# Day 67: AWS S3 Bucket Creation and Management

Prerequisites:

* Terraform installed and configured with AWS credentials
    
* if not then follow this blog
    

%[https://hashnode.com/post/cljbzmnad000109mv11753vyu] 

**Task: Create an S3 bucket using Terraform.**

create s3.tf with following code:

```bash
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-s3-using-terra"
  tags= {
   Name = "My Bucket"
   Environment = "Dev"
  }
}

//use your own unique name for bucket
```

then execute `terraform plan` and `terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688048839356/aac6ee05-f7e4-4a4e-8693-e56d9cdaefc3.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688048864742/a564125a-fda3-43d4-91b7-14919e0142b4.png align="center")

Now check your aws console for s3:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688049023103/3d5dbc30-bf24-4ef8-b742-d1dd2d357f57.png align="center")

**Configure the bucket to allow public read access.**

Open your existing Terraform configuration file for the S3 bucket and modify it to include the following additional configuration:

```bash
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-s3-using-terra"
  tags= {
   Name = "My Bucket"
   Environment = "Dev"
  }

  acl    = "public-read"

  policy = <<EOF
  {
   "Version": "2012-10-17",
   "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-s3-using-terra/*"]
    }
   ]
  }
  EOF
}
```

then execute `terraform plan` and `terraform apply`

Now check your S3 on aws console.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688050225896/498b679a-c693-4961-a671-08bb1a0f40c0.png align="center")

**Create an S3 bucket policy that allows read-only access to a specific IAM user or role.**

Create a new file named `s3_bucket_policy.json` and populate it with the following content:

```bash
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadOnlyAccess",
      "Effect": "Allow",
      "Principal": {
        "AWS": ["arn:aws:iam::YOUR_ACCOUNT_ID:user/USERNAME"]
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}
```

Open your existing Terraform configuration file for the S3 bucket. Add the following resource block to define the S3 bucket policy:

```bash
resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = "YOUR_BUCKET_NAME"
  policy = file("s3_bucket_policy.json")
}
```

then execute `terraform plan` and `terraform apply`

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688050958120/55f838a0-ac9b-4407-ad86-9afa3f81abdd.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688050984324/6490faa3-f917-4847-9d7f-0a34410b39a0.png align="center")

To verify that the IAM user/role has read-only access to the S3 bucket, attempt to retrieve an object from the bucket using the IAM user/role's credentials. If the user/role has the necessary permissions, the operation should succeed. Otherwise, an access denied error will be returned.

Or

You can to your permission section of S3 backet console , you will see 1 attached bucket policy.

**Enable versioning on the S3 bucket.**

Open your existing Terraform configuration file for the S3 bucket. Add the following resource block to enable versioning:

```bash
versioning {
    enabled = true
  }
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688051253842/935bbcb0-a4aa-47f4-ad4c-6efe94e8c5ad.png align="center")

then execute `terraform plan` and `terraform apply`

To verify that versioning is enabled on the S3 bucket, you can check the bucket properties using the AWS Management Console or AWS CLI. You should see the versioning status set to "Enabled" for the respective bucket.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688051391099/4588d240-2a27-493a-9a15-4b921297e279.png align="center")

That was all for today. If you have any queries/suggestion please write in comment. See you another day with another challenge.