ephemeral "vault_kv_secret_v2" "pg_backup" {
  mount = "secret"
  name  = "versitygw/users/pg-backup"
}

resource "versitygw_user" "pg_backup" {
  access_key_id     = "********"
  secret_access_key = ephemeral.vault_kv_secret_v2.pg_backup.data["secret_access_key"]
  role              = "user"
}

resource "minio_s3_bucket" "pg_backup" {
  bucket = "pg-backup"
}

resource "minio_s3_bucket_policy" "pg_backup" {
  bucket = minio_s3_bucket.pg_backup.bucket

  depends_on = [versitygw_user.pg_backup]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "PostgresBackupList"
        Effect    = "Allow"
        Principal = "pg-backup"
        Action = [
          "s3:GetBucketLocation",
          "s3:ListBucket",
        ]
        Resource = ["arn:aws:s3:::pg-backup"]
      },
      {
        Sid       = "PostgresBackupData"
        Effect    = "Allow"
        Principal = "pg-backup"
        Action = [
          "s3:AbortMultipartUpload",
          "s3:GetObject",
          "s3:PutObject",
        ]
        Resource = ["arn:aws:s3:::pg-backup/*"]
      },
      {
        Sid       = "PostgresBackupDelete"
        Effect    = "Allow"
        Principal = "pg-backup"
        Action    = ["s3:DeleteObject"]
        Resource = [
          "arn:aws:s3:::pg-backup",
          "arn:aws:s3:::pg-backup/*",
        ]
      },
    ]
  })
}