feat(s3-static-website): make website bucket ACLs optional (#95)

Author: egarbi

README.md

@@ -42,8 +42,8 @@ In order to run all checks at any point run the following command:
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws.acm_provider"></a> [aws.acm\_provider](#provider\_aws.acm\_provider) | >= 4.0 |
-| <a name="provider_aws.main"></a> [aws.main](#provider\_aws.main) | >= 4.0 |
+| <a name="provider_aws.acm_provider"></a> [aws.acm\_provider](#provider\_aws.acm\_provider) | 6.35.1 |
+| <a name="provider_aws.main"></a> [aws.main](#provider\_aws.main) | 6.35.1 |
 
 ## Modules
 
@@ -110,7 +110,8 @@ In order to run all checks at any point run the following command:
 | <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Name prefix for resources on AWS | `any` | n/a | yes |
 | <a name="input_route53_hosted_zone_id"></a> [route53\_hosted\_zone\_id](#input\_route53\_hosted\_zone\_id) | The Route 53 hosted zone ID to use if create\_route53\_hosted\_zone is false | `string` | `""` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Resource tags | `map(string)` | `{}` | no |
-| <a name="input_website_bucket_acl"></a> [website\_bucket\_acl](#input\_website\_bucket\_acl) | (Optional) The canned ACL to apply. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, and log-delivery-write. Defaults to private. | `string` | `"private"` | no |
+| <a name="input_website_bucket_acl"></a> [website\_bucket\_acl](#input\_website\_bucket\_acl) | (Optional) The canned ACL to apply when website\_bucket\_acl\_enabled is true. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, and log-delivery-write. Defaults to private. | `string` | `"private"` | no |
+| <a name="input_website_bucket_acl_enabled"></a> [website\_bucket\_acl\_enabled](#input\_website\_bucket\_acl\_enabled) | (Optional) Whether to manage and apply bucket ACL settings. Keep true for backward compatibility. Set to false to disable ACL usage (BucketOwnerEnforced), which helps avoid cross-account object upload 403 errors. Defaults to true. | `bool` | `true` | no |
 | <a name="input_website_bucket_force_destroy"></a> [website\_bucket\_force\_destroy](#input\_website\_bucket\_force\_destroy) | (Optional, Default:false) A boolean that indicates all objects (including any locked objects) should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 | <a name="input_website_bucket_policy"></a> [website\_bucket\_policy](#input\_website\_bucket\_policy) | (Optional) Map containing the IAM policy for the website bucket. Defaults to null and the policy will be generated automatically. See examples/custom-website-bucket-policy/main.tf for configuration example. | `any` | `null` | no |
 | <a name="input_website_cors_additional_allowed_origins"></a> [website\_cors\_additional\_allowed\_origins](#input\_website\_cors\_additional\_allowed\_origins) | (Optional) Specifies which origins are allowed besides the domain name specified | `list(string)` | `[]` | no |

examples/acl-disabled/main.tf

@@ -0,0 +1,19 @@
+module "test_website" {
+  source      = "../../"
+  name_prefix = "test-website"
+
+  providers = {
+    aws.main         = aws.main
+    aws.acm_provider = aws.acm_provider
+  }
+
+  website_domain_name        = "test.com"
+  website_bucket_acl_enabled = false
+
+  create_acm_certificate     = false
+  acm_certificate_arn_to_use = "arn:aws:acm:us-east-1:123456789000:certificate/01234567-89a-bcde-f012-3456789abcde"
+
+  create_route53_hosted_zone = true
+
+  aws_accounts_with_read_view_log_bucket = ["mock_account"]
+}

examples/acl-disabled/mock_provider.tf

@@ -0,0 +1,71 @@
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.0"
+    }
+  }
+}
+
+provider "aws" {
+  alias                       = "main"
+  region                      = "us-east-1"
+  skip_credentials_validation = true
+  skip_requesting_account_id  = true
+  skip_metadata_api_check     = true
+  s3_use_path_style           = true
+
+  endpoints {
+    apigateway     = "http://localstack:4566"
+    cloudformation = "http://localstack:4566"
+    cloudwatch     = "http://localstack:4566"
+    dynamodb       = "http://localstack:4566"
+    es             = "http://localstack:4566"
+    firehose       = "http://localstack:4566"
+    iam            = "http://localstack:4566"
+    kinesis        = "http://localstack:4566"
+    lambda         = "http://localstack:4566"
+    route53        = "http://localstack:4566"
+    redshift       = "http://localstack:4566"
+    s3             = "http://localstack:4566"
+    secretsmanager = "http://localstack:4566"
+    ses            = "http://localstack:4566"
+    sns            = "http://localstack:4566"
+    sqs            = "http://localstack:4566"
+    ssm            = "http://localstack:4566"
+    stepfunctions  = "http://localstack:4566"
+    sts            = "http://localstack:4566"
+  }
+}
+
+provider "aws" {
+  alias                       = "acm_provider"
+  region                      = "us-east-1"
+  skip_credentials_validation = true
+  skip_requesting_account_id  = true
+  skip_metadata_api_check     = true
+  s3_use_path_style           = true
+
+  endpoints {
+    apigateway     = "http://localstack:4566"
+    cloudformation = "http://localstack:4566"
+    cloudwatch     = "http://localstack:4566"
+    dynamodb       = "http://localstack:4566"
+    es             = "http://localstack:4566"
+    firehose       = "http://localstack:4566"
+    iam            = "http://localstack:4566"
+    kinesis        = "http://localstack:4566"
+    lambda         = "http://localstack:4566"
+    route53        = "http://localstack:4566"
+    redshift       = "http://localstack:4566"
+    s3             = "http://localstack:4566"
+    secretsmanager = "http://localstack:4566"
+    ses            = "http://localstack:4566"
+    sns            = "http://localstack:4566"
+    sqs            = "http://localstack:4566"
+    ssm            = "http://localstack:4566"
+    stepfunctions  = "http://localstack:4566"
+    sts            = "http://localstack:4566"
+  }
+}

variables.tf

@@ -47,11 +47,17 @@ variable "website_domain_name" {
 }
 
 variable "website_bucket_acl" {
-  description = "(Optional) The canned ACL to apply. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, and log-delivery-write. Defaults to private."
+  description = "(Optional) The canned ACL to apply when website_bucket_acl_enabled is true. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, and log-delivery-write. Defaults to private."
   type        = string
   default     = "private"
 }
 
+variable "website_bucket_acl_enabled" {
+  description = "(Optional) Whether to manage and apply bucket ACL settings. Keep true for backward compatibility. Set to false to disable ACL usage (BucketOwnerEnforced), which helps avoid cross-account object upload 403 errors. Defaults to true."
+  type        = bool
+  default     = true
+}
+
 variable "website_bucket_force_destroy" {
   description = "(Optional, Default:false) A boolean that indicates all objects (including any locked objects) should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable."
   type        = bool

website.tf

@@ -73,11 +73,13 @@ resource "aws_s3_bucket_ownership_controls" "website" {
 
   bucket = aws_s3_bucket.website.id
   rule {
-    object_ownership = "BucketOwnerPreferred"
+    object_ownership = var.website_bucket_acl_enabled ? "BucketOwnerPreferred" : "BucketOwnerEnforced"
   }
 }
 
 resource "aws_s3_bucket_acl" "website" {
+  count = var.website_bucket_acl_enabled ? 1 : 0
+
   depends_on = [aws_s3_bucket_ownership_controls.website]
   provider   = aws.main