#210

[okstart1]

what

• Added an optional bucket_policy_conditions argument to the terraform-aws-s3-bucket module.
• This argument allows users to specify IAM policy conditions for the S3 bucket policy, particularly for privileged_principal_arns.
• Ensured that the addition is backward compatible and does not affect existing module users.

why

• Enhanced Security: By allowing conditions in IAM policies, users can restrict access based on specific AWS elements like VPC endpoints, source IP addresses, or user attributes. This is crucial for sensitive or regulated data stored in S3 buckets.
• Increased Flexibility: Users now have more control over their S3 bucket policies, enabling them to tailor access more precisely to their organizational requirements.
• Alignment with AWS Best Practices: Adding conditions to IAM policies is recommended as part of AWS security best practices. It helps in achieving the principle of least privilege.
• Community Request: This feature was requested by several users (refer to issue Add Support for Condition Block in Privileged Principal ARNs IAM Policy for S3 Bucket #210 ) to meet specific use cases not currently supported by the module.

references

• Closes Add Support for Condition Block in Privileged Principal ARNs IAM Policy for S3 Bucket #210 - GitHub issue requesting the ability to add condition blocks to the S3 bucket IAM policy. AWS Documentation on IAM Policy Conditions: AWS Policy Conditions
• Terraform AWS Provider Documentation: Terraform AWS S3 Bucket

[hans-d]

@okstart1 hi, can you execute the following?

README.md is outdated. Please run the following commands locally and push the file:
  make init
  make readme

[joe-niland]

@okstart1 Thanks for this contribution.

I don't think you need to duplicate the role to path mapping.

The way the module is set up, principals are defined separately to actions, so potentially you could add a new variable to define conditions to be applied to the statement.

[hans-d]

/terratest

[mergify]

This pull request now has conflicts. Could you fix it @okstart1? 🙏

[mergify]

Important

Title is necessary and should not be empty.

Kindly provide a meaningful title for this Pull Request.

[mergify]

This PR has been closed due to inactivity and merge conflicts.
Please resolve the conflicts and reopen if necessary.

[mergify]

Thanks @okstart1 for creating this pull request!

A maintainer will review your changes shortly. Please don't be discouraged if it takes a while.

While you wait, make sure to review our contributor guidelines.

Tip

Need help or want to ask for a PR review to be expedited?

Join us on Slack in the #pr-reviews channel.