cloudwatch-event-rules.tf

resource "aws_cloudwatch_event_rule" "daily" {
  name        = "daily_enforce_bucket_kms_encryption"
  description = "run everyday"

  #schedule_expression = "${var.cron_schedule_enforce_bucket_encryption} "
  event_pattern = <<PATTERN
  {
    "source": [
      "aws.s3"
    ],
    "detail-type": [
      "AWS API Call via CloudTrail"
    ],
    "detail": {
      "eventSource": [
        "s3.amazonaws.com"
      ],
      "eventName": [
        "CreateBucket"
      ]
    }
  }
  PATTERN

}

cloudwatch_event_target_lambda.tf

resource "aws_cloudwatch_event_target" "target_lambda" {
  rule      = aws_cloudwatch_event_rule.daily.name
  target_id = "enforce_bucket_kms_encryption"
  arn       = aws_lambda_function.force_bucket_encryption.arn
}

cloudwatch_event_target_sns.tf

resource "aws_cloudwatch_event_target" "sns_target" {
  arn = var.sns_topic_arn
  rule = aws_cloudwatch_event_rule.daily.name
  target_id = "send-sns-notification"
}

iam_policies.tf

resource "aws_iam_policy" "lambda_policy" {
  name   = aws_iam_role.force_bucket_encryption.name
  path   = "/"
  policy = data.aws_iam_policy_document.lambda_policy_doc.json
}

resource "aws_iam_role_policy_attachment" "ec2_tags_enforced" {
  role       = aws_iam_role.force_bucket_encryption.name
  policy_arn = aws_iam_policy.lambda_policy.arn
}

lambda.tf

resource "aws_lambda_layer_version" "dep" {
  layer_name = "force_bucket_encryption"
  s3_bucket  = var.lambda_s3_bucket
  s3_key     = "force_bucket_encryption/dep.zip"

  compatible_runtimes = ["python3.6"]
}

resource "aws_lambda_function" "force_bucket_encryption" {
  s3_bucket     = var.lambda_s3_bucket
  s3_key        = "force_bucket_encryption/src.zip"
  function_name = "force_bucket_encryption"
  role          = aws_iam_role.force_bucket_encryption.arn
  handler       = "force_bucket_encryption.lambda_handler"
  runtime       = "python3.6"
  memory_size   = 128
  timeout       = 300

  layers = [
    aws_lambda_layer_version.dep.arn,
  ]
  environment{
    variables = {
      KMSMasterKeyID = var.kms_key_id
    } 
  } 
}

resource "aws_iam_role" "force_bucket_encryption" {
  name        = "lambda_force_bucket_encryption"
  assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
}

policy_doc.tf

data "aws_iam_policy_document" "lambda_policy_doc" {
  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogGroup",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "config:PutEvaluations",
    ]

    resources = [
      "*",
    ]
  }
  
  statement {
    effect = "Allow"
    actions = [
      "s3:ListBuckets",
      "s3:ListAllMyBuckets",
      "s3:GetBucketEncryption",
      "s3:GetEncryptionConfiguration",
      "s3:PutEncryptionConfiguration",
    ]
    resources = [
      "*"
    ]
  }
}

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    actions = [
      "sts:AssumeRole",
    ]

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

var.tf

variable "lambda_s3_bucket" {
  type    = string
  default = "BUCKET-THAT-CONTAIN-LAMBDAZIPCODE"
}

variable "kms_key_id" {
  type = string
  default = "KMSKEY-ARN3"
}

variable "cron_schedule_enforce_bucket_encryption" {
  type = string
  default = "cron(0 11,19 ? * * *)"
}

variable "sns_topic_arn" {
  type = string
  default = "SNSTOPICARN"
}