module "amp-archive-export-request-payloads-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-archive-export-request-payloads-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-archive-export-request-payloads-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-archive-export-request-payloads-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-archive-export-request-payloads-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-archive-export-request-payloads-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-archive-export-request-payloads-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-archive-export-request-payloads-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-archive-exports-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-archive-exports-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-archive-exports-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-archive-exports-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-archive-exports-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-archive-exports-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-archive-exports-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-archive-exports-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-asset-app-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-app-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-app-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-app-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "LOGGING" Classification = "internal-use-only" }) } module "amp-asset-processor-test-bucket-1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-processor-test-bucket-1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-processor-test-bucket-1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-processor-test-bucket-1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-processor-test-bucket-ff" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-processor-test-bucket-ff" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-processor-test-bucket-ff.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-processor-test-bucket-ff" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-amb-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-amb-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-amb-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-amb-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-amb-0001-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-amb-0001-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-amb-0001-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-amb-0001-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-aud-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-aud-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-aud-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-aud-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-aud-0001-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-aud-0001-s" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-aud-0001-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-aud-0001-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-aud-0001-s-use1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-aud-0001-s-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-aud-0001-s-use1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-aud-0001-s-use1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-digb-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-digb-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-digb-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-digb-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-digb-0001-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-digb-0001-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-digb-0001-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-digb-0001-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-doc-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-doc-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-doc-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-doc-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-doc-0001-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-doc-0001-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-doc-0001-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-doc-0001-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-dod-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-dod-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-dod-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-dod-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-dod-0001-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-dod-0001-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-dod-0001-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-dod-0001-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-gra-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-gra-0001-dev" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-gra-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-gra-0001-dev-use1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-gra-0001-dev-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-dev-use1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-gra-0001-dev-use1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-gra-0001-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-gra-0001-s" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-gra-0001-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-gra-0001-s-use1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-gra-0001-s-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-gra-0001-s-use1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-gra-0001-s-use1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-lfv-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-lfv-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-lfv-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-lfv-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-lfv-0001-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-lfv-0001-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-lfv-0001-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-lfv-0001-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-packg-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-packg-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-packg-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-packg-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-packg-0001-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-packg-0001-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-packg-0001-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-packg-0001-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-vid-0001-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-vid-0001-s" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-vid-0001-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-vid-0001-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-blueray-0001-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-blueray-0001-s" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-blueray-0001-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy lifecycle_rule = [ { enabled = true id = "version cleanup" noncurrent_version_expiration = { days = 3 } noncurrent_version_transition = [] filter = { tags = {} } transition = [] }, { enabled = true id = "30D-Standard-IA" noncurrent_version_expiration = [] noncurrent_version_transition = [] filter = { tags = {} } transition = [ { days = 30 storage_class = "STANDARD_IA" } ] }, { enabled = true id = "amp_access_tier_12m_to_gir" noncurrent_version_expiration = [] noncurrent_version_transition = [] filter = { tags = { amp_access_tier = "12m" } } transition = [ { days = 0 storage_class = "GLACIER_IR" } ] } ] inventory_configuration = { "CSV" = { enabled = true included_object_versions = "Current" optional_fields = [ "Size", "LastModifiedDate", "ReplicationStatus", "StorageClass", "IntelligentTieringAccessTier", "ETag", ] frequency = "Daily" destination = { bucket = { bucket_arn = module.sme-amp-dev-euc1-s3-inventory } format = "CSV" prefix = "Inventory_Reports/" } }, "Inventory" = { enabled = true included_object_versions = "Current" optional_fields = [ "Size", "LastModifiedDate", "IsMultipartUploaded", "ReplicationStatus", "EncryptionStatus", "StorageClass", "IntelligentTieringAccessTier", "ObjectLockMode", "ObjectLockRetainUntilDate", "ObjectLockLegalHoldStatus", ] frequency = "Daily" destination = { bucket = { bucket_arn = module.sme-amp-dev-euc1-s3-inventory.s3_bucket_arn } format = "Parquet" prefix = "Inventory_Reports/" } } } tags = merge(var.s3_tags, { Name = "amp-asset-repo-blueray-0001-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-blueray-0001-s-notifications" { source = "terraform-aws-modules/s3-bucket/aws//modules/notification" version = "~> 3.11.0" providers = { aws = aws.eu-central-1 } bucket = module.amp-asset-repo-blueray-0001-s.s3_bucket_id sqs_notifications = { s3events = { queue_arn = "arn:aws:sqs:eu-central-1:887829410671:amp-service-s3events-stage" events = ["s3:LifecycleTransition", "s3:IntelligentTiering"] } } create_sqs_policy = false } module "amp-asset-repo-vid-0001-s-use1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-vid-0001-s-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-vid-0001-s-use1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-vid-0001-s-use1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-vid-0002-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-vid-0002-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-vid-0002-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repo-vid-0002-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-blueray-0001-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-blueray-0001-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repo-blueray-0001-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy lifecycle_rule = [ { enabled = true id = "version cleanup" noncurrent_version_expiration = { days = 3 } noncurrent_version_transition = [] filter = { tags = {} } transition = [] }, { enabled = true id = "30D-Standard-IA" noncurrent_version_expiration = [] noncurrent_version_transition = [] filter = { tags = {} } transition = [ { days = 30 storage_class = "STANDARD_IA" } ] }, { enabled = true id = "amp_access_tier_12m_to_gir" noncurrent_version_expiration = [] noncurrent_version_transition = [] filter = { tags = { amp_access_tier = "12m" } } transition = [ { days = 0 storage_class = "GLACIER_IR" } ] } ] inventory_configuration = { "CSV" = { enabled = true included_object_versions = "Current" optional_fields = [ "Size", "LastModifiedDate", "ReplicationStatus", "StorageClass", "IntelligentTieringAccessTier", "ETag", ] frequency = "Daily" destination = { bucket = { bucket_arn = module.sme-amp-dev-euc1-s3-inventory.s3_bucket_arn } format = "CSV" prefix = "Inventory_Reports/" } }, "Inventory" = { enabled = true included_object_versions = "Current" optional_fields = [ "Size", "LastModifiedDate", "IsMultipartUploaded", "ReplicationStatus", "EncryptionStatus", "StorageClass", "IntelligentTieringAccessTier", "ObjectLockMode", "ObjectLockRetainUntilDate", "ObjectLockLegalHoldStatus", ] frequency = "Daily" destination = { bucket = { bucket_arn = module.sme-amp-dev-euc1-s3-inventory } format = "Parquet" prefix = "Inventory_Reports/" } } } tags = merge(var.s3_tags, { Name = "amp-asset-repo-blueray-0001-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repo-blueray-0001-dev-notifications" { source = "terraform-aws-modules/s3-bucket/aws//modules/notification" version = "~> 3.11.0" providers = { aws = aws.eu-central-1 } bucket = module.amp-asset-repo-blueray-0001-dev.s3_bucket_id sqs_notifications = { s3events = { queue_arn = "arn:aws:sqs:eu-central-1:887829410671:amp-service-s3events-dev" events = ["s3:LifecycleTransition", "s3:IntelligentTiering"] } } create_sqs_policy = false } module "amp-asset-repository-0001-dev-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repository-0001-dev-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repository-0001-dev-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repository-0001-dev-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-repository-0002-dev-stage-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repository-0002-dev-stage-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-repository-0002-dev-stage-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-repository-0002-dev-stage-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-service-lambda-code-source" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-service-lambda-code-source" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-service-lambda-code-source.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-service-lambda-code-source" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-service-lambda-code-source-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-service-lambda-code-source-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-service-lambda-code-source-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-service-lambda-code-source-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-srv-d-eu-vpc-flow-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-srv-d-eu-vpc-flow-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-srv-d-eu-vpc-flow-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-srv-d-eu-vpc-flow-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "amp-asset-transfer-sqs-payloads-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-transfer-sqs-payloads-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-transfer-sqs-payloads-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-transfer-sqs-payloads-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-asset-transfer-sqs-payloads-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-transfer-sqs-payloads-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-transfer-sqs-payloads-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-transfer-sqs-payloads-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-asset-usr-amino-export-d" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-amino-export-d" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-amino-export-d.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-amino-export-d" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-amino-export-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-amino-export-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-amino-export-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-amino-export-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-aoma-core-d" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-aoma-core-d" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-aoma-core-d.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-aoma-core-d" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-aoma-core-d-ff" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-aoma-core-d-ff" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-aoma-core-d-ff.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "POST", "PUT"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = ["ETag", "Location"] max_age_seconds = 0 } ] tags = merge(var.s3_tags, { Name = "amp-asset-usr-aoma-core-d-ff" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-aoma-core-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-aoma-core-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-aoma-core-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-aoma-core-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-processor-d" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-processor-d" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-processor-d.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-processor-d" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-processor-d-ff" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-processor-d-ff" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-processor-d-ff.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-processor-d-ff" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-processor-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-processor-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-processor-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-processor-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-ust-d" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-ust-d" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-ust-d.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-usr-ust-d" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-ust-d-ff" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV2_AWS_61: Ensure that an S3 bucket has a lifecycle configuration #checkov:skip=CKV_AWS_18: Ensure the S3 bucket has access logging enabled #checkov:skip=CKV2_AWS_6: Ensure that S3 bucket has a Public Access block source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-ust-d-ff" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-ust-d-ff.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "POST", "PUT"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = ["ETag", "Location"] max_age_seconds = 0 } ] tags = merge(var.s3_tags, { Name = "amp-asset-usr-ust-d-ff" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-ust-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-ust-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-ust-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "POST", "PUT"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = ["ETag", "Location"] max_age_seconds = 0 } ] tags = merge(var.s3_tags, { Name = "amp-asset-usr-ust-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-audio-archives-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-audio-archives-dev" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-audio-archives-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-audio-archives-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-audio-archives-dev-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-audio-archives-dev-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-audio-archives-dev-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-audio-archives-dev-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-audio-archives-dev-use1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-audio-archives-dev-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-audio-archives-dev-use1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-audio-archives-dev-use1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-audio-archives-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-audio-archives-stage" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-audio-archives-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-audio-archives-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-audio-archives-stage-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-audio-archives-stage-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-audio-archives-stage-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-audio-archives-stage-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-d-vpc-flow-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-d-vpc-flow-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-d-vpc-flow-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-d-vpc-flow-logs", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "amp-dev-elb-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-dev-elb-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-dev-elb-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-dev-elb-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "amp-dev-rds-log-backup" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-dev-rds-log-backup" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-dev-rds-log-backup.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-dev-rds-log-backup", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "amp-mediaconvert-output-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-mediaconvert-output-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-mediaconvert-output-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-mediaconvert-output-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-mediaconvert-output-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-mediaconvert-output-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-mediaconvert-output-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-mediaconvert-output-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-photo-archives-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-photo-archives-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-photo-archives-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-photo-archives-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-photo-archives-dev-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-photo-archives-dev-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-photo-archives-dev-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-photo-archives-dev-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-photo-archives-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-photo-archives-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-photo-archives-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-photo-archives-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-s-vpc-flow-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-s-vpc-flow-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-s-vpc-flow-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-s-vpc-flow-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "amp-transcribe-response-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-transcribe-response-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-transcribe-response-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-transcribe-response-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-transcribe-response-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-transcribe-response-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-transcribe-response-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-transcribe-response-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-video-archives-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-video-archives-dev" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-video-archives-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-video-archives-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-video-archives-dev-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-video-archives-dev-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-video-archives-dev-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-video-archives-dev-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-video-archives-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-video-archives-stage" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-video-archives-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-video-archives-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "amp-video-archives-stage-eu" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-video-archives-stage-eu" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-video-archives-stage-eu.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-video-archives-stage-eu" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "ampd-da-s3-exports-test" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "ampd-da-s3-exports-test" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.ampd-da-s3-exports-test.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "ampd-da-s3-exports-test" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "ampd-os-manualsnapshots" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "ampd-os-manualsnapshots" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.ampd-os-manualsnapshots.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "ampd-os-manualsnapshots" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "cf-templates-1ek66qn24l08z-us-east-1" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "cf-templates-1ek66qn24l08z-us-east-1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.cf-templates-1ek66qn24l08z-us-east-1.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "cf-templates-1ek66qn24l08z-us-east-1" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "inspectornext-test" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "inspectornext-test" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.inspectornext-test.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "inspectornext-test" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "metadata-extract-request-sqs-payloads-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "metadata-extract-request-sqs-payloads-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.metadata-extract-request-sqs-payloads-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "metadata-extract-request-sqs-payloads-dev" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "metadata-extract-request-sqs-payloads-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "metadata-extract-request-sqs-payloads-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.metadata-extract-request-sqs-payloads-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "metadata-extract-request-sqs-payloads-stage" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "confidential" }) } module "sme-amp-asset-srv-d-vpc-flowlogs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-asset-srv-d-vpc-flowlogs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-asset-srv-d-vpc-flowlogs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-asset-srv-d-vpc-flowlogs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-asset-srv-s-vpc-flow-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-asset-srv-s-vpc-flow-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-asset-srv-s-vpc-flow-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-asset-srv-s-vpc-flow-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-d2-vpc-flowlogs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-d2-vpc-flowlogs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-d2-vpc-flowlogs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-d2-vpc-flowlogs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-awsconfig" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-awsconfig" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-awsconfig.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-awsconfig" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-db-team-lambda" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-db-team-lambda" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-db-team-lambda.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-db-team-lambda", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-amp-dev-es-backups" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-es-backups" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-es-backups.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-es-backups" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-eu-central-1-elb-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-eu-central-1-elb-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-eu-central-1-elb-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-eu-central-1-elb-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "sme-amp-dev-eu-central-1-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-eu-central-1-logs" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-eu-central-1-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-eu-central-1-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "sme-amp-dev-euc1-s3-inventory" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-euc1-s3-inventory" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-euc1-s3-inventory.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-euc1-s3-inventory" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-rds-backups" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-rds-backups" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-rds-backups.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-rds-backups", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-amp-dev-rds-backups-nv" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-rds-backups-nv" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-rds-backups-nv.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-rds-backups-nv" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-terraform-state-files" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-terraform-state-files" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-terraform-state-files.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-terraform-state-files" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-dev-us-east-1-logs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-us-east-1-logs" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-us-east-1-logs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-us-east-1-logs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "sme-amp-dev-use1-s3-inventory" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-use1-s3-inventory" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-use1-s3-inventory.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-use1-s3-inventory" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-amp-digarch-d-vpc-flowlogs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-digarch-d-vpc-flowlogs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-digarch-d-vpc-flowlogs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-digarch-d-vpc-flowlogs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "LOGGING" Classification = "internal-use-only" }) } module "sme-amp-digarch-s-vpc-flowlogs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-digarch-s-vpc-flowlogs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-digarch-s-vpc-flowlogs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-digarch-s-vpc-flowlogs" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "CLOUDOPS" Classification = "internal-use-only" }) } module "sme-netezza-aoma-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-netezza-aoma-dev" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-netezza-aoma-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-netezza-aoma-dev", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-amp-dev-archive-import" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-archive-import" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-archive-import.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-dev-archive-import", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-amp-stage-archive-import" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-stage-archive-import" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-us-east-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-stage-archive-import.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-amp-stage-archive-import", aws-migration-project-id = "MPE22602", Purpose = "APP-SUPPORT", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-ust-ci-transfer-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-ust-ci-transfer-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } lifecycle_rule = [ { id = "DeleteObjectsAfterOneDay" enabled = true expiration = { days = 1 } } ] server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-ust-ci-transfer-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-ust-ci-transfer-dev", aws-migration-project-id = "MPE22602", Purpose = "CLOUDOPS", map-migrated = "d-server-00jv2rbku5vpq0", Classification = "internal-use-only" }) } module "sme-ust-ci-transfer-stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-ust-ci-transfer-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } lifecycle_rule = [ { id = "DeleteObjectsAfterOneDay" enabled = true expiration = { days = 1 } } ] server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-ust-ci-transfer-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "sme-ust-ci-transfer-stage", aws-migration-project-id = "MPE22602", map-migrated = "d-server-00jv2rbku5vpq0", Purpose = "APP-SUPPORT", Classification = "internal-use-only" }) } module "amp-asset-catalog-transfer-dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-catalog-transfer-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } lifecycle_rule = [ { id = "DeleteObjectsAfterOneDay" enabled = true expiration = { days = 1 } } ] server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-catalog-transfer-dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "amp-asset-catalog-transfer-dev", aws-migration-project-id = "MPE22602", map-migrated = "d-server-00jv2rbku5vpq0", Purpose = "APP-SUPPORT", Classification = "internal-use-only" }) } module "aws-athena-query-results-eu-central-1-887829410671" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aws-athena-query-results-eu-central-1-887829410671" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy policy = data.aws_iam_policy_document.aws-athena-query-results-eu-central-1-887829410671.json attach_policy = var.attach_policy attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Name = "aws-athena-query-results-eu-central-1-887829410671", Purpose = "APP-SUPPORT", Classification = "internal-use-only" }) } module "amp-asset-usr-smej-d-ff" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-smej-d-ff" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-smej-d-ff.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "POST", "PUT"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = ["ETag", "Location"] max_age_seconds = 0 } ] tags = merge(var.s3_tags, { Name = "amp-asset-usr-smej-d-ff" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp-asset-usr-smej-s" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-usr-smej-s" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp-asset-usr-smej-s.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "POST", "PUT"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = ["ETag", "Location"] max_age_seconds = 0 } ] tags = merge(var.s3_tags, { Name = "amp-asset-usr-smej-s" aws-migration-project-id = "MPE22602" map-migrated = "d-server-00jv2rbku5vpq0" Purpose = "APP-SUPPORT" Classification = "internal-use-only" }) } module "amp_asset_repo_dvdddp_0001_stage" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-dvdddp-0001-stage" providers = { aws = aws.eu-central-1 } logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" force_destroy = null attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp_asset_repo_dvdddp_0001_stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Purpose = "APP-SUPPORT", Classification = "internal-use-only", Name = "amp-asset-repo-dvdddp-0001-stage", aws-migration-project-id = "MPE22602", map-migrated = "d-server-00jv2rbku5vpq0" }) } module "amp_asset_repo_dvdddp_0001_dev" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-asset-repo-dvdddp-0001-dev" providers = { aws = aws.eu-central-1 } logging = { target_bucket = "sme-amp-dev-eu-central-1-logs" target_prefix = "sme-amp-dev/" } block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" force_destroy = null attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp_asset_repo_dvdddp_0001_dev.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Purpose = "APP-SUPPORT", Classification = "internal-use-only", Name = "amp-asset-repo-dvdddp-0001-dev", aws-migration-project-id = "MPE22602", map-migrated = "d-server-00jv2rbku5vpq0" }) } module "amp_archives_uslatin_stage_test" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "amp-archives-uslatin-stage-test" providers = { aws = aws } block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" force_destroy = null attach_policy = var.attach_policy policy = data.aws_iam_policy_document.amp_archives_uslatin_stage_test.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Purpose = "APP-SUPPORT", Classification = "internal-use-only", Name = "amp-archives-uslatin-stage-test", }) } module "sme-amp-da-openobserve" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-da-openobserve" versioning = { status = "Disabled" } server_side_encryption_configuration = { rule = { bucket_key_enabled = true apply_server_side_encryption_by_default = { kms_master_key_id = "" sse_algorithm = "AES256" } } } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy attach_policy = false attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Purpose = "APP-SUPPORT", Classification = "internal-use-only", Name = "sme-amp-da-openobserve", }) } module "sme-amp-dev-cs" { #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-amp-dev-cs" versioning = { status = "Disabled" } server_side_encryption_configuration = { rule = { bucket_key_enabled = true apply_server_side_encryption_by_default = { kms_master_key_id = "" sse_algorithm = "AES256" } } } lifecycle_rule = [ { id = "expire-objects-14-days" enabled = true expiration = { days = 14 } } ] object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-amp-dev-cs.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.s3_tags, { Purpose = "APP-SUPPORT", Classification = "internal-use-only", Name = "sme-amp-dev-cs", }) }