Initial code

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Invicton Labs (https://invictonlabs.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,3 @@
+# Terraform AWS Replicated Secure S3 Buckets
+
+This module creates two [Invicton-Labs/secure-s3-bucket/aws](https://registry.terraform.io/modules/Invicton-Labs/secure-s3-bucket/aws/0.2.2) modules and a [Invicton-Labs/secure-s3-bucket-replication/aws](https://registry.terraform.io/modules/Invicton-Labs/secure-s3-bucket-replication/aws/0.1.0) module to replicate between them.

main.tf

@@ -0,0 +1,12 @@
+data "aws_caller_identity" "a" {
+  provider = aws.a
+}
+data "aws_caller_identity" "b" {
+  provider = aws.b
+}
+data "aws_region" "a" {
+  provider = aws.a
+}
+data "aws_region" "b" {
+  provider = aws.b
+}

outputs.tf

@@ -0,0 +1,179 @@
+//==================================================
+//     Outputs that match the input variables
+//==================================================
+output "name_a" {
+  description = "The value of the `name_a` input variable."
+  value       = var.name_a
+}
+output "name_b" {
+  description = "The value of the `name_b` input variable"
+  value       = var.name_b
+}
+output "mfa_delete_enabled_a" {
+  description = "The value of the `mfa_delete_enabled_a` input variable, or the default value if the input was `null`."
+  value       = local.mfa_delete_enabled_a
+}
+output "mfa_delete_enabled_b" {
+  description = "The value of the `mfa_delete_enabled_b` input variable, or the default value if the input was `null`."
+  value       = local.mfa_delete_enabled_b
+}
+output "bucket_policy_json_documents_a" {
+  description = "The value of the `bucket_policy_json_documents_a` input variable, or the default value if the input was `null`."
+  value       = local.bucket_policy_json_documents_a
+}
+output "bucket_policy_json_documents_b" {
+  description = "The value of the `bucket_policy_json_documents_b` input variable, or the default value if the input was `null`."
+  value       = local.bucket_policy_json_documents_b
+}
+output "bucket_policy_json_documents_both" {
+  description = "The value of the `bucket_policy_json_documents_both` input variable, or the default value if the input was `null`."
+  value       = local.bucket_policy_json_documents_both
+}
+output "kms_key_arn_a" {
+  description = "The value of the `kms_key_arn_a` input variable, or the default value if the input was `null`."
+  value       = var.kms_key_arn_a
+}
+output "kms_key_arn_b" {
+  description = "The value of the `kms_key_arn_b` input variable, or the default value if the input was `null`."
+  value       = var.kms_key_arn_b
+}
+output "create_new_kms_key_a" {
+  description = "The value of the `create_new_kms_key_a` input variable, or the default value if the input was `null`."
+  value       = local.create_new_kms_key_a
+}
+output "create_new_kms_key_b" {
+  description = "The value of the `create_new_kms_key_b` input variable, or the default value if the input was `null`."
+  value       = local.create_new_kms_key_b
+}
+output "create_replica_kms_key_a" {
+  description = "The value of the `create_replica_kms_key_a` input variable, or the default value if the input was `null`."
+  value       = local.create_replica_kms_key_a
+}
+output "create_replica_kms_key_b" {
+  description = "The value of the `create_replica_kms_key_b` input variable, or the default value if the input was `null`."
+  value       = local.create_replica_kms_key_b
+}
+output "kms_key_policy_json_documents_a" {
+  description = "The value of the `kms_key_policy_json_documents_a` input variable, or the default value if the input was `null`."
+  value       = local.kms_key_policy_json_documents_a
+}
+output "kms_key_policy_json_documents_b" {
+  description = "The value of the `kms_key_policy_json_documents_b` input variable, or the default value if the input was `null`."
+  value       = local.kms_key_policy_json_documents_b
+}
+output "kms_key_policy_json_documents_both" {
+  description = "The value of the `kms_key_policy_json_documents_both` input variable, or the default value if the input was `null`."
+  value       = local.kms_key_policy_json_documents_both
+}
+output "enable_transfer_acceleration_a" {
+  description = "The value of the `enable_transfer_acceleration_a` input variable, or the default value if the input was `null`."
+  value       = local.enable_transfer_acceleration_a
+}
+output "enable_transfer_acceleration_b" {
+  description = "The value of the `enable_transfer_acceleration_b` input variable, or the default value if the input was `null`."
+  value       = local.enable_transfer_acceleration_b
+}
+output "block_public_acls_a" {
+  description = "The value of the `block_public_acls_a` input variable, or the default value if the input was `null`."
+  value       = local.block_public_acls_a
+}
+output "block_public_acls_b" {
+  description = "The value of the `block_public_acls_b` input variable, or the default value if the input was `null`."
+  value       = local.block_public_acls_b
+}
+output "block_public_policy_a" {
+  description = "The value of the `block_public_policy_a` input variable, or the default value if the input was `null`."
+  value       = local.block_public_policy_a
+}
+output "block_public_policy_b" {
+  description = "The value of the `block_public_policy_b` input variable, or the default value if the input was `null`."
+  value       = local.block_public_policy_b
+}
+output "ignore_public_acls_a" {
+  description = "The value of the `ignore_public_acls_a` input variable, or the default value if the input was `null`."
+  value       = local.ignore_public_acls_a
+}
+output "ignore_public_acls_b" {
+  description = "The value of the `ignore_public_acls_b` input variable, or the default value if the input was `null`."
+  value       = local.ignore_public_acls_b
+}
+output "restrict_public_buckets_a" {
+  description = "The value of the `restrict_public_buckets_a` input variable, or the default value if the input was `null`."
+  value       = local.restrict_public_buckets_a
+}
+output "restrict_public_buckets_b" {
+  description = "The value of the `restrict_public_buckets_b` input variable, or the default value if the input was `null`."
+  value       = local.restrict_public_buckets_b
+}
+output "object_ownership_a" {
+  description = "The value of the `object_ownership_a` input variable, or the default value if the input was `null`."
+  value       = local.object_ownership_a
+}
+output "object_ownership_b" {
+  description = "The value of the `object_ownership_b` input variable, or the default value if the input was `null`."
+  value       = local.object_ownership_b
+}
+output "append_region_suffix_a" {
+  description = "The value of the `append_region_suffix_a` input variable, or the default value if the input was `null`."
+  value       = local.append_region_suffix_a
+}
+output "append_region_suffix_b" {
+  description = "The value of the `append_region_suffix_b` input variable, or the default value if the input was `null`."
+  value       = local.append_region_suffix_b
+}
+output "object_lock_enabled_a" {
+  description = "The value of the `object_lock_enabled_a` input variable, or the default value if the input was `null`."
+  value       = local.object_lock_enabled_a
+}
+output "object_lock_enabled_b" {
+  description = "The value of the `object_lock_enabled_b` input variable, or the default value if the input was `null`."
+  value       = local.object_lock_enabled_b
+}
+output "force_destroy_a" {
+  description = "The value of the `force_destroy_a` input variable, or the default value if the input was `null`."
+  value       = local.force_destroy_a
+}
+output "force_destroy_b" {
+  description = "The value of the `force_destroy_b` input variable, or the default value if the input was `null`."
+  value       = local.force_destroy_b
+}
+output "force_allow_cloudtrail_digest_a" {
+  description = "The value of the `force_allow_cloudtrail_digest_a` input variable, or the default value if the input was `null`."
+  value       = local.force_allow_cloudtrail_digest_a
+}
+output "force_allow_cloudtrail_digest_b" {
+  description = "The value of the `force_allow_cloudtrail_digest_b` input variable, or the default value if the input was `null`."
+  value       = local.force_allow_cloudtrail_digest_b
+}
+output "replicate_a_to_b" {
+  description = "The value of the `replicate_a_to_b` input variable, or the default value if the input was `null`."
+  value       = var.replicate_a_to_b
+}
+output "replicate_b_to_a" {
+  description = "The value of the `replicate_b_to_a` input variable, or the default value if the input was `null`."
+  value       = var.replicate_b_to_a
+}
+output "a_to_b_rules" {
+  description = "The value of the `a_to_b_rules` input variable, or the default value if the input was `null`."
+  value       = local.a_to_b_rules
+}
+output "b_to_a_rules" {
+  description = "The value of the `b_to_a_rules` input variable, or the default value if the input was `null`."
+  value       = local.b_to_a_rules
+}
+
+//==================================================
+//       Outputs generated by this module
+//==================================================
+output "bucket_a" {
+  description = "The Invicton-Labs/secure-s3-bucket/aws module that was created for bucket A."
+  value       = module.bucket_a
+}
+output "bucket_b" {
+  description = "The Invicton-Labs/secure-s3-bucket/aws module that was created for bucket B."
+  value       = module.bucket_b
+}
+output "replication" {
+  description = "The Invicton-Labs/secure-s3-bucket-replication/aws module that was created for the bucket replication."
+  value       = module.replication
+}

s3.tf

@@ -0,0 +1,92 @@
+module "bucket_a" {
+  source  = "Invicton-Labs/secure-s3-bucket/aws"
+  version = "~>0.2.2"
+  providers = {
+    aws = aws.a
+  }
+  depends_on = [
+    module.assert_same_account
+  ]
+  // Versioning always required for replication
+  versioned                     = true
+  name                          = var.name_a
+  mfa_delete_enabled            = local.mfa_delete_enabled_a
+  bucket_policy_json_documents  = concat(local.bucket_policy_json_documents_a, local.bucket_policy_json_documents_both)
+  kms_key_arn                   = var.kms_key_arn_a
+  create_new_kms_key            = local.create_new_kms_key_a
+  create_replica_kms_key        = local.create_replica_kms_key_a
+  kms_key_policy_json_documents = concat(local.kms_key_policy_json_documents_a, local.kms_key_policy_json_documents_both)
+  enable_transfer_acceleration  = local.enable_transfer_acceleration_a
+  block_public_acls             = local.block_public_acls_a
+  block_public_policy           = local.block_public_policy_a
+  ignore_public_acls            = local.ignore_public_acls_a
+  restrict_public_buckets       = local.restrict_public_buckets_a
+  object_ownership              = local.object_ownership_a
+  append_region_suffix          = local.append_region_suffix_a
+  object_lock_enabled           = local.object_lock_enabled_a
+  force_destroy                 = local.force_destroy_a
+  force_allow_cloudtrail_digest = local.force_allow_cloudtrail_digest_a
+}
+
+locals {
+  // If a specific key was provided for bucket B, use that.
+  // Otherwise, use the key that was used for bucket A as the base key
+  b_kms_key_arn = var.kms_key_arn_b != null ? var.kms_key_arn_b : module.bucket_a.kms_key_arn
+  // If a specific key was provided for bucket B, or we're supposed to create a new key for bucket B,
+  // use the input `create_replica_kms_key_b` variable as-is. 
+  b_create_replica_key = var.kms_key_arn_b != null || local.create_new_kms_key_b ? local.create_replica_kms_key_b : (
+    // Otherwise, check if a key was used for Bucket A (one provided, or new one created)
+    var.kms_key_arn_a != null || local.create_new_kms_key_a ? (
+      // If a key was used for bucket A, only create a replica for bucket B if B is in a different region
+      data.aws_region.a.name != data.aws_region.b.name
+      ) : (
+      // No key was used for bucket A, so we don't need a replica key for bucket B
+      false
+    )
+  )
+}
+
+module "bucket_b" {
+  source  = "Invicton-Labs/secure-s3-bucket/aws"
+  version = "~>0.2.2"
+  providers = {
+    aws = aws.b
+  }
+  depends_on = [
+    module.assert_same_account
+  ]
+  // Versioning always required for replication
+  versioned                     = true
+  name                          = var.name_b
+  mfa_delete_enabled            = local.mfa_delete_enabled_b
+  bucket_policy_json_documents  = concat(local.bucket_policy_json_documents_b, local.bucket_policy_json_documents_both)
+  kms_key_arn                   = local.b_kms_key_arn
+  create_new_kms_key            = local.create_new_kms_key_b
+  create_replica_kms_key        = local.b_create_replica_key
+  kms_key_policy_json_documents = concat(local.kms_key_policy_json_documents_b, local.kms_key_policy_json_documents_both)
+  enable_transfer_acceleration  = local.enable_transfer_acceleration_b
+  block_public_acls             = local.block_public_acls_b
+  block_public_policy           = local.block_public_policy_b
+  ignore_public_acls            = local.ignore_public_acls_b
+  restrict_public_buckets       = local.restrict_public_buckets_b
+  object_ownership              = local.object_ownership_b
+  append_region_suffix          = local.append_region_suffix_b
+  object_lock_enabled           = local.object_lock_enabled_b
+  force_destroy                 = local.force_destroy_b
+  force_allow_cloudtrail_digest = local.force_allow_cloudtrail_digest_b
+}
+
+module "replication" {
+  source  = "Invicton-Labs/secure-s3-bucket-replication/aws"
+  version = "~>0.1.0"
+  providers = {
+    aws.a = aws.a
+    aws.b = aws.b
+  }
+  bucket_a_module  = module.bucket_a
+  bucket_b_module  = module.bucket_b
+  replicate_a_to_b = var.replicate_a_to_b
+  replicate_b_to_a = var.replicate_b_to_a
+  a_to_b_rules     = local.a_to_b_rules
+  b_to_a_rules     = local.b_to_a_rules
+}

validation.tf

@@ -0,0 +1,6 @@
+module "assert_same_account" {
+  source        = "Invicton-Labs/assertion/null"
+  version       = "~>0.2.1"
+  condition     = data.aws_caller_identity.a.account_id == data.aws_caller_identity.b.account_id
+  error_message = "Replication may only be configured with this module for two buckets in the same AWS account."
+}