fix: Choose one type of encryption for buckets (#568)

chanzuckerberg · Mar 21, 2024 · 125b37b · 125b37b
1 parent 5c650fc
commit 125b37b
Showing 1 changed file with 12 additions and 10 deletions.
diff --git a/aws-s3-private-bucket/main.tf b/aws-s3-private-bucket/main.tf
@@ -122,16 +122,6 @@ resource "aws_s3_bucket" "bucket" {
   tags = local.tags
 }
 
-resource "aws_s3_bucket_server_side_encryption_configuration" "enc" {
-  bucket = aws_s3_bucket.bucket.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm     = "AES256"
-    }
-  }
-}
-
 resource "aws_s3_bucket_public_access_block" "bucket" {
   count = var.public_access_block ? 1 : 0
 
@@ -204,6 +194,18 @@ resource "aws_kms_key" "bucket_kms_key" {
   }
 }
 
+resource "aws_s3_bucket_server_side_encryption_configuration" "bucket_sse_encryption" {
+  count = var.kms_encryption != null ? 0 : 1
+
+  bucket = aws_s3_bucket.bucket.id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = "AES256"
+    }
+  }
+}
+
 resource "aws_s3_bucket_server_side_encryption_configuration" "bucket_kms_encryption" {
   count = var.kms_encryption != null ? 1 : 0