|
| 1 | +resource "aws_s3_bucket" "secure_bucket" { |
| 2 | + bucket = var.bucket_name |
| 3 | + |
| 4 | + tags = { |
| 5 | + Name = "SecureBucket" |
| 6 | + Environment = "DevSecOps" |
| 7 | + } |
| 8 | +} |
| 9 | + |
| 10 | +resource "aws_s3_bucket_public_access_block" "secure_access" { |
| 11 | + bucket = aws_s3_bucket.secure_bucket.id |
| 12 | + |
| 13 | + block_public_acls = true |
| 14 | + block_public_policy = true |
| 15 | + ignore_public_acls = true |
| 16 | + restrict_public_buckets = true |
| 17 | +} |
| 18 | + |
| 19 | +resource "aws_s3_bucket_versioning" "versioning" { |
| 20 | + bucket = aws_s3_bucket.secure_bucket.id |
| 21 | + |
| 22 | + versioning_configuration { |
| 23 | + status = "Enabled" |
| 24 | + } |
| 25 | +} |
| 26 | + |
| 27 | +resource "aws_s3_bucket_lifecycle_configuration" "lifecycle" { |
| 28 | + bucket = aws_s3_bucket.secure_bucket.id |
| 29 | + |
| 30 | + rule { |
| 31 | + id = "expire-objects" |
| 32 | + status = "Enabled" |
| 33 | + |
| 34 | + expiration { |
| 35 | + days = 30 |
| 36 | + } |
| 37 | + |
| 38 | + noncurrent_version_expiration { |
| 39 | + days = 30 |
| 40 | + } |
| 41 | + |
| 42 | + abort_incomplete_multipart_upload { |
| 43 | + days_after_initiation = 7 |
| 44 | + } |
| 45 | + } |
| 46 | +} |
| 47 | + |
| 48 | +resource "aws_s3_bucket_logging" "s3_logging" { |
| 49 | + bucket = aws_s3_bucket.secure_bucket.id |
| 50 | + |
| 51 | + target_bucket = aws_s3_bucket.secure_bucket.id |
| 52 | + target_prefix = "log/" |
| 53 | +} |
| 54 | + |
| 55 | +resource "aws_s3_bucket_server_side_encryption_configuration" "encryption" { |
| 56 | + bucket = aws_s3_bucket.secure_bucket.id |
| 57 | + |
| 58 | + rule { |
| 59 | + apply_server_side_encryption_by_default { |
| 60 | + sse_algorithm = "AES256" |
| 61 | + } |
| 62 | + } |
| 63 | +} |
| 64 | + |
| 65 | +resource "aws_dynamodb_table" "secure_table" { |
| 66 | + name = var.table_name |
| 67 | + billing_mode = "PAY_PER_REQUEST" |
| 68 | + hash_key = "id" |
| 69 | + |
| 70 | + attribute { |
| 71 | + name = "id" |
| 72 | + type = "S" |
| 73 | + } |
| 74 | + |
| 75 | + server_side_encryption { |
| 76 | + enabled = true |
| 77 | + } |
| 78 | + |
| 79 | + point_in_time_recovery { |
| 80 | + enabled = true |
| 81 | + } |
| 82 | + |
| 83 | + tags = { |
| 84 | + Name = "SecureTable" |
| 85 | + Environment = "DevSecOps" |
| 86 | + } |
| 87 | +} |
0 commit comments