terraform-iam: introduce archeologist role
This is the role we use for the people who wants to spelunk into the S3 bucket.
zimbatm committed
Oct 20, 2023 at 13:51 UTC
81d1522122dfff20325f8cafb85955a91f1e0a93
1 file changed
+57
terraform-iam/archeologist.tf
new
+57
@@ -0,0 +1,57 @@
1
+resource "aws_iam_policy" "archologist" {
2
+ name = "archeologist"
3
+ description = "used by the S3 archeologists"
4
+
5
+ policy = <<EOF
6
+{
7
+ "Version": "2012-10-17",
8
+ "Statement": [
9
+ {
10
+ "Sid": "VisualEditor0",
11
+ "Effect": "Allow",
12
+ "Action": [
13
+ "s3:GetLifecycleConfiguration",
14
+ "s3:GetBucketTagging",
15
+ "s3:GetInventoryConfiguration",
16
+ "s3:GetObjectVersionTagging",
17
+ "s3:GetBucketLogging",
18
+ "s3:GetAccelerateConfiguration",
19
+ "s3:GetObjectVersionAttributes",
20
+ "s3:GetBucketPolicy",
21
+ "s3:GetObjectVersionTorrent",
22
+ "s3:GetObjectAcl",
23
+ "s3:GetEncryptionConfiguration",
24
+ "s3:GetBucketObjectLockConfiguration",
25
+ "s3:GetIntelligentTieringConfiguration",
26
+ "s3:GetBucketRequestPayment",
27
+ "s3:GetObjectVersionAcl",
28
+ "s3:GetObjectTagging",
29
+ "s3:GetMetricsConfiguration",
30
+ "s3:GetBucketOwnershipControls",
31
+ "s3:GetBucketPublicAccessBlock",
32
+ "s3:GetBucketPolicyStatus",
33
+ "s3:GetObjectRetention",
34
+ "s3:GetBucketWebsite",
35
+ "s3:GetObjectAttributes",
36
+ "s3:GetBucketVersioning",
37
+ "s3:GetBucketAcl",
38
+ "s3:GetObjectLegalHold",
39
+ "s3:GetBucketNotification",
40
+ "s3:GetReplicationConfiguration",
41
+ "s3:GetObject",
42
+ "s3:GetObjectTorrent",
43
+ "s3:GetBucketCORS",
44
+ "s3:GetAnalyticsConfiguration",
45
+ "s3:GetObjectVersionForReplication",
46
+ "s3:GetBucketLocation",
47
+ "s3:GetObjectVersion"
48
+ ],
49
+ "Resource": [
50
+ "arn:aws:s3:::nix-cache-inventory",
51
+ "arn:aws:s3:::nix-cache-inventory/*"
52
+ ]
53
+ }
54
+ ]
55
+}
56
+EOF
57
+}