If osquery_carve_s3_bucket.kms.create_kms_key = true, this module now creates the KMS key first and manages the custom key policy through a separate attachment resource. If fleet_role_name is omitted, the module still creates the key but leaves the default KMS key policy in place and does not attach a custom policy.

When a module-created customer-managed key must trust the Fleet IAM role, Terraform needs to resolve that role through data.aws_iam_role in order to build the KMS key policy. Because that data source cannot read a role that is being created in the same apply, this is a technical limitation that requires a two-stage apply:

Apply once without osquery_carve_s3_bucket.kms.fleet_role_name so the Fleet IAM role and the KMS key are created.
Set osquery_carve_s3_bucket.kms.fleet_role_name to the existing Fleet role name and apply again so the module can resolve the role ARN and attach the KMS key policy.

The IAM policy exported by this addon is intentionally S3-only. KMS authorization is handled in the KMS key policy for module-created keys. If osquery_carve_s3_bucket.kms.kms_key_arn is set, this module does not manage the referenced key policy and does not export a generic KMS IAM policy for it.

When bringing your own KMS key, it is your responsibility to ensure that key policy and any separately managed IAM permissions allow the Fleet role to perform the required KMS actions for S3 object encryption and decryption.

S3 Bucket Policy: Deny Non-HTTPS

This module automatically attaches a bucket policy that denies any requests made over plain HTTP. No configuration is required.

Requirements

Name	Version
terraform	>= 1.12.0
aws	>= 6.37.0

Providers

Name	Version
aws	6.39.0

Modules

No modules.

Resources

Name	Type
aws_iam_policy.main	resource
aws_kms_alias.osquery_carve	resource
aws_kms_key.osquery_carve	resource
aws_kms_key_policy.osquery_carve	resource
aws_s3_bucket.main	resource
aws_s3_bucket_lifecycle_configuration.main	resource
aws_s3_bucket_policy.deny_insecure_transport	resource
aws_s3_bucket_public_access_block.main	resource
aws_s3_bucket_server_side_encryption_configuration.main	resource
aws_caller_identity.current	data source
aws_iam_policy_document.deny_insecure_transport	data source
aws_iam_policy_document.main	data source
aws_iam_policy_document.osquery_carve_kms	data source
aws_iam_role.osquery_carve_fleet	data source
aws_kms_key.osquery_carve_provided	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
osquery_carve_s3_bucket	Configuration for the osquery carve S3 bucket, including optional customer-managed KMS settings.	object({ name = optional(string, "fleet-osquery-results-archive") expires_days = optional(number, 1) tags = optional(map(string), {}) kms = optional(object({ kms_key_arn = optional(string, null) create_kms_key = optional(bool, false) kms_alias = optional(string, "osquery-carve") kms_base_policy = optional(list(object({ sid = string effect = string principals = object({ type = string identifiers = list(string) }) actions = list(string) resources = list(string) conditions = optional(list(object({ test = string variable = string values = list(string) })), []) })), null) extra_kms_policies = optional(list(any), []) fleet_role_name = optional(string, null) }), { kms_key_arn = null create_kms_key = false kms_alias = "osquery-carve" kms_base_policy = null extra_kms_policies = [] fleet_role_name = null }) })	{ "expires_days": 1, "kms": { "create_kms_key": false, "extra_kms_policies": [], "fleet_role_name": null, "kms_alias": "osquery-carve", "kms_base_policy": null, "kms_key_arn": null }, "name": "fleet-osquery-results-archive", "tags": {} }	no

Name

Description

Type

Default

Required

osquery_carve_s3_bucket

Configuration for the osquery carve S3 bucket, including optional customer-managed KMS settings.

object({
    name         = optional(string, "fleet-osquery-results-archive")
    expires_days = optional(number, 1)
    tags         = optional(map(string), {})
    kms = optional(object({
      kms_key_arn    = optional(string, null)
      create_kms_key = optional(bool, false)
      kms_alias      = optional(string, "osquery-carve")
      kms_base_policy = optional(list(object({
        sid    = string
        effect = string
        principals = object({
          type        = string
          identifiers = list(string)
        })
        actions   = list(string)
        resources = list(string)
        conditions = optional(list(object({
          test     = string
          variable = string
          values   = list(string)
        })), [])
      })), null)
      extra_kms_policies = optional(list(any), [])
      fleet_role_name    = optional(string, null)
      }), {
      kms_key_arn        = null
      create_kms_key     = false
      kms_alias          = "osquery-carve"
      kms_base_policy    = null
      extra_kms_policies = []
      fleet_role_name    = null
    })
  })

{
  "expires_days": 1,
  "kms": {
    "create_kms_key": false,
    "extra_kms_policies": [],
    "fleet_role_name": null,
    "kms_alias": "osquery-carve",
    "kms_base_policy": null,
    "kms_key_arn": null
  },
  "name": "fleet-osquery-results-archive",
  "tags": {}
}

Outputs

Name	Description
fleet_extra_environment_variables	n/a
fleet_extra_iam_policies	IAM policies required for Fleet to access the osquery carve S3 bucket.