ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/versitygw/project-delivery.tf

@@ -0,0 +1,82 @@
+ephemeral "vault_kv_secret_v2" "project_delivery_cache_reader" {
+  mount = "secret"
+  name  = var.project_delivery_cache_reader_vault_secret_path
+}
+
+ephemeral "vault_kv_secret_v2" "project_delivery_cache_writer" {
+  mount = "secret"
+  name  = var.project_delivery_cache_writer_vault_secret_path
+}
+
+resource "versitygw_user" "project_delivery_cache_reader" {
+  access_key_id     = var.project_delivery_cache_reader_principal
+  secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_reader.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "versitygw_user" "project_delivery_cache_writer" {
+  access_key_id     = var.project_delivery_cache_writer_principal
+  secret_access_key = ephemeral.vault_kv_secret_v2.project_delivery_cache_writer.data["secretAccessKey"]
+  role              = "user"
+}
+
+resource "minio_s3_bucket" "project_delivery" {
+  bucket = var.project_delivery_cache_bucket_name
+}
+
+resource "minio_s3_bucket_policy" "project_delivery" {
+  bucket = minio_s3_bucket.project_delivery.bucket
+
+  depends_on = [
+    versitygw_user.project_delivery_cache_reader,
+    versitygw_user.project_delivery_cache_writer,
+  ]
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "ProjectDeliveryCacheLocation"
+        Effect    = "Allow"
+        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
+        Action    = ["s3:GetBucketLocation"]
+        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
+      },
+      {
+        Sid       = "ProjectDeliveryCacheList"
+        Effect    = "Allow"
+        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
+        Action = [
+          "s3:ListBucket",
+        ]
+        Resource = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}"]
+        Condition = {
+          StringLike = {
+            "s3:prefix" = ["projects/*"]
+          }
+        }
+      },
+      {
+        Sid       = "ProjectDeliveryCacheRead"
+        Effect    = "Allow"
+        Principal = [var.project_delivery_cache_reader_principal, var.project_delivery_cache_writer_principal]
+        Action    = ["s3:GetObject"]
+        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
+      },
+      {
+        Sid       = "ProjectDeliveryCacheWrite"
+        Effect    = "Allow"
+        Principal = var.project_delivery_cache_writer_principal
+        Action    = ["s3:PutObject"]
+        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*"]
+      },
+      {
+        Sid       = "ProjectDeliveryCachePrune"
+        Effect    = "Allow"
+        Principal = var.project_delivery_cache_writer_principal
+        Action    = ["s3:DeleteObject"]
+        Resource  = ["arn:aws:s3:::${var.project_delivery_cache_bucket_name}/projects/*/*/cache/*/objects/*"]
+      },
+    ]
+  })
+}