xdr-terraform-modules/base/splunk_servers/frozen_s3_bucket/main.tf

locals {
  bucket_name  = "xdr-${var.splunk_prefix}-${var.environment}-splunk-frozen"
  accounts     = [var.aws_account_id]
  account_arns = [for a in local.accounts : "arn:${var.aws_partition}:iam::${a}:root"]
}

# tfsec:ignore:aws-s3-enable-bucket-logging TODO: enable everywhere at a later date if required
resource "aws_s3_bucket" "bucket" {
  # checkov:skip=CKV_AWS_18: see tfsec S3 logging above
  # checkov:skip=CKV_AWS_21: We don't version frozen data
  # checkov:skip=CKV_AWS_144: Cross-region replication TODO

  bucket = local.bucket_name
  tags   = merge(local.standard_tags, var.tags)
}

resource "aws_s3_bucket_acl" "s3_acl_bucket" {
  bucket = aws_s3_bucket.bucket.id
  acl    = "private"
}

# tfsec:ignore:aws-s3-enable-versioning We don't version frozen data
resource "aws_s3_bucket_versioning" "s3_version_bucket" {
  bucket = aws_s3_bucket.bucket.id
  versioning_configuration {
    status = "Suspended"
  }
}

#logging {
#  target_bucket = "dps-s3-logs"
#  target_prefix = "aws_terraform_s3_state_access_logs/"
#}

resource "aws_s3_bucket_lifecycle_configuration" "s3_lifecyle_bucket" {
  bucket = aws_s3_bucket.bucket.id

  rule {
    id     = "GLACIER"
    status = "Enabled"

    abort_incomplete_multipart_upload {
      days_after_initiation = 2
    }

    transition {
      days          = 30
      storage_class = "GLACIER"
      ### Cheaper storage
      #storage_class= "DEEP_ARCHIVE"
    }

    expiration {
      # Discard after 18 months per OMB memo
      # 18 months in days is 547, rounding up to 550
      days = 550
    }
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "s3_sse_bucket" {
  bucket = aws_s3_bucket.bucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.bucketkey.arn
      sse_algorithm     = "aws:kms"
    }
  }
}

resource "aws_s3_bucket_public_access_block" "public_access_block" {
  bucket                  = aws_s3_bucket.bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true

  # Not technically dependent, but prevents a "Conflicting conditional operation" conflict.
  # See https://github.com/hashicorp/terraform-provider-aws/issues/7628
  depends_on = [aws_s3_bucket_policy.policy]
}

resource "aws_s3_bucket_policy" "policy" {
  bucket = aws_s3_bucket.bucket.id

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "AllowThisAccount",
  "Statement": [
    {
      "Sid": "AccountAllow",
      "Effect": "Allow",
      "Principal": {
        "AWS": ${jsonencode(local.account_arns)}
      },
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "${aws_s3_bucket.bucket.arn}",
        "${aws_s3_bucket.bucket.arn}/*"
      ]
    }
  ]
}
POLICY
}

//AWS Provider outdated arguments <4.4.0
/*resource "aws_s3_bucket" "bucket" {
  bucket = local.bucket_name
  acl    = "private"

  versioning {
    enabled = false
  }

  tags = merge(local.standard_tags, var.tags)

  #logging {
  #  target_bucket = "dps-s3-logs"
  #  target_prefix = "aws_terraform_s3_state_access_logs/"
  #}

  lifecycle_rule {
    id      = "GLACIER"
    enabled = true

    abort_incomplete_multipart_upload_days = 2

    transition {
      days          = 30
      storage_class = "GLACIER"
      ### Cheaper storage
      #storage_class= "DEEP_ARCHIVE"
    }

    expiration {
      # Discard after 18 months per OMB memo
      # 18 months in days is 547, rounding up to 550
      days = 550
    }
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.bucketkey.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}
*/