make bucket names configurable and cleanup

Author: rudransh-shrivastava

infrastructure/backend/main.tf

@@ -73,13 +73,23 @@ resource "aws_dynamodb_table" "state_lock" {
 
 resource "aws_s3_bucket" "logs" { # NOSONAR
   bucket = "${var.project_name}-terraform-state-logs-${random_id.suffix.hex}"
+
+  lifecycle {
+    prevent_destroy = true
+  }
   tags = {
     Name = "${var.project_name}-terraform-state-logs"
   }
 }
 
 resource "aws_s3_bucket" "state" { # NOSONAR
-  bucket = "${var.project_name}-terraform-state-${random_id.suffix.hex}"
+  bucket              = "${var.project_name}-terraform-state-${random_id.suffix.hex}"
+  object_lock_enabled = true
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
   tags = {
     Name = "${var.project_name}-terraform-state"
   }
@@ -123,6 +133,17 @@ resource "aws_s3_bucket_logging" "state" {
   target_prefix = "s3/"
 }
 
+resource "aws_s3_bucket_object_lock_configuration" "state" {
+  bucket = aws_s3_bucket.state.id
+
+  rule {
+    default_retention {
+      mode = "GOVERNANCE"
+      days = 30
+    }
+  }
+}
+
 resource "aws_s3_bucket_policy" "logs" {
   bucket = aws_s3_bucket.logs.id
   policy = data.aws_iam_policy_document.logs.json
@@ -169,6 +190,7 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "state" {
 
 resource "aws_s3_bucket_versioning" "state" {
   bucket = aws_s3_bucket.state.id
+
   versioning_configuration {
     status = "Enabled"
   }

infrastructure/modules/ecs/main.tf

@@ -217,7 +217,7 @@ module "load_data_task" {
     set -e
     pip install --target=/tmp/awscli-packages awscli
     export PYTHONPATH="/tmp/awscli-packages:$PYTHONPATH"
-    python /tmp/awscli-packages/bin/aws s3 cp s3://${var.fixtures_s3_bucket}/nest.json.gz /tmp/nest.json.gz
+    python /tmp/awscli-packages/bin/aws s3 cp s3://${var.fixtures_bucket_name}/nest.json.gz /tmp/nest.json.gz
     python manage.py load_data --fixture-path /tmp/nest.json.gz
     EOT
   ]

infrastructure/modules/ecs/variables.tf

@@ -30,7 +30,7 @@ variable "fixtures_read_only_policy_arn" {
   type        = string
 }
 
-variable "fixtures_s3_bucket" {
+variable "fixtures_bucket_name" {
   description = "The name of the S3 bucket for fixtures"
   type        = string
 }

infrastructure/modules/storage/main.tf

@@ -5,6 +5,10 @@ terraform {
       source  = "hashicorp/aws"
       version = "6.22.0"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.7.2"
+    }
   }
 }
 
@@ -15,15 +19,19 @@ data "aws_iam_policy_document" "fixtures_read_only" {
     ]
     effect = "Allow"
     resources = [
-      "arn:aws:s3:::${var.fixtures_s3_bucket}/*"
+      "arn:aws:s3:::${var.fixtures_bucket_name}-${random_id.suffix.hex}/*"
     ]
   }
 }
 
+resource "random_id" "suffix" {
+  byte_length = 4
+}
+
 module "fixtures_bucket" {
   source = "./modules/s3-bucket"
 
-  bucket_name   = var.fixtures_s3_bucket
+  bucket_name   = "${var.fixtures_bucket_name}-${random_id.suffix.hex}"
   force_destroy = var.force_destroy_bucket
   tags = merge(var.common_tags, {
     Name = "${var.project_name}-${var.environment}-fixtures"
@@ -33,7 +41,7 @@ module "fixtures_bucket" {
 module "zappa_bucket" {
   source = "./modules/s3-bucket"
 
-  bucket_name   = var.zappa_s3_bucket
+  bucket_name   = "${var.zappa_bucket_name}-${random_id.suffix.hex}"
   force_destroy = var.force_destroy_bucket
   tags = merge(var.common_tags, {
     Name = "${var.project_name}-${var.environment}-zappa-deployments"

infrastructure/modules/storage/modules/s3-bucket/main.tf

@@ -35,10 +35,14 @@ data "aws_iam_policy_document" "this" {
   }
 }
 
-resource "aws_s3_bucket" "this" { #NOSONAR
+resource "aws_s3_bucket" "this" { # NOSONAR
   bucket        = var.bucket_name
   force_destroy = var.force_destroy
   tags          = var.tags
+
+  lifecycle {
+    prevent_destroy = true
+  }
 }
 
 resource "aws_s3_bucket_policy" "this" {

infrastructure/modules/storage/modules/s3-bucket/variables.tf

@@ -16,7 +16,7 @@ variable "force_destroy" {
 }
 
 variable "noncurrent_version_expiration_days" {
-  description = "Specifies the number of days an object is noncurrent before it is expired."
+  description = "The number of days an object is noncurrent before it is expired."
   type        = number
   default     = 30
 }

infrastructure/modules/storage/variables.tf

@@ -9,7 +9,7 @@ variable "environment" {
   type        = string
 }
 
-variable "fixtures_s3_bucket" {
+variable "fixtures_bucket_name" {
   description = "The name of the S3 bucket for fixtures"
   type        = string
 }
@@ -25,7 +25,7 @@ variable "project_name" {
   type        = string
 }
 
-variable "zappa_s3_bucket" {
+variable "zappa_bucket_name" {
   description = "The name of the S3 bucket for Zappa deployments"
   type        = string
 }

infrastructure/staging/main.tf

@@ -60,7 +60,7 @@ module "ecs" {
   ecs_sg_id                     = module.security.ecs_sg_id
   environment                   = var.environment
   fixtures_read_only_policy_arn = module.storage.fixtures_read_only_policy_arn
-  fixtures_s3_bucket            = var.fixtures_s3_bucket
+  fixtures_bucket_name          = var.fixtures_bucket_name
   private_subnet_ids            = module.networking.private_subnet_ids
   project_name                  = var.project_name
 }
@@ -109,8 +109,8 @@ module "storage" {
 
   common_tags          = local.common_tags
   environment          = var.environment
-  fixtures_s3_bucket   = var.fixtures_s3_bucket
+  fixtures_bucket_name = var.fixtures_bucket_name
   force_destroy_bucket = var.force_destroy_bucket
   project_name         = var.project_name
-  zappa_s3_bucket      = var.zappa_s3_bucket
+  zappa_bucket_name    = var.zappa_bucket_name
 }

infrastructure/staging/variables.tf

@@ -87,10 +87,10 @@ variable "force_destroy_bucket" {
   default     = false
 }
 
-variable "fixtures_s3_bucket" {
+variable "fixtures_bucket_name" {
   description = "The name of the S3 bucket for fixtures"
   type        = string
-  default     = "nest-fixtures"
+  default     = "owasp-nest-fixtures"
 }
 
 variable "private_subnet_cidrs" {
@@ -141,7 +141,7 @@ variable "vpc_cidr" {
   default     = "10.0.0.0/16"
 }
 
-variable "zappa_s3_bucket" {
+variable "zappa_bucket_name" {
   description = "The name of the S3 bucket for Zappa deployments"
   type        = string
   default     = "owasp-nest-zappa-deployments"