Red Bucket

A practical S3 bucket module — private and encrypted by default, with an optional secure static-website mode fronted by CloudFront over HTTPS.

Requirements:

1. Terraform >= 1.15.0
2. Trivy >= 0.68.2

Trivy can be installed via Homebrew on macOS with the command:

brew install aquasecurity/trivy/trivy

Security posture

• All public access blocked; SSE-S3 encryption and versioning always on
• force_destroy defaults to false
• Static-website mode uses CloudFront Origin Access Control (OAC) with a distribution-scoped bucket policy — the bucket is never publicly readable
• HTTPS enforced with an ACM-managed certificate (TLS 1.2_2021 minimum)
• Scanned with Trivy and gitleaks; integration-tested with Terratest

Usage

A private bucket — see examples/complete:

provider "aws" {
  region = "us-east-1"
}

module "bucket" {
  source = "RussellGilmore/red-bucket/aws"

  project_name = "my-project"
  bucket_name  = "data"
}

Requirements

Name	Version
terraform	>= 1.15.0
aws	>= 6.47.0

Providers

Name	Version
aws	>= 6.47.0

Modules

No modules.

Resources

Name	Type
aws_acm_certificate.public_cert	resource
aws_acm_certificate_validation.public_cert_validation	resource
aws_cloudfront_distribution.distribution	resource
aws_cloudfront_origin_access_control.default	resource
aws_route53_record.public_cert_validation	resource
aws_route53_record.record	resource
aws_s3_bucket.red_bucket	resource
aws_s3_bucket_policy.bucket_policy	resource
aws_s3_bucket_public_access_block.s3_public_access_block	resource
aws_s3_bucket_server_side_encryption_configuration.s3_encryption	resource
aws_s3_bucket_versioning.s3_versioning	resource
aws_s3_bucket_website_configuration.hosting	resource
aws_s3_object.website_files	resource
aws_caller_identity.current	data source
aws_partition.current	data source
aws_region.current	data source
aws_route53_zone.zone	data source

Inputs

Name	Description	Type	Default	Required
additional_tags	Additional tags to apply to all resources created by this module.	map(string)	{}	no
apex_domain	Apex domain whose Route53 hosted zone holds the website records. Required when enable_static_website is true.	string	""	no
auth_lambda_arn	ARN of a Lambda@Edge function for viewer-request authentication. Must be set when enable_authentication is true.	string	""	no
bucket_name	Name of the S3 bucket (combined with project_name).	string	n/a	yes
enable_authentication	Enable Lambda@Edge-based authentication on the CloudFront distribution.	bool	false	no
enable_static_website	Create the CloudFront + ACM + Route53 resources needed to serve the bucket as a secure static website.	bool	false	no
force_destroy	Allow Terraform to destroy the bucket even when it contains objects. Defaults to false to protect against accidental data loss; set true for ephemeral or test buckets.	bool	false	no
logging_bucket	Domain name of an S3 bucket to receive CloudFront access logs (e.g. my-logs.s3.amazonaws.com). When empty, access logging is disabled. The bucket must have ACLs enabled and grant the awslogsdelivery account write access.	string	""	no
logging_prefix	Object key prefix for CloudFront access logs within logging_bucket.	string	"cloudfront/"	no
project_name	Project name used for resource naming and the Project tag.	string	n/a	yes
record_name	Fully-qualified record name for the website (e.g. app.example.com). Required when enable_static_website is true.	string	""	no
website_path	Path to the static website content to upload.	string	"../site"	no

Outputs

Name	Description
red_bucket_name	The S3 bucket for storing whatever you want
s3_url	S3 hosting URL (HTTP)
website_record	Route 53 record for the website
website_url	Website URL (HTTPS)