Terraform Elastic Beanstalk Environment - setting for encrypting S3 bucket?

Question

I am trying to deploy a simple flask application on Elastibeanstalk using Terraform.

I am using the Terraform's default resource for ElasticBeanstalk Environment - aws_elastic_beanstalk_environment

I am able to deploy my application successfully, however during deployment ElasticBeanstalk creates an S3 bucket - elasticbeanstalk-region-account-id which is not encrypted by default.

I want to change this behaviour and make sure this bucket is encrypted when it gets created. Which setting do I use to accomplish this? I could not find the relevant setting for this. Any ideas?

Answer 1

by default aws beansltalk create an unencrypted bucket so aws_elastic_beanstalk_environment resource cannot do anything here

from the AWS doc :

Elastic Beanstalk doesn't turn on default encryption for the Amazon S3 bucket that it creates. This means that by default, objects are stored unencrypted in the bucket (and are accessible only by authorized users). Some applications require all objects to be encrypted when they are stored—on a hard drive, in a database, etc. (also known as encryption at rest). If you have this requirement, you can configure your account's buckets for default encryption

so you need to enable it yourself, try the folowing after you create the beanstalk env, get the aws s3 bucket created by beanstalk and enable server side encryption by the Terraform resource aws_s3_bucket_server_side_encryption_configuration

    resource "aws_kms_key" "mykey" {
      description             = "This key is used to encrypt bucket objects"
      deletion_window_in_days = 10
    }
    
    data "aws_s3_bucket" "mybucket" {
      bucket = "elasticbeanstalk-region-account-id" # here change the value with your information
    }
    
    resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
      bucket = data.aws_s3_bucket.mybucket
    
      rule {
        apply_server_side_encryption_by_default {
          kms_master_key_id = aws_kms_key.mykey.arn
          sse_algorithm     = "aws:kms"
        }
      }
    }