@cryptotaxi247 / infra / commits / 2e16c34a

Convert S3 policies from JSON to Nix

Eelco Dolstra committed Jun 29, 2018 at 17:24 UTC 2e16c34a0e088b29c8d795dd0df5f6b06358b87f
1 file changed +100 -110
nixos-org/network.nix
+100 -110
@@ -40,63 +40,61 @@ in
40 name = "nixpkgs-tarballs";
41 # All files are readable but not listable.
42 # The s3-upload-tarballs user can upload files.
43 - policy =
44 - ''
45 - {
46 - "Version": "2008-10-17",
47 - "Statement": [
43 + policy = builtins.toJSON
44 + { Version = "2008-10-17";
45 + Statement =
46 + [
47 {
49 - "Sid": "AllowPublicRead",
50 - "Effect": "Allow",
51 - "Principal": {"AWS": "*"},
52 - "Action": ["s3:GetObject"],
53 - "Resource": ["${config.arn}/*"]
54 - },
48 + Sid = "AllowPublicRead";
49 + Effect = "Allow";
50 + Principal.AWS = "*";
51 + Action = [ "s3:GetObject" ];
52 + Resource = [ "${config.arn}/*" ];
53 + }
54 {
56 - "Sid": "AllowUpload",
57 - "Effect": "Allow",
58 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-tarballs"},
59 - "Action": ["s3:PutObject", "s3:PutObjectAcl"],
60 - "Resource": ["${config.arn}/*"]
61 - },
55 + Sid = "AllowUpload";
56 + Effect = "Allow";
57 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-tarballs";
58 + Action = [ "s3:PutObject" "s3:PutObjectAcl" ];
59 + Resource = [ "${config.arn}/*" ];
60 + }
61 {
63 - "Sid": "AllowUpload2",
64 - "Effect": "Allow",
65 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-tarballs"},
66 - "Action": ["s3:ListBucket"],
67 - "Resource": ["${config.arn}"]
68 - },
62 + Sid = "AllowUpload2";
63 + Effect = "Allow";
64 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-tarballs";
65 + Action = [ "s3:ListBucket" ];
66 + Resource = [ "${config.arn}" ];
67 + }
68 {
70 - "Sid": "CopumpkinAllowUpload",
71 - "Effect": "Allow",
72 - "Principal": {"AWS": "arn:aws:iam::390897850978:root"},
73 - "Action": ["s3:PutObject", "s3:PutObjectAcl"],
74 - "Resource": ["${config.arn}/*"]
75 - },
69 + Sid = "CopumpkinAllowUpload";
70 + Effect = "Allow";
71 + Principal.AWS = "arn:aws:iam::390897850978:root";
72 + Action = [ "s3:PutObject" "s3:PutObjectAcl" ];
73 + Resource = [ "${config.arn}/*" ];
74 + }
75 {
77 - "Sid": "CopumpkinAllowUpload2",
78 - "Effect": "Allow",
79 - "Principal": {"AWS": "arn:aws:iam::390897850978:root"},
80 - "Action": ["s3:ListBucket"],
81 - "Resource": ["${config.arn}"]
82 - },
76 + Sid = "CopumpkinAllowUpload2";
77 + Effect = "Allow";
78 + Principal.AWS = "arn:aws:iam::390897850978:root";
79 + Action = [ "s3:ListBucket" ];
80 + Resource = [ "${config.arn}" ];
81 + }
82 {
84 - "Sid": "ShlevyAllowUpload",
85 - "Effect": "Allow",
86 - "Principal": {"AWS": "arn:aws:iam::976576280863:user/shlevy"},
87 - "Action": ["s3:PutObject", "s3:PutObjectAcl"],
88 - "Resource": ["${config.arn}/*"]
89 - },
83 + Sid = "ShlevyAllowUpload";
84 + Effect = "Allow";
85 + Principal.AWS = "arn:aws:iam::976576280863:user/shlevy";
86 + Action = [ "s3:PutObject" "s3:PutObjectAcl" ];
87 + Resource = [ "${config.arn}/*" ];
88 + }
89 {
91 - "Sid": "ShlevyAllowUpload2",
92 - "Effect": "Allow",
93 - "Principal": {"AWS": "arn:aws:iam::976576280863:user/shlevy"},
94 - "Action": ["s3:ListBucket"],
95 - "Resource": ["${config.arn}"]
90 + Sid = "ShlevyAllowUpload2";
91 + Effect = "Allow";
92 + Principal.AWS = "arn:aws:iam::976576280863:user/shlevy";
93 + Action = [ "s3:ListBucket" ];
94 + Resource = [ "${config.arn}" ];
95 }
97 - ]
98 - }
99 - '';
96 + ];
97 + };
98 website.enabled = true;
99 };
100
@@ -105,42 +103,36 @@ in
103 { inherit accessKeyId;
104 region = "us-east-1";
105 name = "nix-cache";
108 - policy =
109 - ''
110 - {
111 - "Version": "2008-10-17",
112 - "Statement": [
113 - {
114 - "Sid": "AllowPublicRead",
115 - "Effect": "Allow",
116 - "Principal": {"AWS": "*"},
117 - "Action": ["s3:GetObject"],
118 - "Resource": ["${config.arn}/*"]
119 - },
120 - {
121 - "Sid": "AllowUploadDebuginfoWrite",
122 - "Effect": "Allow",
123 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"},
124 - "Action": ["s3:PutObject", "s3:PutObjectAcl"],
125 - "Resource": ["${config.arn}/debuginfo/*"]
126 - },
127 - {
128 - "Sid": "AllowUploadDebuginfoRead",
129 - "Effect": "Allow",
130 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"},
131 - "Action": ["s3:GetObject"],
132 - "Resource": ["${config.arn}/*"]
133 - },
134 - {
135 - "Sid": "AllowUploadDebuginfoRead2",
136 - "Effect": "Allow",
137 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"},
138 - "Action": ["s3:ListBucket", "s3:GetBucketLocation"],
139 - "Resource": ["${config.arn}"]
140 - }
141 - ]
142 - }
143 - '';
106 + policy = builtins.toJSON {
107 + Version = "2008-10-17";
108 + Statement =
109 + [
110 + { Sid = "AllowPublicRead";
111 + Effect = "Allow";
112 + Principal.AWS = "*";
113 + Action = [ "s3:GetObject" ];
114 + Resource = [ "${config.arn}/*" ];
115 + }
116 + { Sid = "AllowUploadDebuginfoWrite";
117 + Effect = "Allow";
118 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-releases";
119 + Action = [ "s3:PutObject" "s3:PutObjectAcl" ];
120 + Resource = [ "${config.arn}/debuginfo/*" ];
121 + }
122 + { Sid = "AllowUploadDebuginfoRead";
123 + Effect = "Allow";
124 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-releases";
125 + Action = [ "s3:GetObject" ];
126 + Resource = [ "${config.arn}/*" ];
127 + }
128 + { Sid = "AllowUploadDebuginfoRead2";
129 + Effect = "Allow";
130 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-releases";
131 + Action = [ "s3:ListBucket" "s3:GetBucketLocation" ];
132 + Resource = [ "${config.arn}" ];
133 + }
134 + ];
135 + };
136 };
137
138 /*
@@ -178,35 +170,33 @@ in
170 { inherit accessKeyId;
171 name = "nix-releases";
172 region = "eu-west-1";
181 - policy =
182 - ''
183 - {
184 - "Version": "2008-10-17",
185 - "Statement": [
173 + policy = builtins.toJSON
174 + { Version = "2008-10-17";
175 + Statement =
176 + [
177 {
187 - "Sid": "AllowPublicRead",
188 - "Effect": "Allow",
189 - "Principal": {"AWS": "*"},
190 - "Action": ["s3:GetObject"],
191 - "Resource": ["${config.arn}/*"]
192 - },
178 + Sid = "AllowPublicRead";
179 + Effect = "Allow";
180 + Principal.AWS = "*";
181 + Action = [ "s3:GetObject" ];
182 + Resource = [ "${config.arn}/*" ];
183 + }
184 {
194 - "Sid": "AllowPublicList",
195 - "Effect": "Allow",
196 - "Principal": {"AWS": "*"},
197 - "Action": ["s3:ListBucket"],
198 - "Resource": ["${config.arn}"]
199 - },
185 + Sid = "AllowPublicList";
186 + Effect = "Allow";
187 + Principal.AWS = "*";
188 + Action = [ "s3:ListBucket" ];
189 + Resource = [ "${config.arn}" ];
190 + }
191 {
201 - "Sid": "AllowUpload",
202 - "Effect": "Allow",
203 - "Principal": {"AWS": "arn:aws:iam::080433136561:user/s3-upload-releases"},
204 - "Action": ["s3:PutObject", "s3:PutObjectAcl"],
205 - "Resource": ["${config.arn}/*"]
192 + Sid = "AllowUpload";
193 + Effect = "Allow";
194 + Principal.AWS = "arn:aws:iam::080433136561:user/s3-upload-releases";
195 + Action = [ "s3:PutObject" "s3:PutObjectAcl" ];
196 + Resource = [ "${config.arn}/*" ];
197 }
207 - ]
208 - }
209 - '';
198 + ];
199 + };
200 };
201
202 resources.vpc.nixos-org-vpc =