ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/versitygw/dump.tf

@@ -0,0 +1,35 @@
+ephemeral "vault_kv_secret_v2" "dump_hardware_qualification_writer" {
+  mount = "secret"
+  name  = var.dump_hardware_qualification_writer_vault_secret_path
+}
+
+resource "versitygw_user" "dump_hardware_qualification_writer" {
+  access_key_id     = var.dump_hardware_qualification_writer_principal
+  secret_access_key = ephemeral.vault_kv_secret_v2.dump_hardware_qualification_writer.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "minio_s3_bucket" "dump" {
+  bucket = var.dump_bucket_name
+}
+
+resource "minio_s3_bucket_policy" "dump" {
+  bucket = minio_s3_bucket.dump.bucket
+
+  depends_on = [
+    versitygw_user.dump_hardware_qualification_writer,
+  ]
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "HardwareQualificationWrite"
+        Effect    = "Allow"
+        Principal = var.dump_hardware_qualification_writer_principal
+        Action    = ["s3:PutObject"]
+        Resource  = ["arn:aws:s3:::${var.dump_bucket_name}/hardware-qualification/*"]
+      },
+    ]
+  })
+}