rspec/rules/S6258/terraform/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

For https://aws.amazon.com/s3/[Amazon S3 access requests]:

----
resource "aws_s3_bucket" "mynoncompliantbucket" { # Sensitive
  bucket = "mynoncompliantbucketname"
}
----

For both Amazon https://aws.amazon.com/elasticloadbalancing/classic-load-balancer/[Classic Load Balancing] and https://aws.amazon.com/elasticloadbalancing/application-load-balancer/[Application Load Balancing]:

----
resource "aws_lb" "load_balancer" {
  access_logs {
    enabled = false # Sensitive
    bucket = "mycompliantbucket"
    bucket_prefix = "log/lb-"
  }
}
----

== Compliant Solution

For https://aws.amazon.com/s3/[Amazon S3 access requests]:

----
resource "aws_s3_bucket" "myloggingbucket" { 
  bucket = "myloggingbucketname"
  acl    = "log-delivery-write"
}

resource "aws_s3_bucket" "mycompliantbucket" { # Compliant
  bucket = "mycompliantbucketname"

  logging {
      target_bucket = "myloggingbucketname"
      target_prefix = "log/mycompliantbucket"
  }
}
----

For both Amazon https://aws.amazon.com/elasticloadbalancing/classic-load-balancer/[Classic Load Balancing] and https://aws.amazon.com/elasticloadbalancing/application-load-balancer/[Application Load Balancing]:

----
resource "aws_lb" "load_balancer" {
  access_logs {
    enabled = true
    bucket = "mycompliantbucket"
    bucket_prefix = "log/lb-"
  }
}
----

include::../see.adoc[]
ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

endif::env-github,rspecator-view[]