | docker/test:
22 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \
23 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
24 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test
25 |
26 | .PHONY : clean
27 | ## Clean up files
28 | clean:
29 | rm -rf ../../examples/complete/*.tfstate*
30 |
--------------------------------------------------------------------------------
/test/src/examples_complete_test.go:
--------------------------------------------------------------------------------
1 | package test
2 |
3 | import (
4 | "github.com/gruntwork-io/terratest/modules/random"
5 | "github.com/gruntwork-io/terratest/modules/terraform"
6 | testStructure "github.com/gruntwork-io/terratest/modules/test-structure"
7 | "github.com/stretchr/testify/assert"
8 | "os"
9 | "regexp"
10 | "strings"
11 | "testing"
12 | )
13 |
14 | func cleanup(t *testing.T, terraformOptions *terraform.Options, tempTestFolder string) {
15 | terraform.Destroy(t, terraformOptions)
16 | os.RemoveAll(tempTestFolder)
17 | }
18 |
19 | // Test the Terraform module in examples/complete using Terratest.
20 | func TestExamplesComplete(t *testing.T) {
21 | t.Parallel()
22 | randID := strings.ToLower(random.UniqueId())
23 | attributes := []string{randID}
24 |
25 | rootFolder := "../../"
26 | terraformFolderRelativeToRoot := "examples/complete"
27 | varFiles := []string{"fixtures.us-east-2.tfvars"}
28 |
29 | tempTestFolder := testStructure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot)
30 |
31 | terraformOptions := &terraform.Options{
32 | // The path to where our Terraform code is located
33 | TerraformDir: tempTestFolder,
34 | Upgrade: true,
35 | // Variables to pass to our Terraform code using -var-file options
36 | VarFiles: varFiles,
37 | Vars: map[string]interface{}{
38 | "attributes": attributes,
39 | },
40 | }
41 |
42 | // At the end of the test, run `terraform destroy` to clean up any resources that were created
43 | defer cleanup(t, terraformOptions, tempTestFolder)
44 |
45 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors
46 | terraform.InitAndApplyAndIdempotent(t, terraformOptions)
47 |
48 | // Assume '-' delimiter
49 | bucketArn := terraform.Output(t, terraformOptions, "bucket_arn")
50 | assert.Equal(t, "arn:aws:s3:::eg-test-flowlogs-"+randID, bucketArn)
51 |
52 | flowLogId := terraform.Output(t, terraformOptions, "flow_log_id")
53 | assert.NotEmpty(t, flowLogId)
54 |
55 | flowLogArn := terraform.Output(t, terraformOptions, "flow_log_arn")
56 | assert.Contains(t, flowLogArn, flowLogId)
57 | }
58 |
59 | func TestExamplesCompleteDisabled(t *testing.T) {
60 | t.Parallel()
61 | randID := strings.ToLower(random.UniqueId())
62 | attributes := []string{randID}
63 |
64 | rootFolder := "../../"
65 | terraformFolderRelativeToRoot := "examples/complete"
66 | varFiles := []string{"fixtures.us-east-2.tfvars"}
67 |
68 | tempTestFolder := testStructure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot)
69 |
70 | terraformOptions := &terraform.Options{
71 | // The path to where our Terraform code is located
72 | TerraformDir: tempTestFolder,
73 | Upgrade: true,
74 | // Variables to pass to our Terraform code using -var-file options
75 | VarFiles: varFiles,
76 | Vars: map[string]interface{}{
77 | "attributes": attributes,
78 | "enabled": "false",
79 | },
80 | }
81 |
82 | // At the end of the test, run `terraform destroy` to clean up any resources that were created
83 | defer cleanup(t, terraformOptions, tempTestFolder)
84 |
85 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors
86 | results := terraform.InitAndApply(t, terraformOptions)
87 |
88 | // Should complete successfully without creating or changing any resources.
89 | // Extract the "Resources:" section of the output to make the error message more readable.
90 | re := regexp.MustCompile(`Resources: [^.]+\.`)
91 | match := re.FindString(results)
92 | assert.Equal(t, "Resources: 0 added, 0 changed, 0 destroyed.", match, "Deploying with `enabled = false` should not create any resources.")
93 | }
94 |
--------------------------------------------------------------------------------
/test/src/go.mod:
--------------------------------------------------------------------------------
1 | module github.com/cloudposse/terraform-aws-vpc-flow-logs-s3
2 |
3 | go 1.20
4 |
5 | require (
6 | // Known security flaws in terratest dependencies prior to v0.40.15
7 | github.com/gruntwork-io/terratest v0.41.16
8 | github.com/stretchr/testify v1.8.2
9 | )
10 |
11 | require (
12 | cloud.google.com/go v0.110.0 // indirect
13 | cloud.google.com/go/compute v1.19.1 // indirect
14 | cloud.google.com/go/compute/metadata v0.2.3 // indirect
15 | cloud.google.com/go/iam v0.13.0 // indirect
16 | cloud.google.com/go/storage v1.28.1 // indirect
17 | github.com/agext/levenshtein v1.2.3 // indirect
18 | github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
19 | github.com/aws/aws-sdk-go v1.44.122 // indirect
20 | github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
21 | github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
22 | github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
23 | github.com/davecgh/go-spew v1.1.1 // indirect
24 | github.com/docker/spdystream v0.0.0-20181023171402-6480d4af844c // indirect
25 | github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 // indirect
26 | github.com/go-logr/logr v0.2.0 // indirect
27 | github.com/go-sql-driver/mysql v1.4.1 // indirect
28 | github.com/gogo/protobuf v1.3.2 // indirect
29 | github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
30 | github.com/golang/protobuf v1.5.3 // indirect
31 | github.com/google/go-cmp v0.5.9 // indirect
32 | github.com/google/gofuzz v1.1.0 // indirect
33 | github.com/google/uuid v1.3.0 // indirect
34 | github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
35 | github.com/googleapis/gax-go/v2 v2.7.1 // indirect
36 | github.com/googleapis/gnostic v0.4.1 // indirect
37 | github.com/gruntwork-io/go-commons v0.8.0 // indirect
38 | github.com/hashicorp/errwrap v1.0.0 // indirect
39 | github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
40 | github.com/hashicorp/go-getter v1.7.5 // indirect
41 | github.com/hashicorp/go-multierror v1.1.0 // indirect
42 | github.com/hashicorp/go-safetemp v1.0.0 // indirect
43 | github.com/hashicorp/go-version v1.6.0 // indirect
44 | github.com/hashicorp/hcl/v2 v2.9.1 // indirect
45 | github.com/hashicorp/terraform-json v0.13.0 // indirect
46 | github.com/imdario/mergo v0.3.11 // indirect
47 | github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a // indirect
48 | github.com/jmespath/go-jmespath v0.4.0 // indirect
49 | github.com/json-iterator/go v1.1.11 // indirect
50 | github.com/klauspost/compress v1.15.11 // indirect
51 | github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect
52 | github.com/mitchellh/go-homedir v1.1.0 // indirect
53 | github.com/mitchellh/go-testing-interface v1.14.1 // indirect
54 | github.com/mitchellh/go-wordwrap v1.0.1 // indirect
55 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
56 | github.com/modern-go/reflect2 v1.0.1 // indirect
57 | github.com/pmezard/go-difflib v1.0.0 // indirect
58 | github.com/pquerna/otp v1.2.0 // indirect
59 | github.com/russross/blackfriday/v2 v2.1.0 // indirect
60 | github.com/spf13/pflag v1.0.5 // indirect
61 | github.com/tmccombs/hcl2json v0.3.3 // indirect
62 | github.com/ulikunitz/xz v0.5.10 // indirect
63 | github.com/urfave/cli v1.22.2 // indirect
64 | github.com/zclconf/go-cty v1.9.1 // indirect
65 | go.opencensus.io v0.24.0 // indirect
66 | golang.org/x/crypto v0.17.0 // indirect
67 | golang.org/x/net v0.10.0 // indirect
68 | golang.org/x/oauth2 v0.7.0 // indirect
69 | golang.org/x/sys v0.15.0 // indirect
70 | golang.org/x/term v0.15.0 // indirect
71 | golang.org/x/text v0.14.0 // indirect
72 | golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
73 | golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
74 | google.golang.org/api v0.114.0 // indirect
75 | google.golang.org/appengine v1.6.7 // indirect
76 | google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
77 | google.golang.org/grpc v1.56.3 // indirect
78 | google.golang.org/protobuf v1.30.0 // indirect
79 | gopkg.in/inf.v0 v0.9.1 // indirect
80 | gopkg.in/yaml.v2 v2.4.0 // indirect
81 | gopkg.in/yaml.v3 v3.0.1 // indirect
82 | k8s.io/api v0.20.6 // indirect
83 | k8s.io/apimachinery v0.20.6 // indirect
84 | k8s.io/client-go v0.20.6 // indirect
85 | k8s.io/klog/v2 v2.4.0 // indirect
86 | k8s.io/utils v0.0.0-20201110183641-67b214c5f920 // indirect
87 | sigs.k8s.io/structured-merge-diff/v4 v4.0.3 // indirect
88 | sigs.k8s.io/yaml v1.2.0 // indirect
89 | )
90 |
--------------------------------------------------------------------------------
/variables-deprecated.tf:
--------------------------------------------------------------------------------
1 | variable "lifecycle_rule_enabled" {
2 | type = bool
3 | description = <<-EOF
4 | DEPRECATED: Use `lifecycle_configuration_rules` instead.
5 | When `true`, configures lifecycle events on this bucket using individual (now deprecated) variables.
6 | When `false`, lifecycle events are not configured using individual (now deprecated) variables, but `lifecycle_configuration_rules` still apply.
7 | When `null`, lifecycle events are configured using individual (now deprecated) variables only if `lifecycle_configuration_rules` is empty.
8 | EOF
9 | default = null
10 | }
11 |
12 | variable "lifecycle_prefix" {
13 | type = string
14 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nPrefix filter. Used to manage object lifecycle events"
15 | default = null
16 | }
17 |
18 | variable "lifecycle_tags" {
19 | type = map(string)
20 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nTags filter. Used to manage object lifecycle events"
21 | default = null
22 | }
23 |
24 | variable "expiration_days" {
25 | type = number
26 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nNumber of days after which to expunge the objects"
27 | default = null
28 | }
29 |
30 | variable "standard_transition_days" {
31 | type = number
32 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nNumber of days to persist in the standard storage tier before moving to the infrequent access tier"
33 | default = null
34 | }
35 |
36 | variable "glacier_transition_days" {
37 | type = number
38 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nNumber of days after which to move the data to the Glacier Flexible Retrieval storage tier"
39 | default = null
40 | }
41 |
42 | variable "noncurrent_version_transition_days" {
43 | type = number
44 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nSpecifies (in days) when noncurrent object versions transition to Glacier Flexible Retrieval"
45 | default = null
46 | }
47 |
48 | variable "noncurrent_version_expiration_days" {
49 | type = number
50 | description = "(Deprecated, use `lifecycle_configuration_rules` instead)\nSpecifies when non-current object versions expire (in days)"
51 | default = null
52 | }
53 |
54 |
55 |
56 | locals {
57 | deprecated_lifecycle_rule = {
58 | enabled = var.lifecycle_rule_enabled == true || (var.lifecycle_rule_enabled == null && length(var.lifecycle_configuration_rules) == 0)
59 | id = "_legacy_"
60 | abort_incomplete_multipart_upload_days = 5
61 | filter_and = {
62 | object_size_greater_than = null # integer >= 0
63 | object_size_less_than = null # integer >= 1
64 | prefix = var.lifecycle_prefix
65 | tags = var.lifecycle_tags
66 | }
67 |
68 | transition = [
69 | {
70 | date = null # string, RFC3339 time format, GMT
71 | days = coalesce(var.standard_transition_days, 30)
72 | storage_class = "STANDARD_IA"
73 | },
74 | {
75 | date = null # string, RFC3339 time format, GMT
76 | days = coalesce(var.glacier_transition_days, 60)
77 | storage_class = "GLACIER"
78 | }
79 | ]
80 | noncurrent_version_transition = var.noncurrent_version_transition_days == null ? [] : [
81 | {
82 | days = var.noncurrent_version_transition_days
83 | storage_class = "GLACIER"
84 | }
85 | ]
86 |
87 | expiration = {
88 | date = null # string, RFC3339 time format, GMT
89 | days = coalesce(var.expiration_days, 90)
90 | expired_object_delete_marker = null # bool
91 | }
92 | noncurrent_version_expiration = {
93 | newer_noncurrent_versions = null # integer > 0
94 | noncurrent_days = coalesce(var.noncurrent_version_expiration_days, 90)
95 | }
96 | }
97 | }
98 |
--------------------------------------------------------------------------------
/variables.tf:
--------------------------------------------------------------------------------
1 | variable "vpc_id" {
2 | type = string
3 | description = "VPC ID to create flow logs for"
4 | default = null
5 | }
6 |
7 | variable "bucket_name" {
8 | type = string
9 | description = <<-EOT
10 | Bucket name. If not provided, the bucket will be created with a name generated from the context.
11 | EOT
12 | default = ""
13 | nullable = false
14 | validation {
15 | condition = length(var.bucket_name) <= 63
16 | error_message = "Bucket name, if provided, must be <= 63 characters."
17 | }
18 | }
19 |
20 | variable "force_destroy" {
21 | type = bool
22 | description = "A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable"
23 | default = false
24 | nullable = false
25 | }
26 |
27 | variable "traffic_type" {
28 | type = string
29 | description = "The type of traffic to capture. Valid values: `ACCEPT`, `REJECT`, `ALL`"
30 | default = "ALL"
31 | nullable = false
32 | }
33 |
34 | variable "allow_ssl_requests_only" {
35 | type = bool
36 | description = "Set to `true` to require requests to use Secure Socket Layer (HTTPS/SSL). This will explicitly deny access to HTTP requests"
37 | default = true
38 | nullable = false
39 | }
40 |
41 | variable "flow_log_enabled" {
42 | type = bool
43 | description = "Enable/disable the Flow Log creation. Useful in multi-account environments where the bucket is in one account, but VPC Flow Logs are in different accounts"
44 | default = true
45 | nullable = false
46 | }
47 |
48 | variable "bucket_notifications_enabled" {
49 | type = bool
50 | description = "Send notifications for the object created events. Used for 3rd-party log collection from a bucket"
51 | default = false
52 | nullable = false
53 | }
54 |
55 | variable "bucket_notifications_type" {
56 | type = string
57 | description = "Type of the notification configuration. Only SQS is supported."
58 | default = "SQS"
59 | nullable = false
60 | }
61 |
62 | variable "bucket_notifications_prefix" {
63 | type = string
64 | description = "Prefix filter. Used to manage object notifications"
65 | default = ""
66 | nullable = false
67 | }
68 |
69 | variable "access_log_bucket_name" {
70 | type = string
71 | description = "Name of the S3 bucket where S3 access log will be sent to"
72 | default = ""
73 | nullable = false
74 | }
75 |
76 | variable "access_log_bucket_prefix" {
77 | type = string
78 | description = "Prefix to prepend to the current S3 bucket name, where S3 access logs will be sent to"
79 | default = "logs/"
80 | nullable = false
81 | }
82 |
83 | variable "kms_key_arn" {
84 | type = string
85 | description = "ARN (or alias) of KMS that will be used for s3 bucket encryption."
86 | default = ""
87 | nullable = false
88 | }
89 |
90 | variable "kms_policy_source_json" {
91 | type = string
92 | description = "Additional IAM policy document that can optionally be merged with default created KMS policy"
93 | default = ""
94 | nullable = false
95 | }
96 |
97 | variable "bucket_key_enabled" {
98 | type = bool
99 | description = <<-EOT
100 | Set this to true to use Amazon S3 Bucket Keys for SSE-KMS, which may reduce the number of AWS KMS requests.
101 | For more information, see: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html
102 | EOT
103 | default = true
104 | nullable = false
105 | }
106 |
107 | variable "versioning_enabled" {
108 | type = bool
109 | description = "Enable object versioning, keeping multiple variants of an object in the same bucket"
110 | default = false
111 | nullable = false
112 | }
113 |
114 | variable "s3_object_ownership" {
115 | type = string
116 | description = <<-EOF
117 | Specifies the S3 object ownership control.
118 | Valid values are `ObjectWriter`, `BucketOwnerPreferred`, and `BucketOwnerEnforced`."
119 | Default of `BucketOwnerPreferred` is for backwards compatibility.
120 | Recommended setting is `BucketOwnerEnforced`, which will be used if you pass in `null`.
121 | EOF
122 | default = "BucketOwnerPreferred"
123 | # null selects the recommended setting of BucketOwnerEnforced
124 | }
125 |
126 | variable "acl" {
127 | type = string
128 | description = "The canned ACL to apply. We recommend log-delivery-write for compatibility with AWS services"
129 | default = "log-delivery-write"
130 | }
131 |
132 | /*
133 | Schema for lifecycle_configuration_rules (defined in cloudposse/terraform-aws-s3-bucket module)
134 | {
135 | enabled = true # bool
136 | id = string
137 | abort_incomplete_multipart_upload_days = null # number
138 | filter_and = {
139 | object_size_greater_than = null # integer >= 0
140 | object_size_less_than = null # integer >= 1
141 | prefix = null # string
142 | tags = {} # map(string)
143 | }
144 | expiration = {
145 | date = null # string, RFC3339 time format, GMT
146 | days = null # integer > 0
147 | expired_object_delete_marker = null # bool
148 | }
149 | noncurrent_version_expiration = {
150 | newer_noncurrent_versions = null # integer > 0
151 | noncurrent_days = null # integer >= 0
152 | }
153 | transition = [{
154 | date = null # string, RFC3339 time format, GMT
155 | days = null # integer >= 0
156 | storage_class = null # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
157 | }]
158 | noncurrent_version_transition = [{
159 | newer_noncurrent_versions = null # integer >= 0
160 | noncurrent_days = null # integer >= 0
161 | storage_class = null # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
162 | }]
163 | }
164 |
165 | */
166 | variable "lifecycle_configuration_rules" {
167 | type = list(object({
168 | enabled = bool
169 | id = string
170 |
171 | abort_incomplete_multipart_upload_days = number
172 |
173 | # `filter_and` is the `and` configuration block inside the `filter` configuration.
174 | # This is the only place you should specify a prefix.
175 | filter_and = optional(object({
176 | object_size_greater_than = optional(number) # integer >= 0
177 | object_size_less_than = optional(number) # integer >= 1
178 | prefix = optional(string)
179 | tags = optional(map(string))
180 | }))
181 | expiration = optional(object({
182 | date = optional(string) # string, RFC3339 time format, GMT
183 | days = optional(number) # integer > 0
184 | expired_object_delete_marker = optional(bool)
185 | }))
186 | noncurrent_version_expiration = optional(object({
187 | newer_noncurrent_versions = optional(number) # integer > 0
188 | noncurrent_days = optional(number) # integer >= 0
189 | }))
190 | transition = optional(list(object({
191 | date = optional(string) # string, RFC3339 time format, GMT
192 | days = optional(number) # integer >= 0
193 | storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
194 | })), [])
195 | noncurrent_version_transition = optional(list(object({
196 | newer_noncurrent_versions = optional(number) # integer >= 0
197 | noncurrent_days = optional(number) # integer >= 0
198 | storage_class = string # string/enum, one of GLACIER, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, DEEP_ARCHIVE, GLACIER_IR.
199 | })), [])
200 | }))
201 | description = "A list of lifecycle V2 rules"
202 | default = []
203 | nullable = false
204 |
205 | }
206 |
207 | variable "object_lock_configuration" {
208 | type = object({
209 | mode = string # Valid values are GOVERNANCE and COMPLIANCE.
210 | days = number
211 | years = number
212 | })
213 | description = <<-EOT
214 | A configuration for [S3 object locking](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html).
215 | EOT
216 | default = null
217 | }
218 |
219 | variable "log_format" {
220 | description = "The fields to include in the flow log record, in the order in which they should appear."
221 | type = string
222 | default = null
223 | }
224 |
--------------------------------------------------------------------------------
/versions.tf:
--------------------------------------------------------------------------------
1 | terraform {
2 | required_version = ">= 1.3.0"
3 |
4 | required_providers {
5 | aws = {
6 | source = "hashicorp/aws"
7 | version = ">= 4.9.0"
8 | }
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
