terraform-iam: give s3 bucket to the archeologist team
zimbatm committed
Oct 25, 2023 at 14:41 UTC
a2e7dfd8d3ac9286aadf931fefae438cd2ac87e0
1 file changed
+22
-36
terraform-iam/archeologist.tf
+22
-36
@@ -7,51 +7,37 @@ resource "aws_iam_policy" "archologist" {
7
"Version": "2012-10-17",
8
"Statement": [
9
{
10
- "Sid": "VisualEditor0",
10
+ "Sid": "NixCacheInventoryReadOnly",
11
"Effect": "Allow",
12
"Action": [
13
- "s3:GetLifecycleConfiguration",
14
- "s3:GetBucketTagging",
15
- "s3:GetInventoryConfiguration",
16
- "s3:GetObjectVersionTagging",
17
- "s3:GetBucketLogging",
18
- "s3:GetAccelerateConfiguration",
19
- "s3:GetObjectVersionAttributes",
20
- "s3:GetBucketPolicy",
21
- "s3:GetObjectVersionTorrent",
22
- "s3:GetObjectAcl",
23
- "s3:GetEncryptionConfiguration",
24
- "s3:GetBucketObjectLockConfiguration",
25
- "s3:GetIntelligentTieringConfiguration",
26
- "s3:GetBucketRequestPayment",
27
- "s3:GetObjectVersionAcl",
28
- "s3:GetObjectTagging",
29
- "s3:GetMetricsConfiguration",
30
- "s3:GetBucketOwnershipControls",
31
- "s3:GetBucketPublicAccessBlock",
32
- "s3:GetBucketPolicyStatus",
33
- "s3:GetObjectRetention",
34
- "s3:GetBucketWebsite",
35
- "s3:GetObjectAttributes",
36
- "s3:GetBucketVersioning",
37
- "s3:GetBucketAcl",
38
- "s3:GetObjectLegalHold",
39
- "s3:GetBucketNotification",
40
- "s3:GetReplicationConfiguration",
41
- "s3:GetObject",
42
- "s3:GetObjectTorrent",
43
- "s3:GetBucketCORS",
44
- "s3:GetAnalyticsConfiguration",
45
- "s3:GetObjectVersionForReplication",
46
- "s3:GetBucketLocation",
47
- "s3:GetObjectVersion"
13
+ "s3:Get*"
14
],
15
"Resource": [
16
"arn:aws:s3:::nix-cache-inventory",
17
"arn:aws:s3:::nix-cache-inventory/*"
18
]
19
+ },
20
+ {
21
+ "Sid": "NixArcheologistReadWrite",
22
+ "Effect": "Allow",
23
+ "Action": [
24
+ "s3:Get*",
25
+ "s3:List*",
26
+ "s3:Put*"
27
+ ],
28
+ "Resource": [
29
+ "${aws_s3_bucket.archeologist.arn}",
30
+ "${aws_s3_bucket.archeologist.arn}/*"
31
+ ]
32
}
33
]
34
}
35
EOF
36
}
37
+
38
+resource "aws_s3_bucket" "archeologist" {
39
+ # Keep it in the same region as the cache
40
+ provider = aws.us
41
+
42
+ bucket = "nix-archeologist"
43
+}