Changes from upstream
Compared to terraform-aws-modules/s3-bucket/aws@5.16.2, this version has 5 variable changes and 0 resource changes.
Your code impact
If you are migrating from the upstream module, review each change below before you switch. A changed default applies only where your configuration does not set that variable; values you set keep taking effect.
Defaults changed 5
- attach_policyupstream false, compliance.tf trueThis control checks whether the S3 bucket policy prevents principals from other AWS accounts from performing denied actions on resources in the S3 bucket.Control s3_bucket_policy_restricts_cross_account_permission_changes
- object_lock_enabledupstream false, compliance.tf trueEnsure that your AWS Simple Storage Service (AWS S3) bucket has lock enabled, by default.Control s3_bucket_object_lock_enabled
- policyupstream null, compliance.tf "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"DenyCrossAccountPermissionChanges\",\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":[\"s3:DeleteBucketPolicy\",\"s3:PutBucketAcl\",\"s3:PutBucketPolicy\",\"s3:PutBucketPublicAccessBlock\",\"s3:PutEncryptionConfiguration\",\"s3:PutObjectAcl\"],\"Resource\":[\"_S3_BUCKET_ARN_\",\"_S3_BUCKET_ARN_/*\"],\"Condition\":{\"StringNotEquals\":{\"aws:PrincipalAccount\":[\"_AWS_ACCOUNT_ID_\"]}}}]}"Default differs from upstream
- server_side_encryption_configurationupstream {}, compliance.tf {"rule":{"apply_server_side_encryption_by_default":{"sse_algorithm":"aws:kms"}}}To help protect data at rest, ensure encryption is enabled for your AWS Simple Storage Service (AWS S3) buckets.Control s3_bucket_default_encryption_enabled_kms
- versioningupstream {}, compliance.tf {"mfa_delete":"Enabled"}Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.Control s3_bucket_mfa_delete_enabled