terraform-iam: convert to aws_iam_policy_document
This makes it a bit easier to write these policies. It's a mechanical conversion from the previous version.
Florian Klink committed
Nov 11, 2023 at 19:43 UTC
410a444f4b92198ffd6024d2bea97716bfa86f84
1 file changed
+46
-40
terraform-iam/archeologist.tf
+46
-40
@@ -6,6 +6,51 @@ resource "aws_s3_bucket" "archeologist" {
6
bucket = "nix-archeologist"
7
}
8
9
+data "aws_iam_policy_document" "archaeologist" {
10
+ statement {
11
+ sid = "NixCacheInventoryReadOnly"
12
+
13
+ actions = [
14
+ "s3:Get*"
15
+ ]
16
+
17
+ resources = [
18
+ "arn:aws:s3:::nix-cache-inventory",
19
+ "arn:aws:s3:::nix-cache-inventory/*",
20
+ "arn:aws:s3:::nix-cache-log",
21
+ "arn:aws:s3:::nix-cache-log/*",
22
+ "arn:aws:s3:::nix-releases-inventory220231029182031496800000001",
23
+ "arn:aws:s3:::nix-releases-inventory220231029182031496800000001/*"
24
+ ]
25
+ }
26
+
27
+ statement {
28
+ sid = "NixCacheLogsReadOnly"
29
+
30
+ actions = [
31
+ "s3:Get*"
32
+ ]
33
+
34
+ resources = [
35
+ "arn:aws:s3:::nix-cache-log",
36
+ "arn:aws:s3:::nix-cache-log/*"
37
+ ]
38
+ }
39
+
40
+ statement {
41
+ sid = "NixArcheologistReadWrite"
42
+
43
+ actions = [
44
+ "s3:*"
45
+ ]
46
+
47
+ resources = [
48
+ aws_s3_bucket.archeologist.arn,
49
+ "${aws_s3_bucket.archeologist.arn}/*"
50
+ ]
51
+ }
52
+}
53
+
54
# This is the role that is given to the AWS Identity Center users
55
resource "aws_iam_policy" "archologist" {
56
provider = aws.us
@@ -13,46 +58,7 @@ resource "aws_iam_policy" "archologist" {
58
name = "archeologist"
59
description = "used by the S3 archeologists"
60
16
- policy = <<EOF
17
-{
18
- "Version": "2012-10-17",
19
- "Statement": [
20
- {
21
- "Sid": "NixCacheInventoryReadOnly",
22
- "Effect": "Allow",
23
- "Action": [
24
- "s3:Get*"
25
- ],
26
- "Resource": [
27
- "arn:aws:s3:::nix-cache-inventory",
28
- "arn:aws:s3:::nix-cache-inventory/*",
29
- "arn:aws:s3:::nix-releases-inventory220231029182031496800000001",
30
- "arn:aws:s3:::nix-releases-inventory220231029182031496800000001/*"
31
- ]
32
- },
33
- {
34
- "Sid": "NixCacheLogsReadOnly",
35
- "Effect": "Allow",
36
- "Action": [
37
- "s3:Get*"
38
- ],
39
- "Resource": [
40
- "arn:aws:s3:::nix-cache-log",
41
- "arn:aws:s3:::nix-cache-log/*"
42
- ]
43
- },
44
- {
45
- "Sid": "NixArcheologistReadWrite",
46
- "Effect": "Allow",
47
- "Action": [ "s3:*" ],
48
- "Resource": [
49
- "${aws_s3_bucket.archeologist.arn}",
50
- "${aws_s3_bucket.archeologist.arn}/*"
51
- ]
52
- }
53
- ]
54
-}
55
-EOF
61
+ policy = data.aws_iam_policy_document.archaeologist.json
62
}
63
64
# Prepare this role to be attached to the EC2 instance