46 lines
1.1 KiB
Terraform
46 lines
1.1 KiB
Terraform
locals {
|
|
buckets = concat(var.read_write, var.read_only)
|
|
|
|
statements = [
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"]
|
|
Resource = [for bucket in var.read_write : "arn:aws:s3:::${bucket}/*"]
|
|
},
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:GetObject"]
|
|
Resource = [for bucket in var.read_only : "arn:aws:s3:::${bucket}/*"]
|
|
},
|
|
{
|
|
Effect = "Allow"
|
|
Action = ["s3:ListBucket"]
|
|
Resource = [for bucket in local.buckets : "arn:aws:s3:::${bucket}"]
|
|
},
|
|
]
|
|
}
|
|
|
|
resource "minio_iam_user" "this" {
|
|
name = var.name
|
|
}
|
|
|
|
resource "minio_iam_policy" "this" {
|
|
name = var.name
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [for statement in local.statements : statement if length(statement.Resource) > 0]
|
|
})
|
|
}
|
|
|
|
resource "minio_iam_user_policy_attachment" "this" {
|
|
user_name = minio_iam_user.this.name
|
|
policy_name = minio_iam_policy.this.name
|
|
}
|
|
|
|
resource "minio_iam_service_account" "this" {
|
|
target_user = minio_iam_user.this.name
|
|
description = "keys of ${var.name}"
|
|
|
|
depends_on = [minio_iam_user_policy_attachment.this]
|
|
}
|