Initial commit

modules/app-storage/main.tf

@@ -0,0 +1,71 @@
+resource "minio_s3_bucket" "this" {
+  for_each = var.service.buckets
+  bucket   = each.key
+  acl      = "private"
+}
+
+resource "minio_s3_bucket_versioning" "this" {
+  for_each = { for name, b in var.service.buckets : name => b if b.versioning }
+  bucket   = minio_s3_bucket.this[each.key].bucket
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "minio_ilm_policy" "this" {
+  for_each = var.service.buckets
+  bucket   = minio_s3_bucket.this[each.key].bucket
+
+  rule {
+    id     = "clean-rule-1"
+    status = "Enabled"
+    dynamic "noncurrent_expiration" {
+      for_each = each.value.versioning ? [1] : []
+      content {
+        days = "${each.value.noncurrent_days}d"
+      }
+    }
+    expired_object_delete_marker = each.value.versioning
+    abort_incomplete_multipart_upload {
+      days_after_initiation = "3d"
+    }
+  }
+}
+
+resource "minio_iam_user" "this" {
+  name = var.service.name
+}
+
+resource "minio_iam_policy" "get_upd_del_policy" {
+  name = var.service.name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect = "Allow",
+      Action = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
+      Resource = [
+        for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}/*"
+      ]
+      },
+      {
+        Effect = "Allow",
+        Action = ["s3:ListBucket"],
+        Resource = [
+          for bucket in minio_s3_bucket.this : "arn:aws:s3:::${bucket.bucket}"
+        ]
+    }]
+  })
+}
+
+resource "minio_iam_user_policy_attachment" "this" {
+  user_name   = minio_iam_user.this.name
+  policy_name = minio_iam_policy.get_upd_del_policy.name
+}
+
+resource "minio_iam_service_account" "this" {
+  target_user = minio_iam_user.this.name
+  description = "keys of ${var.service.name}"
+
+  depends_on = [minio_iam_user_policy_attachment.this]
+}