# AWS S3 bucket Terraform module Terraform module which creates S3 bucket on AWS with all (or almost all) features provided by Terraform AWS provider. [![SWUbanner](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md) These features of S3 bucket configurations are supported: - static web-site hosting - access logging - versioning - CORS - lifecycle rules - server-side encryption - object locking - Cross-Region Replication (CRR) - Elastic Load Balancing and AWS WAF log delivery bucket policies - file system access to bucket data with Amazon S3 Files - Account-level Public Access Block Besides general purpose buckets, this repository manages these S3 bucket types: - [S3 Directory Bucket](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/directory-bucket), created by the root module when `is_directory_bucket = true` - [S3 Table Bucket](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/table-bucket), through the `table-bucket` sub-module - [S3 Vectors](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/vectors), through the `vectors` sub-module See the respective sub-module `README.md` for details on how to use: - [`account-public-access`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/account-public-access) - the account-level Public Access Block, which applies to every bucket in the account - [`file-system`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/file-system) - an Amazon S3 Files file system on a bucket this module does not manage - [`notification`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/notification) - bucket notifications to Lambda, SQS, SNS and EventBridge - [`object`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/object) - objects placed in a bucket - [`table-bucket`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/table-bucket) - table buckets and the Iceberg tables in them - [`vectors`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/vectors) - vector buckets and vector indexes ## Usage See the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples) directory for working examples to reference. ### Private bucket with versioning enabled ```hcl module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "my-s3-bucket" acl = "private" control_object_ownership = true object_ownership = "ObjectWriter" versioning = { enabled = true } } ``` ### Bucket with log delivery policies attached Each `attach_*_log_delivery_policy` flag adds the statements one service needs to write its logs to the bucket, and the module merges every enabled flag into a single bucket policy. ```hcl module "s3_bucket_for_logs" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "aws-waf-logs-my-s3-bucket-for-logs" # Application and Classic Load Balancer access logs attach_elb_log_delivery_policy = true # Network Load Balancer access logs attach_lb_log_delivery_policy = true # AWS WAF logs, which require a bucket name that starts with `aws-waf-logs-` attach_waf_log_delivery_policy = true } ``` ### Bucket with a custom policy attached When you need to attach a custom policy to the bucket, use the `policy` argument. The placeholders `_S3_BUCKET_ID_`, `_S3_BUCKET_ARN_` and `_AWS_ACCOUNT_ID_` are replaced with the real values when the policy is attached, which is what makes a policy work against a bucket whose name is generated from `bucket_prefix`. ```hcl module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket_prefix = "my-s3-bucket-" attach_policy = true policy = jsonencode({ Version = "2012-10-17" Statement = [{ Sid = "DenyInsecureTransport" Effect = "Deny" Principal = "*" Action = "s3:*" Resource = ["_S3_BUCKET_ARN_", "_S3_BUCKET_ARN_/*"] Condition = { Bool = { "aws:SecureTransport" = "false" } } }] }) } ``` ### Bucket with an S3 file system S3 Files requires versioning on the bucket. The module creates an IAM role for each file system and a security group shared by the mount targets. A principal listed in an access point's `read_access_arns` or `read_write_access_arns` can mount that file system only through the access points that list it. To put a file system on a bucket this module does not manage, call [`modules/file-system`](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/modules/file-system) directly. Its README covers the one thing that module asks of callers, which is to pass the bucket's versioning status as a reference to the versioning resource rather than as a literal. ```hcl module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" bucket = "my-s3-bucket" versioning = { enabled = true } file_system_security_group_vpc_id = "vpc-1234556abcdef" file_system_security_group_ingress_rules = { clients = { referenced_security_group_id = "sg-1234556abcdef" } } file_systems = { datasets = { prefix = "datasets/" mount_targets = { eu-west-1a = { subnet_id = "subnet-abcde012" } eu-west-1b = { subnet_id = "subnet-bcde012a" } } } } } ``` ## Notes - A bucket carrying an S3 file system needs versioning enabled and either SSE-S3 or SSE-KMS encryption. S3 Files is not available on a directory bucket, and the module says so rather than ignoring `file_systems`. - Changing a file system's `prefix`, its KMS key, or its IAM role replaces the file system, along with its mount targets and access points. An access point cannot be edited either, so any change to one replaces it and gives it a new ARN. - Removing a `synchronization_configuration` leaves the file system expiring data after 365 days, not the 30 days AWS applies to a file system that never had one. - A principal named in an access point's `read_access_arns` or `read_write_access_arns` reaches that file system only through the access points that name it. The module writes the allow and deny pair AWS recommends, and a read-only principal is also denied writes through its own access point. - Key `mount_targets` by something known at plan time, such as the Availability Zone. Terraform cannot create resources whose map keys come from values that only exist after an apply. ## Conditional creation Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_bucket`. ```hcl # This S3 bucket will not be created module "s3_bucket" { source = "terraform-aws-modules/s3-bucket/aws" create_bucket = false # ... omitted } ``` ## Module wrappers Users of Terragrunt can create multiple similar resources from one configuration with the modules in the [wrappers](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/wrappers) directory. ## Known limitations (Terraform/OpenTofu, not this module) A few requests come up again and again and cannot be implemented by this module, or by any module: Terraform requires `lifecycle` arguments to be literal values inside the resource block. [hashicorp/terraform#18367](https://github.com/hashicorp/terraform/issues/18367) has been open since 2018, [#22544](https://github.com/hashicorp/terraform/issues/22544) since 2019, and [opentofu/opentofu#1329](https://github.com/opentofu/opentofu/issues/1329) is the same request for OpenTofu. - **`prevent_destroy` cannot be set through a module input.** Asked for in [#83](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/83), [#186](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/186), [#203](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/203), [#215](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/215), [#283](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/283) and [#407](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/407), and not something this module can offer: the `lifecycle` block has to be a literal inside the resource. Native options: an explicit `Deny` on `s3:DeleteBucket` in the bucket policy, or fork this module and add the block yourself. - **`ignore_changes` cannot be set either** ([#21](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/21)). A tag written by a scanner, a cost tool or an AWS Config rule is removed on the next apply and written back by the tool after that. Native options: move tag ownership into Terraform with provider `default_tags`, or fork this module and add `ignore_changes = [tags, tags_all]`. [Compliance.tf](https://compliance.tf/?utm_source=github&utm_medium=readme&utm_campaign=known-limitations) serves this module with these rules applied at download time, on top of whatever your organization already has enabled there. Inputs and outputs do not change; the `source` line does. Drop the `version` argument and pin the release you use by adding `&version=` and that release number to the URL. To get started, register a free compliance.tf account and configure an access token: source = "https://registry.compliance.tf/terraform-aws-modules/s3-bucket/aws?add_rules=lifecycle_ignore_tags,lifecycle_prevent_destroy_data" The full workaround for each item above, and the exact diff each rule makes, are in the [compliance.tf docs for this module](https://compliance.tf/docs/workarounds/terraform-aws-s3-bucket/?utm_source=github&utm_medium=readme&utm_campaign=known-limitations). To preview a diff without an account, open this module in the [Rules Playground](https://registry.compliance.tf/playground?module=terraform-aws-modules/s3-bucket/aws&rules=lifecycle_ignore_tags,lifecycle_prevent_destroy_data). Disclosure: written by this module's maintainer, who also builds [compliance.tf](https://compliance.tf/?utm_source=github&utm_medium=readme&utm_campaign=known-limitations). ## Examples - [Complete](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/complete) - Complete S3 bucket with most of supported features enabled - [Cross-Region Replication](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/s3-replication) - S3 bucket with Cross-Region Replication (CRR) enabled - [S3 Notifications](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/notification) - S3 bucket notifications to Lambda functions, SQS queues, and SNS topics. - [S3 Object](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/object) - Manage S3 bucket objects. - [S3 Inventory and Analytics](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/inventory-and-analytics) - S3 bucket Inventory and Analytics configurations. - [S3 ACLs](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/acl) - S3 bucket ACLs, for the buckets that still require them. - [S3 Bucket Policies](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/bucket-policies) - Attach the bundled log delivery and transport policies. - [S3 file system](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/file-system) - Amazon S3 Files file systems scoped to bucket prefixes, with mount targets and access points. - [S3 Account-level Public Access Block](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/account-public-access) - Manage S3 account-level Public Access Block. - [S3 Directory Bucket](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/directory-bucket) - S3 Directory Bucket configuration. - [S3 Table Bucket](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/table-bucket) - S3 Table Bucket configuration. - [S3 Vectors](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/examples/vectors) - S3 Vectors vector bucket with indexes configuration. ## Requirements | Name | Version | | ---- | ------- | | [terraform](#requirement\_terraform) | >= 1.5.7 | | [aws](#requirement\_aws) | >= 6.44 | ## Providers | Name | Version | | ---- | ------- | | [aws](#provider\_aws) | >= 6.44 | ## Modules | Name | Source | Version | | ---- | ------ | ------- | | [s3\_file\_system](#module\_s3\_file\_system) | ./modules/file-system | n/a | ## Resources | Name | Type | | ---- | ---- | | [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource | | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource | | [aws_s3_bucket_analytics_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_analytics_configuration) | resource | | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource | | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource | | [aws_s3_bucket_inventory.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_inventory) | resource | | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource | | [aws_s3_bucket_metadata_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metadata_configuration) | resource | | [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource | | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource | | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource | | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | | [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | | [aws_s3_bucket_replication_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_replication_configuration) | resource | | [aws_s3_bucket_request_payment_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_request_payment_configuration) | resource | | [aws_s3_bucket_server_side_encryption_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | | [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | | [aws_s3_bucket_website_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource | | [aws_s3_directory_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_directory_bucket) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_canonical_user_id.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source | | [aws_iam_policy_document.access_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.cloudtrail_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.deny_incorrect_encryption_headers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.deny_incorrect_kms_key_sse](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.deny_ssec_encrypted_object_uploads](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.deny_unencrypted_object_uploads](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.inventory_and_analytics_destination_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.waf_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | ## Inputs | Name | Description | Type | Default | Required | | ---- | ----------- | ---- | ------- | :------: | | [acceleration\_status](#input\_acceleration\_status) | Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended | `string` | `null` | no | | [access\_log\_delivery\_policy\_source\_accounts](#input\_access\_log\_delivery\_policy\_source\_accounts) | List of AWS Account IDs should be allowed to deliver access logs to this bucket | `list(string)` | `[]` | no | | [access\_log\_delivery\_policy\_source\_buckets](#input\_access\_log\_delivery\_policy\_source\_buckets) | List of S3 bucket ARNs which should be allowed to deliver access logs to this bucket | `list(string)` | `[]` | no | | [access\_log\_delivery\_policy\_source\_organizations](#input\_access\_log\_delivery\_policy\_source\_organizations) | List of AWS Organization IDs should be allowed to deliver access logs to this bucket | `list(string)` | `[]` | no | | [acl](#input\_acl) | The canned ACL to apply. Conflicts with `grant` | `string` | `null` | no | | [allowed\_kms\_key\_arn](#input\_allowed\_kms\_key\_arn) | The ARN of KMS key which should be allowed in PutObject | `string` | `null` | no | | [analytics\_configuration](#input\_analytics\_configuration) | Analytics configurations for the bucket, keyed by configuration name |

map(object({
    filter = optional(object({
      prefix = optional(string)
      tags   = optional(map(string))
    }))
    storage_class_analysis = optional(object({
      output_schema_version  = optional(string)
      destination_bucket_arn = optional(string)
      destination_account_id = optional(string)
      export_format          = optional(string)
      export_prefix          = optional(string)
    }))
  }))

| `{}` | no | | [analytics\_self\_source\_destination](#input\_analytics\_self\_source\_destination) | Whether or not the analytics source bucket is also the destination bucket | `bool` | `false` | no | | [analytics\_source\_account\_id](#input\_analytics\_source\_account\_id) | The analytics source account id | `string` | `null` | no | | [analytics\_source\_bucket\_arn](#input\_analytics\_source\_bucket\_arn) | The analytics source bucket ARN | `string` | `null` | no | | [attach\_access\_log\_delivery\_policy](#input\_attach\_access\_log\_delivery\_policy) | Controls if S3 bucket should have S3 access log delivery policy attached | `bool` | `false` | no | | [attach\_analytics\_destination\_policy](#input\_attach\_analytics\_destination\_policy) | Controls if S3 bucket should have bucket analytics destination policy attached | `bool` | `false` | no | | [attach\_cloudtrail\_log\_delivery\_policy](#input\_attach\_cloudtrail\_log\_delivery\_policy) | Controls if S3 bucket should have CloudTrail log delivery policy attached | `bool` | `false` | no | | [attach\_deny\_incorrect\_encryption\_headers](#input\_attach\_deny\_incorrect\_encryption\_headers) | Controls if S3 bucket should deny incorrect encryption headers policy attached | `bool` | `false` | no | | [attach\_deny\_incorrect\_kms\_key\_sse](#input\_attach\_deny\_incorrect\_kms\_key\_sse) | Controls if S3 bucket policy should deny usage of incorrect KMS key SSE | `bool` | `false` | no | | [attach\_deny\_insecure\_transport\_policy](#input\_attach\_deny\_insecure\_transport\_policy) | Controls if S3 bucket should have deny non-SSL transport policy attached | `bool` | `false` | no | | [attach\_deny\_ssec\_encrypted\_object\_uploads](#input\_attach\_deny\_ssec\_encrypted\_object\_uploads) | Controls if S3 bucket should deny SSEC encrypted object uploads | `bool` | `false` | no | | [attach\_deny\_unencrypted\_object\_uploads](#input\_attach\_deny\_unencrypted\_object\_uploads) | Controls if S3 bucket should deny unencrypted object uploads policy attached | `bool` | `false` | no | | [attach\_elb\_log\_delivery\_policy](#input\_attach\_elb\_log\_delivery\_policy) | Controls if S3 bucket should have the log delivery policy for Application and Classic Load Balancer access logs attached | `bool` | `false` | no | | [attach\_inventory\_destination\_policy](#input\_attach\_inventory\_destination\_policy) | Controls if S3 bucket should have bucket inventory destination policy attached | `bool` | `false` | no | | [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have the log delivery policy for Network Load Balancer access logs attached | `bool` | `false` | no | | [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no | | [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if the S3 Bucket Public Access Block is created (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no | | [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no | | [attach\_waf\_log\_delivery\_policy](#input\_attach\_waf\_log\_delivery\_policy) | Controls if S3 bucket should have WAF log delivery policy attached | `bool` | `false` | no | | [availability\_zone\_id](#input\_availability\_zone\_id) | Availability Zone ID or Local Zone ID | `string` | `null` | no | | [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket | `bool` | `true` | no | | [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket | `bool` | `true` | no | | [bucket](#input\_bucket) | The name of the bucket. If omitted, Terraform will assign a random, unique name | `string` | `null` | no | | [bucket\_namespace](#input\_bucket\_namespace) | Namespace for the bucket. Determines bucket naming scope. Valid values: `account-regional`, `global`. Defaults to `global` (AWS) | `string` | `null` | no | | [bucket\_prefix](#input\_bucket\_prefix) | Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket | `string` | `null` | no | | [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket | `bool` | `false` | no | | [cors\_rule](#input\_cors\_rule) | Rules for Cross-Origin Resource Sharing on the bucket |

list(object({
    id              = optional(string)
    allowed_methods = list(string)
    allowed_origins = list(string)
    allowed_headers = optional(list(string))
    expose_headers  = optional(list(string))
    max_age_seconds = optional(number)
  }))

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number)
    ip_protocol                  = string
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    tags                         = optional(map(string))
    to_port                      = optional(number)
  }))

| `{}` | no | | [file\_system\_security\_group\_ingress\_rules](#input\_file\_system\_security\_group\_ingress\_rules) | Map of ingress rules added to every file system security group this module creates. A file system can replace them with its own `security_group_ingress_rules` |

map(object({
    name = optional(string)

    cidr_ipv4                    = optional(string)
    cidr_ipv6                    = optional(string)
    description                  = optional(string)
    from_port                    = optional(number, 2049)
    ip_protocol                  = optional(string, "tcp")
    prefix_list_id               = optional(string)
    referenced_security_group_id = optional(string)
    tags                         = optional(map(string))
    to_port                      = optional(number, 2049)
  }))

| `{}` | no | | [file\_system\_security\_group\_tags](#input\_file\_system\_security\_group\_tags) | A map of additional tags added to every file system security group this module creates | `map(string)` | `null` | no | | [file\_system\_security\_group\_vpc\_id](#input\_file\_system\_security\_group\_vpc\_id) | ID of the VPC where the file system security groups are created. Must be the VPC of the mount target subnets | `string` | `null` | no | | [file\_systems](#input\_file\_systems) | Map of Amazon S3 Files file system definitions to create on the bucket. Requires versioning enabled through `versioning`, even when it is already enabled outside this module, and is not supported on a directory bucket |

map(object({
    create = optional(bool, true)
    name   = optional(string) # Will fall back to map key
    tags   = optional(map(string))

    # File system. Changing the prefix, the KMS key or the IAM role (including the created role's name or path)
    # replaces the file system, its mount targets and its access points
    prefix                = optional(string)
    kms_key_id            = optional(string) # ARN, a key ID or alias is rejected by the provider
    accept_bucket_warning = optional(bool)
    timeouts = optional(object({
      create = optional(string)
      delete = optional(string)
    }))

    # IAM role
    create_iam_role = optional(bool, true)
    # A role brought in must already carry its permissions when the file system is created. S3 Files checks
    # them at creation, and the file system depends only on the role's ARN, not on any policy attached to it
    iam_role_arn                              = optional(string)
    iam_role_name                             = optional(string)
    iam_role_use_name_prefix                  = optional(bool, true)
    iam_role_path                             = optional(string)
    iam_role_description                      = optional(string)
    iam_role_permissions_boundary             = optional(string)
    iam_role_kms_key_arns                     = optional(list(string))
    iam_role_policies                         = optional(map(string), {}) # Ignored when create_iam_role is false
    iam_role_policy_name                      = optional(string)
    iam_role_source_assume_policy_documents   = optional(list(string), [])
    iam_role_override_assume_policy_documents = optional(list(string), [])
    iam_role_source_policy_documents          = optional(list(string), [])
    iam_role_override_policy_documents        = optional(list(string), [])
    iam_role_tags                             = optional(map(string))

    # Mount target(s). Key them by a value known at plan time, such as the Availability Zone
    # security_groups are added to every mount target, alongside the group this module creates unless
    # create_security_group is false
    security_groups                = optional(list(string), [])
    create_security_group          = optional(bool)
    security_group_name            = optional(string)
    security_group_use_name_prefix = optional(bool)
    security_group_description     = optional(string)
    security_group_ingress_rules = optional(map(object({
      name = optional(string)

      cidr_ipv4                    = optional(string)
      cidr_ipv6                    = optional(string)
      description                  = optional(string)
      from_port                    = optional(number, 2049)
      ip_protocol                  = optional(string, "tcp")
      prefix_list_id               = optional(string)
      referenced_security_group_id = optional(string)
      tags                         = optional(map(string))
      to_port                      = optional(number, 2049)
    })))
    security_group_egress_rules = optional(map(object({
      name = optional(string)

      cidr_ipv4                    = optional(string)
      cidr_ipv6                    = optional(string)
      description                  = optional(string)
      from_port                    = optional(number)
      ip_protocol                  = string
      prefix_list_id               = optional(string)
      referenced_security_group_id = optional(string)
      tags                         = optional(map(string))
      to_port                      = optional(number)
    })))
    security_group_tags = optional(map(string))
    mount_targets = optional(map(object({
      subnet_id       = string
      ip_address_type = optional(string)
      ipv4_address    = optional(string)
      ipv6_address    = optional(string)
      security_groups = optional(list(string), [])
      timeouts = optional(object({
        create = optional(string)
        delete = optional(string)
        update = optional(string)
      }))
    })), {})

    # Access point(s)
    access_points = optional(map(object({
      name = optional(string) # Will fall back to map key
      tags = optional(map(string))

      posix_user = optional(object({
        gid            = number
        uid            = number
        secondary_gids = optional(list(number))
      }))
      root_directory = optional(object({
        path = optional(string)
        creation_permissions = optional(object({
          owner_gid   = number
          owner_uid   = number
          permissions = string
        }))
      }))

      timeouts = optional(object({
        create = optional(string)
        delete = optional(string)
      }))

      # A principal listed here is denied every other way into this file system, including mounting without an access point
      read_access_arns       = optional(list(string))
      read_write_access_arns = optional(list(string))
    })), {})

    # File system policy
    create_policy             = optional(bool, false)
    source_policy_documents   = optional(list(string), [])
    override_policy_documents = optional(list(string), [])
    policy_statements = optional(list(object({
      sid           = optional(string)
      actions       = optional(list(string))
      not_actions   = optional(list(string))
      effect        = optional(string)
      resources     = optional(list(string))
      not_resources = optional(list(string))
      principals = optional(list(object({
        type        = string
        identifiers = list(string)
      })))
      not_principals = optional(list(object({
        type        = string
        identifiers = list(string)
      })))
      conditions = optional(list(object({
        test     = string
        values   = list(string)
        variable = string
      })))
    })))

    # Synchronization
    synchronization_configuration = optional(object({
      import_data_rule = list(object({
        prefix         = string
        size_less_than = number
        trigger        = string
      }))
      # Required: the API takes exactly one expiration rule with every synchronization configuration
      expiration_data_rule = object({
        days_after_last_access = number
      })
    }))
  }))

| `{}` | no | | [force\_destroy](#input\_force\_destroy) | A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable | `bool` | `false` | no | | [grant](#input\_grant) | ACL policy grants for the bucket. Conflicts with `acl` |

list(object({
    id         = optional(string)
    type       = string
    permission = string
    uri        = optional(string)
    email      = optional(string)
  }))

map(object({
    status = optional(string)
    filter = optional(object({
      prefix = optional(string)
      tags   = optional(map(string))
    }))
    tiering = map(object({
      days = number
    }))
  }))

| `{}` | no | | [inventory\_configuration](#input\_inventory\_configuration) | Inventory configurations for the bucket, keyed by configuration name |

map(object({
    bucket                   = optional(string)
    included_object_versions = string
    enabled                  = optional(bool, true)
    optional_fields          = optional(list(string))
    frequency                = string
    destination = object({
      bucket_arn = optional(string)
      format     = optional(string)
      account_id = optional(string)
      prefix     = optional(string)
      encryption = optional(object({
        encryption_type = string
        kms_key_id      = optional(string)
      }))
    })
    filter = optional(object({
      prefix = optional(string)
    }))
  }))

| `{}` | no | | [inventory\_self\_source\_destination](#input\_inventory\_self\_source\_destination) | Whether or not the inventory source bucket is also the destination bucket | `bool` | `false` | no | | [inventory\_source\_account\_id](#input\_inventory\_source\_account\_id) | The inventory source account id | `string` | `null` | no | | [inventory\_source\_bucket\_arn](#input\_inventory\_source\_bucket\_arn) | The inventory source bucket ARN | `string` | `null` | no | | [is\_directory\_bucket](#input\_is\_directory\_bucket) | If the s3 bucket created is a directory bucket | `bool` | `false` | no | | [lb\_log\_delivery\_policy\_source\_organizations](#input\_lb\_log\_delivery\_policy\_source\_organizations) | List of AWS Organization IDs should be allowed to deliver ALB/NLB logs to this bucket | `list(string)` | `[]` | no | | [lifecycle\_rule](#input\_lifecycle\_rule) | Object lifecycle management rules for the bucket |

list(object({
    id      = optional(string)
    prefix  = optional(string)
    enabled = optional(bool)
    status  = optional(string)

    abort_incomplete_multipart_upload_days = optional(number)

    expiration = optional(object({
      date                         = optional(string)
      days                         = optional(number)
      expired_object_delete_marker = optional(bool)
    }))
    filter = optional(object({
      object_size_greater_than = optional(number)
      object_size_less_than    = optional(number)
      prefix                   = optional(string)
      tags                     = optional(map(string))
      tag                      = optional(map(string))
    }))
    noncurrent_version_expiration = optional(object({
      newer_noncurrent_versions = optional(number)
      days                      = optional(number)
      noncurrent_days           = optional(number)
    }))
    noncurrent_version_transition = optional(list(object({
      newer_noncurrent_versions = optional(number)
      days                      = optional(number)
      noncurrent_days           = optional(number)
      storage_class             = string
    })), [])
    transition = optional(list(object({
      date          = optional(string)
      days          = optional(number)
      storage_class = string
    })), [])
  }))

object({
    target_bucket = string
    target_prefix = optional(string)
    target_object_key_format = optional(object({
      partitioned_prefix = optional(object({
        partition_date_source = optional(string)
      }))
      simple_prefix = optional(object({}))
    }))
  })

object({
    kms_key_arn   = optional(string)
    sse_algorithm = string
  })

list(object({
    name = string
    filter = optional(object({
      prefix       = optional(string)
      tags         = optional(map(string))
      access_point = optional(string)
    }))
  }))

| `[]` | no | | [object\_lock\_configuration](#input\_object\_lock\_configuration) | Object lock configuration for the bucket |

object({
    token = optional(string)
    rule = optional(object({
      default_retention = object({
        mode  = string
        days  = optional(number)
        years = optional(number)
      })
    }))
  })

| `{}` | no | | [object\_lock\_enabled](#input\_object\_lock\_enabled) | Whether S3 bucket should have an Object Lock configuration enabled | `bool` | `false` | no | | [object\_ownership](#input\_object\_ownership) | Object ownership. Valid values: `BucketOwnerEnforced`, `BucketOwnerPreferred` or `ObjectWriter`. `BucketOwnerEnforced`: ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. `BucketOwnerPreferred`: Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the `bucket-owner-full-control` canned ACL. `ObjectWriter`: The uploading account will own the object if the object is uploaded with the `bucket-owner-full-control` canned ACL | `string` | `"BucketOwnerEnforced"` | no | | [owner](#input\_owner) | Bucket owner's display name and ID. Conflicts with `acl` | `map(string)` | `{}` | no | | [policy](#input\_policy) | A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide | `string` | `null` | no | | [putin\_khuylo](#input\_putin\_khuylo) | Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo! | `bool` | `true` | no | | [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no | | [replication\_configuration](#input\_replication\_configuration) | Cross-region replication configuration for the bucket |

object({
    role = optional(string)

    # `rules` is the original name, `rule` was added to match the provider block. Set either
    rule = optional(list(object({
      id       = optional(string)
      priority = optional(number)
      status   = optional(string)
      prefix   = optional(string)

      # Both spellings are accepted; the newer one matches the provider block name
      delete_marker_replication          = optional(string)
      delete_marker_replication_status   = optional(string)
      existing_object_replication        = optional(string)
      existing_object_replication_status = optional(string)

      filter = optional(object({
        prefix = optional(string)
        tags   = optional(map(string))
        tag    = optional(map(string))
      }))
      source_selection_criteria = optional(object({
        replica_modifications = optional(object({
          enabled = optional(string)
          status  = optional(string)
        }))
        sse_kms_encrypted_objects = optional(object({
          enabled = optional(string)
          status  = optional(string)
        }))
      }))
      destination = object({
        bucket        = string
        storage_class = optional(string)
        account       = optional(string)
        account_id    = optional(string)

        replica_kms_key_id = optional(string)
        encryption_configuration = optional(object({
          replica_kms_key_id = optional(string)
        }))
        access_control_translation = optional(object({
          owner = string
        }))
        replication_time = optional(object({
          status  = optional(string)
          minutes = optional(number)
        }))
        metrics = optional(object({
          status  = optional(string)
          minutes = optional(number)
        }))
      })
    })))
    rules = optional(list(object({
      id       = optional(string)
      priority = optional(number)
      status   = optional(string)
      prefix   = optional(string)

      # Both spellings are accepted; the newer one matches the provider block name
      delete_marker_replication          = optional(string)
      delete_marker_replication_status   = optional(string)
      existing_object_replication        = optional(string)
      existing_object_replication_status = optional(string)

      filter = optional(object({
        prefix = optional(string)
        tags   = optional(map(string))
        tag    = optional(map(string))
      }))
      source_selection_criteria = optional(object({
        replica_modifications = optional(object({
          enabled = optional(string)
          status  = optional(string)
        }))
        sse_kms_encrypted_objects = optional(object({
          enabled = optional(string)
          status  = optional(string)
        }))
      }))
      destination = object({
        bucket        = string
        storage_class = optional(string)
        account       = optional(string)
        account_id    = optional(string)

        replica_kms_key_id = optional(string)
        encryption_configuration = optional(object({
          replica_kms_key_id = optional(string)
        }))
        access_control_translation = optional(object({
          owner = string
        }))
        replication_time = optional(object({
          status  = optional(string)
          minutes = optional(number)
        }))
        metrics = optional(object({
          status  = optional(string)
          minutes = optional(number)
        }))
      })
    })))
  })

| `{}` | no | | [request\_payer](#input\_request\_payer) | Specifies who should bear the cost of Amazon S3 data transfer. Can be either `BucketOwner` or `Requester`. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information | `string` | `null` | no | | [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for this bucket | `bool` | `true` | no | | [server\_side\_encryption\_configuration](#input\_server\_side\_encryption\_configuration) | Server-side encryption configuration for the bucket |

object({
    # AWS permits a single rule per bucket, and every example passes one object
    rule = optional(object({
      bucket_key_enabled       = optional(bool)
      blocked_encryption_types = optional(list(string))
      apply_server_side_encryption_by_default = optional(object({
        sse_algorithm     = string
        kms_master_key_id = optional(string)
      }))
    }))
  })

| `{}` | no | | [skip\_destroy\_public\_access\_block](#input\_skip\_destroy\_public\_access\_block) | Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if `public_access_block` is set to true | `bool` | `true` | no | | [tags](#input\_tags) | A mapping of tags to assign to the bucket | `map(string)` | `{}` | no | | [transition\_default\_minimum\_object\_size](#input\_transition\_default\_minimum\_object\_size) | The default minimum object size behavior applied to the lifecycle configuration. Valid values: `all_storage_classes_128K` (default) or `varies_by_storage_class` | `string` | `null` | no | | [type](#input\_type) | Bucket type. Valid values: `Directory` | `string` | `"Directory"` | no | | [versioning](#input\_versioning) | Versioning configuration for the bucket | `map(string)` | `{}` | no | | [website](#input\_website) | Static website hosting or redirect configuration for the bucket |

object({
    index_document = optional(string)
    error_document = optional(string)
    redirect_all_requests_to = optional(object({
      host_name = string
      protocol  = optional(string)
    }))
    routing_rules = optional(list(object({
      condition = optional(object({
        http_error_code_returned_equals = optional(string)
        key_prefix_equals               = optional(string)
      }))
      redirect = optional(object({
        host_name               = optional(string)
        http_redirect_code      = optional(string)
        protocol                = optional(string)
        replace_key_prefix_with = optional(string)
        replace_key_with        = optional(string)
      }))
    })))
  })

| `{}` | no | ## Outputs | Name | Description | | ---- | ----------- | | [aws\_s3\_bucket\_versioning\_status](#output\_aws\_s3\_bucket\_versioning\_status) | The versioning status of the bucket. Will be 'Enabled', 'Suspended', or 'Disabled' | | [file\_system\_access\_points](#output\_file\_system\_access\_points) | Map of file system access points created and their attributes, keyed by file system and then by access point | | [file\_system\_iam\_roles](#output\_file\_system\_iam\_roles) | Map of file system IAM roles created, with their ARN, name and unique ID | | [file\_system\_mount\_targets](#output\_file\_system\_mount\_targets) | Map of file system mount targets created and their attributes, keyed by file system and then by mount target | | [file\_system\_security\_group\_arns](#output\_file\_system\_security\_group\_arns) | Map of the security group created for each file system's mount targets, by ARN | | [file\_system\_security\_group\_ids](#output\_file\_system\_security\_group\_ids) | Map of the security group created for each file system's mount targets, by ID | | [file\_systems](#output\_file\_systems) | Map of file systems created and their attributes | | [s3\_bucket\_arn](#output\_s3\_bucket\_arn) | The ARN of the bucket. Will be of format arn:aws:s3:::bucketname | | [s3\_bucket\_bucket\_domain\_name](#output\_s3\_bucket\_bucket\_domain\_name) | The bucket domain name. Will be of format bucketname.s3.amazonaws.com | | [s3\_bucket\_bucket\_namespace](#output\_s3\_bucket\_bucket\_namespace) | The namespace of the bucket | | [s3\_bucket\_bucket\_regional\_domain\_name](#output\_s3\_bucket\_bucket\_regional\_domain\_name) | The bucket region-specific domain name. The bucket domain name including the region name, please refer here for format. Note: The AWS CloudFront allows specifying S3 region-specific endpoint when creating S3 origin, it will prevent redirect issues from CloudFront to S3 Origin URL | | [s3\_bucket\_hosted\_zone\_id](#output\_s3\_bucket\_hosted\_zone\_id) | The Route 53 Hosted Zone ID for this bucket's region | | [s3\_bucket\_id](#output\_s3\_bucket\_id) | The name of the bucket | | [s3\_bucket\_lifecycle\_configuration\_rules](#output\_s3\_bucket\_lifecycle\_configuration\_rules) | The lifecycle rules of the bucket, if the bucket is configured with lifecycle rules | | [s3\_bucket\_policy](#output\_s3\_bucket\_policy) | The policy of the bucket, if the bucket is configured with a policy | | [s3\_bucket\_region](#output\_s3\_bucket\_region) | The AWS region this bucket resides in | | [s3\_bucket\_tags](#output\_s3\_bucket\_tags) | Tags of the bucket | | [s3\_bucket\_website\_domain](#output\_s3\_bucket\_website\_domain) | The domain of the website endpoint, if the bucket is configured with a website. This is used to create Route 53 alias records | | [s3\_bucket\_website\_endpoint](#output\_s3\_bucket\_website\_endpoint) | The website endpoint, if the bucket is configured with a website | | [s3\_directory\_bucket\_arn](#output\_s3\_directory\_bucket\_arn) | ARN of the directory bucket | | [s3\_directory\_bucket\_name](#output\_s3\_directory\_bucket\_name) | Name of the directory bucket | ## Authors Module is maintained by [Anton Babenko](https://github.com/antonbabenko) with help from [these awesome contributors](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/graphs/contributors). ## License Apache 2 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/master/LICENSE) for full details. ## Additional information for users from Russia and Belarus * Russia has [illegally annexed Crimea in 2014](https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation) and [brought the war in Donbas](https://en.wikipedia.org/wiki/War_in_Donbas) followed by [full-scale invasion of Ukraine in 2022](https://en.wikipedia.org/wiki/2022_Russian_invasion_of_Ukraine). * Russia has brought sorrow and devastations to millions of Ukrainians, killed hundreds of innocent people, damaged thousands of buildings, and forced several million people to flee. * [Putin khuylo!](https://en.wikipedia.org/wiki/Putin_khuylo!)