Terraform Demo S3 Deployment

​

Repository layout (highlight)

• Root main.tf — provider, random_id, one aws_s3_bucket resource, and a module call.
• modules/s3_bucket_with_env_tag/ — a simple module that creates a bucket and applies an env tag.
• Terraform state and plan artifacts are created when you run terraform init and terraform apply.

​

Root configuration (abbreviated)

# Configure the AWS provider
provider "aws" {
  region = "us-east-1"
}

# Random ID to ensure unique bucket name
resource "random_id" "bucket_id" {
  byte_length = 4
}

# Create an S3 bucket
resource "aws_s3_bucket" "tf-demo-bucket-1" {
  bucket              = "tf-demo-bucket-1-${random_id.bucket_id.hex}"
  object_lock_enabled = true
}

module "s3_bucket" {
  source = "./modules/s3_bucket_with_env_tag"
  env    = "dev"
  name   = "tf-demo-bucket-2-${random_id.bucket_id.hex}" # Ensure unique bucket name
}

• provider "aws" sets the AWS region.
• random_id.bucket_id provides a short hex suffix so bucket names are globally unique.
• object_lock_enabled = true enables S3 Object Lock at bucket creation (see important notes below).
• The module block reuses modules/s3_bucket_with_env_tag and passes env and name inputs.

​

Module: modules/s3_bucket_with_env_tag

resource "aws_s3_bucket" "tf-demo-bucket-2" {
  bucket              = var.name
  object_lock_enabled = true
  tags = {
    env = var.env
  }
}

variable "env" {
  description = "Environment tag for the bucket"
  type        = string

  validation {
    condition     = contains(["dev", "prod"], var.env)
    error_message = "The env variable must be either 'dev' or 'prod'."
  }
}

variable "name" {
  description = "The name of the bucket"
  type        = string
}

• Creates a bucket with the provided name.
• Enables object lock on creation.
• Applies an env tag set to the supplied env value (validated to be either dev or prod).

resource "aws_s3_bucket" "example" {
  bucket              = "example-bucket"
  object_lock_enabled = true

  versioning {
    enabled = true
  }
}

​

Notes and caveats

• Object Lock must be enabled at bucket creation and cannot be disabled later. Plan accordingly for retention and compliance.
• Using a random_id or other unique suffix avoids global name collisions for S3 buckets.
• The env tag applied by the module helps with cost allocation and filtering in the AWS console.

​

What resources will be created?

​

Deploying the Terraform configuration

1. Change into the Terraform directory and initialize:

cd tf
terraform init

2. Apply the configuration:

terraform apply

Plan: 3 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

Enter a value:

​

Summary

• Declarative HCL creates reproducible AWS S3 resources.
• Modules encapsulate reusable patterns (here, a bucket with an env tag).
• Use random_id or other uniqueness strategies for globally unique S3 names.
• Remember to enable versioning whenever you enable object_lock_enabled.

​

Links and references

• Terraform Documentation: AWS Provider
• Amazon S3 Object Lock Overview
• Terraform: Modules