module "aoma-core-elb-logs" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aoma-core-elb-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.aoma-core-elb-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "aoma-core-elb-logs" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS " }) } module "aoma-d1-vpc-flow-logs" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aoma-d1-vpc-flow-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.aoma-d1-vpc-flow-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "aoma-d1-vpc-flow-logs" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS " }) } module "aoma-s1-vpc-flow-logs" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aoma-s1-vpc-flow-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.aoma-s1-vpc-flow-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "aoma-s1-vpc-flow-logs" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS " }) } module "athena-graphql-output" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "athena-graphql-output" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.athena-graphql-output.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "athena-graphql-output" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "athena-ui-test-bucket" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "athena-ui-test-bucket" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.athena-ui-test-bucket.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "athena-ui-test-bucket" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "Classification" = "internal-use-only", "map-migrated" = "migKNBMDMW06I" "Purpose" = "CLOUDOPS" }) } module "email-notification-attachment" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "email-notification-attachment" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.email-notification-attachment.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "email-notification-attachment" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-aoma-audit" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-aoma-audit" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-aoma-audit.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-aoma-audit" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-aoma-reports-dev" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-aoma-reports-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-aoma-reports-dev.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-aoma-reports-dev" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-aoma-reports-stage" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-aoma-reports-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-aoma-reports-stage.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-aoma-reports-stage" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-athena-out" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-athena-out" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-athena-out.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-athena-out" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-awsconfig" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-awsconfig" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-awsconfig.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-awsconfig" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-db-team-lambda" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-db-team-lambda" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-db-team-lambda.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-db-team-lambda" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-euc1-s3-inventory" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-euc1-s3-inventory" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-euc1-s3-inventory.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-euc1-s3-inventory" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-ff-s3-logs" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-ff-s3-logs" versioning = { enabled = true } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-ff-s3-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-ff-s3-logs" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "LOGGING" }) } module "sme-aoma-core-dev-quicksight" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-quicksight" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-quicksight.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-quicksight" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-rough-cuts-data-dev" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-rough-cuts-data-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-rough-cuts-data-dev.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-rough-cuts-data-dev" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "d-server-021njhd9xa37is" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "sme-aoma-core-dev-rds-backups" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-rds-backups" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-rds-backups.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-rds-backups" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-ssm-out" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-ssm-out" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-ssm-out.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-ssm-out" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-ssm-output" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-ssm-output" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-ssm-output.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-ssm-output" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-dev-terraform-state-files" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-terraform-state-files" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-terraform-state-files" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-txmgr-dev-artifact" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-txmgr-dev-artifact" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-txmgr-dev-artifact.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-txmgr-dev-artifact" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-txmgr-metadata-import-dev-processed" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-txmgr-metadata-import-dev-processed" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-txmgr-metadata-import-dev-processed.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-txmgr-metadata-import-dev-processed" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-txmgr-metadata-import-stage-ora-processed" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-txmgr-metadata-import-stage-ora-processed" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-txmgr-metadata-import-stage-ora-processed.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-txmgr-metadata-import-stage-ora-processed" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-txmgr-metadata-import-stage-pg-processed" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-txmgr-metadata-import-stage-pg-processed" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-txmgr-metadata-import-stage-pg-processed.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-txmgr-metadata-import-stage-pg-processed" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-txmgr-metadata-import-stage-processed" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-txmgr-metadata-import-stage-processed" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-txmgr-metadata-import-stage-processed.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-txmgr-metadata-import-stage-processed" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-ust-dev" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-ust-dev" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-ust-dev.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-ust-dev" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-ust-stage" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-ust-stage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-ust-stage.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-ust-stage" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-stand-backup" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-stand-backup" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-stand-backup.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-stand-backup" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "ust-bulk-script-processes" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "ust-bulk-script-processes" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.ust-bulk-script-processes.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "ust-bulk-script-processes" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "sme-aoma-core-dev-betabase-d-vpc-flow-logs" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-betabase-d-vpc-flow-logs" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-betabase-d-vpc-flow-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-betabase-d-vpc-flow-logs" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "arvatok8s-dev-elasticsearch-backup" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "arvatok8s-dev-elasticsearch-backup" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.arvatok8s-dev-elasticsearch-backup.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "arvatok8s-dev-elasticsearch-backup" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "arvatok8s-stage-elasticsearch-backup" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "arvatok8s-stage-elasticsearch-backup" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.arvatok8s-stage-elasticsearch-backup.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "arvatok8s-stage-elasticsearch-backup" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT " }) } module "sme-aoma-core-dev-aoma3-workbench-test" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-aoma3-workbench-test" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-aoma3-workbench-test.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-aoma3-workbench-test" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "aoma-envelope-frontend-uat-ui" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aoma-envelope-frontend-uat-ui" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.aoma-envelope-frontend-uat-ui.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "aoma-envelope-frontend-uat-ui" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT " }) } module "aoma-envelope-frontend-ui" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "aoma-envelope-frontend-ui" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.aoma-envelope-frontend-ui.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "aoma-envelope-frontend-ui" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT " }) } module "file-logo-bucket" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "file-logo-bucket" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "file-logo-bucket" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "sme-aoma-core-dev-kafka-events" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-kafka-events" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = { rule = { bucket_key_enabled = true apply_server_side_encryption_by_default = { kms_master_key_id = "" sse_algorithm = "AES256" } } } logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-kafka-events.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-kafka-events" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } # module "sme-aoma-core-storage-gateway-poc" { # source = "terraform-aws-modules/s3-bucket/aws" # version = "~> 3.11.0" # bucket = "sme-aoma-core-storage-gateway-poc" # versioning = { # enabled = false # } # providers = { # aws = aws.eu-central-1 # } # server_side_encryption_configuration = var.server_side_encryption_configuration # logging = { # target_bucket = "sme-aoma-core-dev-ff-s3-logs" # target_prefix = "sme-aoma-core-storage-gateway-poc/" # } # object_ownership = "BucketOwnerEnforced" # block_public_acls = var.block_public_acls # ignore_public_acls = var.ignore_public_acls # restrict_public_buckets = var.restrict_public_buckets # block_public_policy = var.block_public_policy # force_destroy = var.force_destroy # attach_policy = false # attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy # attach_require_latest_tls_policy = var.attach_require_latest_tls_policy # tags = merge(var.tags, # { # "Name" = "sme-aoma-core-storage-gateway-poc" # "Project-Name" = "AOMA-Core", # "Project-Code" = "SME-2000-0306A", # "Owner" = "nathaniel.lovett@sonymusic.com", # "Environment" = "Dev", # "Terraform" = "True", # "Business-Unit" = "SME-AOMA-Core", # "map-migrated" = "migKNBMDMW06I" # "Classification" = "internal-use-only", # "Purpose" = "APP-SUPPORT" # }) # } module "sme-aoma-core-storage-gateway" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-storage-gateway" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-core-storage-gateway" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "sme-core-aoma-dev-file-storage" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-core-aoma-dev-file-storage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-core-aoma-dev-file-storage.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-core-aoma-dev-file-storage" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-core-aoma-uat-file-storage" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-core-aoma-uat-file-storage" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-core-aoma-uat-file-storage.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-core-aoma-uat-file-storage" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-py-spectro" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-py-spectro" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-py-spectro.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-py-spectro" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "APP-SUPPORT" }) } module "sme-aoma-core-dev-dw" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-dw" providers = { aws = aws.eu-central-1 } versioning = { enabled = false } logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-dev-dw.json block_public_acls = var.block_public_acls block_public_policy = var.block_public_policy ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy server_side_encryption_configuration = var.server_side_encryption_configuration tags = merge(var.tags, { "Name" = "sme-aoma-core-dev-dw" "Project-Name" = "AOMA-Core" "Project-Code" = "SME-2000-0306A" "Owner" = "nathaniel.lovett@sonymusic.com" "Environment" = "Dev" "Business-Unit" = "SME-AOMA-Core" "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only" "Purpose" = "CLOUDOPS" }) } module "sme_aoma_core_dev_historical_data" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-core-dev-historical-data" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy #policy = data.aws_iam_policy_document.sme_aoma_core_dev_historical_data.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { Name = "sme-aoma-core-dev-historical-data" Project-Name = "AOMA-Core" Project-Code = "SME-2000-0306A" Owner = "nathaniel.lovett@sonymusic.com" Environment = "Dev" Terraform = "True" Business-Unit = "SME-AOMA-Core" map-migrated = "migKNBMDMW06I" Classification = "internal-use-only" Purpose = "APP-SUPPORT" }) } module "sme-aoma-da-test" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-aoma-da-test" versioning = { enabled = false } providers = { aws = aws.eu-central-1 } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-da-test.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { "Name" = "sme-aoma-da-test" "Project-Name" = "AOMA-Core", "Project-Code" = "SME-2000-0306A", "Owner" = "nathaniel.lovett@sonymusic.com", "Environment" = "Dev", "Terraform" = "True", "Business-Unit" = "SME-AOMA-Core", "map-migrated" = "migKNBMDMW06I" "Classification" = "internal-use-only", "Purpose" = "CLOUDOPS" }) } module "sme-aoma-core-storage-gateway-stage" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" providers = { aws = aws.eu-central-1 } bucket = "sme-aoma-core-storage-gateway-stage" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-storage-gateway-stage.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { Name = "sme-aoma-core-storage-gateway-stage" Purpose = "APP-SUPPORT" }) } module "sme-aoma-core-storage-gateway-dev-aws" { # checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads # checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled # checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest # checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" providers = { aws = aws.eu-central-1 } bucket = "sme-aoma-core-storage-gateway-dev-aws" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-aoma-core-dev-ff-s3-logs" target_prefix = "sme-aoma-core-dev/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-aoma-core-storage-gateway-dev-aws.json attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = merge(var.tags, { Name = "sme-aoma-core-storage-gateway-dev-aws" Purpose = "APP-SUPPORT" }) }