Resources and access

modules/bucket-access/main.tf

@@ -0,0 +1,45 @@
+locals {
+  buckets = concat(var.read_write, var.read_only)
+
+  statements = [
+    {
+      Effect   = "Allow"
+      Action   = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
+      Resource = [for bucket in var.read_write : "arn:aws:s3:::${bucket}/*"]
+    },
+    {
+      Effect   = "Allow"
+      Action   = ["s3:GetObject"]
+      Resource = [for bucket in var.read_only : "arn:aws:s3:::${bucket}/*"]
+    },
+    {
+      Effect   = "Allow"
+      Action   = ["s3:ListBucket"]
+      Resource = [for bucket in local.buckets : "arn:aws:s3:::${bucket}"]
+    },
+  ]
+}
+
+resource "minio_iam_user" "this" {
+  name = var.name
+}
+
+resource "minio_iam_policy" "this" {
+  name = var.name
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [for statement in local.statements : statement if length(statement.Resource) > 0]
+  })
+}
+
+resource "minio_iam_user_policy_attachment" "this" {
+  user_name   = minio_iam_user.this.name
+  policy_name = minio_iam_policy.this.name
+}
+
+resource "minio_iam_service_account" "this" {
+  target_user = minio_iam_user.this.name
+  description = "keys of ${var.name}"
+
+  depends_on = [minio_iam_user_policy_attachment.this]
+}

modules/bucket-access/output.tf

@@ -0,0 +1,12 @@
+output "buckets" {
+  value = local.buckets
+}
+
+output "access_key" {
+  value = minio_iam_service_account.this.access_key
+}
+
+output "secret_key" {
+  value     = minio_iam_service_account.this.secret_key
+  sensitive = true
+}

modules/bucket-access/variables.tf

@@ -0,0 +1,11 @@
+variable "name" {
+  type = string
+}
+
+variable "read_write" {
+  type = list(string)
+}
+
+variable "read_only" {
+  type = list(string)
+}

modules/bucket-access/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    minio = {
+      source  = "aminueza/minio"
+      version = ">= 3.44.0"
+    }
+  }
+}