ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/versitygw/backups.tf

@@ -0,0 +1,39 @@
+ephemeral "vault_kv_secret_v2" "backup_writer" {
+  mount = "secret"
+  name  = "versitygw/users/backup-writer"
+}
+
+resource "versitygw_user" "backup_writer" {
+  access_key_id     = "backup-writer"
+  secret_access_key = ephemeral.vault_kv_secret_v2.backup_writer.data["secret_access_key"]
+  role              = "user"
+}
+
+resource "minio_s3_bucket" "backups" {
+  bucket = "backups"
+}
+
+resource "minio_s3_bucket_policy" "backups" {
+  bucket     = minio_s3_bucket.backups.bucket
+  depends_on = [versitygw_user.backup_writer]
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "BackupList"
+        Effect    = "Allow"
+        Principal = "backup-writer"
+        Action    = ["s3:GetBucketLocation", "s3:ListBucket"]
+        Resource  = ["arn:aws:s3:::backups"]
+      },
+      {
+        Sid       = "BackupData"
+        Effect    = "Allow"
+        Principal = "backup-writer"
+        Action    = ["s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject"]
+        Resource  = ["arn:aws:s3:::backups/*"]
+      },
+    ]
+  })
+}