Resources and access

modules/bucket-access/main.tf

@@ -0,0 +1,45 @@
+locals {
+  buckets = concat(var.read_write, var.read_only)
+
+  statements = [
+    {
+      Effect   = "Allow"
+      Action   = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
+      Resource = [for bucket in var.read_write : "arn:aws:s3:::${bucket}/*"]
+    },
+    {
+      Effect   = "Allow"
+      Action   = ["s3:GetObject"]
+      Resource = [for bucket in var.read_only : "arn:aws:s3:::${bucket}/*"]
+    },
+    {
+      Effect   = "Allow"
+      Action   = ["s3:ListBucket"]
+      Resource = [for bucket in local.buckets : "arn:aws:s3:::${bucket}"]
+    },
+  ]
+}
+
+resource "minio_iam_user" "this" {
+  name = var.name
+}
+
+resource "minio_iam_policy" "this" {
+  name = var.name
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [for statement in local.statements : statement if length(statement.Resource) > 0]
+  })
+}
+
+resource "minio_iam_user_policy_attachment" "this" {
+  user_name   = minio_iam_user.this.name
+  policy_name = minio_iam_policy.this.name
+}
+
+resource "minio_iam_service_account" "this" {
+  target_user = minio_iam_user.this.name
+  description = "keys of ${var.name}"
+
+  depends_on = [minio_iam_user_policy_attachment.this]
+}