Allow the nixos org to read the log bucket
Eelco Dolstra committed
Jul 29, 2022 at 16:19 UTC
f467c27834fddeb1ffe156c54b637db240bc7273
1 file changed
+30
-2
terraform/fastlylog/main.tf
+30
-2
@@ -1,5 +1,3 @@
1
-
2
-
1
resource "aws_s3_bucket" "logs" {
2
bucket_prefix = "fastly-logs-"
3
@@ -12,6 +10,36 @@ resource "aws_s3_bucket" "logs" {
10
}
11
}
12
13
+resource "aws_s3_bucket_policy" "logs" {
14
+ bucket = aws_s3_bucket.logs.id
15
+ policy = <<EOF
16
+{
17
+ "Version": "2008-10-17",
18
+ "Statement": [
19
+ {
20
+ "Sid": "AllowNixOSOrgRead",
21
+ "Effect": "Allow",
22
+ "Principal": {
23
+ "AWS": "arn:aws:iam::008826681144:user/eelco.dolstra"
24
+ },
25
+ "Action": "s3:GetObject",
26
+ "Resource": "arn:aws:s3:::${aws_s3_bucket.logs.id}/*"
27
+ },
28
+ {
29
+ "Sid": "AllowNixOSOrgList",
30
+ "Effect": "Allow",
31
+ "Principal": {
32
+ "AWS": "arn:aws:iam::008826681144:user/eelco.dolstra"
33
+ },
34
+ "Action": "s3:ListBucket",
35
+ "Resource": "arn:aws:s3:::${aws_s3_bucket.logs.id}"
36
+ }
37
+ ]
38
+}
39
+EOF
40
+}
41
+
42
+
43
resource "aws_iam_role" "fastly_log_forwarder" {
44
name = "FastlyLogForwarder"
45
path = "/system/"