Terraform Provider v5 Support

.github/renovate.json

@@ -1,13 +1,14 @@
 {
   "extends": [
     "config:base",
-    ":preserveSemverRanges"
+    ":preserveSemverRanges",
+    ":rebaseStalePrs"
   ],
-  "baseBranches": ["main", "master", "/^release\\/v\\d{1,2}$/"],
+  "baseBranches": ["main"],
   "labels": ["auto-update"],
   "dependencyDashboardAutoclose": true,
   "enabledManagers": ["terraform"],
   "terraform": {
-    "ignorePaths": ["**/context.tf", "examples/**"]
+    "ignorePaths": ["**/context.tf"]
   }
 }

.github/workflows/release-branch.yml

@@ -10,6 +10,7 @@ on:
       - 'docs/**'
       - 'examples/**'
       - 'test/**'
+      - 'README.*'
 
 permissions:
   contents: write

.github/workflows/release-published.yml

@@ -11,4 +11,4 @@ permissions:
 
 jobs:
   terraform-module:
-    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release.yml@main
+    uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-published.yml@main

examples/complete/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.9"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = ">= 1.2"
+    }
+  }
+}

main.tf

@@ -1,6 +1,6 @@
 locals {
   enabled    = module.this.enabled
-  bucket_arn = "arn:${data.aws_partition.current.partition}:s3:::${join("", aws_s3_bucket.default.*.id)}"
+  bucket_arn = "arn:${data.aws_partition.current.partition}:s3:::${join("", aws_s3_bucket.default[*].id)}"
 
   website_config = {
     redirect_all = [
@@ -19,10 +19,12 @@ locals {
 }
 
 module "logs" {
-  source                   = "cloudposse/s3-log-storage/aws"
-  version                  = "0.20.0"
+  source  = "cloudposse/s3-log-storage/aws"
+  version = "1.4.2"
+
+  enabled = local.enabled && var.logs_enabled
+
   attributes               = ["logs"]
-  enabled                  = local.enabled && var.logs_enabled
   standard_transition_days = var.logs_standard_transition_days
   glacier_transition_days  = var.logs_glacier_transition_days
   expiration_days          = var.logs_expiration_days
@@ -38,13 +40,28 @@ module "default_label" {
   context    = module.this.context
 }
 
+resource "aws_s3_bucket_public_access_block" "s3_allow_public_access" {
+  bucket = aws_s3_bucket.default[0].id
+
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
+}
+
+resource "aws_s3_bucket_ownership_controls" "s3_bucket_ownership_controls" {
+  bucket = aws_s3_bucket.default[0].id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
 resource "aws_s3_bucket" "default" {
   count = local.enabled ? 1 : 0
 
-  #bridgecrew:skip=BC_AWS_S3_1:The bucket used for a public static website. (https://docs.bridgecrew.io/docs/s3_1-acl-read-permissions-everyone)
   #bridgecrew:skip=BC_AWS_S3_14:Skipping `Ensure all data stored in the S3 bucket is securely encrypted at rest` check until bridgecrew will support dynamic blocks (https://github.com/bridgecrewio/checkov/issues/776).
   #bridgecrew:skip=CKV_AWS_52:Skipping `Ensure S3 bucket has MFA delete enabled` due to issue using `mfa_delete` by terraform (https://github.com/hashicorp/terraform-provider-aws/issues/629).
-  acl           = "public-read"
   bucket        = var.hostname
   tags          = module.default_label.tags
   force_destroy = var.force_destroy
@@ -115,6 +132,8 @@ resource "aws_s3_bucket_policy" "default" {
 
   bucket = aws_s3_bucket.default[0].id
   policy = data.aws_iam_policy_document.default[0].json
+
+  depends_on = [aws_s3_bucket_public_access_block.s3_allow_public_access]
 }
 
 data "aws_iam_policy_document" "default" {
@@ -155,7 +174,7 @@ data "aws_iam_policy_document" "default" {
 
   # Support replication ARNs
   dynamic "statement" {
-    for_each = flatten(data.aws_iam_policy_document.replication.*.statement)
+    for_each = flatten(data.aws_iam_policy_document.replication[*].statement)
     content {
       actions       = lookup(statement.value, "actions", null)
       effect        = lookup(statement.value, "effect", null)
@@ -193,7 +212,7 @@ data "aws_iam_policy_document" "default" {
 
   # Support deployment ARNs
   dynamic "statement" {
-    for_each = flatten(data.aws_iam_policy_document.deployment.*.statement)
+    for_each = flatten(data.aws_iam_policy_document.deployment[*].statement)
     content {
       actions       = lookup(statement.value, "actions", null)
       effect        = lookup(statement.value, "effect", null)
@@ -287,8 +306,8 @@ module "dns" {
   aliases          = compact([signum(length(var.parent_zone_id)) == 1 || signum(length(var.parent_zone_name)) == 1 ? var.hostname : ""])
   parent_zone_id   = var.parent_zone_id
   parent_zone_name = var.parent_zone_name
-  target_dns_name  = join("", aws_s3_bucket.default.*.website_domain)
-  target_zone_id   = join("", aws_s3_bucket.default.*.hosted_zone_id)
+  target_dns_name  = join("", aws_s3_bucket.default[*].website_domain)
+  target_zone_id   = join("", aws_s3_bucket.default[*].hosted_zone_id)
 
   context = module.this.context
 }

outputs.tf

@@ -4,31 +4,31 @@ output "hostname" {
 }
 
 output "s3_bucket_name" {
-  value       = join("", aws_s3_bucket.default.*.id)
+  value       = join("", aws_s3_bucket.default[*].id)
   description = "DNS record of the website bucket"
 }
 
 output "s3_bucket_domain_name" {
-  value       = join("", aws_s3_bucket.default.*.bucket_domain_name)
+  value       = join("", aws_s3_bucket.default[*].bucket_domain_name)
   description = "Name of the website bucket"
 }
 
 output "s3_bucket_arn" {
-  value       = join("", aws_s3_bucket.default.*.arn)
+  value       = join("", aws_s3_bucket.default[*].arn)
   description = "ARN identifier of the website bucket"
 }
 
 output "s3_bucket_website_endpoint" {
-  value       = join("", aws_s3_bucket.default.*.website_endpoint)
+  value       = join("", aws_s3_bucket.default[*].website_endpoint)
   description = "The website endpoint URL"
 }
 
 output "s3_bucket_website_domain" {
-  value       = join("", aws_s3_bucket.default.*.website_domain)
+  value       = join("", aws_s3_bucket.default[*].website_domain)
   description = "The domain of the website endpoint"
 }
 
 output "s3_bucket_hosted_zone_id" {
-  value       = join("", aws_s3_bucket.default.*.hosted_zone_id)
+  value       = join("", aws_s3_bucket.default[*].hosted_zone_id)
   description = "The Route 53 Hosted Zone ID for this bucket's region"
 }

versions.tf

@@ -1,10 +1,10 @@
 terraform {
-  required_version = ">= 0.13.0"
+  required_version = ">= 1.0"
 
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = ">= 3.0, < 4.0.0"
+      version = ">= 4.9"
     }
     local = {
       source  = "hashicorp/local"