82 lines
2.9 KiB
Terraform
82 lines
2.9 KiB
Terraform
|
ephemeral "vault_kv_secret_v2" "project_delivery_cache_reader" {
|
||
|
|
mount = "secret"
|
||
|
|
name = var.project_delivery_cache_reader_vault_secret_path
|
||
|
|
}
|
||
|
|
|
||
|
|
ephemeral "vault_kv_secret_v2" "project_delivery_cache_writer" {
|
||
|
|
mount = "secret"
|
||
|
|
name = var.project_delivery_cache_writer_vault_secret_path
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "versitygw_user" "project_delivery_cache_reader" {
|
||
|
|
access_key_id = var.project_delivery_cache_reader_principal
|
||
|
|
secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_reader.data["secretAccessKey"]
|
||
|
|
role = "user"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "versitygw_user" "project_delivery_cache_writer" {
|
||
|
|
access_key_id = var.project_delivery_cache_writer_principal
|
||
|
|
secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_writer.data["secretAccessKey"]
|
||
|
|
role = "user"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "minio_s3_bucket" "project_delivery" {
|
||
|
|
bucket = var.project_delivery_cache_bucket_name
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "minio_s3_bucket_policy" "project_delivery" {
|
||
|
|
bucket = minio_s3_bucket.project_delivery.bucket
|
||
|
|
|
||
|
|
depends_on = [
|
||
|
|
versitygw_user.project_delivery_cache_reader,
|
||
|
|
versitygw_user.project_delivery_cache_writer,
|
||
|
|
]
|
||
|
|
|
||
|
|
policy = jsonencode({
|
||
|
|
Version = "2012-10-17"
|
||
|
|
Statement = [
|
||
|
|
{
|
||
|
|
Sid = "ProjectDeliveryCacheLocation"
|
||
|
|
Effect = "Allow"
|
||
|
|
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
|
||
|
|
Action = ["s3:GetBucketLocation"]
|
||
|
|
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Sid = "ProjectDeliveryCacheList"
|
||
|
|
Effect = "Allow"
|
||
|
|
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
|
||
|
|
Action = [
|
||
|
|
"s3:ListBucket",
|
||
|
|
]
|
||
|
|
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
|
||
|
|
Condition = {
|
||
|
|
StringLike = {
|
||
|
|
"s3:prefix" = ["projects/*"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Sid = "ProjectDeliveryCacheRead"
|
||
|
|
Effect = "Allow"
|
||
|
|
Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
|
||
|
|
Action = ["s3:GetObject"]
|
||
|
|
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Sid = "ProjectDeliveryCacheWrite"
|
||
|
|
Effect = "Allow"
|
||
|
|
Principal = var.project_delivery_cache_writer_principal
|
||
|
|
Action = ["s3:PutObject"]
|
||
|
|
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
Sid = "ProjectDeliveryCachePrune"
|
||
|
|
Effect = "Allow"
|
||
|
|
Principal = var.project_delivery_cache_writer_principal
|
||
|
|
Action = ["s3:DeleteObject"]
|
||
|
|
Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*/*/cache/*/objects/*"]
|
||
|
|
},
|
||
|
|
]
|
||
|
|
})
|
||
|
|
}
|