diff --git a/examples/object/README.md b/examples/object/README.md index b757070..f0b162e 100644 --- a/examples/object/README.md +++ b/examples/object/README.md @@ -37,6 +37,7 @@ Note that this example may create resources which cost money. Run `terraform des | [object](#module\_object) | ../../modules/object | n/a | | [object\_complete](#module\_object\_complete) | ../../modules/object | n/a | | [object\_locked](#module\_object\_locked) | ../../modules/object | n/a | +| [object\_with\_override\_default\_tags](#module\_object\_with\_override\_default\_tags) | ../../modules/object | n/a | | [s3\_bucket](#module\_s3\_bucket) | ../../ | n/a | | [s3\_bucket\_with\_object\_lock](#module\_s3\_bucket\_with\_object\_lock) | ../../ | n/a | diff --git a/examples/object/main.tf b/examples/object/main.tf index a034b34..e6a192e 100644 --- a/examples/object/main.tf +++ b/examples/object/main.tf @@ -5,6 +5,12 @@ provider "aws" { skip_metadata_api_check = true skip_region_validation = true skip_credentials_validation = true + + default_tags { + tags = { + Example = "object" + } + } } locals { @@ -25,6 +31,7 @@ module "object" { Sensitive = "not-really" } } + module "object_complete" { source = "../../modules/object" @@ -33,7 +40,7 @@ module "object_complete" { content = jsonencode({ data : "value" }) - acl = "public-read" + # acl = "public-read" storage_class = "ONEZONE_IA" force_destroy = true @@ -68,6 +75,21 @@ module "object_locked" { object_lock_retain_until_date = formatdate("YYYY-MM-DD'T'hh:00:00Z", timeadd(timestamp(), "1h")) # some time in the future } +module "object_with_override_default_tags" { + source = "../../modules/object" + + bucket = module.s3_bucket.s3_bucket_id + key = "${random_pet.this.id}-local-override-default-tags" + + override_default_tags = true + + file_source = "README.md" + + tags = { + Override = "true" + } +} + ################## # Extra resources ################## @@ -96,7 +118,13 @@ module "s3_bucket_with_object_lock" { bucket = "${random_pet.this.id}-with-object-lock" force_destroy = true + object_lock_enabled = true object_lock_configuration = { - object_lock_enabled = "Enabled" + rule = { + default_retention = { + mode = "GOVERNANCE" + days = 1 + } + } } } diff --git a/modules/object/README.md b/modules/object/README.md index 4f02b57..5f41e71 100644 --- a/modules/object/README.md +++ b/modules/object/README.md @@ -8,13 +8,13 @@ Creates S3 bucket objects with different configurations. | Name | Version | |------|---------| | [terraform](#requirement\_terraform) | >= 1.0 | -| [aws](#requirement\_aws) | >= 3.75 | +| [aws](#requirement\_aws) | >= 5.24 | ## Providers | Name | Version | |------|---------| -| [aws](#provider\_aws) | >= 3.75 | +| [aws](#provider\_aws) | >= 5.24 | ## Modules @@ -50,6 +50,7 @@ No modules. | [object\_lock\_legal\_hold\_status](#input\_object\_lock\_legal\_hold\_status) | The legal hold status that you want to apply to the specified object. Valid values are ON and OFF. | `string` | `null` | no | | [object\_lock\_mode](#input\_object\_lock\_mode) | The object lock retention mode that you want to apply to this object. Valid values are GOVERNANCE and COMPLIANCE. | `string` | `null` | no | | [object\_lock\_retain\_until\_date](#input\_object\_lock\_retain\_until\_date) | The date and time, in RFC3339 format, when this object's object lock will expire. | `string` | `null` | no | +| [override\_default\_tags](#input\_override\_default\_tags) | Ignore provider default\_tags. S3 objects support a maximum of 10 tags. | `bool` | `false` | no | | [server\_side\_encryption](#input\_server\_side\_encryption) | Specifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms". | `string` | `null` | no | | [source\_hash](#input\_source\_hash) | Triggers updates like etag but useful to address etag encryption limitations. Set using filemd5("path/to/source") (Terraform 0.11.12 or later). (The value is only stored in state and not saved by AWS.) | `string` | `null` | no | | [storage\_class](#input\_storage\_class) | Specifies the desired Storage Class for the object. Can be either STANDARD, REDUCED\_REDUNDANCY, ONEZONE\_IA, INTELLIGENT\_TIERING, GLACIER, DEEP\_ARCHIVE, or STANDARD\_IA. Defaults to STANDARD. | `string` | `null` | no | diff --git a/modules/object/main.tf b/modules/object/main.tf index a1eecef..cc8ae6d 100644 --- a/modules/object/main.tf +++ b/modules/object/main.tf @@ -33,6 +33,16 @@ resource "aws_s3_object" "this" { tags = var.tags + dynamic "override_provider" { + for_each = var.override_default_tags ? [true] : [] + + content { + default_tags { + tags = {} + } + } + } + lifecycle { ignore_changes = [object_lock_retain_until_date] } diff --git a/modules/object/variables.tf b/modules/object/variables.tf index 6f07f39..44d1273 100644 --- a/modules/object/variables.tf +++ b/modules/object/variables.tf @@ -147,3 +147,9 @@ variable "source_hash" { type = string default = null } + +variable "override_default_tags" { + description = "Ignore provider default_tags. S3 objects support a maximum of 10 tags." + type = bool + default = false +} diff --git a/modules/object/versions.tf b/modules/object/versions.tf index 3ff4969..a9c2eed 100644 --- a/modules/object/versions.tf +++ b/modules/object/versions.tf @@ -4,7 +4,7 @@ terraform { required_providers { aws = { source = "hashicorp/aws" - version = ">= 3.75" + version = ">= 5.24" } } } diff --git a/wrappers/object/main.tf b/wrappers/object/main.tf index e9fb896..c9d408a 100644 --- a/wrappers/object/main.tf +++ b/wrappers/object/main.tf @@ -23,6 +23,7 @@ module "wrapper" { object_lock_legal_hold_status = try(each.value.object_lock_legal_hold_status, var.defaults.object_lock_legal_hold_status, null) object_lock_mode = try(each.value.object_lock_mode, var.defaults.object_lock_mode, null) object_lock_retain_until_date = try(each.value.object_lock_retain_until_date, var.defaults.object_lock_retain_until_date, null) + override_default_tags = try(each.value.override_default_tags, var.defaults.override_default_tags, false) server_side_encryption = try(each.value.server_side_encryption, var.defaults.server_side_encryption, null) source_hash = try(each.value.source_hash, var.defaults.source_hash, null) storage_class = try(each.value.storage_class, var.defaults.storage_class, null)