Set by controls 12

Active controls fix these values.

• attach_policybool, set to trueControls if S3 bucket should have bucket policy attached (set to true to use value of policy as bucket policy)
• block_public_aclsbool, set to trueWhether Amazon S3 should block public ACLs for this bucket
• block_public_policybool, set to trueWhether Amazon S3 should block public bucket policies for this bucket
• ignore_public_aclsbool, set to trueWhether Amazon S3 should ignore public ACLs for this bucket
• lifecycle_rulelist({...}), set to []Object lifecycle management rules for the bucket
• loggingobject({...}), set to nullAccess log delivery configuration for the bucket
• object_lock_enabledbool, set to trueWhether S3 bucket should have an Object Lock configuration enabled
• object_ownershipstring, set to "BucketOwnerEnforced"Object ownership. Valid values: BucketOwnerEnforced, BucketOwnerPreferred or ObjectWriter. BucketOwnerEnforced: ACLs are disabled, and the bucket owner automatically owns and has full control over every object in the bucket. BucketOwnerPreferred: Objects uploaded to the bucket change ownership to the bucket owner if the objects are uploaded with the bucket-owner-full-control canned ACL. ObjectWriter: The uploading account will own the object if the object is uploaded with the bucket-owner-full-control canned ACL
• replication_configurationobject({...}), set to {}Cross-region replication configuration for the bucket
• restrict_public_bucketsbool, set to trueWhether Amazon S3 should restrict public bucket policies for this bucket
• server_side_encryption_configurationobject({...}), set to {...}Server-side encryption configuration for the bucket
• versioningmap(string), set to {"mfa_delete":"Enabled"}Versioning configuration for the bucket

Optional 60

• acceleration_statusstring, default nullSets the accelerate configuration of an existing bucket. Can be Enabled or Suspended
• access_log_delivery_policy_source_accountslist(string), default []List of AWS Account IDs should be allowed to deliver access logs to this bucket
• access_log_delivery_policy_source_bucketslist(string), default []List of S3 bucket ARNs which should be allowed to deliver access logs to this bucket
• access_log_delivery_policy_source_organizationslist(string), default []List of AWS Organization IDs should be allowed to deliver access logs to this bucket
• aclstring, default nullThe canned ACL to apply. Conflicts with grant
• allowed_kms_key_arnstring, default nullThe ARN of KMS key which should be allowed in PutObject
• analytics_configurationmap({...}), default {}Analytics configurations for the bucket, keyed by configuration name
• analytics_self_source_destinationbool, default falseWhether or not the analytics source bucket is also the destination bucket
• analytics_source_account_idstring, default nullThe analytics source account id
• analytics_source_bucket_arnstring, default nullThe analytics source bucket ARN
• attach_access_log_delivery_policybool, default falseControls if S3 bucket should have S3 access log delivery policy attached
• attach_analytics_destination_policybool, default falseControls if S3 bucket should have bucket analytics destination policy attached
• attach_cloudtrail_log_delivery_policybool, default falseControls if S3 bucket should have CloudTrail log delivery policy attached
• attach_deny_incorrect_encryption_headersbool, default falseControls if S3 bucket should deny incorrect encryption headers policy attached
• attach_deny_incorrect_kms_key_ssebool, default falseControls if S3 bucket policy should deny usage of incorrect KMS key SSE
• attach_deny_insecure_transport_policybool, default falseControls if S3 bucket should have deny non-SSL transport policy attached
• attach_deny_ssec_encrypted_object_uploadsbool, default falseControls if S3 bucket should deny SSEC encrypted object uploads
• attach_deny_unencrypted_object_uploadsbool, default falseControls if S3 bucket should deny unencrypted object uploads policy attached
• attach_elb_log_delivery_policybool, default falseControls if S3 bucket should have ELB log delivery policy attached
• attach_inventory_destination_policybool, default falseControls if S3 bucket should have bucket inventory destination policy attached
• attach_lb_log_delivery_policybool, default falseControls if S3 bucket should have ALB/NLB log delivery policy attached
• attach_public_policybool, default trueControls if the S3 Bucket Public Access Block is created (set to false to allow upstream to apply defaults to the bucket)
• attach_require_latest_tls_policybool, default falseControls if S3 bucket should require the latest version of TLS
• attach_waf_log_delivery_policybool, default falseControls if S3 bucket should have WAF log delivery policy attached
• availability_zone_idstring, default nullAvailability Zone ID or Local Zone ID
• bucketstring, default nullThe name of the bucket. If omitted, Terraform will assign a random, unique name
• bucket_namespacestring, default nullNamespace for the bucket. Determines bucket naming scope. Valid values: account-regional, global. Defaults to global (AWS)
• bucket_prefixstring, default nullCreates a unique bucket name beginning with the specified prefix. Conflicts with bucket
• control_object_ownershipbool, default falseWhether to manage S3 Bucket Ownership Controls on this bucket
• cors_rulelist({...}), default []Rules for Cross-Origin Resource Sharing on the bucket
• create_bucketbool, default trueControls if S3 bucket should be created
• create_metadata_configurationbool, default falseWhether to create metadata configuration resource
• data_redundancystring, default nullData redundancy. Valid values: SingleAvailabilityZone
• expected_bucket_ownerstring, default nullThe account ID of the expected bucket owner
• force_destroybool, default falseA boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable
• grantlist({...}), default []ACL policy grants for the bucket. Conflicts with acl
• intelligent_tieringmap({...}), default {}Intelligent tiering configurations for the bucket, keyed by configuration name
• inventory_configurationmap({...}), default {}Inventory configurations for the bucket, keyed by configuration name
• inventory_self_source_destinationbool, default falseWhether or not the inventory source bucket is also the destination bucket
• inventory_source_account_idstring, default nullThe inventory source account id
• inventory_source_bucket_arnstring, default nullThe inventory source bucket ARN
• is_directory_bucketbool, default falseIf the s3 bucket created is a directory bucket
• lb_log_delivery_policy_source_organizationslist(string), default []List of AWS Organization IDs should be allowed to deliver ALB/NLB logs to this bucket
• location_typestring, default nullLocation type. Valid values: AvailabilityZone or LocalZone
• metadata_encryption_configurationobject({...}), default nullEncryption configuration for the metadata inventory table
• metadata_inventory_table_configuration_statestring, default nullConfiguration state of the inventory table, indicating whether the inventory table is enabled or disabled. Valid values: ENABLED, DISABLED
• metadata_journal_table_record_expirationstring, default nullWhether journal table record expiration is enabled or disabled. Valid values: ENABLED, DISABLED
• metadata_journal_table_record_expiration_daysnumber, default nullNumber of days to retain journal table records
• metric_configurationlist({...}), default []Metric configurations for the bucket
• object_lock_configurationobject({...}), default {}Object lock configuration for the bucket
• ownermap(string), default {}Bucket owner's display name and ID. Conflicts with acl
• policystring, default "{"Version":"2012-10-17","Statement":[{"Sid":"DenyCrossAccountPermissionChanges","Effect":"Deny","Principal":"*","Action":["s3:DeleteBucketPolicy","s3:PutBucketAcl","s3:PutBucketPolicy","s3:PutBucketPublicAccessBlock","s3:PutEncryptionConfiguration","s3:PutObjectAcl"],"Resource":["_S3_BUCKET_ARN_","_S3_BUCKET_ARN_/*"],"Condition":{"StringNotEquals":{"aws:PrincipalAccount":["_AWS_ACCOUNT_ID_"]}}}]}"A valid bucket policy JSON document. Note that if the policy document is not specific enough (but still valid), Terraform may view the policy as constantly changing in a terraform plan. In this case, please make sure you use the verbose/specific version of the policy. For more information about building AWS IAM policy documents with Terraform, see the AWS IAM Policy Document Guide
• putin_khuylobool, default trueDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!
• regionstring, default nullRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
• request_payerstring, default nullSpecifies who should bear the cost of Amazon S3 data transfer. Can be either BucketOwner or Requester. By default, the owner of the S3 bucket would incur the costs of any data transfer. See Requester Pays Buckets developer guide for more information
• skip_destroy_public_access_blockbool, default trueWhether to skip destroying the S3 Bucket Public Access Block configuration when destroying the bucket. Only used if public_access_block is set to true
• tagsmap(string), default {}A mapping of tags to assign to the bucket
• transition_default_minimum_object_sizestring, default nullThe default minimum object size behavior applied to the lifecycle configuration. Valid values: all_storage_classes_128K (default) or varies_by_storage_class
• typestring, default "Directory"Bucket type. Valid values: Directory
• websiteobject({...}), default {}Static website hosting or redirect configuration for the bucket