terraform { required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } } } resource "aws_s3_bucket" "assets" { bucket = "${var.project}-assets-${var.environment}" } resource "aws_s3_bucket_versioning" "assets" { bucket = aws_s3_bucket.assets.id versioning_configuration { status = "Enabled" } } resource "aws_s3_bucket_public_access_block" "assets" { bucket = aws_s3_bucket.assets.id block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } resource "aws_s3_bucket_server_side_encryption_configuration" "assets" { bucket = aws_s3_bucket.assets.id rule { apply_server_side_encryption_by_default { sse_algorithm = "aws:kms" kms_master_key_id = aws_kms_key.s3.arn } } } resource "aws_s3_bucket_logging" "assets" { bucket = aws_s3_bucket.assets.id target_bucket = aws_s3_bucket.logs.id target_prefix = "s3-access-logs/" } resource "aws_kms_key" "s3" { description = "KMS key for S3 encryption" deletion_window_in_days = 30 enable_key_rotation = true }