S3 bucket Object Lock should use COMPLIANCE retention mode

Implementation

Choose the approach that matches how you manage Terraform.

Use the compliance.tf module to enforce this control by default. See get started with compliance.tf.

module "s3_bucket" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = "~> 5.16"

  lifecycle_rule = [
    {
      abort_incomplete_multipart_upload_days = 7
      enabled                                = true
      id                                     = "example-1"
    },
  ]
  logging = {
    target_bucket = "example"
    target_prefix = "example"
  }
  object_lock_configuration = {
    rule = {
      default_retention = {
        days = 30
        mode = "COMPLIANCE"
      }
    }
  }
  replication_configuration = {
    role = "arn:aws:iam::123456789012:role/example-replication"
    rule = [
      {
        destination = {
          bucket = "arn:aws:s3:::example-replica"
        }
        status = "Enabled"
      },
    ]
  }
  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        kms_master_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
        sse_algorithm     = "aws:kms"
      }
    }
  }
  versioning = {
    enabled = true
  }
}

module "s3_bucket" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = "~> 5.16"

  lifecycle_rule = [
    {
      abort_incomplete_multipart_upload_days = 7
      enabled                                = true
      id                                     = "example-1"
    },
  ]
  logging = {
    target_bucket = "example"
    target_prefix = "example"
  }
  object_lock_configuration = {
    rule = {
      default_retention = {
        days = 30
        mode = "COMPLIANCE"
      }
    }
  }
  replication_configuration = {
    role = "arn:aws:iam::123456789012:role/example-replication"
    rule = [
      {
        destination = {
          bucket = "arn:aws:s3:::example-replica"
        }
        status = "Enabled"
      },
    ]
  }
  server_side_encryption_configuration = {
    rule = {
      apply_server_side_encryption_by_default = {
        kms_master_key_id = "arn:aws:kms:eu-west-1:123456789012:key/00000000-0000-0000-0000-000000000000"
        sse_algorithm     = "aws:kms"
      }
    }
  }
  versioning = {
    enabled = true
  }
}

This control is enforced automatically with Compliance.tf modules. Start free trial

If you use terraform-aws-modules/s3-bucket/aws, set the right module inputs for this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 5.16"

  object_lock_configuration = {
    rule = {
      default_retention = {
        days = 30
        mode = "COMPLIANCE"
      }
    }
  }
  object_lock_enabled = true
}

Use AWS provider resources directly. See docs for the resources involved: aws_s3_bucket_object_lock_configuration.

resource "aws_s3_bucket" "this" {
  bucket        = "example-abc123"
  force_destroy = true
}

resource "aws_s3_bucket_object_lock_configuration" "this" {
  bucket = "example-bucket-abc123"
  rule {
    default_retention {
      mode = "COMPLIANCE"
    }
  }
}

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: s3_bucket_object_lock_compliance_mode

Stop fixing controls one by one. Compliance.tf modules enforce 85 module-backed controls for EU GMP Annex 11 automatically.

Start free trial View all controls

S3 bucket Object Lock should use COMPLIANCE retention mode

Implementation

Tool mappings

On this page