Add more AWS S3 buckets naming rules validation

[davimmt]

I opened a discussion about lenght naming rules for S3 buckets some time ago and now realised there's actually no rules in place. Are there plans to include rules based on https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html

Example:

╰─❯ cat main.tf
provider "aws" { region = "us-east-1" }

resource "aws_s3_bucket" "upper" {
  bucket = "I-am-ok.com"
}

resource "aws_s3_bucket" "short" {
  bucket = "sh"
}

resource "aws_s3_bucket" "ip" {
  bucket = "192.168.0.255"
}

resource "aws_s3_bucket" "not_ip" {
  bucket = "921.388.420.256"
}

╰─❯ terraform validate
Success! The configuration is valid.

╰─❯ terraform apply --auto-approve

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_s3_bucket.ip will be created
  + resource "aws_s3_bucket" "ip" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "192.168.0.255"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # aws_s3_bucket.not_ip will be created
  + resource "aws_s3_bucket" "not_ip" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "921.388.420.256"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # aws_s3_bucket.short will be created
  + resource "aws_s3_bucket" "short" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "sh"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

  # aws_s3_bucket.upper will be created
  + resource "aws_s3_bucket" "upper" {
      + acceleration_status         = (known after apply)
      + acl                         = (known after apply)
      + arn                         = (known after apply)
      + bucket                      = "I-am-ok.com"
      + bucket_domain_name          = (known after apply)
      + bucket_prefix               = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + object_lock_enabled         = (known after apply)
      + policy                      = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + tags_all                    = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)
    }

Plan: 4 to add, 0 to change, 0 to destroy.
aws_s3_bucket.upper: Creating...
aws_s3_bucket.short: Creating...
aws_s3_bucket.not_ip: Creating...
aws_s3_bucket.ip: Creating...
╷
│ Error: creating Amazon S3 (Simple Storage) Bucket (I-am-ok.com): InvalidBucketName: The specified bucket is not valid.
│       status code: 400, request id: RJY2Z74J91BFX2QC, host id: QH2Xj7Y0947yq62l8Tv3wColszRBvJcyYY9aqbm25miCUNc9ysQWFJlaQ18fBCBsbT/R62aPMys=
│
│   with aws_s3_bucket.upper,
│   on main.tf line 3, in resource "aws_s3_bucket" "upper":
│    3: resource "aws_s3_bucket" "upper" {
│
╵
╷
│ Error: creating Amazon S3 (Simple Storage) Bucket (sh): InvalidBucketName: The specified bucket is not valid.
│       status code: 400, request id: RJY8T7Z3RKWJES1C, host id: j7onMe4I6ItV3wFmEjIXNPVPrgXbiG8ajmPmRC3ENWfRn1qOF0/14GukxbCTp63DdEYcCDq93ak=
│
│   with aws_s3_bucket.short,
│   on main.tf line 7, in resource "aws_s3_bucket" "short":
│    7: resource "aws_s3_bucket" "short" {
│
╵
╷
│ Error: creating Amazon S3 (Simple Storage) Bucket (192.168.0.255): InvalidBucketName: The specified bucket is not valid.
│       status code: 400, request id: RJY81K8VNV533G2X, host id: 26PWwWNX+5AfZPGZeMS/6h3y3pUPDCaufY61vMcyjKUjUEpndi2LBYKQamldyxVJaPZtvDWwT8w=
│
│   with aws_s3_bucket.ip,
│   on main.tf line 11, in resource "aws_s3_bucket" "ip":
│   11: resource "aws_s3_bucket" "ip" {
│
╵
╷
│ Error: creating Amazon S3 (Simple Storage) Bucket (921.388.420.256): InvalidBucketName: The specified bucket is not valid.
│       status code: 400, request id: RJY3PH380M5RNRHF, host id: a1MSXtAFvPb9E0nJYmjnCRe+ycDTubjV+IvjoWEEY4Y4dzSMuGHk5d2lrfYM0pTG2i6kRtkGAec=
│
│   with aws_s3_bucket.not_ip,
│   on main.tf line 15, in resource "aws_s3_bucket" "not_ip":
│   15: resource "aws_s3_bucket" "not_ip" {
│
╵

╰─❯ tflint
4 issue(s) found:

Error: Bucket name "I-am-ok.com" failed regex rule "[^a-z0-9\\.\\-]": "Bucket names can consist only of lowercase letters, numbers, dots (.), and hyphens (-)." (aws_s3_bucket_name)

  on main.tf line 4:
   4:   bucket = "I-am-ok.com"

Reference: https://github.com/terraform-linters/tflint-ruleset-aws/blob/v0.27.0/docs/rules/aws_s3_bucket_name.md

Error: Bucket name "I-am-ok.com" failed regex rule "^[^a-z0-9]": "Bucket names must begin with a lowercase letter or number." (aws_s3_bucket_name)

  on main.tf line 4:
   4:   bucket = "I-am-ok.com"

Reference: https://github.com/terraform-linters/tflint-ruleset-aws/blob/v0.27.0/docs/rules/aws_s3_bucket_name.md

Error: Bucket name "sh" failed regex rule "^(.{0,2})?(.{64,})?$": "Bucket names must be between 3 (min) and 63 (max) characters long." (aws_s3_bucket_name)

  on main.tf line 8:
   8:   bucket = "sh"

Reference: https://github.com/terraform-linters/tflint-ruleset-aws/blob/v0.27.0/docs/rules/aws_s3_bucket_name.md

Error: Bucket name "192.168.0.255" failed regex rule "^\\b((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.|$)){4}\\b$": "Bucket names must not be formatted as an IP address (for example, 192.168.5.4)." (aws_s3_bucket_name)

  on main.tf line 12:
  12:   bucket = "192.168.0.255"

Reference: https://github.com/terraform-linters/tflint-ruleset-aws/blob/v0.27.0/docs/rules/aws_s3_bucket_name.md

[davimmt]

Here's how I'm implementing it.

[bendrucker]

Are there plans...

Plans, no, but please send a PR so I can review/incorporate your work!

[davimmt]

#571