Secure Bucket
The Secure Bucket blueprint (s3 v1) deploys one hardened S3 bucket in
your account. It is the simplest blueprint and a common first deploy: a
place to put regulated data with the settings auditors ask about turned
on from the start.
What it provisions
Section titled “What it provisions”- An S3 bucket named
stacktakt-<label>-<account-id>. The account ID keeps the name globally unique and inside the namespace the deployment role is scoped to. - Default encryption at rest (SSE-S3, AES256).
- Object versioning, so prior versions survive overwrite and deletion.
- Public access block with all four settings on: no anonymous path to the data exists.
- An optional lifecycle rule that expires noncurrent object versions after your chosen window. Current data is never expired.
The bucket is never force-deleted: destroying the deployment removes tracked configuration but never silently deletes customer data.
Inputs
Section titled “Inputs”| Input | Required | Description |
|---|---|---|
| Bucket label | Yes | 3 to 40 characters, lowercase letters, digits, hyphens. Names the bucket. |
| Expire noncurrent versions after N days | No | 1 to 3650. Empty means every version is retained. |
Region and resource tags are platform-supplied from the connection, never entered by hand.
Control mapping
Section titled “Control mapping”Deploying this template version asserts the control set below, snapshotted with the deployment at apply time.
Generated from backend/templates/s3/v1/controls.yaml (framework: hipaa-security-rule). Run npm run generate:blueprints to refresh.
| HIPAA citation | Requirement | Status | Implemented by |
|---|---|---|---|
| §164.312(a)(1) | Access control | Implemented | aws_s3_bucket_public_access_block.secure |
| §164.312(a)(2)(iv) | Encryption and decryption | Implemented | aws_s3_bucket_server_side_encryption_configuration.secure |
| §164.312(c)(1) | Integrity | Implemented | aws_s3_bucket_versioning.secure, aws_s3_bucket_lifecycle_configuration.secure |
| §164.308(a)(4)(i) | Information access management | Implemented | aws_s3_bucket_public_access_block.secure |
Caveats recorded in the mapping, shown verbatim:
- §164.312(a)(2)(iv): Encryption uses AWS-managed keys (SSE-S3); a customer-managed KMS key is a later template version plus a deployment-role amendment.
Generated documents
Section titled “Generated documents”Once applied, the Documentation Center derives a System overview and, after the control snapshot exists, a Control narrative for this deployment. The narrative walks each control above with its citation, implementing resources, and caveats.
Works with
Section titled “Works with”A Secure Bucket can feed a Simple ETL pipeline, and a Compliant SFTP endpoint can use one as its backing store.