The terraform-aws-modules/terraform-aws-s3-bucket module represents a Terraform implementation that creates an S3 bucket on AWS with all or almost all features provided by the Terraform AWS provider. The module is described as a comprehensive Terraform solution for creating and managing AWS S3 buckets with an extensive range of configurations and features. This description establishes the central purpose of the artifact: to abstract the complexity of S3 bucket management while providing fine-grained control over bucket properties, security settings, and integration with other AWS services. The module is designed to be comprehensive, handling nearly all S3 bucket configurations supported by the AWS provider for Terraform.
The practical impact of this abstraction is significant for teams operating at scale. Instead of manually assembling dozens of individual awss3bucket, awss3bucketacl, awss3bucketversioning, awss3bucket_policy, and related resources, operators invoke a single module with a declarative input surface. This reduces duplication, enforces consistent naming conventions, and lowers the risk of misconfiguration across environments. The contextual layer connects this abstraction directly to DevOps workflows where modules are versioned, tested, and reused across projects, which aligns with the broader Terraform ecosystem where modules serve as the primary unit of reuse.
The module is organized around several core components that work together to provision and configure S3 buckets. The module uses local variables and conditional logic to determine which resources should be created based on the provided configuration. This conditional creation model means that unused features do not generate extraneous resources, keeping state clean and plan output minimal. The design choice reflects an awareness that S3 buckets often serve different roles in the same account, from data lakes to static web hosting to log archives.
Module Feature Set And Supported Capabilities
The module supports a comprehensive set of S3 bucket features that map directly to capabilities exposed by the AWS provider.
The supported features include:
- static web-site hosting
- access logging
- versioning
- CORS
- lifecycle rules
- server-side encryption
- object locking
- Cross-Region Replication (CRR)
- ELB log delivery bucket policy
- ALB/NLB log delivery bucket policy
- WAF log delivery bucket policy
- Account-level Public Access Block
- S3 Directory Bucket
- S3 Table Bucket
- S3 Vectors
Each feature carries operational impact. Static web-site hosting enables serving content directly from S3, eliminating the need for a separate web server tier for low-traffic sites. Access logging provides an audit trail of all requests, which is critical for security investigations and compliance reporting. Versioning protects against accidental overwrites and enables point-in-time recovery. CORS configuration allows browsers to interact with the bucket from different origins, essential for web applications. Lifecycle rules automate cost optimization by transitioning objects to cheaper storage classes or expiring them. Server-side encryption ensures data at rest is protected without client-side changes. Object locking supports WORM compliance models for regulated data. Cross-Region Replication provides durability and low-latency access across AWS regions. Log delivery bucket policies enable integration with Elastic Load Balancing, Application Load Balancer, Network Load Balancer, and WAF, centralizing operational telemetry.
The feature taxonomy can be expressed as a structured mapping of categories to supported features and configuration variables.
| Feature Category | Supported Features | Configuration Variable |
|---|---|---|
| Basic Configuration | Bucket creation, naming, force destroy | bucket, bucketprefix, forcedestroy |
| Access Control | ACLs, Object Ownership, Public Access Block | acl, grant, objectownership, blockpublic_acls |
| Encryption | SSE-S3, SSE-KMS, Encryption policies | serversideencryption_configuration |
| Storage Management | Versioning, Lifecycle rules, Intelligent tiering | versioning, lifecyclerule, intelligenttiering |
| Website Hosting | Index/error docs, redirects, routing rules | website |
| Integrations | CORS, Logging, Replication, Notifications | corsrule, logging, replicationconfiguration |
| Monitoring | Metrics, Inventory, Analytics | metricconfiguration, inventoryconfiguration, analytics_configuration |
| Security Policies | TLS |
This table is derived from the module documentation and provides a quick reference for which input variables activate which S3 capabilities. The impact layer for this table is that engineers can scan a single view to determine whether a desired capability is supported natively by the module without reading the entire README. The contextual layer connects this mapping to the module's promise of handling nearly all S3 bucket configurations supported by the AWS provider, reinforcing that the module tracks provider parity.
Configuration Patterns And Example Usage
The module exposes a declarative interface that is invoked via the module block.
A minimal private bucket with object ownership control and versioning enabled is expressed as:
module "s3_bucket" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket"
acl = "private"
control_object_ownership = true
object_ownership = "ObjectWriter"
versioning = {
enabled = true
}
}
The configuration sets source to terraform-aws-modules/s3-bucket/aws, bucket to my-s3-bucket, acl to private, controlobjectownership to true, object_ownership to ObjectWriter, and versioning.enabled to true. The impact of this pattern is that object ownership control is explicitly enabled, which aligns with AWS best practices that discourage ACL reliance. Versioning enabled protects new objects from accidental deletion. The contextual layer shows how this pattern serves as a template for production data buckets where immutability and access control are required.
A log delivery bucket for Elastic Load Balancing is configured as:
```
module "s3bucketfor_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
acl = "log-delivery-write"
Allow deletion of non-empty bucket
forcedestroy = true
controlobjectownership = true
objectownership = "ObjectWriter"
attachelblogdeliverypolicy = true
}
```
The acl is set to log-delivery-write, forcedestroy is true to allow deletion of a non-empty bucket, and attachelblogdeliverypolicy is true. The impact is that the bucket is prepared to receive logs from ELB without manual policy authoring. The contextual layer links this to operational requirements where log buckets must be writable by AWS services and often need forcedestroy for test environments.
A variant for Application Load Balancer and Network Load Balancer logs adds an additional policy flag:
```
module "s3bucketfor_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
Allow deletion of non-empty bucket
forcedestroy = true
controlobjectownership = true
objectownership = "ObjectWriter"
attachelblogdeliverypolicy = true # Required for ALB logs
attachlblogdeliverypolicy = true # Required for ALB/NLB logs
}
```
The addition of attachlblogdeliverypolicy true extends the permission set to cover ALB/NLB log delivery. The impact is a single module invocation that satisfies both ELB and LB log delivery requirements. The contextual layer connects this to multi-tier architectures where a single logging bucket aggregates traffic from different load balancer types.
A WAF log bucket example begins with:
module "s3_bucket_for_waf_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket =
The snippet is truncated in the reference material, but it demonstrates the naming convention for service-specific logging buckets.
Placeholder Substitution For Bucket Policies
To keep bucket policy with correct S3 bucket and AWS account properties, you can use the placeholders S3BUCKETID, S3BUCKETARN, and AWSACCOUNTID in the policy document. Those values will be replaced with the actual values during the policy attachment. This is especially useful when using bucket prefixes.
The impact of placeholder substitution is that policy documents remain portable across environments and can be reused without string interpolation errors. Engineers can define a policy once and rely on the module to inject the correct identifiers at apply time. The contextual layer connects this to scenarios where bucket names are generated via prefix, making hard-coded ARNs impossible to maintain manually.
Conditional Creation And Module Lifecycle Control
Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use count inside module block, so the solution is to specify argument create_bucket.
The example:
```
module "s3bucket" {
source = "terraform-aws-modules/s3-bucket/aws"
createbucket = false
..
}
```
With createbucket set to false, this S3 bucket will not be created. The impact is that the same module code can be toggled off for environments where a bucket should not exist, such as disabled features or feature flags. The contextual layer relates this to GitOps workflows where a single module definition is shared across dev, staging, and production, with createbucket controlling presence without branching the code.
Basic Terraform S3 Provisioning Context
The reference material also describes foundational Terraform usage for S3.
Creating an S3 bucket begins with creating a new directory for the project and a file named main.tf, where all the Terraform configurations will be placed. You can accomplish this by executing the following commands:
mkdir terraform-s3 && touch terraform-s3/main.tf
Open main.tf in your preferred text editor and follow along with our basic provider configuration and the creation of a new S3 bucket.
A minimal provider and resource definition is:
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "4.64.0"
}
}
}
provider "aws" {}
resource "aws_s3_bucket" "s3" {
bucket = "terraform-experiments"
}
In just three lines of HCL, we've defined a new S3 bucket. Using the resource block, we've defined a new resource of type awss3bucket. This tells Terraform that we want to create a new S3 bucket in our AWS account. Inside the awss3bucket block, we've specified the name of our bucket using the bucket field. In this case, we've named it terraform-experiments, but you can choose any name that meets the requirements for S3 bucket names.
It's worth noting that while the bucket field is optional, it's considered a best practice to give your resources descriptive names to help with organization and management.
Before we can apply our configuration and create the S3 bucket, we need to initialize the Terraform module by running terraform init in our terminal. This command downloads the necessary provider plugins and sets up the backend for storing the state file.
Terraform is not limited to a specific cloud; rather, it uses provider plugins to facilitate infrastructure management across all major cloud providers. Additionally, there are community plugins available for other popular services, such as Cloudflare.
To see a preview of the resource that will be created, you can run the terraform plan command in your terminal. This will show you what changes Terraform will make to your infrastructure based on the configuration in your main.tf file.
The impact of this basic workflow is that engineers can bootstrap a bucket with minimal HCL, then migrate to the module for advanced features. The contextual layer shows the progression from raw resource to module abstraction as complexity grows.
The document detailing the complete S3 bucket example provided in the terraform-aws-s3-bucket module demonstrates a comprehensive configuration with most supported S3 features enabled. This example serves as a reference implementation for teams seeking a single source of truth for secure, feature-rich S3 provisioning.
Conclusion
The terraform-aws-modules/s3-bucket module consolidates nearly the entire surface area of AWS S3 bucket configuration into a single reusable interface. By exposing inputs for basic configuration, access control, encryption, storage management, website hosting, integrations, monitoring, and security policies, the module allows teams to declare intent rather than assemble individual resources. The presence of placeholders for bucket ID, ARN, and account ID, the create_bucket toggle for conditional provisioning, and the dedicated log delivery policy flags illustrate how the module anticipates real-world operational constraints such as environment promotion, service integration, and policy portability.
The feature list covering static web-site hosting, access logging, versioning, CORS, lifecycle rules, server-side encryption, object locking, Cross-Region Replication, ELB, ALB/NLB, and WAF log delivery bucket policies, account-level Public Access Block, S3 Directory Bucket, S3 Table Bucket, and S3 Vectors demonstrates breadth that tracks provider capabilities. The mapping of categories to configuration variables provides a navigable contract for engineers. Example module invocations for private buckets, log delivery buckets, and WAF log buckets show how the same module adapts to different workload requirements through input variation.
When viewed alongside the foundational Terraform S3 provisioning steps of initializing providers, running terraform init, and previewing changes with terraform plan, the module appears as the natural evolution from manual resource definitions to standardized, auditable, and composable infrastructure. The module abstracts complexity while preserving fine-grained control, enabling consistent S3 deployments across organizations without sacrificing the ability to enable advanced capabilities such as object ownership control, force destroy, and conditional creation.