Initial commit

README.md

+tf_mod_aws_remotestate
+==
+
+A Terraform module for creating an initial S3 bucket for remote state storage
+and a DynamoDB table for remote state locking.
+
+```
+module "remote_state" {
+  source = "git::https://git.steamhaus.co.uk/steamhaus/tf_mod_aws_remotestate"
+
+  name  = "my-awsesome-remote-state"
+}
+```
+
+Notes:
+- The name variable names both the S3 bucket and the DynamoDB table and therefore
+needs to be globally unique.
+- The S3 bucket policy only allows SSE object uploads so ensure Terraform is
+configured with the encryption setting on the S3 backend.

dynamodb.tf

+resource "aws_dynamodb_table" "remote_state_locking" {
+  name           = "${var.name}"
+  read_capacity  = "${var.dynamodb_read_capacity}"
+  write_capacity = "${var.dynamodb_write_capacity}"
+  hash_key       = "LockID"
+
+  attribute {
+    name = "LockID"
+    type = "S"
+  }
+}

s3.tf

+resource "aws_s3_bucket" "remote_state" {
+  bucket = "${var.name}"
+  acl    = "private"
+
+  versioning {
+    enabled = true
+  }
+}
+
+data "aws_iam_policy_document" "remote_state_always_enc" {
+  statement {
+    sid       = "DenyIncorrectEncryptionHeader"
+    effect    = "Deny"
+    actions   = ["s3:PutObject"]
+    resources = ["arn:aws:s3:::${var.name}/*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "StringNotEquals"
+      variable = "s3:x-amz-server-side-encryption"
+      values   = ["AES256"]
+    }
+  }
+
+  statement {
+    sid       = "DenyUnEncryptedObjectUploads"
+    effect    = "Deny"
+    actions   = ["s3:PutObject"]
+    resources = ["arn:aws:s3:::${var.name}/*"]
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "Null"
+      variable = "s3:x-amz-server-side-encryption"
+      values   = ["true"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "remote_state" {
+  bucket = "${aws_s3_bucket.remote_state.id}"
+  policy = "${data.aws_iam_policy_document.remote_state_always_enc.json}"
+}

variables.tf

+variable "name" {}
+
+variable "dynamodb_read_capacity" {
+  default = "5"
+}
+
+variable "dynamodb_write_capacity" {
+  default = "5"
+}