S3 bucket Object Lock should use COMPLIANCE retention mode

Implementation

Choose the approach that matches how you manage Terraform.

Use the compliance.tf module to enforce this control by default. See get started with compliance.tf.

module "s3_bucket" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  object_lock_configuration = {
    rule = {
      default_retention = {
        mode = "COMPLIANCE"
      }
    }
  }
}

module "s3_bucket" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  object_lock_configuration = {
    rule = {
      default_retention = {
        mode = "COMPLIANCE"
      }
    }
  }
}

This control is enforced automatically with Compliance.tf modules. Start free trial

If you use terraform-aws-modules/s3-bucket/aws, set the right module inputs for this control. You can later migrate to the compliance.tf module with minimal changes because it is compatible by design.

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  object_lock_configuration = {
    rule = {
      default_retention = {
        mode = "COMPLIANCE"
      }
    }
  }
}

Use AWS provider resources directly. See docs for the resources involved: aws_s3_bucket_object_lock_configuration.

resource "aws_s3_bucket" "this" {
  bucket        = "example-abc123"
  force_destroy = true
}

resource "aws_s3_bucket_object_lock_configuration" "this" {
  bucket = "example-bucket-abc123"
  rule {
    default_retention {
      mode = "COMPLIANCE"
    }
  }
}

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: s3_bucket_object_lock_compliance_mode

S3 bucket Object Lock should use COMPLIANCE retention mode

Implementation

Tool mappings

On this page