forked from ExpediaGroup/apiary-replication
-
Notifications
You must be signed in to change notification settings - Fork 0
/
iam-policy-s3-buckets.tf
39 lines (37 loc) · 1.08 KB
/
iam-policy-s3-buckets.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
/**
* Copyright (C) 2020 Expedia, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
*/
resource "aws_iam_role_policy" "s3_for_shuntingyard" {
name = "s3"
role = "${aws_iam_role.shuntingyard_task.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:Get*",
"s3:List*",
"s3:PutBucketLogging",
"s3:PutBucketNotification",
"s3:PutBucketVersioning",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectTagging",
"s3:PutObjectVersionAcl",
"s3:PutObjectVersionTagging"
],
"Resource": [
"${join("\",\"", formatlist("arn:aws:s3:::%s",var.allowed_s3_buckets))}",
"${join("\",\"", formatlist("arn:aws:s3:::%s/*",var.allowed_s3_buckets))}"
]
}
]
}
EOF
}