IaC Bazaar
AWSLive-tested

AWS S3 Bucket (hardened)

Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.

terraformAWS#aws

Compare Object Storage across clouds →

Part of: AWS Production Landing Zone

aws-s3-bucketterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan tests (mocked: validation rules · outputs)

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-11 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o aws-s3-bucket-1.0.1.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/aws-s3-bucket/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle aws-s3-bucket-1.0.1.sigstore.json \
  aws-s3-bucket-1.0.1.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "2584dfe4309dc6024749f4ae70735cd6025ab6f6440d88ef339270d682ead14a  aws-s3-bucket-1.0.1.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "s3_bucket" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-s3-bucket/aws"
  version = "1.0.1"
}

Free module — Terraform/OpenTofu downloads it with no token or setup. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

This module is in the Free band, and a free account sees the contract of every Free module — no subscription needed.

Create a free account →Sign in

Documentation

aws-s3-bucket

A hardened-by-default private AWS S3 bucket module. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 5.0, < 7.0.

Secure defaults:

  • Server-side encryption (AES256, or SSE-KMS when kms_key_arn is set)
  • Object versioning (on by default)
  • Full public-access block
  • Bucket policy denying any non-TLS (aws:SecureTransport = false) access
  • Default lifecycle rule aborting incomplete multipart uploads after 7 days (set abort_incomplete_multipart_upload_days = null to manage lifecycle configuration outside the module)
  • Optional server access logging into a buyer-owned bucket via access_log_bucket

Upgrade note

Since 2026-08 the module creates a default aws_s3_bucket_lifecycle_configuration with a single rule that aborts incomplete multipart uploads after abort_incomplete_multipart_upload_days (7) days — a cost-hygiene rule that never touches completed objects. Existing buckets gain the rule on the next apply. S3 allows only one lifecycle configuration per bucket, so if you manage lifecycle rules outside the module, set abort_incomplete_multipart_upload_days = null.

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Usage
  • Inputs
  • Outputs

Related modules

AWS✓ live-tested

EFS File System (encrypted, in-transit TLS)

An EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit.

$29.00v1.0.0
Azure✓ live-tested

Azure Storage Account (secure-by-default)

Storage account with containers/file shares, lifecycle rules, network rules, CMK encryption and private endpoint options - Azure's most-deployed resource done right.

$29.00v1.0.0
Google Cloud✓ live-tested

Cloud Storage Bucket

Hardened GCS bucket with uniform access, versioning, lifecycle/soft-delete policies, CMEK and least-privilege IAM.

$0.00v1.0.1
LinodeAlt & Specialty Clouds

Linode Object Storage Bucket

S3-compatible bucket with scoped access keys, versioning, lifecycle rules, and optional static-site hosting.

$0.00v1.0.0
Oracle CloudOracle Cloud

Object Storage Bucket

Bucket with versioning, lifecycle/auto-tiering, retention rules, replication and pre-authenticated request support.

$0.00v1.0.0