FredsAWSStandaloneWithSmartStore/3.infrastructure/s3.smartstore.tf

# This is the smartstore bucket. This is the data. Keep this safe.
resource "aws_s3_bucket" "splunk-smartstore" {
  bucket = "ftd-splunk-smartstore"

  versioning {
    enabled = true # Allows us to archive frozen data directly into glacier without splunk intervention
  }

  lifecycle {
    # Set to TRUE for production!
    prevent_destroy = false
  }
  # set to FALSE for production!
  force_destroy = true

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = "${aws_kms_key.splunk_s3_key.arn}"
        sse_algorithm     = "aws:kms"
      }
    }
  }

  # This will save some money by moving to "infrequently accessed" after a period of time
  lifecycle_rule {
    id = "InfrequentAccessAfteraYear"
    enabled = true
    transition {
      # For production, probably set this to something longer, like 90 days or a year
      days = 30
      storage_class = "STANDARD_IA"
    }

    noncurrent_version_transition {
      days = 0
      storage_class = "GLACIER"
    }
    
    # This would be a good place to transition to deep archive a few days/weeks/months after
    # the transition to glacier, if you're really only rarely going to access it.
  }

  tags = {
    Project = "Splunk"
    Environment = "Production"
  }
}

resource "aws_s3_bucket_public_access_block" "keep_smartstore_safe" {
  bucket = "${aws_s3_bucket.splunk-smartstore.id}"

  block_public_acls = true
  block_public_policy = true
  ignore_public_acls = true
  restrict_public_buckets = true
}

data "template_file" "s3_splunk_bucket_policy" {
  template = "${file("policies/s3_splunk_bucket_policy.json.tpl")}"
  vars = {
    account = "${data.aws_caller_identity.current.account_id}"
    bucket_arn = "${aws_s3_bucket.splunk-smartstore.arn}"
    vpc_cidr = "${data.terraform_remote_state.network.outputs.vpc_cidr}"
    role_arn = "${aws_iam_role.Splunk-EC2-Standalone.arn}"
  }
}

resource "aws_s3_bucket_policy" "splunk_servers_only" {
  bucket = "${aws_s3_bucket.splunk-smartstore.id}"
  policy = "${data.template_file.s3_splunk_bucket_policy.rendered}"
}