Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
Based on #166 (I didn't have push permissions to the fork) by @bamaralf.

Closes #166.

Added support for intelligent tiering configuration - [registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration)

---

Choice A:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) are (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -293,4 +293,35 @@ module "s3_bucket" {
       }
     },
   ]
+
+  intelligent_tiering = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags = {
+          Environment = "dev"
+        }
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 125
+        }
+        DEEP_ARCHIVE_ACCESS = {
+          days = 200
+        }
+      }
+    }
+  }
 }
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants              = try(jsondecode(var.grant), var.grant)
+  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,31 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = try(tobool(each.value.status) ? "Enabled" : "Disabled", title(lower(each.value.status)), null)
+
+  # Max 1 block - filter
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -148,6 +148,12 @@ variable "server_side_encryption_configuration" {
   default     = {}
 }

+variable "intelligent_tiering" {
+  description = "Map containing intelligent tiering configuration."
+  type        = any
+  default     = {}
+}
+
 variable "object_lock_configuration" {
   description = "Map containing S3 object locking configuration."
   type        = any
---
wrappers/main.tf
@@ -28,6 +28,7 @@ module "wrapper" {
   lifecycle_rule                        = try(each.value.lifecycle_rule, var.defaults.lifecycle_rule, [])
   replication_configuration             = try(each.value.replication_configuration, var.defaults.replication_configuration, {})
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
---

---

Choice B:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -293,4 +293,35 @@ module "s3_bucket" {
       }
     },
   ]
+
+  intelligent_tiering = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags = {
+          Environment = "dev"
+        }
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 125
+        }
+        DEEP_ARCHIVE_ACCESS = {
+          days = 200
+        }
+      }
+    }
+  }
 }
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants              = try(jsondecode(var.grant), var.grant)
+  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,31 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = try(tobool(each.value.status) ? "Enabled" : "Disabled", title(lower(each.value.status)), null)
+
+  # Max 1 block - filter
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -148,6 +148,12 @@ variable "server_side_encryption_configuration" {
   default     = {}
 }

+variable "intelligent_tiering" {
+  description = "Map containing intelligent tiering configuration."
+  type        = any
+  default     = {}
+}
+
 variable "object_lock_configuration" {
   description = "Map containing S3 object locking configuration."
   type        = any
---
wrappers/main.tf
@@ -28,6 +28,7 @@ module "wrapper" {
   lifecycle_rule                        = try(each.value.lifecycle_rule, var.defaults.lifecycle_rule, [])
   replication_configuration             = try(each.value.replication_configuration, var.defaults.replication_configuration, {})
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
---

---

Choice C:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -293,4 +293,35 @@ module "s3_bucket" {
       }
     },
   ]
+
+  intelligent_tiering = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags = {
+          Environment = "dev"
+        }
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 125
+        }
+        DEEP_ARCHIVE_ACCESS = {
+          days = 200
+        }
+      }
+    }
+  }
 }
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants              = try(jsondecode(var.grant), var.grant)
+  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,31 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = try(tobool(each.value.status) ? "Enabled" : "Disabled", title(lower(each.value.status)), null)
+
+  # Max 1 block - filter
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+
+  dynamic "tiering" "documents/"
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -148,6 +148,12 @@ variable "server_side_encryption_configuration" {
   default     = {}
 }

+variable "intelligent_tiering" {
+  description = "Map containing intelligent tiering configuration."
+  type        = any
+  default     = {}
+}
+
 variable "object_lock_configuration" {
   description = "Map containing S3 object locking configuration."
   type        = any
---
wrappers/main.tf
@@ -28,6 +28,7 @@ module "wrapper" {
   lifecycle_rule                        = try(each.value.lifecycle_rule, var.defaults.lifecycle_rule, [])
   replication_configuration             = try(each.value.replication_configuration, var.defaults.replication_configuration, {})
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
---

---

Choice D:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering](#input\_intelligent\_tiering) | Map containing intelligent tiering configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -293,4 +293,35 @@ module "s3_bucket" {
       }
     },
   ]
+
+  intelligent_tiering = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags = {
+          Environment = "dev"
+        }
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        ARCHIVE_ACCESS = {
+          days = 125
+        }
+        DEEP_ARCHIVE_ACCESS = {
+          days = 200
+        }
+      }
+    }
+  }
 }
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants    k      = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants              = try(jsondecode(var.grant), var.grant)
+  cors_rules          = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules     = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering = try(jsondecode(var.intelligent_tiering), var.intelligent_tiering)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,31 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = try(tobool(each.value.status) ? "Enabled" : "Disabled", title(lower(each.value.status)), null)
+
+  # Max 1 block - filter
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [] : [true]
+
+    content {
+      prefix = try(each.value.filter.prefix, null)
+      tags   = try(each.value.filter.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -148,6 +148,12 @@ variable "server_side_encryption_configuration" {
   default     = {}
 }

+variable "intelligent_tiering" {
+  description = "Map containing intelligent tiering configuration."
+  type        = any
+  default     = {}
+}
+
 variable "object_lock_configuration" {
   description = "Map containing S3 object locking configuration."
   type        = any
---
wrappers/main.tf
@@ -28,6 +28,7 @@ module "wrapper" {
   lifecycle_rule                        = try(each.value.lifecycle_rule, var.defaults.lifecycle_rule, [])
   replication_configuration             = try(each.value.replication_configuration, var.defaults.replication_configuration, {})
   server_side_encryption_configuration  = try(each.value.server_side_encryption_configuration, var.defaults.server_side_encryption_configuration, {})
+  intelligent_tiering                   = try(each.value.intelligent_tiering, var.defaults.intelligent_tiering, {})
   object_lock_configuration             = try(each.value.object_lock_configuration, var.defaults.object_lock_configuration, {})
   object_lock_enabled                   = try(each.value.object_lock_enabled, var.defaults.object_lock_enabled, false)
   block_public_acls                     = try(each.value.block_public_acls, var.defaults.block_public_acls, false)
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This pull request adds the option of managing the bucket intelligent  tiering configuration by passing a map of objects to this module. This map of objects encapsulates the configuration options from this resource: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration

## Motivation and Context
Intelligent tiering configuration can optimize the costs of the S3 buckets infrastructure and the changes in this pull request make these configurations available from the module.

## Breaking Changes
None

## How Has This Been Tested?
- [x] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

- [x] I have executed `pre-commit run -a` on my pull request

---

Choice A:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering\_config](#input\_intelligent\_tiering\_config) | Map containing inteligent tiering config encryption configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -114,6 +114,31 @@ module "s3_bucket" {
     Owner = "Anton"
   }

+  intelligent_tiering_config = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags   = { Environment = "dev" }
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 125
+        }
+      }
+    }
+  }
   # Note: Object Lock configuration can be enabled only on new buckets
   # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration
   object_lock_enabled = true
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants                     = try(jsondecode(var.grant), var.grant)
+  cors_rules                 = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules            = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering_config = try(jsondecode(var.intelligent_tiering_config), var.intelligent_tiering_config)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,30 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = local.create_bucket ? local.intelligent_tiering_config : {}
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = each.value.status || each.value.status == "Enabled" ? "Enabled" : "Disabled"
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [true] : []
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -201,3 +201,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "intelligent_tiering_config" {
+  description = "Map containing inteligent tiering config encryption configuration."
+  type        = any
+  default     = {}
+}
---
wrappers/main.tf
@@ -37,4 +37,5 @@ module "wrapper" {
   control_object_ownership              = try(each.value.control_object_ownership, var.defaults.control_object_ownership, false)
   object_ownership                      = try(each.value.object_ownership, var.defaults.object_ownership, "ObjectWriter")
   putin_khuylo                         "Disabled"
+
+ = try(each.value.putin_khuylo, var.defaults.putin_khuylo, true)
+  intelligent_tiering_config            = try(each.value.intelligent_tiering_config, var.defaults.intelligent_tiering_config, {})
 }
---

---

Choice B:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering\_config](#input\_intelligent\_tiering\_config) | Map containing inteligent tiering config encryption configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -114,6 +114,31 @@ module "s3_bucket" {
     Owner = "Anton"
   }

+  intelligent_tiering_config = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags   = { Environment = "dev" }
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 125
+        }
+      }
+    }
+  }
   # Note: Object Lock configuration can be enabled only on new buckets
   # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration
   object_lock_enabled = true
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants                     = try(jsondecode(var.grant), var.grant)
+  cors_rules                 = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules            = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering_config = try(jsondecode(var.intelligent_tiering_config), var.intelligent_tiering_config)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,30 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = local.create_bucket ? local.intelligent_tiering_config : {}
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = each.value.status || each.value.status == "Enabled" ? "Enabled" : "Disabled"
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [true] : []
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -201,3 +201,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "intelligent_tiering_config" {
+  description = "Map containing inteligent tiering config encryption configuration."
+  type        = any
+  default     = {}
+}
---
wrappers/main.tf
@@ -37,4 +37,5 @@ module "wrapper" {
   control_object_ownership              = try(each.value.control_object_ownership, var.defaults.control_object_ownership, false)
   object_ownership                      = try(each.value.object_ownership, var.defaults.object_ownership, "ObjectWriter")
   putin_khuylo                          = try(each.value.putin_khuylo, var.defaults.putin_khuylo, true)
+  intelligent_tiering_config            = try(each.value.intelligent_tiering_config, var.defaults.intelligent_tiering_config, {})
 }
---

---

Choice C:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering\_config](#input\_intelligent\_tiering\_config) | Map containing inteligent tiering config encryption configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -114,6 +114,31 @@ module "s3_bucket" {
     Owner = "Anton"
   }

+  intelligent_tiering_config = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags   = { Environment = "dev" }
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 125
+        }
+      }
+    }
+  }
   # Note: Object Lock configuration can be enabled only on new buckets
   # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration
   object_lock_enabled = true
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants                     = try(jsondecode(var.grant), var.grant)
+  cors_rules                 = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules            = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering_config = try(jsondecode(var.intelligent_tiering_config), var.intelligent_tiering_config)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,30 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = local.create_bucket ? local.intelligent_tiering_config : {}
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = each.value.status || each.value.status == "Enabled" ? "Enabled" : "Disabled"
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [true] : []
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -201,3 +201,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "intelligent_tiering_config" {
+  description = "Map containing inteligent tiering config encryption configuration."
+  type        = any
+  default     = {}
+}
---
wrappers/main.tf
@@ -37,4 +37,5 @@ module "wrapper" {
   control_object_ownership              = try(each.value.control_object_ownership, var.defaults.control_object_ownership, false)
   object_ownership                      = try(each.value.object_ownership, var.defaults.object_ownership, "ObjectWriter")
   putin_khuylo                          = try(each.value.putin_khuylo, var.defaults.putin_khuylo, true)
+  intelligent_tiering_config            = try(each.value.intelligent_tiering_config, var.defaults.intelligent_tiering_config, {})
 }
---

---

Choice D:
README.md
@@ -138,6 +138,7 @@ No modules.
 | [aws_s3_bucket_accelerate_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_accelerate_configuration) | resource |
 | [aws_s3_bucket_acl.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
 | [aws_s3_bucket_cors_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
+| [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
@@ -180,6 +181,7 @@ No modules.
 |  [force\_destroy](#input\_force\_destroy) | (Optional, Default:false ) A boolean that indicates all objects should be deleted from the bucket so that the bucket var.lifecycle_rule)
+ be destroyed without error. These objects are not recoverable. | `bool` | `false` | no |
 |  [grant](#input\_grant) | An ACL policy grant. Conflicts with `acl` | `any` | `[]` | no |
 |  [ignore\_public\_acls](#input\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for this bucket. | `bool` | `false` | no |
+|  [intelligent\_tiering\_config](#input\_intelligent\_tiering\_config) | Map containing inteligent tiering config encryption configuration. | `any` | `{}` | no |
 |  [lifecycle\_rule](#input\_lifecycle\_rule) | List of maps containing configuration of object lifecycle management. | `any` | `[]` | no |
 |  [logging](#input\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |
 |  [object\_lock\_configuration](#input\_object\_lock\_configuration) | Map containing S3 object locking configuration. | `any` | `{}` | no |
---
examples/complete/main.tf
@@ -114,6 +114,31 @@ module "s3_bucket" {
     Owner = "Anton"
   }

+  intelligent_tiering_config = {
+    general = {
+      status = "Enabled"
+      filter = {
+        prefix = "/"
+        tags   = { Environment = "dev" }
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 180
+        }
+      }
+    },
+    documents = {
+      status = false
+      filter = {
+        prefix = "documents/"
+      }
+      tiering = {
+        "ARCHIVE_ACCESS" = {
+          days = 125
+        }
+      }
+    }
+  }
   # Note: Object Lock configuration can be enabled only on new buckets
   # https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration
   object_lock_enabled = true
---
main.tf
@@ -6,9 +6,10 @@ locals {
   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
-  grants          = try(jsondecode(var.grant), var.grant)
-  cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
-  lifecycle_rules = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  grants                     = try(jsondecode(var.grant), var.grant)
+  cors_rules                 = try(jsondecode(var.cors_rule), var.cors_rule)
+  lifecycle_rules            = try(jsondecode(var.lifecycle_rule), var.lifecycle_rule)
+  intelligent_tiering_config = try(jsondecode(var.intelligent_tiering_config), var.intelligent_tiering_config)
 }

 resource "aws_s3_bucket" "this" {
@@ -707,3 +708,30 @@ resource "aws_s3_bucket_ownership_controls" "this" {
     aws_s3_bucket.this
   ]
 }
+
+resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
+  for_each = local.create_bucket ? local.intelligent_tiering_config : {}
+
+  name   = each.key
+  bucket = aws_s3_bucket.this[0].id
+  status = each.value.status || each.value.status == "Enabled" ? "Enabled" : "Disabled"
+
+  dynamic "filter" {
+    for_each = length(try(flatten([each.value.filter]), [])) == 0 ? [true] : []
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+
+  dynamic "tiering" {
+    for_each = each.value.tiering
+
+    content {
+      access_tier = tiering.key
+      days        = tiering.value.days
+    }
+  }
+
+}
---
variables.tf
@@ -201,3 +201,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "intelligent_tiering_config" {
+  description = "Map containing inteligent tiering config encryption configuration."
+  type        = any
+  default     = {}
+}
---
wrappers/main.tf
@@ -37,4 +37,5 @@ module "wrapper" {
   control_object_ownership              = try(each.value.control_object_ownership, var.defaults.control_object_ownership, false)
   object_ownership                      = try(each.value.object_ownership, var.defaults.object_ownership, "ObjectWriter")
   putin_khuylo                          = try(each.value.putin_khuylo, var.defaults.putin_khuylo, true)
+  intelligent_tiering_config            = try(each.value.intelligent_tiering_config, var.defaults.intelligent_tiering_config, {})
 }
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
<!--- Describe your changes in detail -->
When iterating over a list of buckets to create in AWS S3 multiple module instantiations must be created with conditionals for buckets that desire logging and buckets that do not. Adding the the parameter `logging.enabled` will make this have a more DRY approach.

Fixes #153

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
This change solves the problem where someone is looping over a list of buckets and some of them require logging and others do not. Currently this requires two separate module instantiations with `for_each` loops that filter based on some parameter added to the list of inputs.

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->
No breaking changes. Flag is optional and defaulted to `true` to keep existing behavior identical with no changes required from existing users.

## How Has This Been Tested?
- [X] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [X] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [X] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

---

Choice A:
CHANGELOG.md
@@ -2,6 +2,12 @@

 All notable changes to this project will be documented in this file.

+### [3.2.4](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.1.1...v3.1.2) (2022-04-27)
+
+### Features
+
+* Add 'enabled' flag to module logging map input to selectively disable logging when using a loop ([#153](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/153))
+
 ### [3.2.3](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.2.2...v3.2.3) (2022-05-25)

---
examples/complete/main.tf
@@ -147,6 +147,8 @@ module "s3_bucket" {

   acl = "private" # "acl" conflicts with "grant" and "owner"

+  # S3 Bucket Logging controls
+  # Optional: Set "enabled = false" when using module in a loop if some buckets do not require logging
   logging = {
     target_bucket = module.log_bucket.s3_bucket_id
     target_prefix = "log/"
---
main.tf
@@ -5,6 +5,8 @@ locals {

   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

+  enable_logging = local.create_bucket && try(var.logging["enabled"], true)
+
   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
   grants          = try(jsondecode(var.grant), var.grant)
   cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
@@ -40,7 +42,7 @@ resource "aws_s3_bucket" "this" {
 }

 resource "aws_s3_bucket_logging" "this" {
-  count = local.create_bucket && length(keys(var.logging)) > 0 ? 1 : 0
+  count = local.enable_logging && length(keys(var.logging)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id

---

---

Choice B:
CHANGELOG.md
@@ -2,6 +2,12 @@

 All notable changes to this project will be documented in this file.

+###  (2022-04-27)
+
+### Features
+
+* Add 'enabled' flag to module logging map input to selectively disable logging when using a loop ([#153](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/153))
+
 ### [3.2.3](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.2.2...v3.2.3) (2022-05-25)

---
examples/complete/main.tf
@@ -147,6 +147,8 @@ module "s3_bucket" {

   acl = "private" # "acl" conflicts with "grant" and "owner"

+  # S3 Bucket Logging controls
+  # Optional: Set "enabled = false" when using module in a loop if some buckets do not require logging
   logging = {
     target_bucket = module.log_bucket.s3_bucket_id
     target_prefix = "log/"
---
main.tf
@@ -5,6 +5,8 @@ locals {

   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

+  enable_logging = local.create_bucket && try(var.logging["enabled"], true)
+
   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
   grants          = try(jsondecode(var.grant), var.grant)
   cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
@@ -40,7 +42,7 @@ resource "aws_s3_bucket" "this" {
 }

 resource "aws_s3_bucket_logging" "this" {
-  count = local.create_bucket && length(keys(var.logging)) > 0 ? 1 : 0
+  count = local.enable_logging && length(keys(var.logging)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id

---

---

Choice C:
CHANGELOG.md
@@ -2,6 +2,12 @@

 All notable changes to this project will be documented in this file.

+### [3.2.4](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.1.1...v3.1.2) (2022-04-27)
+
+### Features
+
+* Add 'enabled' flag to module logging map input to selectively disable logging when using a loop ([#153](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/153))
+
 ### [3.2.3](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.2.2...v3.2.3) (2022-05-25)

---
examples/complete/main.tf
@@ -147,6 +147,8 @@ module "s3_bucket" {

   acl = "private" # "acl" conflicts with "grant" and "owner"

+  # S3 Bucket Logging controls
+  # Optional: Set "enabled = false" when using module in a loop if some buckets do not require logging
   logging = {
     target_bucket = module.log_bucket.s3_bucket_id
     target_prefix = "log/"
---
main.tf
@@ -5,6 +5,8 @@ locals {

   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

+  enable_logging = local.create_bucket && try(var.logging["enabled"], true)
+
   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
   grants          = try(jsondecode(var.grant), var.grant)
   cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
@@ -40,7 +42,7 @@ resource "aws_s3_bucket" "this" {
 }

 resource "aws_s3_bucket_logging" "this" {
-  count = local.create_bucket && length(keys(var.logging)) > 0 ? 1 : 0
+  count = local.enable_logging && length(keys(var.logging)) > 0 ? 1 : 0

   bucket = aws_s3_bucket.this[0].id

---

---

Choice D:
CHANGELOG.md
@@ -2,6 +2,12 @@

 All notable changes to this project will be documented in this file.

+### [3.2.4](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.1.1...v3.1.2) (2022-04-27)
+
+### Features
+
+* Add 'enabled' flag to module logging map input to selectively disable logging when using a loop ([#153](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/153))
+
 ### [3.2.3](https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/compare/v3.2.2...v3.2.3) (2022-05-25)

---
examples/complete/main.tf
@@ -147,6 +147,8 @@ module "s3_bucket" {

   acl = "private" # "acl" conflicts with "grant" and "owner"

+  # S3 Bucket Logging controls
+  # Optional: Set "enabled = false" when using module in a loop if some buckets do not require logging
   logging = {
     target_bucket = module.log_bucket.s3_bucket_id
     target_prefix = "log/"
---
main.tf
@@ -5,6 +5,8 @@ locals {

   attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy

+  enable_logging = local.create_bucket && try(var.logging["enabled"], true)
+
   # Variables with type `any` should be jsonencode()'d when value is coming from Terragrunt
   grants          = try(jsondecode(var.grant), var.grant)
   cors_rules      = try(jsondecode(var.cors_rule), var.cors_rule)
@@ -40,7 +42,7 @@ resource "aws_s3_bucket" "this" {
 }

 resource "aws_s3_bucket_logging" "this" {
-  count = local.create_bucket && length(keys(var.logging)) > 0 ? 1 : 0
+  count = local.enable_logging && length(keys(var.logging)) > 0 disable 1 : 0

   bucket = aws_s3_bucket.this[0].id

---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
add lifecycle ignore changes on s3_bucket resource to prevent configuration loop to fix https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/144

## Description
add lifecycle ignore changes on s3_bucket resource for all new resources that are separate to prevent configuration loop

## Motivation and Context
<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->
fixes lifecycle loop

## Breaking Changes
<!-- Does this break backwards compatibility with the current major version? -->
<!-- If so, please provide an explanation why it is necessary. -->

## How Has This Been Tested?
- [ ] I have updated at least one of the `examples/*` to demonstrate and validate my change(s)
- [ ] I have tested and validated these changes using one or more of the provided `examples/*` projects
<!--- Users should start with an existing example as its written, deploy it, then check their changes against it -->
<!--- This will highlight breaking/disruptive changes. Once you have checked, deploy your changes to verify -->
<!--- Please describe how you tested your changes -->
- [ ] I have executed `pre-commit run -a` on my pull request
<!--- Please see https://github.com/antonbabenko/pre-commit-terraform#how-to-install for how to install -->

I tested it live because this is blocking my work 😞

---

Choice A:
main.tf
@@ -28,6 +28,23 @@ resource "aws_s3_bucket" "this" {
       object_lock_enabled = "Enabled"
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      acceleration_status,
+      acl,
+      grant,
+      cors_rule,
+      lifecycle_rule,
+      logging,
+      object_lock_configuration[0].rule,
+      replication_configuration,
+      request_payer,
+      server_side_encryption_configuration,
+      versioning,
+      website
+    ]
+  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice B:
main.tf
@@ -28,6 +28,23 @@ resource "aws_s3_bucket" "this" {
       object_lock_enabled = "Enabled"
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      acceleration_status,
+      acl,
+      grant,
+      cors_rule,
+      lifecycle_rule,
+      logging,
+      object_lock_configuration[0].rule,
+      replication_configuration,
+      request_payer,
+      server_side_encryption_configuration,
+      versioning,
+      website
+    ]
+  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice C:
main.tf
@@ -28,6 +28,23 @@ resource "aws_s3_bucket" "this" {
       object_lock_enabled = "Enabled"
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      acceleration_status,
+      acl,
+      grant,
+      cors_rule,
+      lifecycle_rule,
+      logging,
+      object_lock_configuration[0].rule,
+      replication_configuration,
+      request_payer,
+      server_side_encryption_configuration,
+      versioning,
+      website
+    ]
+  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---

Choice D:
main.tf
@@ -28,6 +28,23 @@ resource "aws_s3_bucket" "this" {
       object_lock_enabled = "Enabled"
     }
   }
+
+  lifecycle {
+    ignore_changes = [
+      acceleration_status,
+      acl,
+      grant,
+      cors_rule,
+      lifecycle_rule,
+      logging,
+      object_lock_configuration[0].rule,
+      replication_configuration,
+      request_payer,
+      server_side_encryption_configuration,
+      versioning,
+      website
+    ]
+  }
 }

 resource "aws_s3_bucket_logging" "this" {
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
Allow to add S3 bucket metrics.

## Motivation and Context
See https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/85

## Breaking Changes
No breaking change.

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects

---

Choice A:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -173,6 +174,7 @@ No modules.
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
+|  [bucket\_metrics](#input\_bucket\_metrics) | (Optional) Specifies bucket metrics. | `any` | `{}` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
 |  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
---
examples/complete/main.tf
@@ -324,4 +324,36 @@ module "s3_bucket" {
       }
     }
   }
+
+  # S3 Bucket Metrics
+  bucket_metrics = [
+    {
+      name = "EntireBucket"
+    },
+    {
+      name = "PrefixFilter"
+      filter = {
+        prefix = "prefix/"
+      }
+    },
+    {
+      name = "TagsFilter"
+      filter = {
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    },
+    {
+      name = "FullFilter"
+      filter = {
+        prefix = "prefix/"
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    }
+  ]
 }
---
main.tf
@@ -709,6 +709,22 @@ resource "aws_s3_bucket_ownership_controls" "this" {
   ]
 }

+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in var.bucket_metrics : v.name => v if var.create_bucket }
+
+  bucket = aws_s3_bucket.this[0].bucket
+  name   = each.key
+
+  dynamic "filter" {
+    for_each = try([each.value.filter], [])
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+}
+
 resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }

@@ -734,5 +750,4 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
       days        = tiering.value.days
     }
   }
-
 }
---
variables.tf
@@ -202,6 +202,12 @@ variable "object_ownership" {
   default     = "ObjectWriter"
 }

+variable "bucket_metrics" {
+  description = "(Optional) Specifies bucket metrics."
+  type        = list(any)
+  default     },
+ []
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---

---

Choice B:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -173,6 +174,7 @@ No modules.
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
+|  [bucket\_metrics](#input\_bucket\_metrics) | (Optional) Specifies bucket metrics. | `any` | `{}` |  |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
 |  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
---
examples/complete/main.tf
@@ -324,4 +324,36 @@ module "s3_bucket" {
       }
     }
   }
+
+  # S3 Bucket Metrics
+  bucket_metrics = [
+    {
+      name = "EntireBucket"
+    },
+    {
+      name = "PrefixFilter"
+      filter = {
+        prefix = "prefix/"
+      }
+    },
+    {
+      name = "TagsFilter"
+      filter = {
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    },
+    {
+      name = "FullFilter"
+      filter = {
+        prefix = "prefix/"
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    }
+  ]
 }
---
main.tf
@@ -709,6 +709,22 @@ resource "aws_s3_bucket_ownership_controls" "this" {
   ]
 }

+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in var.bucket_metrics : v.name => v if var.create_bucket }
+
+  bucket = aws_s3_bucket.this[0].bucket
+  name   = each.key
+
+  dynamic "filter" {
+    for_each = try([each.value.filter], [])
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+}
+
 resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }

@@ -734,5 +750,4 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
       days        = tiering.value.days
     }
   }
-
 }
---
variables.tf
@@ -202,6 +202,12 @@ variable "object_ownership" {
   default     = "ObjectWriter"
 }

+variable "bucket_metrics" {
+  description = "(Optional) Specifies bucket metrics."
+  type        = list(any)
+  default     = []
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---

---

Choice C:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -173,6 +174,7 @@ No modules.
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
+|  [bucket\_metrics](#input\_bucket\_metrics) | (Optional) Specifies bucket metrics. | `any` | `{}` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
 |  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
---
examples/complete/main.tf
@@ -324,4 +324,36 @@ module "s3_bucket" {
       }
     }
   }
+
+  # S3 Bucket Metrics
+  bucket_metrics = [
+    {
+      name = "EntireBucket"
+    },
+    {
+      name = "PrefixFilter"
+      filter = {
+        prefix = "prefix/"
+      }
+    },
+    {
+      name = "TagsFilter"
+      filter = {
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    },
+    {
+      name = "FullFilter"
+      filter = {
+        prefix = "prefix/"
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    }
+  ]
 }
---
main.tf
@@ -709,6 +709,22 @@ resource "aws_s3_bucket_ownership_controls" "this" {
   ]
 }

+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in var.bucket_metrics : v.name => v if var.create_bucket }
+
+  bucket = aws_s3_bucket.this[0].bucket
+  name   = each.key
+
+  dynamic "filter" {
+    for_each = try([each.value.filter], [])
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+}
+
 resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }

@@ -734,5 +750,4 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
       days        = tiering.value.days
     }
   }
-
 }
---
variables.tf
@@ -202,6 +202,12 @@ variable "object_ownership" {
   default     = "ObjectWriter"
 }

+variable "bucket_metrics" {
+  description = "(Optional) Specifies bucket metrics."
+  type        = list(any)
+  default     = []
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---

---

Choice D:
README.md
@@ -141,6 +141,7 @@ No modules.
 | [aws_s3_bucket_intelligent_tiering_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_intelligent_tiering_configuration) | resource |
 | [aws_s3_bucket_lifecycle_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
 | [aws_s3_bucket_logging.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
+| [aws_s3_bucket_metric.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_metric) | resource |
 | [aws_s3_bucket_object_lock_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_object_lock_configuration) | resource |
 | [aws_s3_bucket_ownership_controls.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource |
 | [aws_s3_bucket_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -173,6 +174,7 @@ No modules.
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
+|  [bucket\_metrics](#input\_bucket\_metrics) | (Optional) Specifies bucket metrics. | `any` | `{}` | no |
 |  [bucket\_prefix](#input\_bucket\_prefix) | (Optional, Forces new resource) Creates a unique bucket name beginning with the specified prefix. Conflicts with bucket. | `string` | `null` | no |
 |  [control\_object\_ownership](#input\_control\_object\_ownership) | Whether to manage S3 Bucket Ownership Controls on this bucket. | `bool` | `false` | no |
 |  [cors\_rule](#input\_cors\_rule) | List of maps containing rules for Cross-Origin Resource Sharing. | `any` | `[]` | no |
---
examples/complete/main.tf
@@ -324,4 +324,36 @@ module "s3_bucket" {
       }
     }
   }
+
+  # S3 Bucket Metrics
+  bucket_metrics = [
+    {
+      name = "EntireBucket"
+    },
+    {
+      name = "PrefixFilter"
+      filter = {
+        prefix = "prefix/"
+      }
+    },
+    {
+      name = "TagsFilter"
+      filter = {
+        tags = {
+    {
      my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    },
+    {
+      name = "FullFilter"
+      filter = {
+        prefix = "prefix/"
+        tags = {
+          my-first-tag  = "my-value"
+          my-second-tag = "my-value"
+        }
+      }
+    }
+  ]
 }
---
main.tf
@@ -709,6 +709,22 @@ resource "aws_s3_bucket_ownership_controls" "this" {
   ]
 }

+resource "aws_s3_bucket_metric" "this" {
+  for_each = { for k, v in var.bucket_metrics : v.name => v if var.create_bucket }
+
+  bucket = aws_s3_bucket.this[0].bucket
+  name   = each.key
+
+  dynamic "filter" {
+    for_each = try([each.value.filter], [])
+
+    content {
+      prefix = try(filter.value.prefix, null)
+      tags   = try(filter.value.tags, null)
+    }
+  }
+}
+
 resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
   for_each = { for k, v in local.intelligent_tiering : k => v if local.create_bucket }

@@ -734,5 +750,4 @@ resource "aws_s3_bucket_intelligent_tiering_configuration" "this" {
       days        = tiering.value.days
     }
   }
-
 }
---
variables.tf
@@ -202,6 +202,12 @@ variable "object_ownership" {
   default     = "ObjectWriter"
 }

+variable "bucket_metrics" {
+  description = "(Optional) Specifies bucket metrics."
+  type        = list(any)
+  default     = []
+}
+
 variable "putin_khuylo" {
   description = "Do you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!"
   type        = bool
---

---


Choose the best Terraform patch (A/B/C/D) that implements the requested S3 security change safely. Only respond with a single uppercase letter.

Task Description:
## Description
This adds an additional parameter that toggles whether to add a bucket policy for requiring TLS 1.2 in order to access the bucket.

## Motivation and Context
I'm working in an organization that requires TLS v1.2 on all of their buckets. I was already using the module and thought this is a common enough need in secure organizations that we should generalize it. I created an issue requesting the feature here: https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/issues/125.

Fixes #125

## Breaking Changes
No

## How Has This Been Tested?
- [x] I have tested and validated these changes using one or more of the provided `examples/*` projects
I tested using the `examples/complete` project by adding the new parameter on to the buckets. I confirmed in my console that the policy was created.

---

Choice A:
README.md
@@ -133,6 +133,7 @@ No modules.
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -145,6 +146,7 @@ No modules.
 |  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
+|  [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -59,6 +59,7 @@ module "log_bucket" {
   attach_elb_log_delivery_policy        = true
   attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
 }

 module "cloudfront_log_bucket" {
@@ -90,6 +91,7 @@ module "s3_bucket" {
   policy        = data.aws_iam_policy_document.bucket_policy.json

   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true

   tags = {
     Owner = "Anton"
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -275,6 +275,7 @@ data "aws_iam_policy_document" "combined" {
   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
     var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
+    var.attach_require_latest_tls_policy ? data.aws_iam_policy_document.require_latest_tls[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -390,6 +391,37 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }

+data "aws_iam_policy_document" "require_latest_tls" {
+  count = var.create_bucket && var.attach_require_latest_tls_policy ? 1 : 0
+
+  statement {
+    sid    = "denyOutdatedTLS"
+    effect = "Deny"
+
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.this[0].arn,
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values = [
+        "1.2"
+      ]
+    }
+  }
+}
+
 resource "aws_s3_bucket_public_access_block" "this" {
   count = var.create_bucket && var.attach_public_policy ? 1 : 0

---
variables.tf
@@ -22,6 +22,12 @@ variable "attach_deny_insecure_transport_policy" {
   default     = false
 }

+variable "attach_require_latest_tls_policy" {
+  description = "Controls if S3 bucket should require the latest version of TLS"
+  type        = bool
+  default     = false
+}
+
 variable "attach_policy" {
   description = "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)"
   type        = bool
---

---

Choice B:
README.md
@@ -133,6 +133,7 @@ No modules.
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -145,6 +146,7 @@ No modules.
 |  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
+|  [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -59,6 +59,7 @@ module "log_bucket" {
   attach_elb_log_delivery_policy        = true
   attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
 }

 module "cloudfront_log_bucket" {
@@ -90,6 +91,7 @@ module "s3_bucket" {
   policy        = data.aws_iam_policy_document.bucket_policy.json

   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true

   tags = {
     Owner = "Anton"
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -275,6 +275,7 @@ data "aws_iam_policy_document" "combined" {
   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
     var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
+    var.attach_require_latest_tls_policy ? data.aws_iam_policy_document.require_latest_tls[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -390,6 +391,37 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }

+data "aws_iam_policy_document" "require_latest_tls" {
+  count = var.create_bucket && var.attach_require_latest_tls_policy ? 1 : 0
+
+  statement {
+    sid    = "denyOutdatedTLS"
+    effect = "Deny"
+
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.this[0].arn,
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values = [
+        "1.2"
+      ]
+    }
+  }
+}
+
 resource "aws_s3_bucket_public_access_block" "this" {
   count = var.create_bucket && var.attach_public_policy ? 1 : 0

---
variables.tf
@@ -22,6 +22,12 @@ variable "attach_deny_insecure_transport_policy" {
   default     = false
 }

+variable "attach_require_latest_tls_policy" {
+  description = "Controls if S3 bucket should require the latest version of TLS"
+  type        = bool
+  default     = false
+}
+
 variable "attach_policy" {
   description = "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)"
   type        = bool
---

---

Choice C:
README.md
@@ -133,6 +133,7 @@ No modules.
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -145,6 +146,7 @@ No modules.
 |  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
+|  [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will module a random, unique name. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -59,6 +59,7 @@ module "log_bucket" {
   attach_elb_log_delivery_policy        = true
   attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
 }

 module "cloudfront_log_bucket" {
@@ -90,6 +91,7 @@ module "s3_bucket" {
   policy        = data.aws_iam_policy_document.bucket_policy.json

   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true

   tags = {
     Owner = "Anton"
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -275,6 +275,7 @@ data "aws_iam_policy_document" "combined" {
   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
     var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
+    var.attach_require_latest_tls_policy ? data.aws_iam_policy_document.require_latest_tls[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -390,6 +391,37 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }

+data "aws_iam_policy_document" "require_latest_tls" {
+  count = var.create_bucket && var.attach_require_latest_tls_policy ? 1 : 0
+
+  statement {
+    sid    = "denyOutdatedTLS"
+    effect = "Deny"
+
+    actions = [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.this[0].arn,
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values = [
+        "1.2"
+      ]
+    }
+  }
+}
+
 resource "aws_s3_bucket_public_access_block" "this" {
   count = var.create_bucket && var.attach_public_policy ? 1 : 0

---
variables.tf
@@ -22,6 +22,12 @@ variable "attach_deny_insecure_transport_policy" {
   default     = false
 }

+variable "attach_require_latest_tls_policy" {
+  description = "Controls if S3 bucket should require the latest version of TLS"
+  type        = bool
+  default     = false
+}
+
 variable "attach_policy" {
   description = "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)"
   type        = bool
---

---

Choice D:
README.md
@@ -133,6 +133,7 @@ No modules.
 | [aws_iam_policy_document.deny_insecure_transport](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.elb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.lb_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.require_latest_tls](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |

 ## Inputs

@@ -145,6 +146,7 @@ No modules.
 |  [attach\_lb\_log\_delivery\_policy](#input\_attach\_lb\_log\_delivery\_policy) | Controls if S3 bucket should have ALB/NLB log delivery policy attached | `bool` | `false` | no |
 |  [attach\_policy](#input\_attach\_policy) | Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy) | `bool` | `false` | no |
 |  [attach\_public\_policy](#input\_attach\_public\_policy) | Controls if a user defined public bucket policy will be attached (set to `false` to allow upstream to apply defaults to the bucket) | `bool` | `true` | no |
+|  [attach\_require\_latest\_tls\_policy](#input\_attach\_require\_latest\_tls\_policy) | Controls if S3 bucket should require the latest version of TLS | `bool` | `false` | no |
 |  [block\_public\_acls](#input\_block\_public\_acls) | Whether Amazon S3 should block public ACLs for this bucket. | `bool` | `false` | no |
 |  [block\_public\_policy](#input\_block\_public\_policy) | Whether Amazon S3 should block public bucket policies for this bucket. | `bool` | `false` | no |
 |  [bucket](#input\_bucket) | (Optional, Forces new resource) The name of the bucket. If omitted, Terraform will assign a random, unique name. | `string` | `null` | no |
---
examples/complete/main.tf
@@ -59,6 +59,7 @@ module "log_bucket" {
   attach_elb_log_delivery_policy        = true
   attach_lb_log_delivery_policy         = true
   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true
 }

 module "cloudfront_log_bucket" {
@@ -90,6 +91,7 @@ module "s3_bucket" {
   policy        = data.aws_iam_policy_document.bucket_policy.json

   attach_deny_insecure_transport_policy = true
+  attach_require_latest_tls_policy      = true

   tags = {
     Owner = "Anton"
---
main.tf
@@ -1,5 +1,5 @@
 locals {
-  attach_policy = var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
+  attach_policy = var.attach_require_latest_tls_policy || var.attach_elb_log_delivery_policy || var.attach_lb_log_delivery_policy || var.attach_deny_insecure_transport_policy || var.attach_policy
 }

 resource "aws_s3_bucket" "this" {
@@ -275,6 +275,7 @@ data "aws_iam_policy_document" "combined" {
   source_policy_documents = compact([
     var.attach_elb_log_delivery_policy ? data.aws_iam_policy_document.elb_log_delivery[0].json : "",
     var.attach_lb_log_delivery_policy ? data.aws_iam_policy_document.lb_log_delivery[0].json : "",
+    var.attach_require_latest_tls_policy ? data.aws_iam_policy_document.require_latest_tls[0].json : "",
     var.attach_deny_insecure_transport_policy ? data.aws_iam_policy_document.deny_insecure_transport[0].json : "",
     var.attach_policy ? var.policy : ""
   ])
@@ -390,6 +391,37 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }

+data "aws_iam_policy_document" "require_latest_tls" {
+  count = var.create_bucket && var.attach_require_latest_tls_policy ? 1 : 0
+
+  statement {
+    sid    = "denyOutdatedTLS"
+    effect = "Deny"
+
+    actions -1,5 [
+      "s3:*",
+    ]
+
+    resources = [
+      aws_s3_bucket.this[0].arn,
+      "${aws_s3_bucket.this[0].arn}/*",
+    ]
+
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+
+    condition {
+      test     = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values = [
+        "1.2"
+      ]
+    }
+  }
+}
+
 resource "aws_s3_bucket_public_access_block" "this" {
   count = var.create_bucket && var.attach_public_policy ? 1 : 0

---
variables.tf
@@ -22,6 +22,12 @@ variable "attach_deny_insecure_transport_policy" {
   default     = false
 }

+variable "attach_require_latest_tls_policy" {
+  description = "Controls if S3 bucket should require the latest version of TLS"
+  type        = bool
+  default     = false
+}
+
 variable "attach_policy" {
   description = "Controls if S3 bucket should have bucket policy attached (set to `true` to use value of `policy` as bucket policy)"
   type        = bool
---

---