Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/jameswoolfenden/terraform-aws-staticsite
Basic Static Site module
https://github.com/jameswoolfenden/terraform-aws-staticsite
aws module s3 s3-website terraform
Last synced: 26 days ago
JSON representation
Basic Static Site module
- Host: GitHub
- URL: https://github.com/jameswoolfenden/terraform-aws-staticsite
- Owner: JamesWoolfenden
- License: apache-2.0
- Created: 2019-07-10T14:27:29.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2022-09-20T07:02:35.000Z (over 2 years ago)
- Last Synced: 2023-12-16T12:57:44.595Z (about 1 year ago)
- Topics: aws, module, s3, s3-website, terraform
- Language: HCL
- Homepage:
- Size: 104 KB
- Stars: 0
- Watchers: 2
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# terraform-aws-staticsite
[](https://github.com/JamesWoolfenden/terraform-aws-staticsite)
[](https://github.com/JamesWoolfenden/terraform-aws-staticsite/releases/latest)
[](https://github.com/JamesWoolfenden/terraform-aws-staticsite/releases/latest)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=JamesWoolfenden%2Fterraform-aws-staticsite&benchmark=CIS+AWS+V1.2)
[](https://github.com/pre-commit/pre-commit)
[](https://www.checkov.io/)
[](https://www.bridgecrew.cloud/link/badge?vcs=github&fullRepo=JamesWoolfenden%2Fterraform-aws-staticsite&benchmark=INFRASTRUCTURE+SECURITY)
Terraform module to provision a secure Terraform S3 bucket as a static website, access via SSL only.
---
It's 100% Open Source and licensed under the [APACHE2](LICENSE).
## Usage
Include this repository as a module in your existing terraform code:
```hcl
module "static" {
source = "JamesWoolfenden/staticsite/aws"
version = "0.3.1"
permitted_ip_ranges = var.permitted_ip_ranges
s3_bucket_name = var.s3_bucket_name
}
```
## Costs
This will entirely depends on the usage of the Bucket as the storage cost of a website on S3 should be minimal.
```text
monthly cost estimate
Project: .
Name Monthly Qty Unit Monthly Cost
module.static.aws_s3_bucket.static-site
├─ Standard
│ ├─ Storage 0 GB-months $0.00
│ ├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
│ ├─ GET, SELECT, and all other requests 0 1k requests $0.00
│ ├─ Select data scanned 0 GB-months $0.00
│ └─ Select data returned 0 GB-months $0.00
├─ Intelligent tiering
│ ├─ Storage (frequent access) 0 GB-months $0.00
│ ├─ Storage (infrequent access) 0 GB-months $0.00
│ ├─ Monitoring and automation 0 1k objects $0.00
│ ├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
│ ├─ GET, SELECT, and all other requests 0 1k requests $0.00
│ ├─ Lifecycle transition 0 1k requests $0.00
│ ├─ Select data scanned 0 GB-months $0.00
│ ├─ Select data returned 0 GB-months $0.00
│ └─ Early delete (within 30 days) 0 GB-months $0.00
├─ Standard - infrequent access
│ ├─ Storage 0 GB-months $0.00
│ ├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
│ ├─ GET, SELECT, and all other requests 0 1k requests $0.00
│ ├─ Lifecycle transition 0 1k requests $0.00
│ ├─ Retrievals 0 GB-months $0.00
│ ├─ Select data scanned 0 GB-months $0.00
│ └─ Select data returned 0 GB-months $0.00
├─ One zone - infrequent access
│ ├─ Storage 0 GB-months $0.00
│ ├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
│ ├─ GET, SELECT, and all other requests 0 1k requests $0.00
│ ├─ Lifecycle transition 0 1k requests $0.00
│ ├─ Retrievals 0 GB-months $0.00
│ ├─ Select data scanned 0 GB-months $0.00
│ └─ Select data returned 0 GB-months $0.00
├─ Glacier
│ ├─ Storage 0 GB-months $0.00
│ ├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
│ ├─ GET, SELECT, and all other requests 0 1k requests $0.00
│ ├─ Lifecycle transition 0 1k requests $0.00
│ ├─ Retrieval requests (standard) 0 1k requests $0.00
│ ├─ Retrievals (standard) 0 GB-months $0.00
│ ├─ Select data scanned (standard) 0 GB-months $0.00
│ ├─ Select data returned (standard) 0 GB-months $0.00
│ ├─ Retrieval requests (expedited) 0 1k requests $0.00
│ ├─ Retrievals (expedited) 0 GB-months $0.00
│ ├─ Select data scanned (expedited) 0 GB-months $0.00
│ ├─ Select data returned (expedited) 0 GB-months $0.00
│ ├─ Retrieval requests (bulk) 0 1k requests $0.00
│ ├─ Retrievals (bulk) 0 GB-months $0.00
│ ├─ Select data scanned (bulk) 0 GB-months $0.00
│ ├─ Select data returned (bulk) 0 GB-months $0.00
│ └─ Early delete (within 90 days) 0 GB-months $0.00
└─ Glacier deep archive
├─ Storage 0 GB-months $0.00
├─ PUT, COPY, POST, LIST requests 0 1k requests $0.00
├─ GET, SELECT, and all other requests 0 1k requests $0.00
├─ Lifecycle transition 0 1k requests $0.00
├─ Retrieval requests (standard) 0 1k requests $0.00
├─ Retrievals (standard) 0 GB-months $0.00
├─ Retrieval requests (bulk) 0 1k requests $0.00
├─ Retrievals (bulk) 0 GB-months $0.00
└─ Early delete (within 180 days) 0 GB-months $0.00
PROJECT TOTAL $0.00
```
## Module Usage
This creates an S3 bucket with policy and applies the default tags via the provider.
## Checkov
I have added a number of exceptions to this module:
```markdown
#checkov:skip=CKV_AWS_52: "Ensure S3 bucket has MFA delete enabled"
#checkov:skip=CKV_AWS_19: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
#checkov:skip=CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
#checkov:skip=CKV_AWS_20: "S3 Bucket has an ACL defined which allows public READ access."
#checkov:skip=CKV_AWS_18: "Ensure the S3 bucket has access logging enabled"
```
They relate to private usage and not website - public usage.
## Testing
This module is validated and built and destroyed with every version.
## Requirements
No requirements.
## Providers
| Name | Version |
|------|---------|
| [aws](#provider\_aws) | n/a |
## Modules
No modules.
## Resources
| Name | Type |
|------|------|
| [aws_s3_bucket.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
| [aws_s3_bucket_acl.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
| [aws_s3_bucket_cors_configuration.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
| [aws_s3_bucket_policy.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
| [aws_s3_bucket_public_access_block.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
| [aws_s3_bucket_versioning.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
| [aws_s3_bucket_website_configuration.static_site](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource |
| [aws_s3_object._404](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |
| [aws_s3_object.index](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
## Inputs
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| [access\_log\_bucket](#input\_access\_log\_bucket) | Name of your access logging bucket | `string` | `"access_log_record"` | no |
| [bucket\_acl](#input\_bucket\_acl) | n/a | `string` | `"public-read"` | no |
| [force\_destroy](#input\_force\_destroy) | n/a | `bool` | `true` | no |
| [permitted\_iam](#input\_permitted\_iam) | iam roles with access to S3 bucket website. | `list(any)` | n/a | yes |
| [permitted\_ip\_ranges](#input\_permitted\_ip\_ranges) | IP Address ranges permitted to access S3 bucket website. | `list(any)` | n/a | yes |
| [s3\_bucket\_name](#input\_s3\_bucket\_name) | The raw name of the bucket | `string` | n/a | yes |
| [versioning](#input\_versioning) | Switch to control versioning | `bool` | `true` | no |
## Outputs
| Name | Description |
|------|-------------|
| [account\_id](#output\_account\_id) | n/a |
| [s3](#output\_s3) | n/a |
## Policy
This is the policy required to build this project:
The Terraform resource required is:
```golang
resource "aws_iam_policy" "terraform_pike" {
name_prefix = "terraform_pike"
path = "/"
description = "Pike Autogenerated policy from IAC"
policy = jsonencode({
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:DeleteObject",
"s3:GetAccelerateConfiguration",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetBucketLogging",
"s3:GetBucketObjectLockConfiguration",
"s3:GetBucketPolicy",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketRequestPayment",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectTagging",
"s3:GetReplicationConfiguration",
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketVersioning",
"s3:PutObject"
],
"Resource": "*"
}
]
})
}
```
## Instructions
## Related Projects
Check out these related projects.
- [terraform-aws-statebucket](https://github.com/jameswoolfenden/terraform-aws-statebucket) - Terraform s3 state buckets
## Help
**Got a question?**
File a GitHub [issue](https://github.com/JamesWoolfenden/terraform-aws-staticsite/issues).
## Contributing
### Bug Reports & Feature Requests
Please use the [issue tracker](https://github.com/JamesWoolfenden/terraform-aws-staticsite/issues) to report any bugs or file feature requests.
## Copyrights
Copyright © 2019-2022 James Woolfenden
## License
[](https://opensource.org/licenses/Apache-2.0)
See [LICENSE](LICENSE) for full details.
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
### Contributors
[![James Woolfenden][jameswoolfenden_avatar]][jameswoolfenden_homepage]
[James Woolfenden][jameswoolfenden_homepage]
[jameswoolfenden_homepage]: https://github.com/jameswoolfenden
[jameswoolfenden_avatar]: https://github.com/jameswoolfenden.png?size=150