# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. # SPDX-License-Identifier: MIT-0 # # Permission is hereby granted, free of charge, to any person obtaining a copy of this # software and associated documentation files (the "Software"), to deal in the Software # without restriction, including without limitation the rights to use, copy, modify, # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to # permit persons to whom the Software is furnished to do so. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Data Source (https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) data "aws_caller_identity" "current" {} provider "aws" { region = "eu-west-1" } resource "aws_s3_bucket" "backend" { # checkov:skip=CKV_AWS_145:SSE-S3 is sufficient for this data # checkov:skip=CKV_AWS_18:Access logging is not required for data in this S3 Bucket # checkov:skip=CKV_AWS_144:CRR is not required for this data # checkov:skip=CKV2_AWS_61:A lifecycle is not required for Terraform state # checkov:skip=CKV2_AWS_62:Event notifications are not required bucket = "${data.aws_caller_identity.current.account_id}-terraform-backend" lifecycle { prevent_destroy = true } } resource "aws_s3_bucket_acl" "backend" { bucket = aws_s3_bucket.backend.id acl = "private" } resource "aws_s3_bucket_versioning" "backend" { bucket = aws_s3_bucket.backend.id versioning_configuration { status = "Enabled" } } resource "aws_s3_bucket_server_side_encryption_configuration" "backend" { bucket = aws_s3_bucket.backend.id rule { apply_server_side_encryption_by_default { sse_algorithm = "AES256" } } } resource "aws_s3_bucket_public_access_block" "backend" { bucket = aws_s3_bucket.backend.id block_public_acls = true block_public_policy = true ignore_public_acls = true restrict_public_buckets = true } resource "aws_dynamodb_table" "lock" { # checkov:skip=CKV_AWS_28:Point in time recovery is not required for a simple locking record # checkov:skip=CKV_AWS_119:KMS encryption is not required for a simple locking record # checkov:skip=CKV2_AWS_16:Autoscaling is not required name = "terraform-lock" read_capacity = 1 write_capacity = 1 hash_key = "LockID" attribute { name = "LockID" type = "S" } lifecycle { prevent_destroy = true } }