TerraformでS3バケットを管理する方法｜バージョニング・ライフサイクル・暗号化のリソース分割設計

この記事のポイント

・AWS Provider v4以降ではaws_s3_bucket_*リソースで属性を分割して定義する
・バージョニング有効化後にライフサイクルルールを設定するにはdepends_onが必要
・SSE-S3はbucket_key_enabled = trueでKMS APIコール料金を削減できる
・force_destroyはオブジェクト全削除を伴うため本番バケットへの使用は要注意

# AWS Provider v3系の旧スタイル（v4以降は非推奨）
resource "aws_s3_bucket" "example" {
  bucket = "my-terraform-bucket"

  versioning {
    enabled = true
  }

  lifecycle_rule {
    id      = "delete-old-versions"
    enabled = true

    noncurrent_version_expiration {
      days = 30
    }
  }

  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        sse_algorithm = "AES256"
      }
    }
  }
}

# terraform plan 実行時の警告例
Warning: Argument is deprecated

  with aws_s3_bucket.example,
  on main.tf line 8, in resource "aws_s3_bucket" "example":
   8:   versioning {

Use the aws_s3_bucket_versioning resource instead.

resource "aws_s3_bucket" "example" {
  bucket = "my-terraform-bucket-prod"

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = aws_s3_bucket.example.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_versioning" "example" {
  bucket = aws_s3_bucket.example.id

  versioning_configuration {
    status = "Enabled"
    # status = "Suspended"  # 停止（削除はできない）
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  # バージョニングが有効になった後に設定するためdepends_onが必須
  depends_on = [aws_s3_bucket_versioning.example]

  rule {
    id     = "delete-old-versions"
    status = "Enabled"

    # 最新版以外のバージョンを30日後に削除
    noncurrent_version_expiration {
      noncurrent_days = 30
    }

    # 不完全なマルチパートアップロードを7日後に削除
    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }
}

rule {
  id     = "transition-lifecycle"
  status = "Enabled"

  # 90日後にStandard-IAへ移行
  transition {
    days          = 90
    storage_class = "STANDARD_IA"
  }

  # 365日後にGlacier Flexible Retrievalへ移行
  transition {
    days          = 365
    storage_class = "GLACIER"
  }

  # 旧バージョンも同様に移行
  noncurrent_version_transition {
    noncurrent_days = 30
    storage_class   = "STANDARD_IA"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
    # S3バケットキーを有効化するとKMS APIコールを削減できる
    bucket_key_enabled = true
  }
}

resource "aws_kms_key" "s3" {
  description             = "KMS key for S3 server-side encryption"
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

resource "aws_kms_alias" "s3" {
  name          = "alias/my-s3-key"
  target_key_id = aws_kms_key.s3.key_id
}

resource "aws_s3_bucket_server_side_encryption_configuration" "kms" {
  bucket = aws_s3_bucket.example.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
    bucket_key_enabled = true
  }
}

# terraform destroy 実行時のエラー例
Error: deleting Amazon S3 Bucket (my-terraform-bucket-prod): BucketNotEmpty:
  The bucket you tried to delete is not empty.
  You must delete all versions in the bucket.
  status code: 409, request id: XXXX, host id: YYYY

resource "aws_s3_bucket" "dev" {
  bucket        = "my-dev-bucket"
  # 開発環境専用。本番バケットには設定しないこと
  force_destroy = true
}

# ライフサイクルルールの登録状態を確認
# aws s3api get-bucket-lifecycle-configuration #   --bucket my-terraform-bucket-prod

{
    "Rules": [
        {
            "ID": "delete-old-versions",
            "Status": "Enabled",
            "NoncurrentVersionExpiration": {
                "NoncurrentDays": 30
            }
        }
    ]
}