Input Variables

This page documents every input variable accepted by the terraform-aws-s3-bucket module. Variables are organized into logical groups to make them easier to navigate.

The module requires Terraform >= 1.5.7 and the AWS provider >= 6.37.

Bucket Configuration

bucket

string

default:"null"

(Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name.

bucket_prefix

string

default:"null"

(Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket.

bucket_namespace

string

default:"null"

Namespace for the bucket. Determines bucket naming scope. Valid values: account-regional, global. Defaults to global (AWS).

region

string

default:"null"

Region where the resource(s) will be managed. Defaults to the region set in the provider configuration.

create_bucket

bool

default:"true"

Controls if S3 bucket should be created. Set to false to conditionally skip bucket creation.

force_destroy

bool

default:"false"

A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable.

Access Control

block_public_acls

bool

default:"true"

Whether Amazon S3 should block public ACLs for this bucket.

block_public_policy

bool

default:"true"

Whether Amazon S3 should block public bucket policies for this bucket.

ignore_public_acls

bool

default:"true"

Whether Amazon S3 should ignore public ACLs for this bucket.

restrict_public_buckets

bool

default:"true"

Whether Amazon S3 should restrict public bucket policies for this bucket.

attach_public_policy

bool

default:"true"

Controls if a user defined public bucket policy will be attached. Set to false to allow upstream to apply defaults to the bucket.

skip_destroy_public_access_block

bool

default:"true"

Whether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if public_access_block is set to true.

control_object_ownership

bool

default:"false"

Whether to manage S3 Bucket Ownership Controls on this bucket.

object_ownership

string

default:"BucketOwnerEnforced"

Object ownership. Valid values:

BucketOwnerEnforced — ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket.
BucketOwnerPreferred — Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL.
ObjectWriter — The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL.

Encryption

server_side_encryption_configuration

any

default:"{}"

Map containing server-side encryption configuration.

Show Example configuration

server_side_encryption_configuration = {
  rule = {
    apply_server_side_encryption_by_default = {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.objects.arn
    }
  }
}

attach_deny_incorrect_encryption_headers

bool

default:"false"

Controls if S3 bucket should deny incorrect encryption headers policy attached.

attach_deny_incorrect_kms_key_sse

bool

default:"false"

Controls if S3 bucket policy should deny usage of incorrect KMS key SSE.

allowed_kms_key_arn

string

default:"null"

The ARN of KMS key which should be allowed in PutObject. Used in conjunction with attach_deny_incorrect_kms_key_sse.

attach_deny_unencrypted_object_uploads

bool

default:"false"

Controls if S3 bucket should deny unencrypted object uploads policy attached.

attach_deny_ssec_encrypted_object_uploads

bool

default:"false"

Controls if S3 bucket should deny SSEC (customer-provided key) encrypted object uploads.

Versioning & Object Lock

versioning

map(string)

default:"{}"

Map containing versioning configuration.

Show Example configuration

versioning = {
  enabled    = true
  mfa_delete = false
}

object_lock_enabled

bool

default:"false"

Whether S3 bucket should have an Object Lock configuration enabled.

object_lock_configuration

any

default:"{}"

Map containing S3 object locking configuration.

Show Example configuration

object_lock_configuration = {
  rule = {
    default_retention = {
      mode = "GOVERNANCE"
      days = 1
    }
  }
}

Lifecycle

lifecycle_rule

any

default:"[]"

List of maps containing configuration of object lifecycle management.

Show Example configuration

lifecycle_rule = [
  {
    id      = "log-expiry"
    enabled = true

    expiration = {
      days = 90
    }

    transition = [
      {
        days          = 30
        storage_class = "STANDARD_IA"
      },
      {
        days          = 60
        storage_class = "GLACIER"
      }
    ]
  }
]

transition_default_minimum_object_size

string

default:"null"

The default minimum object size behavior applied to the lifecycle configuration. Valid values: all_storage_classes_128K (default), varies_by_storage_class.

Replication

replication_configuration

any

default:"{}"

Map containing cross-region replication configuration.

Show Example configuration

replication_configuration = {
  role = aws_iam_role.replication.arn

  rules = [
    {
      id     = "everything-without-filters"
      status = "Enabled"

      destination = {
        bucket        = module.replica_bucket.s3_bucket_arn
        storage_class = "STANDARD"
      }
    }
  ]
}

Logging

logging

any

default:"{}"

Map containing access bucket logging configuration.

Show Example configuration

logging = {
  target_bucket = module.log_bucket.s3_bucket_id
  target_prefix = "log/"
}

attach_elb_log_delivery_policy

bool

default:"false"

Controls if S3 bucket should have ELB log delivery policy attached.

attach_lb_log_delivery_policy

bool

default:"false"

Controls if S3 bucket should have ALB/NLB log delivery policy attached.

attach_access_log_delivery_policy

bool

default:"false"

Controls if S3 bucket should have S3 access log delivery policy attached.

attach_cloudtrail_log_delivery_policy

bool

default:"false"

Controls if S3 bucket should have CloudTrail log delivery policy attached.

attach_waf_log_delivery_policy

bool

default:"false"

Controls if S3 bucket should have WAF log delivery policy attached.

access_log_delivery_policy_source_buckets

list(string)

default:"[]"

List of S3 bucket ARNs which should be allowed to deliver access logs to this bucket.

access_log_delivery_policy_source_accounts

list(string)

default:"[]"

List of AWS Account IDs that should be allowed to deliver access logs to this bucket.

access_log_delivery_policy_source_organizations

list(string)

default:"[]"

List of AWS Organization IDs that should be allowed to deliver access logs to this bucket.

lb_log_delivery_policy_source_organizations

list(string)

default:"[]"

List of AWS Organization IDs that should be allowed to deliver ALB/NLB logs to this bucket.

Website & CORS

website

any

default:"{}"

Map containing static web-site hosting or redirect configuration.

Show Example configuration

website = {
  index_document = "index.html"
  error_document = "error.html"
}

cors_rule

any

default:"[]"

List of maps containing rules for Cross-Origin Resource Sharing.

Show Example configuration

cors_rule = [
  {
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["https://modules.tf", "https://terraform-aws-modules.modules.tf"]
    allowed_headers = ["*"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }
]

acceleration_status

string

default:"null"

Sets the accelerate configuration of an existing bucket. Can be Enabled or Suspended.

request_payer

string

default:"null"

Specifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer.

Policies

attach_policy

bool

default:"false"

Controls if S3 bucket should have bucket policy attached. Set to true to use the value of policy as the bucket policy.

attach_deny_insecure_transport_policy

bool

default:"false"

Controls if S3 bucket should have a deny non-SSL transport policy attached.

attach_require_latest_tls_policy

bool

default:"false"

Controls if S3 bucket should require the latest version of TLS.

Intelligent Tiering & Metrics

intelligent_tiering

any

default:"{}"

Map containing intelligent tiering configuration.

Show Example configuration

intelligent_tiering = {
  general = {
    status = "Enabled"
    tiering = {
      ARCHIVE_ACCESS = {
        days = 180
      }
      DEEP_ARCHIVE_ACCESS = {
        days = 270
      }
    }
  }
}

metric_configuration

any

default:"[]"

Map containing bucket metric configuration.

Show Example configuration

metric_configuration = [
  {
    name = "documents"
    filter = {
      prefix = "documents/"
      tags = {
        priority = "high"
      }
    }
  }
]

Inventory & Analytics

inventory_configuration

any

default:"{}"

Map containing S3 inventory configuration.

inventory_source_account_id

string

default:"null"

The inventory source account ID.

inventory_source_bucket_arn

string

default:"null"

The inventory source bucket ARN.

inventory_self_source_destination

bool

default:"false"

Whether or not the inventory source bucket is also the destination bucket.

analytics_configuration

any

default:"{}"

Map containing bucket analytics configuration.

analytics_source_account_id

string

default:"null"

The analytics source account ID.

analytics_source_bucket_arn

string

default:"null"

The analytics source bucket ARN.

analytics_self_source_destination

bool

default:"false"

Whether or not the analytics source bucket is also the destination bucket.

attach_inventory_destination_policy

bool

default:"false"

Controls if S3 bucket should have bucket inventory destination policy attached.

attach_analytics_destination_policy

bool

default:"false"

Controls if S3 bucket should have bucket analytics destination policy attached.

Directory Bucket

Directory bucket variables are only applicable when is_directory_bucket = true. Directory buckets have a different feature set and do not support all standard bucket configurations.

is_directory_bucket

bool

default:"false"

If the S3 bucket created is a directory bucket.

availability_zone_id

string

default:"null"

Availability Zone ID or Local Zone ID. Required for directory buckets.

data_redundancy

string

default:"null"

Data redundancy. Valid values: SingleAvailabilityZone.

type

string

default:"Directory"

Bucket type. Valid values: Directory.

location_type

string

default:"null"

Location type. Valid values: AvailabilityZone or LocalZone.

Metadata

create_metadata_configuration

bool

default:"false"

Whether to create a metadata configuration resource.

metadata_inventory_table_configuration_state

string

default:"null"

Configuration state of the inventory table, indicating whether the inventory table is enabled or disabled. Valid values: ENABLED, DISABLED.

metadata_encryption_configuration

any

default:"null"

Encryption configuration block for metadata.

metadata_journal_table_record_expiration_days

number

default:"null"

Number of days to retain journal table records.

metadata_journal_table_record_expiration

string

default:"null"

Whether journal table record expiration is enabled or disabled. Valid values: ENABLED, DISABLED.

Other

putin_khuylo

bool

default:"true"

Do you agree that Putin doesn’t respect Ukrainian sovereignty and territorial integrity? Must be true to use this module. More info

Module Inputs

Module Outputs

Submodules

Examples

Bucket Configuration

Access Control

Encryption

Versioning & Object Lock

Lifecycle

Replication

Logging

Website & CORS

Policies

Intelligent Tiering & Metrics

Inventory & Analytics

Directory Bucket

Metadata

Other

Build docs developers (and LLMs) love

Module Inputs

Module Outputs

Submodules

Examples

​Bucket Configuration

​Access Control

​Encryption

​Versioning & Object Lock

​Lifecycle

​Replication

​Logging

​Website & CORS

​Policies

​Intelligent Tiering & Metrics

​Inventory & Analytics

​Directory Bucket

​Metadata

​Other

Build docs developers (and LLMs) love

Bucket Configuration

Access Control

Encryption

Versioning & Object Lock

Lifecycle

Replication

Logging

Website & CORS

Policies

Intelligent Tiering & Metrics

Inventory & Analytics

Directory Bucket

Metadata

Other