forked from cloudposse/terraform-aws-lb-s3-bucket
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
102 lines (88 loc) · 3.04 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
locals {
enabled = module.this.enabled
generate_bucket_name = local.enabled && try(length(var.bucket_name) == 0, true) # Use `try` to handle `null` value
bucket_name = local.generate_bucket_name ? module.bucket_name.id : var.bucket_name
}
module "bucket_name" {
source = "cloudposse/label/null"
version = "0.25.0"
enabled = local.generate_bucket_name
id_length_limit = 63 # https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
context = module.this.context
}
data "aws_caller_identity" "default" {}
data "aws_iam_policy_document" "default" {
count = module.this.enabled ? 1 : 0
statement {
sid = ""
principals {
type = "Service"
identifiers = ["logdelivery.elasticloadbalancing.amazonaws.com"]
}
effect = "Allow"
actions = [
"s3:PutObject"
]
resources = [
"arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}/*",
]
}
statement {
sid = ""
principals {
type = "Service"
identifiers = ["delivery.logs.amazonaws.com"]
}
effect = "Allow"
actions = [
"s3:PutObject"
]
resources = [
"arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}/*",
]
condition {
test = "StringEquals"
variable = "s3:x-amz-acl"
values = ["bucket-owner-full-control"]
}
}
statement {
sid = ""
effect = "Allow"
principals {
type = "Service"
identifiers = ["delivery.logs.amazonaws.com"]
}
actions = [
"s3:GetBucketAcl"
]
resources = [
"arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}",
]
}
}
data "aws_partition" "current" {}
module "s3_bucket" {
source = "cloudposse/s3-log-storage/aws"
version = "1.4.3"
acl = var.acl
bucket_name = var.bucket_name
source_policy_documents = [join("", data.aws_iam_policy_document.default[*].json)]
force_destroy = var.force_destroy
versioning_enabled = var.versioning_enabled
allow_ssl_requests_only = var.allow_ssl_requests_only
access_log_bucket_name = var.access_log_bucket_name
access_log_bucket_prefix = var.access_log_bucket_prefix
lifecycle_configuration_rules = var.lifecycle_configuration_rules
s3_object_ownership = var.s3_object_ownership
# TODO: deprecate these inputs in favor of `lifecycle_configuration_rules`
lifecycle_rule_enabled = var.lifecycle_rule_enabled
enable_glacier_transition = var.enable_glacier_transition
expiration_days = var.expiration_days
glacier_transition_days = var.glacier_transition_days
noncurrent_version_expiration_days = var.noncurrent_version_expiration_days
noncurrent_version_transition_days = var.noncurrent_version_transition_days
standard_transition_days = var.standard_transition_days
lifecycle_prefix = var.lifecycle_prefix
context = module.this.context
}