S3 Bucket

Why it mattersCopy Anchor Link

Uploads, exports, and logs all end up in S3, and a bucket left open to the public is one of the most common ways cloud data leaks. Every bucket from this module blocks public access, keeps old versions of each file, and encrypts objects at rest. Federal stacks add a customer managed key and a policy that rejects any request not sent over TLS.

Use it whenCopy Anchor Link

• The app stores user uploads, generated files, or exports.
• You need a log bucket, for example the load balancer's access_logs_bucket.
• You host a static site behind CloudFront with origin access control.

Reach for something else whenCopy Anchor Link

• You need to query the data with SQL or keep relational records. Use rds-postgres.

What it createsCopy Anchor Link

• aws_s3_bucket (force_destroy = false by default)
• aws_s3_bucket_versioning (enabled by default)
• aws_s3_bucket_server_side_encryption_configuration (AES256, or aws:kms with a bucket key)
• aws_s3_bucket_public_access_block (all four settings true)
• aws_s3_bucket_ownership_controls (BucketOwnerEnforced, optional)
• aws_s3_bucket_lifecycle_configuration (optional)
• aws_s3_bucket_policy (DenyInsecureTransport and caller JSON, optional)
• aws_s3_bucket_cors_configuration (optional, for browser uploads)

Secure by defaultCopy Anchor Link

• All four public access block settings are on (not configurable).
• Versioning is on (versioning_enabled = true).
• Objects are encrypted at rest with AES256 when no key is given.
• Terraform refuses to delete a bucket that still holds objects (force_destroy = false).

Commercial and GovCloudCopy Anchor Link

module "s3_uploads" {
  source = "git::ssh://git@github.com/the-kaizen-labs/terraform-modules.git//s3-bucket?ref=v1.7.0"

  bucket_name = "${local.app_name}-uploads"

  cors_rules = [{
    allowed_origins = [local.app_url]
    allowed_methods = ["GET", "PUT"]
    allowed_headers = ["*"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }]

  tags = local.tags
}

How it connectsCopy Anchor Link

• To ecs-service: bucket_arn, in a policy on task_role_name
• To alb: bucket_name (as access_logs_bucket)

InputsCopy Anchor Link

OutputsCopy Anchor Link

Used byCopy Anchor Link