v1.5.0

• No changes

v1.4.2

feature: Add ability to use KMS encryption @pazaan (#178)

what

• Add the ability to use KMS encryption through the addition of the sse_encryption and kms_master_key_id variables.

why

• Some business have security policies that require the use of customer-managed keys.
• As per the statement in #105, the default behavior has been left the same as it currently is.

references

• closes #105

v1.4.1

feature: Add support for deletion_protection_enabled attribute for DynamoDB @Hamza-Aziz (#156)

what

This PR add support for the attribute deletion_protection_enabled in the DynamoDB ressource

why

To address an issue #143
To present or force DynamoDB table deletion

references

To address an issue #143
https://aws.amazon.com/about-aws/whats-new/2023/03/amazon-dynamodb-table-deletion-protection/

chore: points to correct issue in README link @Gowiem (#154)

what

• Fixes link in README that was pointing to wrong issue

why

• We don't want to lead people astray 👍

references

• This is a redo of #153 by @tripplilley. Fame, fortune, and internet points go to him 😄

🤖 Automatic Updates

Update README.md and docs @cloudpossebot (#155)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @cloudpossebot (#152)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

v1.4.0

fix: s3 backend deprecated role_arn field @basvandijk (#151)

what

The following step was returning an error:

terraform init -force-copy

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.
Initializing modules...
Terraform encountered problems during initialisation, including problems
with the configuration, described below.

The Terraform configuration must be valid before initialization so that
Terraform can determine which modules and providers need to be installed.
╷
│ Error: Argument or block definition required
│
│   on backend.tf line 9, in terraform:
│    9:     assume_role.role_arn = ""
│
│ An argument or block definition is required here. To set an argument, use the equals sign "=" to introduce the argument value.
╵

🤖 Automatic Updates

Update README.md and docs @cloudpossebot (#150)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

v1.3.0

fix: Better TF formating when dynamodb_table is empty when creating backend template file @SMontiel (#149)

what

Improve TF formatting when a DynamoDB table is not specified.

why

As our CI pipeline checks formatting and we don't use a DynamoDB for locking, we keep committing changes made to the backend file which is handled by this module.

references

N/A

v1.2.0

feat: add user_policy_document parameter @dod38fr (#142)

what

This parameter allows the user to specify policies that are applied to the S3 bucket with the policies defined by this module.

why

We want to add policies that forbid non admin users to access the bucket containing tfstates.

This commit allow us to specify a policy that implement these restriction without clobbering the policies put in place by this module.

Note that I have no problem to change the name of this new parameter if you want another.

references

Closes: #115

v1.1.1

tfsec ignores added @davenicoll (#136)

what

• added tfsec ignores to false positives

why

• the terraform aws_s3_bucket resource was updated some time ago to deprecate access policies, encryption and logging as arguments, instead preferring separate terraform resources. tfsec incorrectly highlights the aws_s3_bucket resource are CRITICALly vulnerable.

references

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#argument-reference

Sync github @max-lobur (#138)

Rebuild github dir from the template

🐛 Bug Fixes

Always require TLS connection to S3 bucket @Nuru (#139)

what

• Always require TLS connection to S3 bucket

why

• Restores intended behavior
• Fixes crash. Supersedes and closes #135. Thank you @dod38fr

v0.40.1 S3 updates

🤖 Automatic Updates

Update Terraform cloudposse/s3-log-storage/aws to v1.3.1 (release/v0) @renovate (#134)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-log-storage/aws (source)	module	minor	1.1.0 -> 1.3.1

---

Release Notes

cloudposse/terraform-aws-s3-log-storage

v1.3.1

Compare Source

🚀 Enhancements

Update Terraform cloudposse/s3-bucket/aws to v3.1.1 (master) @​renovate (#​88)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	patch	3.1.0 -> 3.1.1

---

Release Notes

cloudposse/terraform-aws-s3-bucket

v3.1.1

Compare Source

🐛 Bug Fixes

Revert change to Transfer Acceleration from #&#​8203;178 @​&#​8203;Nuru (#&#​8203;180)

what

• Revert change to Transfer Acceleration from #​178

why

• Transfer Acceleration is not available in every region, and the change in #​178 (meant to detect and correct drift) does not work (throws API errors) in regions where Transfer Acceleration is not supported

---

🤖 Automatic Updates

Update Terraform cloudposse/s3-bucket/aws to v3.1.1 (master) @​renovate (#​88)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	patch	3.1.0 -> 3.1.1

---

Release Notes

cloudposse/terraform-aws-s3-bucket

v3.1.1

Compare Source

🐛 Bug Fixes

Revert change to Transfer Acceleration from #&#​8203;178 @​&#​8203;Nuru (#&#​8203;180)

what

• Revert change to Transfer Acceleration from #​178

why

• Transfer Acceleration is not available in every region, and the change in #​178 (meant to detect and correct drift) does not work (throws API errors) in regions where Transfer Acceleration is not supported

---

v1.3.0

Compare Source

🚀 Enhancements

Enhance lifecycle object with optionals, limit length of bucket name @​Nuru (#​87)

what

• Limit length of auto-generated bucket name to match AWS-imposed limit
• Enhance lifecycle_configuration_rules to be fully defined with optional members

why

• Avoid situation where module fails because auto-generated bucket name is too long
• Make it easier to build a list of rules

references

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
• https://github.com/cloudposse/terraform-aws-s3-bucket/issues/167

v1.2.0: Support new AWS S3 defaults (ACL prohibited)

Compare Source

🤖 Automatic Updates

Update Terraform cloudposse/s3-bucket/aws to v3.1.0 @​renovate (#​85)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	minor	3.0.0 -> 3.1.0

---

Release Notes

cloudposse/terraform-aws-s3-bucket

v3.1.0

Compare Source

Make compatible with new S3 defaults. Add user permissions boundary. @​&#​8203;Nuru (#&#​8203;178)

what

• Make compatible with new S3 defaults by setting S3 Object Ownership before setting ACL and disabling ACL if Ownership is "BucketOwnerEnforced"
• Add optional permissions boundary input for IAM user created by this module
• Create aws_s3_bucket_accelerate_configuration and aws_s3_bucket_versioning resources even when the feature is disabled, to enable drift detection

why

• S3 buckets with ACLs were failing to be provisioned because the ACL was set before the bucket ownership was changed
• Requested feature
• See #​171

references

• Closes #​174
• Supersedes and closes #​175
• Supersedes and closes #​176

Always include `aws_s3_bucket_versioning` resource @​&#​8203;mviamari (#&#​8203;172)

what

• Always create an aws_s3_bucket_versioning resource to track changes made to bucket versioning configuration

why

• When there is no aws_s3_bucket_versioning, the expectation is that the bucket versioning is disabled/suspend for the bucket. If bucket versioning is turned on outside of terraform (e.g. through the console), the change is not detected by terraform unless the aws_s3_bucket_versioning resource exists.

references

• Closes #​171

Add support for permission boundaries on replication IAM role @​&#​8203;mchristopher (#&#​8203;170)

what

• Adds support for assigning permission boundaries to the replication IAM role

why

• Our AWS environment enforces permission boundaries on all IAM roles to follow AWS best practices with security.

references

• AWS IAM Access Policies

🤖 Automatic Updates

Update README.md and docs @​&#​8203;cloudpossebot (#&#​8203;164)

what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

---

---

v0.40.0 Update dependencies

🚀 Enhancements

notes

• Terraform minimum version is now 1.1.0
• AWS provider minimum version is now 4.9.0

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-log-storage/aws (source)	module	major	0.26.0 -> 1.1.0

---

Release Notes

cloudposse/terraform-aws-s3-log-storage

v1.1.0

Compare Source

Adding "object_lock_configuration" variable @​ramses999 (#​84)

what

Adding "object_lock_configuration" variable which is used in module "cloudposse/s3-bucket/aws"

why

Must be able to use the Object Lock option for S3 in this module

references

https://github.com/cloudposse/terraform-aws-s3-bucket/blob/6837ed7b2f2460043d6be3981f16ed90563fd12a/main.tf#L5

v1.0.0

Compare Source

Important Notes

• Terraform version 1.3.0 and Terraform AWS version 4.9.0 or later are required
• The new bucket_key_enabled flag defaults to false for backward compatibility. At one point we recommend setting it to true for significant savings on KMS usage, but since bucket keys are only reused within a user session, it is not clear if it provides any savings at all. See AWS docs for more information.
• The new lifecycle_configuration_rules input replaces the now deprecated individual inputs for individual settings of a single lifecycle rule. See the terraform-aws-s3-bucket documentation for details on how to specify lifecycles using lifecycle_configuration_rules. This mechanism is much more flexible and closely follows the Terraform aws_s3_bucket_lifecycle_configuration resource.
• The new source_policy_documents input replaces the now deprecated policy input to match changes to the aws_iam_policy_document resource
• You can now select default values for (non-deprecated) inputs by setting them to null
• With Terraform 1.3 the manual interventions documented for upgrading to this module's versions 0.27.0 and 0.28.0 are no longer needed. You can safely upgrade from any earlier version to this one (although we always recommend leaving force_destroy at its default value of false, and if you have it set to true but want extra safety against the S3 bucket being destroyed, set it to false before upgrading).
• The force_destroy_enabled flag introduced in v0.27.0 has been removed
• In version 0.28.0, old lifecycle rule variables were deprecated and the new lifecycle_configuration_rules input was introduced. In that version, you would continue to get the old default lifecycle rule even if you supplied new rules via lifecycle_configuration_rules. Now, the default behavior is to ignore all the deprecated lifecycle inputs when the lifecycle_configuration_rules input is not empty, unless you explicitly set lifecycle_rule_enabled to true.

---

Enhancements

Automate upgrade using `moved` blocks @​Nuru (#​81)

what

• Automate the upgrade process from v0.26.0 or earlier by using moved block functionality introduced in Terraform 1.3.0
• Add nullable = false for module input variables which have a default value and where null is not a sensible/handled value for the variable.

why

• Safely upgrade without loss of data or manual intervention
• Allow users to select default values by setting inputs to null, closes #​63

v0.28.3: Not recommended, use v0.26.0 or v1.x instead

Compare Source

Update: This version no longer recommended

With the release of version 1.0.0 of this module, use of this version is no longer recommended. When you are able to use Terraform v1.3.0 or later and Terraform AWS provider v4.9.0 or later, upgrade directly to v1.0.0 or later of this module.

🤖 Automatic Updates

Update Terraform cloudposse/s3-bucket/aws to v3 @​renovate (#​78)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	major	2.0.1 -> 3.0.0

---

v0.28.2: Action required if updating from prior to v0.28.0

Compare Source

Update: This version no longer recommended

With the release of version 1.0.0 of this module, use of this version is no longer recommended. When you are able to use Terraform v1.3.0 or later and Terraform AWS provider v4.9.0 or later, upgrade directly to v1.0.0 or later of this module.

v0.28.0 introduced breaking changes with high risk of permanent data loss. See release notes there. This is only a safe upgrade if upgrading from v0.28.0.

We will convert to semantic versioning (incrementing the major version number for breaking changes), but having missed the opportunity to do that for earlier versions of this module, we are waiting for the next major change, expected to be soon after Terraform v1.3 is released.

🤖 Automatic Updates

Update Terraform cloudposse/s3-bucket/aws to v2.0.1 @​renovate (#​76)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	patch	2.0.0 -> 2.0.1

v0.28.1: accidental release, do not use

Compare Source

v0.28.0 introduced breaking changes with high risk of permanent data loss. See release notes there. This is only a safe upgrade if upgrading from v0.28.0.

We will convert to semantic versioning (incrementing the major version number for breaking changes), but having missed the opportunity to do that for earlier versions of this module, we are waiting for the next major change, expected to be soon after Terraform v1.3 is released.

git.io->cloudposse.tools update @​dylanbannon (#​73)

what and why

Change all references to git.io/build-harness into cloudposse.tools/build-harness, since git.io redirects will stop working on April 29th, 2022.

References

• DEV-143

🤖 Automatic Updates

Update Terraform cloudposse/s3-bucket/aws to v2 @​renovate (#​72)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/s3-bucket/aws (source)	module	major	0.49.0 -> 2.0.3

---

v0.28.0: (Action Needed) Support AWS v4 provider

Compare Source

WARNING, DATA LOSS LIKELY if you do not follow upgrade instructions:

• Upgrade instructions: v0.27.0 to v0.28.0
• Upgrade instructions: versions prior to v0.27.0 to v0.27.0
  

🚀 Enhancements

Support AWS v4 provider @​Nuru (#​71)

what

• Migrate to AWS v4 Terraform provider
• Add features
  • Allow full S3 storage lifecycle configuration
  • Allow multiple bucket policy documents
  • Allow specifying the bucket name directly, rather than requiring it to be generated by null-label
  • Allow specifying S3 object ownership
  • Allow enabling S3 bucket keys for encryption
• Deprecate variable by variable specification of a single storage lifecycle rule
• Add extra safety measure force_destroy_enabled

why

• AWS v4 broke this module
• Feature parity
• Replaced with more power and more flexible input
• Reduce the chance that automated upgrades will cause data loss

references

• ...

v1.1.0

• No changes