ephemeral "vault_kv_secret_v2" "backup_writer" {
  mount = "secret"
  name  = "versitygw/users/backup-writer"
}

resource "versitygw_user" "backup_writer" {
  access_key_id     = "backup-writer"
  secret_access_key = ephemeral.vault_kv_secret_v2.backup_writer.data["secret_access_key"]
  role              = "user"
}

resource "minio_s3_bucket" "backups" {
  bucket = "backups"
}

resource "minio_s3_bucket_policy" "backups" {
  bucket     = minio_s3_bucket.backups.bucket
  depends_on = [versitygw_user.backup_writer]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "BackupList"
        Effect    = "Allow"
        Principal = "backup-writer"
        Action    = ["s3:GetBucketLocation", "s3:ListBucket"]
        Resource  = ["arn:aws:s3:::backups"]
      },
      {
        Sid       = "BackupData"
        Effect    = "Allow"
        Principal = "backup-writer"
        Action    = ["s3:AbortMultipartUpload", "s3:GetObject", "s3:PutObject"]
        Resource  = ["arn:aws:s3:::backups/*"]
      },
    ]
  })
}