Based on #383 findings, in Checkov https://github.com/bridgecrewio/checkov/pull/5599 was added check for disabled ACL in S3 Buckets and set object ownership to BucketOwnerEnforced which disable usage of the ACL.
When this parameter is set and ACL is trying to be created it gives error in Terraform:
module.bootstrap["vmseries-01"].aws_s3_bucket_acl.this[0]: Still creating... [10s elapsed]
╷
│ Error: creating S3 Bucket (pi-chore334194cc585f9651) ACL: operation error S3: PutBucketAcl, https response error StatusCode: 400, RequestID: NK9CT6SCXPYH4WHM, HostID: dVY0b0Hu04SRZrhSLyW+fCTjtruromIxOWNRhZH2mW9Xe3IpGWmDIJ8r6u6MqAsvdVQEQNkJ6w0=, api error AccessControlListNotSupported: The bucket does not allow ACLs
│
│ with module.bootstrap["vmseries-01"].aws_s3_bucket_acl.this[0],
│ on ../../modules/bootstrap/main.tf line 66, in resource "aws_s3_bucket_acl" "this":
│ 66: resource "aws_s3_bucket_acl" "this" {
│
╵
I try to create dynamic rule based on ACL creation but it sill raise the error from Chekov, so I decide to remove it completely from the codebase.
Here is also AWS documentation which was a base to create rule in Checkov -> link
Also link to the Checkov info about that rule.
Another quick fix was removing unused TF file and move S3 files structure for full bootstrapping to the example that use full bootstrap.
How Has This Been Tested?
Deployed in AWS, check if everything works and if full bootstrap was done without issue.
Types of changes
Bug fix (non-breaking change which fixes an issue)
Checklist
[x] I have updated the documentation accordingly.
[x] I have read the CONTRIBUTING document.
[ ] I have added tests to cover my changes if appropriate.
Description
Based on #383 findings, in Checkov https://github.com/bridgecrewio/checkov/pull/5599 was added check for disabled ACL in S3 Buckets and set object ownership to
BucketOwnerEnforced
which disable usage of the ACL. When this parameter is set and ACL is trying to be created it gives error in Terraform:I try to create dynamic rule based on ACL creation but it sill raise the error from Chekov, so I decide to remove it completely from the codebase.
Here is also AWS documentation which was a base to create rule in Checkov -> link Also link to the Checkov info about that rule.
Another quick fix was removing unused TF file and move S3 files structure for full bootstrapping to the example that use full bootstrap.
How Has This Been Tested?
Deployed in AWS, check if everything works and if full bootstrap was done without issue.
Types of changes
Checklist