remove vault s3 bucket versioning config

dsaidgovsg · Mar 6, 2024 · 3a76bd0 · 3a76bd0
1 parent 91448eb
commit 3a76bd0
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 14 deletions.
diff --git a/modules/core/vault.tf b/modules/core/vault.tf
@@ -44,8 +44,8 @@ module "vault" {
   allowed_ssh_cidr_blocks              = concat([data.aws_vpc.this.cidr_block], var.allowed_ssh_cidr_blocks)
   associate_public_ip_address          = var.associate_public_ip_address
 
-  enable_s3_backend = var.vault_enable_s3_backend
-  s3_bucket_name    = var.vault_s3_bucket_name
+  enable_s3_backend           = var.vault_enable_s3_backend
+  s3_bucket_name              = var.vault_s3_bucket_name
 
   enable_auto_unseal      = var.vault_enable_auto_unseal
   auto_unseal_kms_key_arn = var.vault_auto_unseal_kms_key_arn
@@ -91,8 +91,8 @@ data "template_file" "user_data_vault_cluster" {
     kms_aes_root       = "/opt/aes-kms"
 
     # S3 Variables
-    enable_s3_backend = var.vault_enable_s3_backend ? "true" : "false"
-    s3_bucket_name    = var.vault_s3_bucket_name
+    enable_s3_backend           = var.vault_enable_s3_backend ? "true" : "false"
+    s3_bucket_name              = var.vault_s3_bucket_name
 
     consul_prefix = var.integration_consul_prefix
 

diff --git a/modules/vault-cluster/INOUT.md b/modules/vault-cluster/INOUT.md
@@ -29,7 +29,6 @@
 | enable\_auto\_unseal | (Vault Enterprise only) Emable auto unseal of the Vault cluster | `bool` | `false` | no |
 | enable\_dynamo\_backend | Whether to use a DynamoDB storage backend instead of Consul | `bool` | `false` | no |
 | enable\_s3\_backend | Whether to configure an S3 storage backend in addition to Consul. | `bool` | `false` | no |
-| enable\_s3\_bucket\_versioning | Whether to enable bucket versioning for the S3 bucket. | `bool` | `false` | no |
 | enabled\_metrics | List of autoscaling group metrics to enable. | `list(string)` | `[]` | no |
 | force\_destroy\_s3\_bucket | If 'configure\_s3\_backend' is enabled and you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves. Only used if 'enable\_s3\_backend' is set to true. | `bool` | `false` | no |
 | health\_check\_grace\_period | Time, in seconds, after instance comes into service before checking health. | `number` | `300` | no |

diff --git a/modules/vault-cluster/main.tf b/modules/vault-cluster/main.tf
@@ -287,10 +287,6 @@ resource "aws_s3_bucket" "vault_storage" {
     var.s3_bucket_tags,
   )
 
-  versioning {
-    enabled = var.enable_s3_bucket_versioning
-  }
-
   # aws_launch_configuration.launch_configuration in this module sets create_before_destroy to true, which means
   # everything it depends on, including this resource, must set it as well, or you'll get cyclic dependency errors
   # when you try to do a terraform destroy.

diff --git a/modules/vault-cluster/variables.tf b/modules/vault-cluster/variables.tf
@@ -203,11 +203,6 @@ variable "s3_bucket_tags" {
   default     = {}
 }
 
-variable "enable_s3_bucket_versioning" {
-  description = "Whether to enable bucket versioning for the S3 bucket."
-  default     = false
-}
-
 variable "force_destroy_s3_bucket" {
   description = "If 'configure_s3_backend' is enabled and you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves. Only used if 'enable_s3_backend' is set to true."
   default     = false