terraform-iam: fix listing for nix-cache-logs and others (hopefully)
This adds support for the ListObjects[V2] actions, which should allow listing the contents in there.
Florian Klink committed
Nov 11, 2023 at 19:51 UTC
eccb66deafc6c34b479c2caab3c98cefc1ddd1b5
1 file changed
+10
-3
terraform-iam/archeologist.tf
+10
-3
@@ -8,9 +8,13 @@ resource "aws_s3_bucket" "archeologist" {
8
9
data "aws_iam_policy_document" "archaeologist" {
10
statement {
11
- sid = "NixCacheInventoryReadOnly"
11
+ # Read-only access and listing permissions
12
+ # To the cache and releases inventories,
13
+ # as well as the bucket where cache bucket logs end up in.
14
+ sid = "NixCacheLogsInventoryReadOnly"
15
16
actions = [
17
+ "s3:List*",
18
"s3:Get*"
19
]
20
@@ -33,12 +37,15 @@ data "aws_iam_policy_document" "archaeologist" {
37
38
resources = [
39
"arn:aws:s3:::nix-cache-log",
36
- "arn:aws:s3:::nix-cache-log/*"
40
+ "arn:aws:s3:::nix-cache-log/*",
41
+ "arn:aws:s3:::nix-releases-inventory220231029182031496800000001",
42
+ "arn:aws:s3:::nix-releases-inventory220231029182031496800000001/*",
43
]
44
}
45
46
statement {
41
- sid = "NixArcheologistReadWrite"
47
+ # Full access to the Archaeologist bucket
48
+ sid = "NixArchaeologistReadWrite"
49
50
actions = [
51
"s3:*"