코드

resource "aws_s3_bucket" "test" {
  bucket = "tf-test-hyeob-bucket"

  tags = {
    Name        = "tf-test-hyeob"
    Environment = "Dev"
  }
}

resource "aws_s3_bucket_acl" "test" {
  bucket = aws_s3_bucket.test.id
  # `private`, `public-read`, `public-read-write`, `aws-exec-read`, `authenticated-read`, `log-delivery-write` 중 하나 선택. 
  # 기본값은 `private`.
  # `grant`와 대비되는 속성
  acl = "private"
}

# 파일 업로드
resource "aws_s3_object" "object" {
    for_each        = fileset("uploads/", "*.html")
    bucket          = data.aws_s3_bucket.selected-bucket.bucket
    key             = each.value
    source          = "uploads/${each.value}"
    content_type    = "text/html"
    etag            = filemd5("uploads/${each.value}")
    acl             = "public-read"
}

# 버킷 정책
resource "aws_s3_bucket_policy" "allow_access_from_another_account" {
  bucket = aws_s3_bucket.test.id
  policy = data.aws_iam_policy_document.allow_access_from_another_account.json
}
data "aws_iam_user" "test" {
  user_name = var.user_id
}
data "aws_iam_policy_document" "allow_access_from_another_account" {
  statement {
    sid = "bucketPolicyTest"
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.test.arn,
      "${aws_s3_bucket.test.arn}/*",
    ]

    # effect = "Allow"

    # condition {
    #   test     = "IpAddressIfExists"
    #   variable = "aws:SourceIp"

    #   values = [
    #     "119.194.170.104/32"
    #   ]
    # }
  }
}

# 버전 관리 활성화 여부
resource "aws_s3_bucket_versioning" "test" {
  bucket = aws_s3_bucket.test.id
  versioning_configuration {
    status = "Enabled" # or Disabled
  }
}

# CORS 규칙 설정
# resource "aws_s3_bucket_cors_configuration" "test" {
#   bucket = aws_s3_bucket.test.id

#   cors_rule {
#     allowed_headers = ["*"]
#     allowed_methods = ["PUT", "POST"]
#     allowed_origins = ["https://s3-website-test.hashicorp.com"]
#     expose_headers  = ["ETag"]
#     max_age_seconds = 3000
#   }

#   cors_rule {
#     allowed_methods = ["GET"]
#     allowed_origins = ["*"]
#   }
# }

# 서버 액세스 로깅
## 로깅용 버킷 생성
resource "aws_s3_bucket" "log_bucket" {
  bucket = "tf-test-hyeob-log-bucket"
}
## 로그 쓰기 전용 ACL
resource "aws_s3_bucket_acl" "log_bucket_acl" {
  bucket = aws_s3_bucket.log_bucket.id
  acl    = "log-delivery-write"
}
## 서버 액세스 로깅 설정
resource "aws_s3_bucket_logging" "test" {
  bucket = aws_s3_bucket.test.id

  target_bucket = aws_s3_bucket.log_bucket.id # 대상 버킷으로 현재 버킷의 로그를 전송
  target_prefix = "log/"                      # s3://<bucket>/<prefix> 경로에 로그가 저장됨.
}

# 정적 웹 사이트 호스팅
resource "aws_s3_bucket_website_configuration" "test" {
  bucket = aws_s3_bucket.test.id

  index_document {
    suffix = "index.html"
  }

  error_document {
    key = "error.html"
  }

  # routing_rule {
  #   condition {
  #     key_prefix_equals = "docs/"
  #   }
  #   redirect {
  #     replace_key_prefix_with = "documents/"
  #   }
  # }

  # 라우팅 규칙을 JSON 내용 그대로 입력 가능
  #   routing_rules = <<EOF
  # [{
  #     "Condition": {
  #         "KeyPrefixEquals": "docs/"
  #     },
  #     "Redirect": {
  #         "ReplaceKeyPrefixWith": ""
  #     }
  # }]
  # EOF
}

# 수명 주기 설정
resource "aws_s3_bucket_lifecycle_configuration" "test" {
  bucket = aws_s3_bucket.test.id

  rule {
    id = "log"

    expiration {
      days = 90
    }

    filter {
      and {
        prefix = "log/"

        tags = {
          rule      = "log"
          autoclean = "true"
        }
      }
    }

    status = "Enabled"

    transition {
      days          = 30
      storage_class = "STANDARD_IA"
    }

    transition {
      days          = 60
      storage_class = "GLACIER"
    }
  }

  rule {
    id = "tmp"

    filter {
      prefix = "tmp/"
    }

    expiration {
      date = "2023-01-13T00:00:00Z"
    }

    status = "Enabled"
  }
}