The terraform-aws-s3-bucket module is a comprehensive Terraform solution for creating and managing AWS S3 buckets with an extensive range of configurations and features. The module abstracts the complexity of S3 bucket management while providing fine-grained control over bucket properties, security settings, and integration with other AWS services. The design is intended to handle nearly all S3 bucket configurations supported by the AWS provider for Terraform. The module is organized around several core components that work together to provision and configure S3 buckets. The module uses local variables and conditional logic to determine which resources should be created based on the provided configuration. This approach enables users to enable or disable specific capabilities without maintaining separate templates. The module enables users to define a single source reference and then vary inputs to produce different bucket profiles for development, logging, static hosting, or data lake use cases.
The module is described as a Terraform module which creates S3 bucket on AWS with all or almost all features provided by Terraform AWS provider. The breadth of coverage is reflected in the explicit feature list that the module supports. The supported capabilities include static web-site hosting, access logging, versioning, CORS, lifecycle rules, server-side encryption, object locking, Cross-Region Replication, ELB log delivery bucket policy, ALB/NLB log delivery bucket policy, WAF log delivery bucket policy, Account-level Public Access Block, S3 Directory Bucket, S3 Table Bucket, and S3 Vectors. The inclusion of these features means that a single module invocation can replace multiple hand-crafted resources and policy documents. For operators, this reduces drift risk and shortens review cycles because the module encodes best practice defaults while still exposing configuration variables for customization.
The module is presented as a solution that abstracts complexity while preserving control. The abstraction reduces the number of resources a team must write manually. The fine-grained control preserves the ability to tune bucket properties, security settings, and integration with other AWS services. The comprehensive nature of the module means that nearly all S3 bucket configurations supported by the AWS provider for Terraform are addressable through the module interface. The organization around core components means that provisioning and configuration are handled as a cohesive unit rather than as fragmented resources. The use of local variables and conditional logic means that resource creation is driven by the provided configuration, which prevents unnecessary resources from being created and keeps plans clean.
Module Identity and Scope
The terraform-aws-s3-bucket module is positioned as a comprehensive Terraform solution for creating and managing AWS S3 buckets with an extensive range of configurations and features. The module is designed to be comprehensive, handling nearly all S3 bucket configurations supported by the AWS provider for Terraform. The module abstracts the complexity of S3 bucket management while providing fine-grained control over bucket properties, security settings, and integration with other AWS services. The module enables users to define a single module block with a source reference and then configure bucket behavior through inputs.
The scope includes basic bucket creation, naming, and force destroy behavior. It also includes access control mechanisms such as ACLs, object ownership, and public access block settings. Encryption options are covered through server-side encryption configuration. Storage management is addressed through versioning, lifecycle rules, and intelligent tiering. Website hosting capabilities are exposed. Integrations such as CORS, logging, replication, and notifications are supported. Monitoring features such as metrics, inventory, and analytics are included. Security policies such as TLS are part of the module surface.
Supported Feature Set and Category Mapping
The module supports a comprehensive set of S3 bucket features. The feature categories and corresponding configuration variables are documented as follows.
| Feature Category | Supported Features | Configuration Variable |
|---|---|---|
| Basic Configuration | Bucket creation, naming, force destroy | bucket, bucketprefix, forcedestroy |
| Access Control | ACLs, Object Ownership, Public Access Block | acl, grant, objectownership, blockpublic_acls |
| Encryption | SSE-S3, SSE-KMS, Encryption policies | serversideencryption_configuration |
| Storage Management | Versioning, Lifecycle rules, Intelligent tiering | versioning, lifecyclerule, intelligenttiering |
| Website Hosting | Index/error docs, redirects, routing rules | website |
| Integrations | CORS, Logging, Replication, Notifications | corsrule, logging, replicationconfiguration |
| Monitoring | Metrics, Inventory, Analytics | metricconfiguration, inventoryconfiguration, analytics_configuration |
| Security Policies | TLS |
The table provides a mapping from high-level capability areas to the specific configuration variables that control them. For users, this mapping reduces discovery time because the variable names align with the AWS provider concepts. For teams, the mapping supports governance because each category can be reviewed independently.
The explicit feature list from the module documentation includes static web-site hosting, access logging, versioning, CORS, lifecycle rules, server-side encryption, object locking, Cross-Region Replication, ELB log delivery bucket policy, ALB/NLB log delivery bucket policy, WAF log delivery bucket policy, Account-level Public Access Block, S3 Directory Bucket, S3 Table Bucket, and S3 Vectors. The presence of log delivery policies means that buckets used for ELB, ALB, NLB, and WAF logs can be provisioned with the correct policy attachments without manual JSON authoring. The inclusion of S3 Directory Bucket, S3 Table Bucket, and S3 Vectors reflects support for newer S3 storage types.
Example Implementations for Versioning and Log Delivery
The module is used through a module block with source set to terraform-aws-modules/s3-bucket/aws. A basic example with versioning enabled is shown in the reference material.
module "s3_bucket" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket"
acl = "private"
control_object_ownership = true
object_ownership = "ObjectWriter"
versioning = {
enabled = true
}
}
The example sets bucket to my-s3-bucket, acl to private, controlobjectownership to true, object_ownership to ObjectWriter, and enables versioning. The impact for the user is that object ownership is explicitly controlled and multiple versions of objects are retained. The context is that versioning can be used for recovery and auditability, while object ownership control prevents unexpected permission issues after AWS changes.
A log delivery bucket example is provided.
module "s3_bucket_for_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
acl = "log-delivery-write"
force_destroy = true
control_object_ownership = true
object_ownership = "ObjectWriter"
attach_elb_log_delivery_policy = true
}
The example uses acl log-delivery-write, forcedestroy true, and attaches ELB log delivery policy. The impact is that the bucket can receive logs from Elastic Load Balancing without manual policy creation. The forcedestroy flag allows non-empty bucket deletion in development environments.
A variant for ALB and NLB logs is shown.
module "s3_bucket_for_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
force_destroy = true
control_object_ownership = true
object_ownership = "ObjectWriter"
attach_elb_log_delivery_policy = true
attach_lb_log_delivery_policy = true
}
The addition of attachlblogdeliverypolicy true extends log acceptance to ALB and NLB. The comment in the reference material notes that attachelblogdeliverypolicy is required for ALB logs and attachlblogdeliverypolicy is required for ALB/NLB logs. The impact is that a single bucket can centralize logs from multiple load balancer types.
A WAF log bucket example is initiated in the reference material.
module "s3_bucket_for_waf_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket =
The snippet is truncated in the reference facts. The presence of the example signals that the module supports WAF log delivery bucket policy configuration.
Ownership Control and Security Defaults
The module includes ownership control in response to a recent AWS S3 update. The module now includes ownership control, allowing users to specify ownership types. The default is ObjectWriter. The controlobjectownership parameter ensures proper object ownership controls. The object_ownership parameter can be set to ObjectWriter. The impact for users is that uploads from different principals behave predictably and access control does not depend on implicit ACL semantics. The context is that AWS moved toward explicit ownership controls, and the module provides a way to codify that shift.
Encryption is enabled by default, allowing users to utilize existing AWS Customer Master Keys or create new ones using the module. Additionally, it supports Server-Side Encryption. The module follows AWS security best practices by utilizing checkov to ensure compliance. The module offers simplicity through detailed examples, making it user-friendly. The module simplifies the process of setting up s3 bucket with the desired configurations. The module provides support for lifecycle configuration. The support for lifecycle configuration allows automatic transition or expiration of objects.
Versioning is supported which is in this module disabled by default, providing automatic version control when enabled. The default disabled state reduces cost impact for users who do not need versioning. The ability to enable versioning through the versioning block provides explicit control.
The module includes support for S3 bucket notifications, enabling users to set up event-driven workflows. Notifications can trigger Lambda functions or other services on object create or delete events. The impact is that buckets can be integrated into event-driven architectures without additional manual configuration.
Getting Started Patterns and Conditional Creation
The guide provides instructions for quickly getting started with the AWS S3 bucket Terraform module. It covers basic setup, common usage patterns, and essential configurations. For comprehensive feature details, see Features and Capabilities. For advanced usage scenarios, refer to Advanced Usage Patterns.
The simplest way to use the module is to create a basic S3 bucket. For a more secure configuration with versioning enabled, the controlobjectownership and object_ownership parameters ensure proper object ownership controls, while versioning enables keeping multiple versions of an object.
S3 buckets are commonly used for storing logs from various AWS services. Secure your S3 bucket with encryption, access controls, and security policies. For more comprehensive security configurations, refer to Security Configurations. Configure your S3 bucket for static website hosting. Configure lifecycle rules to automatically transition or expire objects.
You can conditionally create a bucket using the create_bucket parameter. This is useful when you need to manage bucket creation based on environment variables or other conditions. The conditional creation capability allows the same configuration to be used across environments where bucket creation may be restricted or deferred.
You can create multiple similar buckets in two ways: foreach meta-argument. Refer to the wrappers directory in the module repository for detailed implementation. The foreach pattern supports bulk provisioning of buckets with shared configuration and variable naming.
After mastering the basics, you can explore additional patterns. The reference material directs users to explore further.
Provider Setup Context and Terraform Workflow
The reference material includes a generic Terraform workflow for S3 bucket creation. S3 stands for Simple Storage Service. S3 buckets are cloud storage services by Amazon Web Service. It is used to store objects. It consists of data in any format like documents, images, videos, and application code. These are highly scalable.
Prerequisite steps described include configuring AWS credentials.
aws configure
Step 2 involves creating provider.tf.
```
terraform {
required_providers{
aws={
source = "hashicorp/aws"
version = "4.33.0"
}
}
}
provider "aws"{
configuration options
region = "us-east-1"
}
```
The provider file stores information about the cloud provider, version, and region for the s3 bucket. After this, terraform init is executed.
terraform init
The Terraform init command prepares the working directory for use with Terraform. It initialises the backend, any child module installation and any plugin installation.
Step 3 involves creating main.tf in the same directory where provider.tf file is located. In this file the resource and bucket name are defined. The bucket name should be unique, here the bucket name is my-s3-test-bucket02.
The workflow illustrates the standard Terraform initialization sequence that precedes module usage. The context is that module usage builds on a correctly configured provider and initialized working directory.
Lifecycle Storage Management and Intelligent Tiering
The module supports storage management through versioning, lifecycle rules, and intelligent tiering. The configuration variables versioning, lifecyclerule, and intelligenttiering control these capabilities. Lifecycle rules enable automatic transition or expiration of objects. Intelligent tiering allows cost optimization based on access patterns. The impact for users is reduced storage costs and automated data retention policies. The context is that lifecycle rules can be combined with versioning to expire old versions while retaining current objects.
Integration Capabilities
Integrations are covered through corsrule, logging, replicationconfiguration. CORS rules enable cross-origin requests for web applications. Logging enables access logging to a target bucket. Replication configuration enables Cross-Region Replication for durability. The impact is that buckets can participate in multi-region architectures and web applications without manual policy authoring.
Monitoring and Security Policy Extensions
Monitoring is supported through metricconfiguration, inventoryconfiguration, analytics_configuration. These capabilities enable CloudWatch metrics, inventory reports, and analytics. Security policies include TLS enforcement. The impact is improved observability and compliance.
The module is designed to be comprehensive, handling nearly all S3 bucket configurations supported by the AWS provider for Terraform. The module abstracts complexity while providing fine-grained control. The module enables users to provision buckets with consistent defaults and then vary configuration per use case.
Upgrade and Maintenance Considerations
The module documentation notes that if you have been using version 2.2.0 or any earlier iteration of this module, it is important to upgrade to the most recent release. The upgrade note reflects changes related to ownership control and other AWS updates. The impact is that legacy configurations may lack ownership controls and may not align with current AWS best practices.
The module offers simplicity through detailed examples, making it user-friendly. It follows AWS security best practices by utilizing checkov to ensure compliance. It simplifies the process of setting up s3 bucket with the desired configurations. The module provides support for lifecycle configuration. The module now includes ownership control, allowing users to specify ownership types. The default is ObjectWriter. Encryption is enabled by default, allowing users to utilize existing AWS Customer Master Keys or create new ones using the module. Additionally, it supports Server-Side Encryption. It includes support for S3 bucket notifications, enabling users to set up event-driven workflows. Supports versioning which is in this module disabled by default.
Conclusion
The terraform-aws-s3-bucket module represents a consolidation point for S3 bucket provisioning in Terraform codebases. The module covers basic configuration, access control, encryption, storage management, website hosting, integrations, monitoring, and security policies. The feature category mapping provides a clear variable surface for each capability. Example implementations demonstrate versioning, log delivery, and ownership control. The module abstracts complexity while retaining fine-grained control over bucket properties, security settings, and integration with other AWS services. The conditional creation and for_each patterns support environment-specific and bulk provisioning scenarios. The ownership control defaults and encryption defaults align with AWS security best practices. The lifecycle and intelligent tiering capabilities enable cost-aware data management. The integration features enable logging and replication without manual policy authoring. The module remains current with AWS changes, as evidenced by ownership control additions and upgrade guidance. The combination of comprehensive coverage, example-driven usage, and conditional logic makes the module a central building block for S3 infrastructure as code.