add aws s3 keys for staging
Jörg Thalheim committed
Feb 12, 2025 at 14:58 UTC
30e1fb03b7f4fbf40095ec2e10f685c74c760c50
1 file changed
+46
terraform-iam/cache-staging.tf
new
+46
@@ -0,0 +1,46 @@
1
+resource "aws_iam_user" "s3-upload-cache-staging" {
2
+ name = "s3-upload-cache-staging"
3
+}
4
+
5
+resource "aws_iam_access_key" "s3-upload-cache-staging" {
6
+ user = aws_iam_user.s3-upload-cache-staging.name
7
+}
8
+
9
+data "aws_iam_policy_document" "s3-upload-cache-staging" {
10
+ statement {
11
+ # Read-only access and listing permissions
12
+ # To the cache and releases inventories,
13
+ # as well as the bucket where cache bucket logs end up in.
14
+ sid = "NixCacheStagingBucket"
15
+
16
+ actions = [
17
+ "s3:*"
18
+ ]
19
+
20
+ resources = [
21
+ "arn:aws:s3:::nix-cache-staging",
22
+ "arn:aws:s3:::nix-cache-staging/*",
23
+ "arn:aws:s3:::nix-cache-staging-202410",
24
+ "arn:aws:s3:::nix-cache-staging-202410/*",
25
+ ]
26
+ }
27
+}
28
+
29
+# This is the role that is given to the AWS Identity Center users
30
+resource "aws_iam_policy" "s3-upload-cache-staging" {
31
+ provider = aws.us
32
+
33
+ name = "s3-upload-cache-staging"
34
+ description = "used by staging hydra"
35
+
36
+ policy = data.aws_iam_policy_document.s3-upload-cache-staging.json
37
+}
38
+
39
+output "s3-upload-key-staging" {
40
+ value = {
41
+ key = aws_iam_access_key.s3-upload-cache-staging.id
42
+ secret = aws_iam_access_key.s3-upload-cache-staging.secret
43
+ }
44
+ sensitive = true
45
+}
46
+