@cryptotaxi247 / infra-1 / commits / eb95ce55

terraform: update the bucket policies (#71)

Formatted with jq nix-releases inherits the policy from nix-cache

zimbatm committed Dec 20, 2018 at 11:10 UTC eb95ce55580da4af702c6e8137df8201d3b4e040
3 files changed +193 -15
terraform/cache.tf
+47 -1
@@ -25,7 +25,53 @@ resource "aws_s3_bucket_policy" "cache" {
25
26 # imported from existing
27 policy = <<EOF
28 -{"Version":"2008-10-17","Statement":[{"Sid":"AllowPublicRead","Effect":"Allow","Principal":{"AWS":"*"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::nix-cache/*"},{"Sid":"AllowUploadDebuginfoWrite","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::080433136561:user/s3-upload-releases"},"Action":["s3:PutObject","s3:PutObjectAcl"],"Resource":"arn:aws:s3:::nix-cache/debuginfo/*"},{"Sid":"AllowUploadDebuginfoRead","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::080433136561:user/s3-upload-releases"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::nix-cache/*"},{"Sid":"AllowUploadDebuginfoRead2","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::080433136561:user/s3-upload-releases"},"Action":["s3:ListBucket","s3:GetBucketLocation"],"Resource":"arn:aws:s3:::nix-cache"}]}
28 +{
29 + "Version": "2008-10-17",
30 + "Statement": [
31 + {
32 + "Sid": "AllowPublicRead",
33 + "Effect": "Allow",
34 + "Principal": {
35 + "AWS": "*"
36 + },
37 + "Action": "s3:GetObject",
38 + "Resource": "arn:aws:s3:::nix-cache/*"
39 + },
40 + {
41 + "Sid": "AllowUploadDebuginfoWrite",
42 + "Effect": "Allow",
43 + "Principal": {
44 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
45 + },
46 + "Action": [
47 + "s3:PutObject",
48 + "s3:PutObjectAcl"
49 + ],
50 + "Resource": "arn:aws:s3:::nix-cache/debuginfo/*"
51 + },
52 + {
53 + "Sid": "AllowUploadDebuginfoRead",
54 + "Effect": "Allow",
55 + "Principal": {
56 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
57 + },
58 + "Action": "s3:GetObject",
59 + "Resource": "arn:aws:s3:::nix-cache/*"
60 + },
61 + {
62 + "Sid": "AllowUploadDebuginfoRead2",
63 + "Effect": "Allow",
64 + "Principal": {
65 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
66 + },
67 + "Action": [
68 + "s3:ListBucket",
69 + "s3:GetBucketLocation"
70 + ],
71 + "Resource": "arn:aws:s3:::nix-cache"
72 + }
73 + ]
74 +}
75 EOF
76 }
77
terraform/nixpkgs-tarballs.tf
+98 -1
@@ -11,7 +11,104 @@ resource "aws_s3_bucket_policy" "nixpkgs-tarballs" {
11
12 # imported from existing
13 policy = <<EOF
14 -{"Version":"2008-10-17","Statement":[{"Sid":"AllowPublicRead","Effect":"Allow","Principal":{"AWS":"*"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::nixpkgs-tarballs/*"},{"Sid":"AllowUpload","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::080433136561:user/s3-upload-tarballs"},"Action":["s3:PutObject","s3:PutObjectAcl"],"Resource":"arn:aws:s3:::nixpkgs-tarballs/*"},{"Sid":"AllowUpload2","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::080433136561:user/s3-upload-tarballs"},"Action":"s3:ListBucket","Resource":"arn:aws:s3:::nixpkgs-tarballs"},{"Sid":"CopumpkinAllowUpload","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::390897850978:root"},"Action":["s3:PutObject","s3:PutObjectAcl"],"Resource":"arn:aws:s3:::nixpkgs-tarballs/*"},{"Sid":"CopumpkinAllowUpload2","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::390897850978:root"},"Action":"s3:ListBucket","Resource":"arn:aws:s3:::nixpkgs-tarballs"},{"Sid":"ShlevyAllowUpload","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::976576280863:user/shlevy"},"Action":["s3:PutObject","s3:PutObjectAcl"],"Resource":"arn:aws:s3:::nixpkgs-tarballs/*"},{"Sid":"ShlevyAllowUpload2","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::976576280863:user/shlevy"},"Action":"s3:ListBucket","Resource":"arn:aws:s3:::nixpkgs-tarballs"},{"Sid":"DaiderdAllowUpload","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::014292808257:user/lnl7"},"Action":["s3:PutObject","s3:PutObjectAcl"],"Resource":"arn:aws:s3:::nixpkgs-tarballs/*"},{"Sid":"DaiderdAllowUpload2","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::014292808257:user/lnl7"},"Action":"s3:ListBucket","Resource":"arn:aws:s3:::nixpkgs-tarballs"}]}
14 +{
15 + "Version": "2008-10-17",
16 + "Statement": [
17 + {
18 + "Sid": "AllowPublicRead",
19 + "Effect": "Allow",
20 + "Principal": {
21 + "AWS": "*"
22 + },
23 + "Action": "s3:GetObject",
24 + "Resource": "arn:aws:s3:::nixpkgs-tarballs/*"
25 + },
26 + {
27 + "Sid": "AllowUpload",
28 + "Effect": "Allow",
29 + "Principal": {
30 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-tarballs"
31 + },
32 + "Action": [
33 + "s3:PutObject",
34 + "s3:PutObjectAcl"
35 + ],
36 + "Resource": "arn:aws:s3:::nixpkgs-tarballs/*"
37 + },
38 + {
39 + "Sid": "AllowUpload2",
40 + "Effect": "Allow",
41 + "Principal": {
42 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-tarballs"
43 + },
44 + "Action": "s3:ListBucket",
45 + "Resource": "arn:aws:s3:::nixpkgs-tarballs"
46 + },
47 + {
48 + "Sid": "CopumpkinAllowUpload",
49 + "Effect": "Allow",
50 + "Principal": {
51 + "AWS": "arn:aws:iam::390897850978:root"
52 + },
53 + "Action": [
54 + "s3:PutObject",
55 + "s3:PutObjectAcl"
56 + ],
57 + "Resource": "arn:aws:s3:::nixpkgs-tarballs/*"
58 + },
59 + {
60 + "Sid": "CopumpkinAllowUpload2",
61 + "Effect": "Allow",
62 + "Principal": {
63 + "AWS": "arn:aws:iam::390897850978:root"
64 + },
65 + "Action": "s3:ListBucket",
66 + "Resource": "arn:aws:s3:::nixpkgs-tarballs"
67 + },
68 + {
69 + "Sid": "ShlevyAllowUpload",
70 + "Effect": "Allow",
71 + "Principal": {
72 + "AWS": "arn:aws:iam::976576280863:user/shlevy"
73 + },
74 + "Action": [
75 + "s3:PutObject",
76 + "s3:PutObjectAcl"
77 + ],
78 + "Resource": "arn:aws:s3:::nixpkgs-tarballs/*"
79 + },
80 + {
81 + "Sid": "ShlevyAllowUpload2",
82 + "Effect": "Allow",
83 + "Principal": {
84 + "AWS": "arn:aws:iam::976576280863:user/shlevy"
85 + },
86 + "Action": "s3:ListBucket",
87 + "Resource": "arn:aws:s3:::nixpkgs-tarballs"
88 + },
89 + {
90 + "Sid": "DaiderdAllowUpload",
91 + "Effect": "Allow",
92 + "Principal": {
93 + "AWS": "arn:aws:iam::014292808257:user/lnl7"
94 + },
95 + "Action": [
96 + "s3:PutObject",
97 + "s3:PutObjectAcl"
98 + ],
99 + "Resource": "arn:aws:s3:::nixpkgs-tarballs/*"
100 + },
101 + {
102 + "Sid": "DaiderdAllowUpload2",
103 + "Effect": "Allow",
104 + "Principal": {
105 + "AWS": "arn:aws:iam::014292808257:user/lnl7"
106 + },
107 + "Action": "s3:ListBucket",
108 + "Resource": "arn:aws:s3:::nixpkgs-tarballs"
109 + }
110 + ]
111 +}
112 EOF
113 }
114
terraform/releases.tf
+48 -13
@@ -12,20 +12,55 @@ resource "aws_s3_bucket" "releases" {
12
13 resource "aws_s3_bucket_policy" "releases" {
14 bucket = "${aws_s3_bucket.releases.id}"
15 - policy = "${data.aws_iam_policy_document.releases.json}"
16 -}
17 -
18 -data "aws_iam_policy_document" "releases" {
19 - statement {
20 - sid = "1"
21 - actions = ["s3:GetObject"]
22 - resources = ["${aws_s3_bucket.releases.arn}/*"]
23 -
24 - principals {
25 - type = "AWS"
26 - identifiers = ["*"]
15 + policy = <<EOF
16 +{
17 + "Version": "2008-10-17",
18 + "Statement": [
19 + {
20 + "Sid": "AllowPublicRead",
21 + "Effect": "Allow",
22 + "Principal": {
23 + "AWS": "*"
24 + },
25 + "Action": "s3:GetObject",
26 + "Resource": "arn:aws:s3:::nix-releases/*"
27 + },
28 + {
29 + "Sid": "AllowUploadDebuginfoWrite",
30 + "Effect": "Allow",
31 + "Principal": {
32 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
33 + },
34 + "Action": [
35 + "s3:PutObject",
36 + "s3:PutObjectAcl"
37 + ],
38 + "Resource": "arn:aws:s3:::nix-releases/debuginfo/*"
39 + },
40 + {
41 + "Sid": "AllowUploadDebuginfoRead",
42 + "Effect": "Allow",
43 + "Principal": {
44 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
45 + },
46 + "Action": "s3:GetObject",
47 + "Resource": "arn:aws:s3:::nix-releases/*"
48 + },
49 + {
50 + "Sid": "AllowUploadDebuginfoRead2",
51 + "Effect": "Allow",
52 + "Principal": {
53 + "AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"
54 + },
55 + "Action": [
56 + "s3:ListBucket",
57 + "s3:GetBucketLocation"
58 + ],
59 + "Resource": "arn:aws:s3:::nix-releases"
60 }
28 - }
61 + ]
62 +}
63 +EOF
64 }
65
66 resource "aws_cloudfront_distribution" "releases" {