Initial commit

modules/app-storage/main.tf

@@ -0,0 +1,71 @@
+resource "minio_s3_bucket" "this" {
+  for_each = var.service.buckets
+  bucket   = each.key
+  acl      = "private"
+}
+
+resource "minio_s3_bucket_versioning" "this" {
+  for_each = { for name, b in var.service.buckets : name => b if b.versioning }
+  bucket   = minio_s3_bucket.this[each.key].bucket
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "minio_ilm_policy" "this" {
+  for_each = var.service.buckets
+  bucket   = minio_s3_bucket.this[each.key].bucket
+
+  rule {
+    id     = "clean-rule-1"
+    status = "Enabled"
+    dynamic "noncurrent_expiration" {
+      for_each = each.value.versioning ? [1] : []
+      content {
+        days = "${each.value.noncurrent_days}d"
+      }
+    }
+    expired_object_delete_marker = each.value.versioning
+    abort_incomplete_multipart_upload {
+      days_after_initiation = "3d"
+    }
+  }
+}
+
+resource "minio_iam_user" "this" {
+  name = var.service.name
+}
+
+resource "minio_iam_policy" "get_upd_del_policy" {
+  name = var.service.name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow",
+      Action = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
+      Resource = [
+        for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}/*"
+      ]
+      },
+      {
+        Effect = "Allow",
+        Action = ["s3:ListBucket"],
+        Resource = [
+          for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}"
+        ]
+    }]
+  })
+}
+
+resource "minio_iam_user_policy_attachment" "this" {
+  user_name   = minio_iam_user.this.name
+  policy_name = minio_iam_policy.get_upd_del_policy.name
+}
+
+resource "minio_iam_service_account" "this" {
+  target_user = minio_iam_user.this.name
+  description = "keys of ${var.service.name}"
+
+  depends_on = [minio_iam_user_policy_attachment.this]
+}

modules/app-storage/output.tf

@@ -0,0 +1,15 @@
+output "buckets" {
+  value       = [for bucket in minio_s3_bucket.this : bucket.bucket]
+  description = "buckets of the service"
+}
+
+output "access_key" {
+  value       = minio_iam_service_account.this.access_key
+  description = "access key of the service"
+}
+
+output "secret_key" {
+  value       = minio_iam_service_account.this.secret_key
+  description = "secret key of the service"
+  sensitive   = true
+}

modules/app-storage/variables.tf

@@ -0,0 +1,13 @@
+variable "service" {
+  type = object({
+    name = string
+    buckets = map(object({
+      versioning      = optional(bool, true)
+      noncurrent_days = optional(number, 30)
+    }))
+  })
+  validation {
+    condition     = length(var.service.buckets) > 0
+    error_message = "У сервиса должен быть хотя бы один бакет: IAM-политика с пустым списком Resource невалидна."
+  }
+}

modules/app-storage/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    minio = {
+      source  = "aminueza/minio"
+      version = ">= 3.44.0"
+    }
+  }
+}