Terraform module for iam policy docco to block non-VPC access

main.tf

data "aws_iam_policy_document" "s3_bucket_policy" {
  statement {
    condition {
      test     = "StringNotEquals"
      variable = "aws:sourceVpc"

      values = [
        "${var.vpc_id}",
      ]
    }

    actions = [
      "s3:*",
    ]

    resources = [
      "arn:aws:s3:::${var.bucket_name}",
      "arn:aws:s3:::${var.bucket_name}/*"
    ]
  }
}

outputs.tf

output "bucket_policy" {
  description = "JSON string of bucket policy"
  value       = "${data.aws_iam_policy_document.s3_bucket_policy.json}"
}

variables.tf

variable "bucket_name" {
  description = "Name of S3 bucket"
}

variable "vpc_id" {
  description = "VPC ID to allow"
}