diff --git a/terraform/aws/alb/modules/alb/s3.tf b/terraform/aws/alb/modules/alb/s3.tf
index ef906830b..4394f7fc4 100644
--- a/terraform/aws/alb/modules/alb/s3.tf
+++ b/terraform/aws/alb/modules/alb/s3.tf
@@ -48,7 +48,7 @@
 # tfsec:ignore:aws-s3-enable-bucket-encryption
 module "logs" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.15.2"
+  version = "4.0.1"
 
   bucket = local.alb_logs_bucket_name
   acl    = "log-delivery-write"
diff --git a/terraform/aws/guardduty/modules/guardduty/s3.tf b/terraform/aws/guardduty/modules/guardduty/s3.tf
index 3b5328796..6bff4ebd8 100644
--- a/terraform/aws/guardduty/modules/guardduty/s3.tf
+++ b/terraform/aws/guardduty/modules/guardduty/s3.tf
@@ -17,7 +17,7 @@
 # tfsec:ignore:aws-s3-enable-bucket-logging
 module "s3_bucket_ipset_log" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.15.2"
+  version = "4.0.1"
 
   providers = {
     aws = aws.audit
@@ -50,7 +50,7 @@ module "s3_bucket_ipset_log" {
 
 module "s3_bucket_ipset" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.15.2"
+  version = "4.0.1"
 
   providers = {
     aws = aws.audit
diff --git a/terraform/aws/root/modules/config/s3.tf b/terraform/aws/root/modules/config/s3.tf
index ac163ecb1..7808d56d2 100644
--- a/terraform/aws/root/modules/config/s3.tf
+++ b/terraform/aws/root/modules/config/s3.tf
@@ -18,7 +18,7 @@
 #tfsec:ignore:aws-s3-enable-bucket-logging
 module "bucket_awsconfig" {
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.15.2"
+  version = "4.0.1"
 
   bucket = local.bucket_name
   #   policy = data.aws_iam_policy_document.config_bucket.json
diff --git a/terraform/aws/root/waf.tf b/terraform/aws/root/waf.tf
index 84b10a95c..f6abcba7d 100644
--- a/terraform/aws/root/waf.tf
+++ b/terraform/aws/root/waf.tf
@@ -18,7 +18,7 @@ module "bucket_waf_core" {
   for_each = toset([local.core_dev_account, local.core_staging_account, local.core_prod_account])
 
   source  = "terraform-aws-modules/s3-bucket/aws"
-  version = "3.15.2"
+  version = "4.0.1"
 
   providers = {
     aws = aws.logging