Skip to content

Commit 8836d0f

Browse files
magreenbaummagreenbaum
authored
feat: Add inventory config support (#192)
Co-authored-by: magreenbaum <magreenbaum>
1 parent 4ee2d93 commit 8836d0f

File tree

10 files changed

+409
-2
lines changed

10 files changed

+409
-2
lines changed

‎README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ No modules.
139139
| [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
140140
| [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
141141
| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
142+
| [aws_s3_bucket_inventory.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_inventory) | resource |
142143
| [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
143144
| [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
144145
| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
@@ -151,11 +152,13 @@ No modules.
151152
| [aws_s3_bucket_server_side_encryption_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
152153
| [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
153154
| [aws_s3_bucket_website_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource |
155+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
154156
| [aws_canonical_user_id.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
155157
| [aws_elb_service_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
156158
| [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
157159
| [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
158160
| [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
161+
| [aws_iam_policy_document.inventory_destination_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
159162
| [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
160163
| [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
161164

@@ -167,6 +170,7 @@ No modules.
167170
| <a name="input_acl"></a> [acl](#input\_acl) | (Optional) The canned ACL to apply. Conflicts with `grant` | `string` | `null` | no |
168171
| <a name="input_attach_deny_insecure_transport_policy"></a> [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no |
169172
| <a name="input_attach_elb_log_delivery_policy"></a> [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have ELB log delivery policy attached | `bool` | `false` | no |
173+
| <a name="input_attach_inventory_destination_policy"></a> [attach\_inventory\_destination\_policy](#input\_attach\_inventory\_destination\_policy) | Controls if S3 bucket should have bucket inventory destination policy attached. | `bool` | `false` | no |
170174
| <a name="input_attach_lb_log_delivery_policy"></a> [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
171175
| <a name="input_attach_policy"></a> [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
172176
| <a name="input_attach_public_policy"></a> [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
@@ -183,6 +187,10 @@ No modules.
183187
| <a name="input_grant"></a> [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
184188
| <a name="input_ignore_public_acls"></a> [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
185189
| <a name="input_intelligent_tiering"></a> [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
190+
| <a name="input_inventory_configuration"></a> [inventory\_configuration](#input\_inventory\_configuration) | Map containing S3 inventory configuration. | `any` | `{}` | no |
191+
| <a name="input_inventory_self_source_destination"></a> [inventory\_self\_source\_destination](#input\_inventory\_self\_source\_destination) | Whether or not the inventory source bucket is also the destination bucket. | `bool` | `false` | no |
192+
| <a name="input_inventory_source_account_id"></a> [inventory\_source\_account\_id](#input\_inventory\_source\_account\_id) | The inventory source account id. | `string` | `null` | no |
193+
| <a name="input_inventory_source_bucket_arn"></a> [inventory\_source\_bucket\_arn](#input\_inventory\_source\_bucket\_arn) | The inventory source bucket ARN. | `string` | `null` | no |
186194
| <a name="input_lifecycle_rule"></a> [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
187195
| <a name="input_logging"></a> [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
188196
| <a name="input_metric_configuration"></a> [metric\_configuration](#input\_metric\_configuration) | Map containing bucket metric configuration. | `any` | `[]` | no |

‎examples/complete/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -347,5 +347,4 @@ module "s3_bucket" {
347347
name = "all"
348348
}
349349
]
350-
351350
}

‎examples/s3-inventory/README.md

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# S3 bucket with Inventory Configurations
2+
3+
Configuration in this directory creates an S3 bucket with several inventory configurations including a different source and destination for inventory reports generated.
4+
5+
Please check [complete example](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) to see all other features supported by this module.
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Requirements
9+
10+
| Name | Version |
11+
|------|---------|
12+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
13+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9 |
14+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
15+
16+
## Providers
17+
18+
| Name | Version |
19+
|------|---------|
20+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9 |
21+
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
22+
23+
## Modules
24+
25+
| Name | Source | Version |
26+
|------|--------|---------|
27+
| <a name="module_inventory_destination_bucket"></a> [inventory\_destination\_bucket](#module\_inventory\_destination\_bucket) | ../../ | n/a |
28+
| <a name="module_inventory_source_bucket"></a> [inventory\_source\_bucket](#module\_inventory\_source\_bucket) | ../../ | n/a |
29+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-aws-modules/kms/aws | n/a |
30+
| <a name="module_multi_inventory_configurations_bucket"></a> [multi\_inventory\_configurations\_bucket](#module\_multi\_inventory\_configurations\_bucket) | ../../ | n/a |
31+
32+
## Resources
33+
34+
| Name | Type |
35+
|------|------|
36+
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
37+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
38+
39+
## Inputs
40+
41+
No inputs.
42+
43+
## Outputs
44+
45+
| Name | Description |
46+
|------|-------------|
47+
| <a name="output_s3_bucket_arn"></a> [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname. |
48+
| <a name="output_s3_bucket_bucket_domain_name"></a> [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com. |
49+
| <a name="output_s3_bucket_bucket_regional_domain_name"></a> [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL. |
50+
| <a name="output_s3_bucket_hosted_zone_id"></a> [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region. |
51+
| <a name="output_s3_bucket_id"></a> [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket. |
52+
| <a name="output_s3_bucket_region"></a> [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in. |
53+
| <a name="output_s3_bucket_website_domain"></a> [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. |
54+
| <a name="output_s3_bucket_website_endpoint"></a> [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website. If not, this will be an empty string. |
55+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/s3-inventory/main.tf

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
locals {
2+
bucket_name = "s3-bucket-${random_pet.this.id}"
3+
region = "eu-west-1"
4+
}
5+
6+
provider "aws" {
7+
region = local.region
8+
9+
# Make it faster by skipping something
10+
skip_get_ec2_platforms = true
11+
skip_metadata_api_check = true
12+
skip_region_validation = true
13+
skip_credentials_validation = true
14+
skip_requesting_account_id = true
15+
}
16+
17+
data "aws_caller_identity" "current" {}
18+
19+
module "multi_inventory_configurations_bucket" {
20+
source = "../../"
21+
22+
bucket = local.bucket_name
23+
24+
force_destroy = true
25+
26+
attach_policy = true
27+
attach_inventory_destination_policy = true
28+
inventory_self_source_destination = true
29+
acl = "private" # "acl" conflicts with "grant" and "owner"
30+
31+
versioning = {
32+
status = true
33+
mfa_delete = false
34+
}
35+
36+
inventory_configuration = {
37+
38+
# Same source and destination buckets
39+
daily = {
40+
included_object_versions = "Current"
41+
destination = {
42+
format = "CSV"
43+
encryption = {
44+
encryption_type = "sse_kms"
45+
kms_key_id = module.kms.key_arn
46+
}
47+
}
48+
filter = {
49+
prefix = "documents/"
50+
}
51+
frequency = "Daily"
52+
}
53+
54+
weekly = {
55+
included_object_versions = "All"
56+
destination = {
57+
format = "CSV"
58+
}
59+
frequency = "Weekly"
60+
}
61+
62+
# Different destination bucket
63+
destination_other = {
64+
included_object_versions = "All"
65+
destination = {
66+
bucket_arn = module.inventory_destination_bucket.s3_bucket_arn
67+
format = "Parquet"
68+
encryption = {
69+
encryption_type = "sse_s3"
70+
}
71+
}
72+
frequency = "Weekly"
73+
optional_fields = ["Size", "EncryptionStatus", "StorageClass", "ChecksumAlgorithm"]
74+
}
75+
76+
# Different source bucket
77+
source_other = {
78+
included_object_versions = "Current"
79+
bucket = module.inventory_source_bucket.s3_bucket_id
80+
destination = {
81+
format = "ORC"
82+
encryption = {
83+
encryption_type = "sse_s3"
84+
}
85+
}
86+
frequency = "Daily"
87+
}
88+
}
89+
}
90+
91+
resource "random_pet" "this" {
92+
length = 2
93+
}
94+
95+
# https://docs.aws.amazon.com/AmazonS3/latest/userguide/configure-inventory.html#configure-inventory-kms-key-policy
96+
module "kms" {
97+
source = "terraform-aws-modules/kms/aws"
98+
99+
description = "Key example for Inventory S3 destination encyrption"
100+
deletion_window_in_days = 7
101+
key_statements = [
102+
{
103+
sid = "s3InventoryPolicy"
104+
actions = [
105+
"kms:GenerateDataKey",
106+
]
107+
resources = ["*"]
108+
109+
principals = [
110+
{
111+
type = "Service"
112+
identifiers = ["s3.amazonaws.com"]
113+
}
114+
]
115+
116+
conditions = [
117+
{
118+
test = "StringEquals"
119+
variable = "aws:SourceAccount"
120+
values = [
121+
data.aws_caller_identity.current.id,
122+
]
123+
},
124+
{
125+
test = "ArnLike"
126+
variable = "aws:SourceARN"
127+
values = [
128+
module.inventory_source_bucket.s3_bucket_arn,
129+
module.multi_inventory_configurations_bucket.s3_bucket_arn
130+
]
131+
}
132+
]
133+
}
134+
]
135+
}
136+
137+
module "inventory_destination_bucket" {
138+
source = "../../"
139+
140+
bucket = "inventory-destination-${random_pet.this.id}"
141+
acl = "private" # "acl" conflicts with "grant" and "owner"
142+
force_destroy = true
143+
attach_policy = true
144+
attach_inventory_destination_policy = true
145+
inventory_source_bucket_arn = module.multi_inventory_configurations_bucket.s3_bucket_arn
146+
inventory_source_account_id = data.aws_caller_identity.current.id
147+
}
148+
149+
module "inventory_source_bucket" {
150+
source = "../../"
151+
152+
bucket = "inventory-source-${random_pet.this.id}"
153+
acl = "private" # "acl" conflicts with "grant" and "owner"
154+
force_destroy = true
155+
}

‎examples/s3-inventory/outputs.tf

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
output "s3_bucket_id" {
2+
description = "The name of the bucket."
3+
value = module.multi_inventory_configurations_bucket.s3_bucket_id
4+
}
5+
6+
output "s3_bucket_arn" {
7+
description = "The ARN of the bucket. Will be of format arn:aws:s3:::bucketname."
8+
value = module.multi_inventory_configurations_bucket.s3_bucket_arn
9+
}
10+
11+
output "s3_bucket_bucket_domain_name" {
12+
description = "The bucket domain name. Will be of format bucketname.s3.amazonaws.com."
13+
value = module.multi_inventory_configurations_bucket.s3_bucket_bucket_domain_name
14+
}
15+
16+
output "s3_bucket_bucket_regional_domain_name" {
17+
description = "The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL."
18+
value = module.multi_inventory_configurations_bucket.s3_bucket_bucket_regional_domain_name
19+
}
20+
21+
output "s3_bucket_hosted_zone_id" {
22+
description = "The Route 53 Hosted Zone ID for this bucket's region."
23+
value = module.multi_inventory_configurations_bucket.s3_bucket_hosted_zone_id
24+
}
25+
26+
output "s3_bucket_region" {
27+
description = "The AWS region this bucket resides in."
28+
value = module.multi_inventory_configurations_bucket.s3_bucket_region
29+
}
30+
31+
output "s3_bucket_website_endpoint" {
32+
description = "The website endpoint, if the bucket is configured with a website. If not, this will be an empty string."
33+
value = module.multi_inventory_configurations_bucket.s3_bucket_website_endpoint
34+
}
35+
36+
output "s3_bucket_website_domain" {
37+
description = "The domain of the website endpoint, if the bucket is configured with a website. If not, this will be an empty string. This is used to create Route 53 alias records. "
38+
value = module.multi_inventory_configurations_bucket.s3_bucket_website_domain
39+
}

‎examples/s3-inventory/variables.tf

Whitespace-only changes.

‎examples/s3-inventory/versions.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 0.13.1"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 4.9"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 2.0"
12+
}
13+
}
14+
}

0 commit comments

Comments
 (0)