terraform-iam: tune archeologist permissions
The main change is to give them read-only access to the main s3://nix-cache/ on top of the side ones. The profile had two sid with overlapping permissions, so I removed one side. Finally, we also given them access to CloudWatch metrics so they can see the bucket sizes.
zimbatm committed
Jun 3, 2025 at 22:48 UTC
b7378f06d0890ac4c2f6fd0d0405d8e3116bf0a7
1 file changed
+9
-9
terraform-iam/archeologist.tf
+9
-9
@@ -11,7 +11,7 @@ data "aws_iam_policy_document" "archaeologist" {
11
# Read-only access and listing permissions
12
# To the cache and releases inventories,
13
# as well as the bucket where cache bucket logs end up in.
14
- sid = "NixCacheLogsInventoryReadOnly"
14
+ sid = "NixCacheReadOnly"
15
16
actions = [
17
"s3:List*",
@@ -19,6 +19,8 @@ data "aws_iam_policy_document" "archaeologist" {
19
]
20
21
resources = [
22
+ "arn:aws:s3:::nix-cache",
23
+ "arn:aws:s3:::nix-cache/*",
24
"arn:aws:s3:::nix-cache-inventory",
25
"arn:aws:s3:::nix-cache-inventory/*",
26
"arn:aws:s3:::nix-cache-log",
@@ -29,18 +31,16 @@ data "aws_iam_policy_document" "archaeologist" {
31
}
32
33
statement {
32
- sid = "NixCacheLogsReadOnly"
34
+ # Allows fetching information on the bucket
35
+ sid = "ListMetrics"
36
37
actions = [
35
- "s3:Get*"
38
+ "cloudwatch:ListMetrics",
39
+ "cloudwatch:GetMetricStatistics"
40
]
41
38
- resources = [
39
- "arn:aws:s3:::nix-cache-log",
40
- "arn:aws:s3:::nix-cache-log/*",
41
- "arn:aws:s3:::nix-releases-inventory220231029182031496800000001",
42
- "arn:aws:s3:::nix-releases-inventory220231029182031496800000001/*",
43
- ]
42
+ # We don't have any private metrics, KISS
43
+ resources = ["*"]
44
}
45
46
statement {