HIPAA-Compliant AWS Infrastructure, Defined as Code

1# HIPAA-Compliant S3 Storage Service
2# Aligns with: 164.312(a)(2)(iv) Encryption, 164.312(c)(1) Integrity, 164.312(e)(1) Transmission Security
3
4resource "aws_s3_bucket" "phi" {
5  bucket        = var.bucket_name
6  force_destroy = false
7
8  tags = {
9    Environment = var.environment
10    Compliance  = "HIPAA"
11  }
12}
13
14resource "aws_s3_bucket_public_access_block" "phi_block" {
15  bucket = aws_s3_bucket.phi.id
16
17  block_public_acls       = true
18  block_public_policy     = true
19  ignore_public_acls      = true
20  restrict_public_buckets = true
21}
22
23resource "aws_s3_bucket_versioning" "phi_versioning" {
24  bucket = aws_s3_bucket.phi.id
25  versioning_configuration {
26    status = "Enabled"
27  }
28}
29
30resource "aws_s3_bucket_server_side_encryption_configuration" "phi_encryption" {
31  bucket = aws_s3_bucket.phi.id
32
33  rule {
34    apply_server_side_encryption_by_default {
35      kms_master_key_id = var.kms_key_arn
36      sse_algorithm     = "aws:kms"
37    }
38    bucket_key_enabled = true
39  }
40}
41
42resource "aws_s3_bucket_policy" "phi_policy" {
43  bucket = aws_s3_bucket.phi.id
44
45  policy = jsonencode({
46    Version = "2012-10-17"
47    Statement = [
48      {
49        Sid       = "EnforceTLSRequestsOnly"
50        Effect    = "Deny"
51        Principal = "*"
52        Action    = "s3:*"
53        Resource = [
54          aws_s3_bucket.phi.arn,
55          "${aws_s3_bucket.phi.arn}/*"
56        ]
57        Condition = {
58          Bool = {
59            "aws:SecureTransport" = "false"
60          }
61        }
62      }
63    ]
64  })
65}