diff --git a/README.md b/README.md index 90c181c3..d3e7085a 100644 --- a/README.md +++ b/README.md @@ -377,7 +377,7 @@ Available targets: | [store\_access\_key\_in\_ssm](#input\_store\_access\_key\_in\_ssm) | Set to `true` to store the created IAM user's access key in SSM Parameter Store,
`false` to store them in Terraform state as outputs.
Since Terraform state would contain the secrets in plaintext,
use of SSM Parameter Store is recommended. | `bool` | `false` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | -| [transfer\_acceleration\_enabled](#input\_transfer\_acceleration\_enabled) | Set this to true to enable S3 Transfer Acceleration for the bucket. | `bool` | `false` | no | +| [transfer\_acceleration\_enabled](#input\_transfer\_acceleration\_enabled) | Set this to `true` to enable S3 Transfer Acceleration for the bucket.
Note: When this is set to `false` Terraform does not perform drift detection
and will not disable Transfer Acceleration if it was enabled outside of Terraform.
To disable it via Terraform, you must set this to `true` and then to `false`.
Note: not all regions support Transfer Acceleration. | `bool` | `false` | no | | [user\_enabled](#input\_user\_enabled) | Set to `true` to create an IAM user with permission to access the bucket | `bool` | `false` | no | | [user\_permissions\_boundary\_arn](#input\_user\_permissions\_boundary\_arn) | Permission boundary ARN for the IAM user created to access the bucket. | `string` | `null` | no | | [versioning\_enabled](#input\_versioning\_enabled) | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket | `bool` | `true` | no | diff --git a/docs/terraform.md b/docs/terraform.md index eadecb49..56f8f213 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -107,7 +107,7 @@ | [store\_access\_key\_in\_ssm](#input\_store\_access\_key\_in\_ssm) | Set to `true` to store the created IAM user's access key in SSM Parameter Store,
`false` to store them in Terraform state as outputs.
Since Terraform state would contain the secrets in plaintext,
use of SSM Parameter Store is recommended. | `bool` | `false` | no | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | -| [transfer\_acceleration\_enabled](#input\_transfer\_acceleration\_enabled) | Set this to true to enable S3 Transfer Acceleration for the bucket. | `bool` | `false` | no | +| [transfer\_acceleration\_enabled](#input\_transfer\_acceleration\_enabled) | Set this to `true` to enable S3 Transfer Acceleration for the bucket.
Note: When this is set to `false` Terraform does not perform drift detection
and will not disable Transfer Acceleration if it was enabled outside of Terraform.
To disable it via Terraform, you must set this to `true` and then to `false`.
Note: not all regions support Transfer Acceleration. | `bool` | `false` | no | | [user\_enabled](#input\_user\_enabled) | Set to `true` to create an IAM user with permission to access the bucket | `bool` | `false` | no | | [user\_permissions\_boundary\_arn](#input\_user\_permissions\_boundary\_arn) | Permission boundary ARN for the IAM user created to access the bucket. | `string` | `null` | no | | [versioning\_enabled](#input\_versioning\_enabled) | A state of versioning. Versioning is a means of keeping multiple variants of an object in the same bucket | `bool` | `true` | no | diff --git a/examples/complete/main.tf b/examples/complete/main.tf index d140f556..62c3391f 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -25,7 +25,7 @@ module "s3_bucket" { s3_replication_rules = local.s3_replication_rules privileged_principal_actions = var.privileged_principal_actions privileged_principal_arns = local.privileged_principal_arns - transfer_acceleration_enabled = true + transfer_acceleration_enabled = var.transfer_acceleration_enabled bucket_key_enabled = var.bucket_key_enabled access_key_enabled = var.access_key_enabled diff --git a/examples/complete/privileged-principals.us-east-2.tfvars b/examples/complete/privileged-principals.us-east-2.tfvars index e2421ee0..6a64b9d2 100644 --- a/examples/complete/privileged-principals.us-east-2.tfvars +++ b/examples/complete/privileged-principals.us-east-2.tfvars @@ -30,3 +30,5 @@ privileged_principal_enabled = true versioning_enabled = false user_enabled = false + +transfer_acceleration_enabled = false diff --git a/examples/complete/variables.tf b/examples/complete/variables.tf index de1ef853..4356735b 100644 --- a/examples/complete/variables.tf +++ b/examples/complete/variables.tf @@ -342,3 +342,8 @@ variable "store_access_key_in_ssm" { EOT } +variable "transfer_acceleration_enabled" { + type = bool + default = true + description = "Set true to enable Transfer Acceleration (many regions not supported)" +} diff --git a/main.tf b/main.tf index f766fcbf..f6634930 100644 --- a/main.tf +++ b/main.tf @@ -44,11 +44,10 @@ resource "aws_s3_bucket" "default" { tags = module.this.tags } -# Ensure the resource exists to track drift, even if the feature is disabled resource "aws_s3_bucket_accelerate_configuration" "default" { - count = local.enabled ? 1 : 0 + count = local.transfer_acceleration_enabled ? 1 : 0 bucket = join("", aws_s3_bucket.default.*.id) - status = local.transfer_acceleration_enabled ? "Enabled" : "Suspended" + status = "Enabled" } # Ensure the resource exists to track drift, even if the feature is disabled diff --git a/variables.tf b/variables.tf index 17e6c476..2092b371 100644 --- a/variables.tf +++ b/variables.tf @@ -376,7 +376,13 @@ variable "privileged_principal_actions" { variable "transfer_acceleration_enabled" { type = bool default = false - description = "Set this to true to enable S3 Transfer Acceleration for the bucket." + description = <<-EOT + Set this to `true` to enable S3 Transfer Acceleration for the bucket. + Note: When this is set to `false` Terraform does not perform drift detection + and will not disable Transfer Acceleration if it was enabled outside of Terraform. + To disable it via Terraform, you must set this to `true` and then to `false`. + Note: not all regions support Transfer Acceleration. + EOT } variable "s3_object_ownership" {