S3 Bucket

Type: rvn-s3 · Latest version: 0.3.1

Dependencies and consumers

Every dependency input can be specified manually to reference existing external infrastructure rather than a Ravion module.

Readme

S3 bucket with public access blocking, encryption, versioning, CORS, lifecycle rules, and configurable bucket policies.

Overview

Use this module to create an Amazon S3 bucket with secure defaults and common operational controls exposed in Ravion. The module blocks public access by default, enables server-side encryption, and can manage versioning, CORS rules, lifecycle rules, and bucket policy statements.

Use cases

Scenario	Benefit
Application object storage	Create a private bucket with encryption and tags.
Access log storage	Use ALB, NLB, or VPC Flow Logs policy templates with lifecycle expiration.
Browser uploads or downloads	Add CORS rules for approved web origins and methods.
Compliance retention	Enable versioning and lifecycle rules for noncurrent versions.
Custom integrations	Attach custom bucket policy statements while preserving public access block settings.

Security defaults

Public access block settings are enabled by default: Block public ACLs, Block public policies, Ignore public ACLs, and Restrict public buckets. Leave these enabled for private application buckets and log buckets unless you have a specific public bucket design. The bucket uses SSE-S3 AES256 encryption by default and blocks SSE-C uploads. Set KMS key ID to use SSE-KMS. Bucket key remains enabled by default for SSE-KMS to reduce KMS request volume.

Lifecycle rules

Lifecycle rules can expire current objects, expire noncurrent versions, transition current or noncurrent versions to colder storage classes, and abort incomplete multipart uploads. The lifecycle rule form covers the common one-transition-per-rule cases. Advanced lifecycle rules accept the Terraform lifecycle rule shape, including id, enabled, prefix, tags, expiration, noncurrent_version_expiration, transitions, noncurrent_version_transitions, and abort_incomplete_multipart_upload_days.

CORS

CORS rules allow browser-based applications on approved origins to make cross-origin requests to bucket objects. Each rule includes allowed origins and methods, with optional allowed request headers, exposed response headers, and browser preflight cache duration.

Bucket policies

Policy templates add statements for common AWS service integrations:

Template	Purpose
Deny insecure transport	Denies S3 requests over HTTP.
ALB access logs	Allows Application Load Balancer log delivery.
NLB access logs	Allows Network Load Balancer log delivery.
VPC Flow Logs	Allows VPC Flow Logs delivery.
CloudFront OAC read	Allows selected CloudFront distributions using Origin Access Control to read objects.

Custom policy JSON can be provided for additional statements. When templates and custom policy are both set, the module merges their statements into one bucket policy. For private buckets served through rvn-cloudfront, apply the CloudFront module first, then add the CloudFront OAC read template here with the CloudFront distribution ARN. The bucket remains private because access is granted only to the CloudFront service principal for that distribution.

Configuration

Setting	Required	Default	Notes
AWS account	Yes	None	AWS account where the bucket is created.
Region	Yes	None	AWS Region for the bucket.
Bucket name	Yes	Project, environment, and module given IDs	Must be globally unique and follow S3 naming rules.
Force destroy	No	false	Deletes objects during bucket destroy. Use with caution.
Public access block settings	No	true	Four independent controls for ACLs and public bucket policies.
KMS key ID	No	None	Uses SSE-KMS when set; otherwise uses SSE-S3 AES256.
Bucket key	No	true	Applies to SSE-KMS only.
Versioning	No	false	Keeps multiple versions of objects.
CORS rules	No	Empty list	Browser cross-origin access rules for approved origins and methods.
Lifecycle rules	No	Empty list	Form-based expiration, transition, noncurrent version, and multipart cleanup rules.
Advanced lifecycle rules	No	Empty list	Raw Terraform lifecycle rule shape for tag filters, multiple transitions, and uncommon combinations.
Policy templates	No	Empty list	Adds common bucket policy statements.
CloudFront distribution ARNs	No	Empty list	Required when the CloudFront OAC read policy template is selected.
Custom policy JSON	No	None	Additional policy statements merged with templates.
Tags	No	Standard Ravion tags	Additional tags merged with Ravion ownership and identity tags.
Advanced Terraform variables	No	Empty object	Escape hatch for one-off Terraform variable overrides.
Ravion Terraform workspace name	No	Generated from project, environment, module, and stack IDs	Override only when you need a specific backend workspace name.

Design decisions

The module defaults to private, encrypted buckets. Public access settings are exposed because some AWS integrations need carefully scoped policies, but the secure defaults should remain enabled for most buckets. Bucket policy creation is inferred from selected policy templates or Custom policy JSON. Internal Terraform callers can override that inference for policies whose value is known only during apply, but that escape hatch is not part of the normal Ravion form. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata.

Learn more

Inputs reference

All inputs for rvn-s3 version 0.3.1. Use the name shown for each field as the input key in module config.

AWS account & region

aws_account_id

string

required

AWS account.

Immutable after creation

aws_region

string

required

Region.

Immutable after creation

Bucket

name

string

required

Bucket name. Globally unique S3 bucket name.

Default: <<project.given_id>>-<<environment.given_id>>-<<module.given_id>>
Immutable after creation
Pattern: ^.{3,63}$ — Bucket names must be 3-63 characters long.
Pattern: ^[a-z0-9][a-z0-9.-]*[a-z0-9]$ — Use a valid S3 bucket name: lowercase letters, numbers, hyphens, and periods; start and end with a letter or number.
Pattern: ^(?!.*\.\.).*$ — Bucket names must not contain consecutive periods.
Pattern: ^(?!.*(\.-|-\.)).*$ — Bucket names must not contain periods next to hyphens.
Pattern: ^(?!\d+\.\d+\.\d+\.\d+$).*$ — Bucket names must not be formatted as an IPv4 address.
Pattern: ^(?!xn--)(?!.*-s3alias$).*$ — Bucket names must not start with xn— or end with -s3alias.

force_destroy_enabled

boolean

Force destroy. Delete the bucket even when it contains objects. Use with caution.

Default: false

Public access block

block_public_acls

boolean

Block public ACLs. Block public ACLs for this bucket.

Default: true

block_public_policy

boolean

Block public policies. Block public bucket policies for this bucket.

Default: true

ignore_public_acls

boolean

Ignore public ACLs. Ignore public ACLs on this bucket and its objects.

Default: true

restrict_public_buckets

boolean

Restrict public buckets. Restrict public bucket policies to AWS service principals and authorized users in this account.

Default: true

Encryption

kms_key_id

string

KMS key ID. Optional AWS KMS key ID or ARN for SSE-KMS. Leave empty to use SSE-S3 AES256 encryption.

bucket_key_enabled

boolean

Bucket key. Enable S3 Bucket Keys for SSE-KMS to reduce KMS request costs. Applies only when KMS key ID is set.

Default: true

Versioning

versioning_enabled

boolean

Versioning. Keep multiple versions of objects in the bucket.

Default: false

Lifecycle rules

lifecycle_rule_forms

object_array

Lifecycle rules. Configure common lifecycle rules with form fields. Use advanced lifecycle rules below for multiple transitions, tag filters, or less common combinations.

Default: []

Show item fields

string

required

Rule ID. Unique identifier for this lifecycle rule. Use letters, numbers, periods, underscores, or hyphens.

Pattern: ^[A-Za-z0-9._-]{1,255}$ — Use 1-255 letters, numbers, periods, underscores, or hyphens.

enabled

boolean

Enabled. Whether this lifecycle rule is enabled.

Default: true

prefix

string

Prefix. Object key prefix matched by this rule. Leave empty to apply to the whole bucket.

expiration_days

number

Expiration days. Days after object creation when current versions expire.

Min: 1

expiration_date

string

Expiration date. Date when current versions expire, in YYYY-MM-DD format. Use either expiration days or expiration date, not both.

Pattern: ^\d{4}-\d{2}-\d{2}$ — Use YYYY-MM-DD format.

expiration_expired_object_delete_marker_enabled

boolean

Expire delete markers. Expire delete markers when they are the only remaining version.

Default: false

noncurrent_version_expiration_days

number

Noncurrent expiration days. Days after an object becomes noncurrent when noncurrent versions expire.

Min: 1

noncurrent_version_newer_noncurrent_versions

number

Newer noncurrent versions to retain. Number of newer noncurrent versions to retain before noncurrent expiration applies.

Min: 1

transition_storage_class

string

Transition storage class. Storage class for a current version transition.

Allowed values: GLACIER (Glacier Flexible Retrieval), STANDARD_IA (Standard-IA), ONEZONE_IA (One Zone-IA), INTELLIGENT_TIERING (Intelligent-Tiering), DEEP_ARCHIVE (Deep Archive), GLACIER_IR (Glacier Instant Retrieval)

transition_days

number

Transition days. Days after object creation when the current version transitions.

transition_date

string

Transition date. Date when current versions transition, in YYYY-MM-DD format. Use either transition days or transition date, not both.

Pattern: ^\d{4}-\d{2}-\d{2}$ — Use YYYY-MM-DD format.

noncurrent_transition_storage_class

string

Noncurrent transition storage class. Storage class for a noncurrent version transition.

Allowed values: GLACIER (Glacier Flexible Retrieval), STANDARD_IA (Standard-IA), ONEZONE_IA (One Zone-IA), INTELLIGENT_TIERING (Intelligent-Tiering), DEEP_ARCHIVE (Deep Archive), GLACIER_IR (Glacier Instant Retrieval)

noncurrent_transition_days

number

Noncurrent transition days. Days after an object becomes noncurrent when it transitions.

noncurrent_transition_newer_noncurrent_versions

number

Newer noncurrent versions before transition. Number of newer noncurrent versions to retain before noncurrent transition applies.

abort_incomplete_multipart_upload_days

number

Abort incomplete multipart uploads days. Days after initiation when incomplete multipart uploads are aborted.

Min: 1

lifecycle_rules_raw

array

Advanced lifecycle rules. Advanced lifecycle rules in the Terraform lifecycle rule shape. Use this for tag filters, multiple transitions, or other combinations not covered by the form above.

Default: []

Bucket policy

policy_templates

string_array

Policy templates. Prebuilt bucket policy statements to add.

Default: []
Allowed values: deny_insecure_transport (Deny insecure transport), alb_access_logs (ALB access logs), nlb_access_logs (NLB access logs), vpc_flow_logs (VPC Flow Logs), cloudfront_oac_read (CloudFront OAC read)

cloudfront_distribution_arns

string_array

CloudFront distribution ARNs. CloudFront distribution ARNs allowed to read objects when the CloudFront OAC read policy template is selected.

Default: []
Pattern: ^arn:aws:cloudfront::[0-9]{12}:distribution/[A-Z0-9]+$ — Invalid CloudFront distribution ARN.

custom_policy

text

Custom policy JSON. Custom bucket policy JSON document. If policy templates are also selected, statements are merged.

CORS

cors_rules

object_array

CORS rules. Configure Cross-Origin Resource Sharing rules for browser access to bucket objects.

Default: []

Show item fields

string

Rule ID. Optional unique identifier for this CORS rule.

allowed_origins

string_array

required

Allowed origins. Origins allowed to make cross-origin requests to this bucket.

allowed_methods

string_array

required

Allowed methods. HTTP methods allowed for cross-origin requests.

Allowed values: GET, PUT, HEAD, POST, DELETE

allowed_headers

string_array

Allowed headers. Request headers allowed in cross-origin requests. Use * to allow any header.

Default: []

expose_headers

string_array

Exposed headers. Response headers browsers may expose to client code.

Default: []

max_age_seconds

number

Max age (seconds). Seconds browsers can cache CORS preflight responses.

Min: 0

Terraform settings

opentofu_version

string

OpenTofu version override. Override the environment’s default version for this module

ravion_state_backend_workspace

string

Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.

Immutable after creation

advanced_terraform_variables

object

Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.

Default: {}

execution_environment_id

string

Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.

Introduction

Use cases

Concepts

Config as code

Migrate

Modules

Pipelines

Guides

Module definitions

Dependencies and consumers

Readme

Overview

Use cases

Security defaults

Lifecycle rules

CORS

Bucket policies

Configuration

Design decisions

Learn more

Inputs reference

AWS account & region

Bucket

Public access block

Encryption

Versioning

Lifecycle rules

Bucket policy

CORS

Terraform settings

​Dependencies and consumers

​Readme

​Overview

​Use cases

​Security defaults

​Lifecycle rules

​CORS

​Bucket policies

​Configuration

​Design decisions

​Learn more

​Inputs reference

​AWS account & region

​Bucket

​Public access block

​Encryption

​Versioning

​Lifecycle rules

​Bucket policy

​CORS

​Terraform settings

Dependencies and consumers

Readme

Overview

Use cases

Security defaults

Lifecycle rules

CORS

Bucket policies

Configuration

Design decisions

Learn more

Inputs reference

AWS account & region

Bucket

Public access block

Encryption

Versioning

Lifecycle rules

Bucket policy

CORS

Terraform settings