Skip to content

feat: configure logging lifecycle filter prefix #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jajera merged 2 commits into from
Apr 4, 2025
Merged

feat: configure logging lifecycle filter prefix #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1738686
feat: configure logging lifecycle filter prefix
jajera Apr 4, 2025
ff77545
feat: add terraform linter
jajera Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/terraform-lint-validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
name: Terraform Lint & Validate
on:
pull_request: {}
permissions:
statuses: write
checks: write
contents: read
pull-requests: read
jobs:
terraform-lint-validate:
uses: tfstack/actions/.github/workflows/terraform-lint-validate.yml@main
32 changes: 15 additions & 17 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,13 @@ Terraform module to create an S3 bucket

## Requirements

| Name | Version |
|------|---------|
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | 5.84.0 |
No requirements.

## Providers

| Name | Version |
|------|---------|
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.84.0 |
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.94.1 |

## Modules

Expand All @@ -22,18 +20,18 @@ No modules.

| Name | Type |
|------|------|
| [aws_s3_bucket.logging](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_acl) | resource |
| [aws_s3_bucket_lifecycle_configuration.logging](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_lifecycle_configuration) | resource |
| [aws_s3_bucket_logging.logging](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_logging) | resource |
| [aws_s3_bucket_ownership_controls.logging](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_ownership_controls) | resource |
| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_ownership_controls) | resource |
| [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_policy) | resource |
| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.logging](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/5.84.0/docs/resources/s3_bucket_versioning) | resource |
| [aws_s3_bucket.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
| [aws_s3_bucket_lifecycle_configuration.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
| [aws_s3_bucket_logging.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
| [aws_s3_bucket_ownership_controls.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
| [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
| [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
| [aws_s3_bucket_public_access_block.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_server_side_encryption_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
| [aws_s3_bucket_versioning.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |

## Inputs

Expand All @@ -51,10 +49,10 @@ No modules.
| <a name="input_logging_enabled"></a> [logging\_enabled](#input\_logging\_enabled) | Enable logging for the S3 bucket | `bool` | `false` | no |
| <a name="input_logging_encryption_algorithm"></a> [logging\_encryption\_algorithm](#input\_logging\_encryption\_algorithm) | The encryption algorithm used for S3 logging. Valid values: 'AES256', 'aws:kms'. | `string` | `"AES256"` | no |
| <a name="input_logging_encryption_enabled"></a> [logging\_encryption\_enabled](#input\_logging\_encryption\_enabled) | Enable encryption for S3 logging. | `bool` | `true` | no |
| <a name="input_logging_lifecycle_filter_prefix"></a> [logging\_lifecycle\_filter\_prefix](#input\_logging\_lifecycle\_filter\_prefix) | Prefix to apply S3 lifecycle rule to. Set to "" to apply to all objects. | `string` | `""` | no |
| <a name="input_logging_log_retention_days"></a> [logging\_log\_retention\_days](#input\_logging\_log\_retention\_days) | Number of days to retain S3 logging data before expiration. | `number` | `30` | no |
| <a name="input_logging_s3_prefix"></a> [logging\_s3\_prefix](#input\_logging\_s3\_prefix) | Prefix for S3 logging objects. | `string` | `"s3/"` | no |
| <a name="input_object_ownership"></a> [object\_ownership](#input\_object\_ownership) | Defines who owns newly uploaded objects in the bucket. | `string` | `"BucketOwnerPreferred"` | no |
| <a name="input_region"></a> [region](#input\_region) | AWS region for the provider. Defaults to ap-southeast-2 if not specified. | `string` | `"ap-southeast-2"` | no |
| <a name="input_restrict_public_buckets"></a> [restrict\_public\_buckets](#input\_restrict\_public\_buckets) | Whether to restrict public access to the bucket. | `bool` | `true` | no |
| <a name="input_sse_algorithm"></a> [sse\_algorithm](#input\_sse\_algorithm) | The encryption algorithm for S3 bucket | `string` | `"AES256"` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Tags for the S3 bucket | `map(string)` | `{}` | no |
Expand Down
13 changes: 7 additions & 6 deletions examples/complete/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "5.84.0"
version = "5.94.0"
}
}
}
Expand Down Expand Up @@ -48,11 +48,12 @@ module "s3_bucket" {
enable_versioning = true

# Logging Configuration
logging_enabled = true
logging_encryption_enabled = true
logging_encryption_algorithm = "AES256"
logging_log_retention_days = 90
logging_s3_prefix = "logs/"
logging_enabled = true
logging_encryption_enabled = true
logging_encryption_algorithm = "AES256"
logging_lifecycle_filter_prefix = "access-logs/"
logging_log_retention_days = 90
logging_s3_prefix = "logs/"
}

# Outputs
Expand Down
10 changes: 7 additions & 3 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
locals {
base_bucket_name = (
var.bucket_suffix == "" ?
var.bucket_name :
"${var.bucket_name}-${var.bucket_suffix}")
var.bucket_suffix == "" ?
var.bucket_name :
"${var.bucket_name}-${var.bucket_suffix}")
}

############################################
Expand Down Expand Up @@ -127,6 +127,10 @@ resource "aws_s3_bucket_lifecycle_configuration" "logging" {
id = "log-retention"
status = "Enabled"

filter {
prefix = var.logging_lifecycle_filter_prefix
}

expiration {
days = var.logging_log_retention_days
}
Expand Down
18 changes: 11 additions & 7 deletions tests/s3_bucket.tftest.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ run "setup" {

run "test_s3_bucket" {
variables {
region = run.setup.region

bucket_name = "test-s3-bucket"
bucket_suffix = run.setup.suffix
force_destroy = true
Expand All @@ -34,11 +32,12 @@ run "test_s3_bucket" {
enable_versioning = true

# Logging Configuration
logging_enabled = true
logging_encryption_enabled = true
logging_encryption_algorithm = "AES256"
logging_log_retention_days = 90
logging_s3_prefix = "logs/"
logging_enabled = true
logging_encryption_enabled = true
logging_encryption_algorithm = "AES256"
logging_log_retention_days = 90
logging_s3_prefix = "logs/"
logging_lifecycle_filter_prefix = "logs/"
}

# Assertions referencing actual Terraform resources
Expand Down Expand Up @@ -97,4 +96,9 @@ run "test_s3_bucket" {
condition = aws_s3_bucket_logging.logging[0].target_prefix == "logs/"
error_message = "Logging S3 prefix is not set to 'logs/'."
}

assert {
condition = aws_s3_bucket_lifecycle_configuration.logging[0].rule[0].filter[0].prefix == "logs/"
error_message = "Lifecycle rule prefix is not set to the expected value 'logs/'."
}
}
4 changes: 0 additions & 4 deletions tests/setup/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,3 @@ output "suffix" {
output "account_id" {
value = data.aws_caller_identity.current.account_id
}

output "region" {
value = "ap-southeast-2"
}
11 changes: 11 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,17 @@ variable "logging_encryption_algorithm" {
}
}

variable "logging_lifecycle_filter_prefix" {
description = "Prefix to apply S3 lifecycle rule to. Set to \"\" to apply to all objects."
type = string
default = ""

validation {
condition = can(regex("^[a-zA-Z0-9!_.*'()/~\\-]*$", var.logging_lifecycle_filter_prefix))
error_message = "The lifecycle prefix must be a valid S3 object key prefix or an empty string."
}
}

variable "logging_log_retention_days" {
description = "Number of days to retain S3 logging data before expiration."
type = number
Expand Down