cloud-based-sensor/terragrunt/aws/central_account/s3.tf at e3fdd947256af59407a1987cce1cbba222a8acff · cds-snc/cloud-based-sensor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
locals {
  calculated_replicate_role_arns = [
    for account_id in var.satellite_account_ids : "arn:aws:iam::${account_id}:role/${var.satellite_s3_replicate_role_name}"
  ]
  trusted_replicate_role_arns = concat(
    local.calculated_replicate_role_arns,
    ["arn:aws:iam::274536870005:role/service-role/s3crr_role_for_aws-controltower-logs-274536870005-ca-central-1"]
  )
}

#
# Log archive bucket and access logging
#
module "log_archive_bucket" {
  source            = "github.com/cds-snc/terraform-modules//S3?ref=v10.11.4"
  bucket_name       = var.log_archive_bucket_name
  billing_tag_value = var.billing_tag_value
  kms_key_arn       = aws_kms_key.log_archive_encrypt.arn

  versioning = {
    enabled = true
  }

  logging = {
    target_bucket = module.log_archive_access_bucket.s3_bucket_id
  }

  lifecycle_rule = [
    {
      id      = "delete-old-objects"
      enabled = true
      expiration = {
        days = 90
      }
    }
  ]
}

module "log_archive_access_bucket" {
  source            = "github.com/cds-snc/terraform-modules//S3_log_bucket?ref=v10.11.4"
  bucket_name       = "${var.log_archive_bucket_name}-access"
  billing_tag_value = var.billing_tag_value
  versioning_status = "Disabled"
  force_destroy     = true
}

#
# Bucket policy that allows satellite buckets to
# replicate content
#
resource "aws_s3_bucket_policy" "log_archive_bucket" {
  bucket = module.log_archive_bucket.s3_bucket_id
  policy = data.aws_iam_policy_document.combined.json
}

data "aws_iam_policy_document" "combined" {
  source_policy_documents = [
    sensitive(data.aws_iam_policy_document.log_archive_bucket.json)
  ]
}

data "aws_iam_policy_document" "log_archive_bucket" {
  statement {
    principals {
      type        = "AWS"
      identifiers = local.trusted_replicate_role_arns
    }
    actions = [
      "s3:ObjectOwnerOverrideToBucketOwner",
      "s3:ReplicateObject",
      "s3:ReplicateDelete"
    ]
    resources = [
      "${module.log_archive_bucket.s3_bucket_arn}/*",
    ]
  }

  statement {
    principals {
      type        = "AWS"
      identifiers = local.trusted_replicate_role_arns
    }
    actions = [
      "s3:List*",
      "s3:GetBucketVersioning",
      "s3:PutBucketVersioning"
    ]
    resources = [
      module.log_archive_bucket.s3_bucket_arn
    ]
  }

  #
  # Bucket Policy that allows the specified principal to get objects
  #
  statement {
    principals {
      type        = "AWS"
      identifiers = [var.cbs_principal_role_arn]
    }
    effect  = "Allow"
    actions = ["s3:GetObject"]
    resources = [
      "${module.log_archive_bucket.s3_bucket_arn}",
      "${module.log_archive_bucket.s3_bucket_arn}/*",
    ]
  }
}

#
# Publish a notification to the SNS topic when objects are created
#
resource "aws_s3_bucket_notification" "cbs_transport_lambda" {
  bucket = module.log_archive_bucket.s3_bucket_id

  topic {
    id        = "CbsEvent"
    topic_arn = aws_sns_topic.log_archive.arn
    events    = ["s3:ObjectCreated:*"]
  }
  # Required for CBS v2.3
  eventbridge = true
}