Exploded asset bundle for S3

aptible_s3_bucket.tf

resource "aws_s3_bucket" "b" {
  bucket = "my-tf-test-bucket-{random_string.suffix.id}"
}

resource "random_string" "suffix" {
  length  = 20
  special = false
  upper   = false
}

resource "aws_s3_bucket_acl" "example" {
  bucket = aws_s3_bucket.b.id
  acl    = "private"
}

resource "aws_s3_bucket_public_access_block" "access_log" {
  bucket                  = aws_s3_bucket.b.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_kms_key" ? "main" {
  customer_master_key_spec = var.customer_master_key_spec
  description              = var.description
  deletion_window_in_days  = var.deletion_window_in_days
  enable_key_rotation      = var.enable_key_rotation
  key_usage                = var.key_usage
}

resource "aws_s3_bucket_server_side_encryption_configuration" "default" {
  bucket = aws_s3_bucket.b.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.main.arn
      sse_algorithm     = "aws:kms"
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_versioning" "versioning" {
  bucket = aws_s3_bucket.b.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_logging" "main" {
  bucket        = aws_s3_bucket.b.id
  target_bucket = aws_s3_bucket.logging_bucket.id
  target_prefix = "access_logs/${aws_s3_bucket.b.id}/"
}

resource "aws_s3_bucket_policy" "policy" {
  bucket = aws_s3_bucket.b.id
  policy = aws_iam_policy_document.require_ssl_requests.json
}

data "aws_iam_policy_document" "require_ssl_requests" {
  version = "2012-10-17"

  statement {
    sid     = "AllowSSLRequestsOnly"
    effect  = "Deny"
    actions = ["s3:*"]
    resources = [
      "${aws_s3_bucket.b.arn}/*",
      "${aws_s3_bucket.b.arn}"
    ]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}