The terraform-aws-s3-bucket module is a comprehensive Terraform solution for creating and managing AWS S3 buckets with an extensive range of configurations and features. The module abstracts the complexity of S3 bucket management while providing fine-grained control over bucket properties, security settings, and integration with other AWS services. The module is designed to be comprehensive, handling nearly all S3 bucket configurations supported by the AWS provider for Terraform. The module is organized around several core components that work together to provision and configure S3 buckets. The module uses local variables and conditional logic to determine which resources should be created based on the provided configuration.
The module creates S3 bucket on AWS with all or almost all features provided by Terraform AWS provider. The approach enables users to define a single module source and then apply a wide set of arguments that map directly to S3 bucket behavior in AWS. For teams operating at scale, this reduces repetition across Terraform codebases and centralizes policy decisions for storage, logging, and web hosting. The impact for practitioners is reduced time spent writing bespoke bucket resources and fewer drift incidents caused by manual configuration of ACLs, encryption, and logging policies.
Core Module Identity and Purpose
The terraform-aws-s3-bucket module is a community maintained Terraform module that encapsulates S3 bucket creation and configuration. The module supports S3 Bucket, S3 Bucket Policy, and S3 Bucket Notification. Notification configuration references modules/notification to configure notifications to Lambda functions, SQS queues, and SNS topics.
The module supports Terraform 0.12 and above.
The module enables users to:
- Provision a bucket with a single source declaration
- Apply security controls such as object ownership and public access block
- Configure integration with load balancers and WAF for log delivery
- Manage lifecycle, versioning, and replication without separate resources
The module uses local variables and conditional logic to determine which resources should be created based on the provided configuration. This design allows the same module call to create a simple static website bucket or a fully hardened log archive bucket depending on input arguments.
Supported S3 Bucket Features and Capabilities
These features of S3 bucket configurations are supported:
- static web-site hosting
- access logging
- versioning
- CORS
- lifecycle rules
- server-side encryption
- object locking
- Cross-Region Replication (CRR)
- ELB log delivery bucket policy
- ALB/NLB log delivery bucket policy
- WAF log delivery bucket policy
- Account-level Public Access Block
- S3 Directory Bucket
- S3 Table Bucket
- S3 Vectors
The feature set covers basic creation through advanced storage classes and integrations. Static website hosting enables index and error document serving directly from S3. Access logging provides audit trails for object access. Versioning retains multiple versions of objects, which supports recovery from accidental deletion. CORS enables browser-based access from web applications. Lifecycle rules automate transitions and expirations. Server-side encryption protects data at rest. Object locking provides WORM compliance. Cross-Region Replication keeps copies in another region. Log delivery policies allow ELB, ALB/NLB, and WAF to write logs without manual policy authoring. Public Access Block enforces account-level restrictions. Directory Bucket, Table Bucket, and Vectors support newer S3 storage types.
| Feature Category | Supported Features | Configuration Variable |
|---|---|---|
| Basic Configuration | Bucket creation, naming, force destroy | bucket, bucketprefix, forcedestroy |
| Access Control | ACLs, Object Ownership, Public Access Block | acl, grant, objectownership, blockpublic_acls |
| Encryption | SSE-S3, SSE-KMS, Encryption policies | serversideencryption_configuration |
| Storage Management | Versioning, Lifecycle rules, Intelligent tiering | versioning, lifecyclerule, intelligenttiering |
| Website Hosting | Index/error docs, redirects, routing rules | website |
| Integrations | CORS, Logging, Replication, Notifications | corsrule, logging, replicationconfiguration |
| Monitoring | Metrics, Inventory, Analytics | metricconfiguration, inventoryconfiguration, analytics_configuration |
| Security Policies | TLS |
The table reflects the organization of the module around several core components that work together to provision and configure S3 buckets.
Module Inputs and Configuration Variables
The module exposes arguments that map to AWS S3 behavior. Key inputs include bucket, bucketprefix, forcedestroy for basic configuration. Access control inputs include acl, grant, objectownership, blockpublicacls. Encryption inputs include serversideencryptionconfiguration. Storage management inputs include versioning, lifecyclerule, intelligenttiering. Website hosting inputs include website. Integration inputs include corsrule, logging, replicationconfiguration. Monitoring inputs include metricconfiguration, inventoryconfiguration, analytics_configuration.
The controlobjectownership and objectownership parameters ensure proper object ownership controls, while versioning enables keeping multiple versions of an object. The forcedestroy argument allows deletion of non-empty bucket, which is essential for log buckets that accumulate objects.
Example Implementations
Basic bucket creation:
hcl
module "s3_bucket" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket"
acl = "private"
control_object_ownership = true
object_ownership = "ObjectWriter"
versioning = {
enabled = true
}
}
The simplest way to use the module is to create a basic S3 bucket. For a more secure configuration with versioning enabled, the above pattern is used.
Log delivery bucket with ELB policy:
hcl
module "s3_bucket_for_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
acl = "log-delivery-write"
force_destroy = true
control_object_ownership = true
object_ownership = "ObjectWriter"
attach_elb_log_delivery_policy = true
}
S3 buckets are commonly used for storing logs from various AWS services. The attachelblogdeliverypolicy enables the bucket to receive logs from Elastic Load Balancing.
Combined ALB and NLB log delivery:
hcl
module "s3_bucket_for_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "my-s3-bucket-for-logs"
force_destroy = true
control_object_ownership = true
object_ownership = "ObjectWriter"
attach_elb_log_delivery_policy = true
attach_lb_log_delivery_policy = true
}
The attachlblogdeliverypolicy is required for ALB/NLB logs.
WAF logs bucket:
hcl
module "s3_bucket_for_waf_logs" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket =
The pattern continues for WAF log delivery bucket policy configuration.
Conditional Creation and Object Ownership
Sometimes you need to have a way to create S3 resources conditionally but Terraform does not allow to use count inside module block, so the solution is to specify argument create_bucket.
hcl
module "s3_bucket" {
source = "terraform-aws-modules/s3-bucket/aws"
create_bucket = false
}
This S3 bucket will not be created. This is useful when you need to manage bucket creation based on environment variables or other conditions. You can conditionally create a bucket using the create_bucket parameter. This is useful when you need to manage bucket creation based on environment variables or other conditions.
Object ownership controls are applied via controlobjectownership and objectownership. Setting objectownership to "ObjectWriter" ensures proper ownership handling when ACLs are used.
Integration Patterns with AWS Services
The module supports log delivery bucket policies for ELB, ALB/NLB, and WAF. The attachelblogdeliverypolicy argument creates the required bucket policy for Elastic Load Balancing log delivery. The attachlblogdeliverypolicy argument creates policies for Application Load Balancer and Network Load Balancer logs. The WAF log delivery bucket policy supports centralized web access logging.
Cross-Region Replication configuration enables automated copy of objects to another region for durability and latency optimization. Server-side encryption configuration supports SSE-S3 and SSE-KMS. CORS rule configuration allows controlled cross-origin access for web applications.
Security Configuration
Secure your S3 bucket with encryption, access controls, and security policies. The module supports serversideencryptionconfiguration for SSE-S3 and SSE-KMS. Access control is handled via acl, grant, objectownership, and blockpublicacls. Account-level Public Access Block can be enforced.
The module abstracts the complexity of S3 bucket management while providing fine-grained control over bucket properties, security settings, and integration with other AWS services.
Website Hosting Configuration
Configure your S3 bucket for static website hosting. The website argument supports index/error docs, redirects, and routing rules. Static web-site hosting enables serving content directly from S3 without additional compute.
Lifecycle and Storage Management
Configure lifecycle rules to automatically transition or expire objects. The lifecycle_rule argument supports transitions to Glacier or expiration after a retention period. Versioning retains historical versions. Intelligent tiering optimizes storage costs automatically.
The impact for data owners is reduced manual intervention for retention compliance and cost optimization.
Prerequisites and Initial Setup
Before using this module, ensure you have the prerequisites in place.
S3 stands for Simple Storage Service. S3 buckets are cloud storage services by Amazon Web Service. It is used to store objects, It consists of data in any format like documents, images, videos, and application code. These are highly scalable.
Step 1: Open the cmd if you are in Windows and configure aws using the aws configure command.
bash
aws configure
Step 2: After that open a code editor(vs code) and make a file called provider.tf
.tf is the file extension for the terraform file. This file will store the information about the cloud provider, version, and region for the s3 bucket. Use the following code to set the provider, version, and region.
hcl
terraform {
required_providers{
aws={
source = "hashicorp/aws"
version = "4.33.0"
}
}
}
provider "aws"{
#configuration options
region = "us-east-1"
}
After this open terminal where this file is located and type terraform init to initialize terraform. The Terraform init command prepares the working directory for use with Terraform. It initialises the backend, any child module installation and any plugin installation.
Step 3: Now we have defied our provider. Let's create S3 bucket , make a file called main.tf in the same directory where provider.tf file is located. In this file we have define the resource , bucket name. The bucket name should be unique , here the bucket name is "my-s3-test-bucket02"
The provider configuration establishes the AWS connection context for all subsequent module calls.
Common Usage Patterns and Advanced Scenarios
You can create multiple similar buckets in two ways:
- for_each meta-argument
Refer to the wrappers directory in the module repository for detailed implementation.
After mastering the basics, you can explore advanced usage scenarios. For comprehensive feature details, see Features and Capabilities. For advanced usage scenarios, refer to Advanced Usage Patterns.
The following diagram illustrates how the terraform-aws-s3-bucket module integrates with your Terraform configuration and AWS. The module sits between Terraform configuration and the AWS provider, translating arguments into S3 bucket resources, bucket policies, and notifications.
Module Organization and Conditional Logic
The module is organized around several core components that work together to provision and configure S3 buckets. The module uses local variables and conditional logic to determine which resources should be created based on the provided configuration. This avoids creating empty resources when arguments are omitted.
The module enables users to:
- Manage bucket creation conditionally via create_bucket
- Apply object ownership controls without manual ACL editing
- Attach log delivery policies with boolean flags
- Configure versioning, encryption, and lifecycle in a single call
Conclusion
The terraform-aws-s3-bucket module provides a single source for provisioning nearly all S3 bucket configurations supported by the Terraform AWS provider. The breadth of supported features from static website hosting to S3 Directory Bucket, S3 Table Bucket, and S3 Vectors demonstrates the module's evolution alongside AWS storage innovations. The integration of log delivery policies for ELB, ALB/NLB, and WAF removes the need for handcrafted bucket policies and reduces configuration errors. Object ownership controls and public access block settings address the most common security findings in S3 audits. Conditional creation via create_bucket solves Terraform's limitation with count inside module blocks, enabling environment gated deployments. The module's organization around core components, local variables, and conditional logic delivers a predictable interface that scales from a single basic bucket to multi-region replicated, encrypted, versioned archives. For practitioners, this translates into faster delivery, consistent policy enforcement, and reduced operational overhead when managing S3 at scale.