module "msrv-p-vpc-flow-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "msrv-p-vpc-flow-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.msrv-p-vpc-flow-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "msrv-p-vpc-flow-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "msrvp-release-access-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "msrvp-release-access-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.msrvp-release-access-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "msrvp-release-access-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "msrvp-akamai-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "msrvp-akamai-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "msrvp-akamai-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "msrvp-virginia-alb-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "msrvp-virginia-alb-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.msrvp-virginia-alb-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "msrvp-virginia-alb-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "s3-mirror-source-dev" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "s3-mirror-source-dev" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.s3-mirror-source-dev.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "s3-mirror-source-dev" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-cf-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-cf-logs" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-cf-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-cf-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "sme-media-service-rs-dw-01" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-service-rs-dw-01" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-service-rs-dw-01.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-media-service-rs-dw-01" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-media-services-prod-athena-out" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-athena-out" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-athena-out.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "Delivery-Media-Services" Environment = "Prod" Name = "sme-media-services-prod-athena-out" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "sme-media-services-prod-awsconfig" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-awsconfig" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-awsconfig.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-media-services-prod-awsconfig" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "sme-media-services-prod-rds-backups" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-rds-backups" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-rds-backups.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Name = "sme-media-services-prod-rds-backups" Classification = "internal-use-only" Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-media-services-prod-ssm-out" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-ssm-out" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-ssm-out.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-media-services-prod-ssm-out" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" } } module "sme-media-services-prod-us-east-1-logs" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-us-east-1-logs" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-us-east-1-logs.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-media-services-prod-us-east-1-logs" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" USE = "LOGGING" Classification = "internal-use-only" Terraform = "True" Purpose = "LOGGING" } } module "sme-media-services-prod-use1-s3-inventory" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-media-services-prod-use1-s3-inventory" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-media-services-prod-use1-s3-inventory.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "Delivery-Media-Services" Environment = "Prod" Name = "sme-media-services-prod-use1-s3-inventory" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "CLOUDOPS" Owner = "Robert Dewilder" } } module "sme-mps-datastore" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-mps-datastore" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-mps-datastore" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-msrvp-redshift-use1" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV2_AWS_61: Ensure that an S3 bucket has a lifecycle configuration #checkov:skip=CKV2_AWS_6: Ensure that S3 bucket has a Public Access block #checkov:skip=CKV_AWS_18: Ensure the S3 bucket has access logging enabled #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-msrvp-redshift-use1" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-msrvp-redshift-use1.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-msrvp-redshift-use1" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-amp" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-amp" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "denyInsecureTransport" Effect = "Deny" Principal = "*" Action = "s3:*" Resource = [ "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp", ] Condition = { Bool = { "aws:SecureTransport" = "false" } } }, { Sid = "1" Effect = "Allow" Principal = { AWS = [ "arn:aws:iam::638682502729:role/mcp-batch-ecs-task-role", "arn:aws:iam::505950216627:role/ecsInstanceRole", "arn:aws:iam::613871678587:role/asset-preview-service-mediaconvert-prod", "arn:aws:iam::505950216627:role/promop-mcon-s3-role", "arn:aws:iam::505950216627:role/ecs-service-role", "arn:aws:iam::361463692799:role/lambda_python_execution", "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E352NHIFSBHPFR", "arn:aws:iam::554998489284:role/eks-sa-da-cs-handler-prod", "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01", "arn:aws:iam::361463692799:user/msrvp-aoma-origin-amp-dx3", "arn:aws:iam::638682502729:role/ecsInstanceRole", "arn:aws:iam::638682502729:role/AWSBatchServiceRole", "arn:aws:iam::638682502729:role/mconp-del-s3-source-target", "arn:aws:iam::554998489284:user/da-contact-sheet-app", "arn:aws:iam::361463692799:user/msrvp-ampp-origin-s3", ] } Action = [ "s3:PutObjectTagging", "s3:PutObject", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject", ] Resource = [ "arn:aws:s3:::sme-origin-amp/prod/*", "arn:aws:s3:::sme-origin-amp", ] }, { Sid = "2" Effect = "Allow" Principal = { AWS = [ "arn:aws:iam::130080192946:role/msrvd-msrvd2-report1b01", "arn:aws:iam::361463692799:user/msrvp-aoma-origin-amp-dx3", ] } Action = [ "s3:PutObjectTagging", "s3:PutObject", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject", ] Resource = [ "arn:aws:s3:::sme-origin-amp/*", "arn:aws:s3:::sme-origin-amp", ] }, ] }) attach_deny_insecure_transport_policy = false attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-amp" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-central" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-central" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-central.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-central" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-digex" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-digex" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-digex.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-digex" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-dx3" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-dx3" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-dx3.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-dx3" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-medialib" { #checkov:skip=CKV2_AWS_65: Ensure access control lists for S3 buckets are disabled #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-medialib" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerPreferred" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-medialib.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-medialib" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-misc" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-misc" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-misc.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-misc" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "sme-origin-promommx" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "sme-origin-promommx" versioning = { enabled = false } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.sme-origin-promommx.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy cors_rule = [ { allowed_methods = ["GET", "HEAD"] allowed_origins = ["*"] allowed_headers = ["*"] expose_headers = null max_age_seconds = 0 } ] tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "sme-origin-promommx" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "ssrv-index-backup" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "ssrv-index-backup" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = var.block_public_acls ignore_public_acls = var.ignore_public_acls restrict_public_buckets = var.restrict_public_buckets block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = var.attach_policy policy = data.aws_iam_policy_document.ssrv-index-backup.json attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "ssrv-index-backup" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "True" Purpose = "APP-SUPPORT" } } module "origin_library" { #checkov:skip=CKV_AWS_21: Ensure all data stored in the S3 bucket have versioning enabled #checkov:skip=CKV_AWS_145: Ensure that S3 buckets are encrypted with KMS by default #checkov:skip=CKV_AWS_19: Ensure all data stored in the S3 bucket is securely encrypted at rest #checkov:skip=CKV2_AWS_6: Ensure that S3 bucket has a Public Access block #checkov:skip=CKV_AWS_55: Ensure S3 bucket has ignore public ACLs enabled #checkov:skip=CKV_AWS_53: Ensure S3 bucket has block public ACLS enabled #checkov:skip=CKV_AWS_56: Ensure S3 bucket has 'restrict_public_buckets' enabled #checkov:skip=CKV_AWS_300: Ensure S3 lifecycle configuration sets period for aborting failed uploads source = "terraform-aws-modules/s3-bucket/aws" version = "~> 3.11.0" bucket = "origin.library" versioning = { enabled = true } server_side_encryption_configuration = var.server_side_encryption_configuration logging = { target_bucket = "sme-media-services-prod-us-east-1-logs" target_prefix = "sme-media-services-prod/" } object_ownership = "BucketOwnerEnforced" object_lock_enabled = false block_public_acls = false ignore_public_acls = false restrict_public_buckets = false block_public_policy = var.block_public_policy force_destroy = var.force_destroy attach_policy = false attach_deny_insecure_transport_policy = var.attach_deny_insecure_transport_policy attach_require_latest_tls_policy = var.attach_require_latest_tls_policy tags = { Business-Unit = "DeliveryMedia-Services" Environment = "Prod" Name = "origin.library" Owner = "Robert Dewilder" Project-Code = "SME-2000-0306G" Project-Name = "Delivery-Media-Services" Classification = "internal-use-only" Terraform = "False" Purpose = "APP-SUPPORT" } }