terraform-aws-s3-bucket

Executive Summary

This Terraform module provisions production-grade AWS S3 buckets with comprehensive security controls aligned to CIS AWS Foundations Benchmark and AWS Security Hub best practices. It manages encryption (SSE-S3/SSE-KMS), versioning with MFA Delete, public access blocking, TLS enforcement, lifecycle management with intelligent tiering, cross-region replication, Object Lock (WORM), CORS configuration, static website hosting, event notifications (Lambda/SQS/SNS), S3 Access Points with VPC restriction, and custom bucket policies.

Overview

Architecture Diagram

Component Breakdown

Data Flow

Security Controls

CIS AWS Foundations Benchmark Alignment

AWS Security Hub Controls

Industry Adaptation

Production Readiness Checklist

• Enable versioning (default: true) for data protection
• Enable server-side encryption (default: true) with KMS for sensitive data
• Keep block_public_access = true (default) for all buckets
• Keep enforce_tls = true (default) to deny HTTP requests
• Enable access logging for security audit trail
• Configure lifecycle rules to manage storage costs
• Use KMS customer-managed keys for CloudTrail audit capability
• Enable Object Lock for compliance-critical data
• Set force_destroy = false (default) for production buckets
• Use VPC-restricted access points for network isolation
• Enable cross-region replication for disaster recovery
• Configure event notifications for operational automation
• Tag all resources for cost allocation and governance
• Review bucket policy for least-privilege access
• Consider MFA Delete for critical buckets (root account required)

Configuration Reference

Key Variables

Outputs

Cost Estimation

Deployment

# Minimal - secure defaults
module "s3_bucket" {
  source = "github.com/kogunlowo123/terraform-aws-s3-bucket"

  bucket_name = "my-secure-bucket"
  tags        = { Environment = "production" }
}

# Full-featured
module "s3_bucket" {
  source = "github.com/kogunlowo123/terraform-aws-s3-bucket"

  bucket_name       = "my-app-data"
  enable_encryption = true
  kms_key_arn       = aws_kms_key.s3.arn
  enable_logging    = true
  logging_target_bucket = "my-logs-bucket"

  lifecycle_rules = [
    {
      id      = "tiering"
      enabled = true
      transitions = [
        { days = 30,  storage_class = "STANDARD_IA" },
        { days = 90,  storage_class = "GLACIER" },
        { days = 365, storage_class = "DEEP_ARCHIVE" },
      ]
      noncurrent_version_expiration = { days = 180 }
    },
  ]

  enable_replication  = true
  replication_role_arn = aws_iam_role.replication.arn
  replication_rules = [{
    id                 = "replicate-all"
    status             = "Enabled"
    priority           = 1
    destination_bucket = module.replica.bucket_arn
  }]

  tags = { Environment = "production" }
}

terraform init
terraform plan
terraform apply

Links

• AWS S3 Documentation
• Terraform: aws_s3_bucket
• CIS AWS Foundations Benchmark
• AWS Security Hub S3 Controls
• AWS S3 Pricing
• S3 Object Lock
• S3 Access Points