S3 bucket without versioning

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: terraform-aws-s3-bucket-without-versioning

Provider: AWS

Platform: Terraform

Severity: Medium

Category: Backup

Learn More

Description

Amazon S3 buckets should have versioning enabled to protect against accidental or malicious deletion and overwriting of objects. Without versioning (versioning { enabled = false }), deleted or overwritten files cannot be recovered, potentially leading to permanent data loss or loss of critical information. Enabling versioning (versioning { enabled = true }) allows you to preserve, retrieve, and restore every version of every object stored in the bucket, significantly improving data resiliency.

Compliant Code Examples

provider "aws" {
  region = "us-east-1"
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

resource "aws_s3_bucket" "negative1" {
  bucket = "my-tf-test-bucket"
  acl    = "private"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }

  versioning {
    enabled = true
  }
}

module "s3_bucket" {
  source = "terraform-aws-modules/s3-bucket/aws"

  version = "3.7.0"

  bucket = "my-s3-bucket"
  acl    = "private"

  versioning = {
    enabled = true
  }

}

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "4.2.0"
    }
  }
}

provider "aws" {
  # Configuration options
}

resource "aws_s3_bucket" "b" {
  bucket = "my-tf-test-bucket"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }
}

resource "aws_s3_bucket_versioning" "example" {
  bucket = aws_s3_bucket.b.id

  versioning_configuration {
    status = "Enabled"
  }
}

Non-Compliant Code Examples

module "mybucket" {
  source = "./modules/aws-simple-bucket"

  bucket_name = "dd-mybucket-eric-aws-simple-test-001"
  versioning_config = {
    enabled = false
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" "positive10" {
  bucket = "my-tf-test-bucket-unversioned"
}

resource "aws_iam_role" "unrelated" {
  name = "unrelated-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action    = "sts:AssumeRole"
      Effect    = "Allow"
      Principal = { Service = "s3.amazonaws.com" }
    }]
  })
}

# Targets a bucket name derived from an unrelated, unresolved resource
# attribute - not aws_s3_bucket.positive10, which remains genuinely
# unversioned. The single-bucket-in-document heuristic previously assumed
# this must target positive10 since it's the only bucket in the
# document - it doesn't; the reference here has nothing to do with
# positive10 at all.
resource "aws_s3_bucket_versioning" "external_target" {
  bucket = aws_iam_role.unrelated.unique_id

  versioning_configuration {
    status = "Enabled"
  }
}

provider "aws" {
  region = "us-east-1"
}

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.0"
    }
  }
}

resource "aws_s3_bucket" "positive2" {
  bucket = "my-tf-test-bucket"
  acl    = "private"

  tags = {
    Name        = "My bucket"
    Environment = "Dev"
  }
}