Skip to content

Commit 51e7d27

Browse files
antonbabenkoantonbabenko
committed
Added module for S3 Account-level Public Access Block
1 parent 5518b15 commit 51e7d27

File tree

16 files changed

+340
-2
lines changed

16 files changed

+340
-2
lines changed

‎README.md

+6-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ These features of S3 bucket configurations are supported:
1616
- Cross-Region Replication (CRR)
1717
- ELB log delivery bucket policy
1818
- ALB/NLB log delivery bucket policy
19+
- Account-level Public Access Block
1920

2021
## Usage
2122

@@ -117,8 +118,11 @@ Users of Terragrunt can achieve similar results by using modules provided in the
117118

118119
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled
119120
- [Cross-Region Replication](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/s3-replication) - S3 bucket with Cross-Region Replication (CRR) enabled
120-
- [S3 Bucket Notifications](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/notification) - S3 bucket notifications to Lambda functions, SQS queues, and SNS topics.
121-
- [S3 Bucket Object](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/object) - Manage S3 bucket objects.
121+
- [S3 Notifications](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/notification) - S3 bucket notifications to Lambda functions, SQS queues, and SNS topics.
122+
- [S3 Object](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/object) - Manage S3 bucket objects.
123+
- [S3 Analytics](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/s3-analytics) - S3 bucket Analytics Configurations.
124+
- [S3 Inventory](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/s3-inventory) - S3 bucket Inventory configuration.
125+
- [S3 Account-level Public Access Block](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/account-public-access) - Manage S3 account-level Public Access Block.
122126

123127
<!-- BEGIN_TF_DOCS -->
124128
## Requirements

‎examples/account-public-access/README.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# S3 account-level Public Access Block
2+
3+
Configuration in this directory creates S3 account-level Public Access Block.
4+
5+
## Usage
6+
7+
To run this example you need to execute:
8+
9+
```bash
10+
$ terraform init
11+
$ terraform plan
12+
$ terraform apply
13+
```
14+
15+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGIN_TF_DOCS -->
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.70 |
24+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
25+
26+
## Providers
27+
28+
No providers.
29+
30+
## Modules
31+
32+
| Name | Source | Version |
33+
|------|--------|---------|
34+
| <a name="module_account_public_access"></a> [account\_public\_access](#module\_account\_public\_access) | ../../modules/account-public-access | n/a |
35+
36+
## Resources
37+
38+
No resources.
39+
40+
## Inputs
41+
42+
No inputs.
43+
44+
## Outputs
45+
46+
| Name | Description |
47+
|------|-------------|
48+
| <a name="output_s3_account_public_access_block_id"></a> [s3\_account\_public\_access\_block\_id](#output\_s3\_account\_public\_access\_block\_id) | AWS account ID |
49+
<!-- END_TF_DOCS -->

‎examples/account-public-access/main.tf

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
provider "aws" {
2+
region = local.region
3+
4+
# Make it faster by skipping something
5+
skip_metadata_api_check = true
6+
skip_region_validation = true
7+
skip_credentials_validation = true
8+
}
9+
10+
locals {
11+
region = "eu-west-1"
12+
}
13+
14+
module "account_public_access" {
15+
source = "../../modules/account-public-access"
16+
17+
block_public_acls = true
18+
block_public_policy = true
19+
ignore_public_acls = true
20+
restrict_public_buckets = true
21+
}

‎examples/account-public-access/outputs.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "s3_account_public_access_block_id" {
2+
description = "AWS account ID"
3+
value = module.account_public_access.s3_account_public_access_block_id
4+
}

‎examples/account-public-access/variables.tf

Whitespace-only changes.

‎examples/account-public-access/versions.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.70"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 2.0"
12+
}
13+
}
14+
}

‎modules/account-public-access/README.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# S3 account-level Public Access Block
2+
3+
Manages S3 account-level Public Access Block configuration.
4+
5+
## Note
6+
7+
Each AWS account may only have one S3 Public Access Block configuration.
8+
9+
<!-- BEGIN_TF_DOCS -->
10+
## Requirements
11+
12+
| Name | Version |
13+
|------|---------|
14+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
15+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.74 |
16+
17+
## Providers
18+
19+
| Name | Version |
20+
|------|---------|
21+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.74 |
22+
23+
## Modules
24+
25+
No modules.
26+
27+
## Resources
28+
29+
| Name | Type |
30+
|------|------|
31+
| [aws_s3_account_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_account_public_access_block) | resource |
32+
33+
## Inputs
34+
35+
| Name | Description | Type | Default | Required |
36+
|------|-------------|------|---------|:--------:|
37+
| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS account ID | `string` | `null` | no |
38+
| <a name="input_block_public_acls"></a> [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for buckets in this account. | `bool` | `false` | no |
39+
| <a name="input_block_public_policy"></a> [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for buckets in this account. | `bool` | `false` | no |
40+
| <a name="input_create"></a> [create](#input\_create) | Whether to create this resource or not? | `bool` | `true` | no |
41+
| <a name="input_ignore_public_acls"></a> [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for buckets in this account. | `bool` | `false` | no |
42+
| <a name="input_restrict_public_buckets"></a> [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for buckets in this account. | `bool` | `false` | no |
43+
44+
## Outputs
45+
46+
| Name | Description |
47+
|------|-------------|
48+
| <a name="output_s3_account_public_access_block_id"></a> [s3\_account\_public\_access\_block\_id](#output\_s3\_account\_public\_access\_block\_id) | AWS account ID |
49+
<!-- END_TF_DOCS -->

‎modules/account-public-access/main.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_s3_account_public_access_block" "this" {
2+
count = var.create ? 1 : 0
3+
4+
account_id = var.account_id
5+
6+
block_public_acls = var.block_public_acls
7+
block_public_policy = var.block_public_policy
8+
ignore_public_acls = var.ignore_public_acls
9+
restrict_public_buckets = var.restrict_public_buckets
10+
}

‎modules/account-public-access/outputs.tf

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "s3_account_public_access_block_id" {
2+
description = "AWS account ID"
3+
value = try(aws_s3_account_public_access_block.this[0].id, "")
4+
}

‎modules/account-public-access/variables.tf

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
variable "create" {
2+
description = "Whether to create this resource or not?"
3+
type = bool
4+
default = true
5+
}
6+
7+
variable "account_id" {
8+
description = "AWS account ID"
9+
type = string
10+
default = null
11+
}
12+
13+
variable "block_public_acls" {
14+
description = "Whether Amazon S3 should block public ACLs for buckets in this account."
15+
type = bool
16+
default = false
17+
}
18+
19+
variable "block_public_policy" {
20+
description = "Whether Amazon S3 should block public bucket policies for buckets in this account."
21+
type = bool
22+
default = false
23+
}
24+
25+
variable "ignore_public_acls" {
26+
description = "Whether Amazon S3 should ignore public ACLs for buckets in this account."
27+
type = bool
28+
default = false
29+
}
30+
31+
variable "restrict_public_buckets" {
32+
description = "Whether Amazon S3 should restrict public bucket policies for buckets in this account."
33+
type = bool
34+
default = false
35+
}

‎modules/account-public-access/versions.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.74"
8+
}
9+
}
10+
}

‎wrappers/account-public-access/README.md

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Wrapper for module: `modules/account-public-access`
2+
3+
The configuration in this directory contains an implementation of a single module wrapper pattern, which allows managing several copies of a module in places where using the native Terraform 0.13+ `for_each` feature is not feasible (e.g., with Terragrunt).
4+
5+
You may want to use a single Terragrunt configuration file to manage multiple resources without duplicating `terragrunt.hcl` files for each copy of the same module.
6+
7+
This wrapper does not implement any extra functionality.
8+
9+
## Usage with Terragrunt
10+
11+
`terragrunt.hcl`:
12+
13+
```hcl
14+
terraform {
15+
source = "tfr:///terraform-aws-modules/s3-bucket/aws//wrappers/account-public-access"
16+
# Alternative source:
17+
# source = "git::[email protected]:terraform-aws-modules/terraform-aws-s3-bucket.git//wrappers/account-public-access?ref=master"
18+
}
19+
20+
inputs = {
21+
defaults = { # Default values
22+
create = true
23+
tags = {
24+
Terraform = "true"
25+
Environment = "dev"
26+
}
27+
}
28+
29+
items = {
30+
my-item = {
31+
# omitted... can be any argument supported by the module
32+
}
33+
my-second-item = {
34+
# omitted... can be any argument supported by the module
35+
}
36+
# omitted...
37+
}
38+
}
39+
```
40+
41+
## Usage with Terraform
42+
43+
```hcl
44+
module "wrapper" {
45+
source = "terraform-aws-modules/s3-bucket/aws//wrappers/account-public-access"
46+
47+
defaults = { # Default values
48+
create = true
49+
tags = {
50+
Terraform = "true"
51+
Environment = "dev"
52+
}
53+
}
54+
55+
items = {
56+
my-item = {
57+
# omitted... can be any argument supported by the module
58+
}
59+
my-second-item = {
60+
# omitted... can be any argument supported by the module
61+
}
62+
# omitted...
63+
}
64+
}
65+
```
66+
67+
## Example: Manage multiple S3 buckets in one Terragrunt layer
68+
69+
`eu-west-1/s3-buckets/terragrunt.hcl`:
70+
71+
```hcl
72+
terraform {
73+
source = "tfr:///terraform-aws-modules/s3-bucket/aws//wrappers"
74+
# Alternative source:
75+
# source = "git::[email protected]:terraform-aws-modules/terraform-aws-s3-bucket.git//wrappers?ref=master"
76+
}
77+
78+
inputs = {
79+
defaults = {
80+
force_destroy = true
81+
82+
attach_elb_log_delivery_policy = true
83+
attach_lb_log_delivery_policy = true
84+
attach_deny_insecure_transport_policy = true
85+
attach_require_latest_tls_policy = true
86+
}
87+
88+
items = {
89+
bucket1 = {
90+
bucket = "my-random-bucket-1"
91+
}
92+
bucket2 = {
93+
bucket = "my-random-bucket-2"
94+
tags = {
95+
Secure = "probably"
96+
}
97+
}
98+
}
99+
}
100+
```

‎wrappers/account-public-access/main.tf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
module "wrapper" {
2+
source = "../../modules/account-public-access"
3+
4+
for_each = var.items
5+
6+
account_id = try(each.value.account_id, var.defaults.account_id, null)
7+
block_public_acls = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
8+
block_public_policy = try(each.value.block_public_policy, var.defaults.block_public_policy, false)
9+
create = try(each.value.create, var.defaults.create, true)
10+
ignore_public_acls = try(each.value.ignore_public_acls, var.defaults.ignore_public_acls, false)
11+
restrict_public_buckets = try(each.value.restrict_public_buckets, var.defaults.restrict_public_buckets, false)
12+
}

‎wrappers/account-public-access/outputs.tf

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
output "wrapper" {
2+
description = "Map of outputs of a wrapper."
3+
value = module.wrapper
4+
# sensitive = false # No sensitive module output found
5+
}

‎wrappers/account-public-access/variables.tf

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
variable "defaults" {
2+
description = "Map of default values which will be used for each item."
3+
type = any
4+
default = {}
5+
}
6+
7+
variable "items" {
8+
description = "Maps of items to create a wrapper from. Values are passed through to the module."
9+
type = any
10+
default = {}
11+
}

‎wrappers/account-public-access/versions.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 3.74"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)