# Day 67: AWS S3 Bucket Creation and Management   (Feb 1, 2024)

## **🙏 Introduction:**

In this blog, we will dive into the creation and management of S3 buckets, exploring key features and best practices.

## **🔶AWS S3 Bucket**

Amazon S3 (Simple Storage Service) is an object storage service that offers industry-leading scalability, data availability, security, and performance. It can be used for a variety of use cases, such as storing and retrieving data, hosting static websites, and more.

In this task, you will learn how to create and manage S3 buckets in AWS.

# **🎯Task: 1**

1. ### **Create an S3 bucket using Terraform**
    

* In our [**main.tf**](https://sutish.hashnode.dev/day-67-aws-s3-bucket-creation-and-management#heading-aws-s3-bucket) file, add the following code to create S3 bucket
    

```plaintext
provider "aws" {
        region = "us-west-2"
}

resource "aws_s3_bucket" "my_bucket" {
        bucket = "demokbucket0a"
}
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704990544140/9f739dc9-fceb-4e34-bee5-93e6d4dd89b8.png?auto=compress,format&format=webp align="left")

`terraform init`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704990932921/22571944-1070-449d-ad50-5925d5e48407.png?auto=compress,format&format=webp align="left")

`terraform plan`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704991936781/122c46cb-990e-455c-a60a-89c7ffd1b26e.png?auto=compress,format&format=webp align="left")

`terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704992059210/b8deec5f-a4a2-4c18-a1e5-ae08f0b70ff8.png?auto=compress,format&format=webp align="left")

1. ### **Configure the bucket to allow public read access**
    

* In our [**main.tf**](https://sutish.hashnode.dev/day-67-aws-s3-bucket-creation-and-management#heading-aws-s3-bucket) file, add resource block to allow public read access
    

```plaintext
resource "aws_s3_bucket_public_access_block" "example" {
            bucket = aws_s3_bucket.my_bucket.id

            block_public_acls       = false
            block_public_policy     = false
            ignore_public_acls      = false
            restrict_public_buckets = false
  }
resource "aws_s3_bucket_acl" "bucket_acl" {
        bucket = aws_s3_bucket.my_bucket.id
        acl    = "public-read"
 }
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704995469986/d4e4fc32-4765-47fa-a372-49c075ba43f2.png?auto=compress,format&format=webp align="left")

* Enable the ACL in the S3 bucket and choose Bucket owner preferred and save the change
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704995013654/89aab34d-c286-496a-83f2-326e769d0d9e.png?auto=compress,format&format=webp align="left")

`terraform plan`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704995521062/b2a856e8-09a2-4a38-9d1c-cf1e41d24bd6.png?auto=compress,format&format=webp align="left")

`terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704995755516/0b408226-0588-4174-add7-ee92494ff7fb.png?auto=compress,format&format=webp align="left")

* Check the bucket in the console for the public access
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704995798913/1e517b69-f4c2-465d-b3a3-d59b2061b53b.png?auto=compress,format&format=webp align="left")

1. ### **Create an S3 bucket policy that allows read-only access to a specific IAM user or role**
    

```plaintext
resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.my_bucket.id
  policy = data.aws_iam_policy_document.allow_read_only_access.json
}


data "aws_iam_policy_document" "allow_read_only_access" {
  statement {
    principals {
      type        = "AWS"
      identifiers = ["767397805477"]
    }

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]

    resources = [
      aws_s3_bucket.my_bucket.arn,
      "${aws_s3_bucket.my_bucket.arn}/*",
    ]
  }
}
```

To provide read-only access to a specific IAM user or role, the code creates an S3 bucket policy resource using the **aws\_s3\_bucket\_policy** resource type. The resource is associated with the S3 bucket resource **aws\_s3\_**[**bucket.my**](https://sutish.hashnode.dev/day-67-aws-s3-bucket-creation-and-management#heading-aws-s3-bucket)**\_bucket** using the bucket parameter.

The policy parameter is set to the Terraform data source [**data.aws**](https://sutish.hashnode.dev/day-67-aws-s3-bucket-creation-and-management#heading-aws-s3-bucket)**\_iam\_policy\_document.allow\_read\_only\_access.json**, which defines the policy document.

The policy document is created using the **data** block, which creates a Terraform data source.

The data source **aws\_iam\_policy\_document.allow\_read\_only\_access** defines a policy document that allows read-only access to the S3 bucket for a specific IAM user or role. The policy document is specified using JSON syntax.

The policy document has a single statement block, which defines the permissions to grant. The statement grants the **s3:GetObject** and **s3:ListBucket** permissions for the specified bucket and bucket objects. The principals block specifies the AWS user or role to which the permissions are granted. In this case, the identifiers field specifies the AWS account ID of the user or role to which read-only access is granted.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704997137173/e1408ab5-4cc5-42bf-ad79-047b56960002.png?auto=compress,format&format=webp align="left")

`terraform plan`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704997185362/86730965-bc96-49a0-9840-8c918c5c921b.png?auto=compress,format&format=webp align="left")

`terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704997234067/0c7dfb97-49bc-4418-ab9b-45deb426c606.png?auto=compress,format&format=webp align="left")

* Check the bucket to view the policy
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704997332287/db788da6-ea36-4660-8c23-e1353021fd3a.png?auto=compress,format&format=webp align="left")

1. ### **Enable versioning on the S3 bucket**
    

```plaintext
resource "aws_s3_bucket" "my_bucket" {
        bucket = "demokbucket0a"
 versioning {
      enabled = true
    }
}
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704998221817/29f207db-6891-481b-8ef1-47fd3b02c898.png?auto=compress,format&format=webp align="left")

`terraform plan`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704998275540/bd764f7f-63bb-4f11-8d70-1ad6bb786941.png?auto=compress,format&format=webp align="left")

`terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704998341308/c3ee8ffe-122a-4ea8-bdef-fca9ac355ed8.png?auto=compress,format&format=webp align="left")

* Check the bucket to view the Bucket Versioning
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1704998414567/05fa409f-bb0c-4938-9ec7-f0434e91f777.png?auto=compress,format&format=webp align="left")