Adds an IAM policy example to the README #15
Conversation
…um permissions required to apply the module.
| "s3:PutBucketVersioning", | ||
| "s3:PutEncryptionConfiguration" | ||
| ], | ||
| "Resource": ["arn:aws:s3:::example-remote-state-backend"] |
There was a problem hiding this comment.
Add in resource the logging bucket
example-logging
Add the state object that will be move from local to s3
"arn:aws:s3:::example-remote-state-backend/eample-account.tfstate"
| "s3:PutBucketPublicAccessBlock", | ||
| "s3:PutBucketTagging", | ||
| "s3:PutBucketVersioning", | ||
| "s3:PutEncryptionConfiguration" |
There was a problem hiding this comment.
add "s3:PutLifecycleConfiguration"
needed for logging bucket
and "s3:PutObject"
Needed for moving the state form local to s3
| "dynamodb:DescribeContinuousBackups", | ||
| "dynamodb:DescribeTable", | ||
| "dynamodb:DescribeTimeToLive", | ||
| "dynamodb:ListTagsOfResource", |
There was a problem hiding this comment.
add "dynamodb:PutItem",
Needed for re-init terraform using remote values
| "dynamodb:CreateTable", | ||
| "dynamodb:DescribeContinuousBackups", | ||
| "dynamodb:DescribeTable", | ||
| "dynamodb:DescribeTimeToLive", |
There was a problem hiding this comment.
add "dynamodb:GetItem",
Needed for re-init terraform using the remote values
| { | ||
| "Sid": "CreateKMSKeyStatement2", | ||
| "Effect": "Allow", | ||
| "Action": [ |
There was a problem hiding this comment.
add "kms:Decrypt",
Needed for re-init terraform using the remote values
| "Effect": "Allow", | ||
| "Action": [ | ||
| "kms:DescribeKey", | ||
| "kms:EnableKeyRotation", |
There was a problem hiding this comment.
add "kms:GenerateDataKey",
Needed for moving the state form local to s3
| "s3:GetBucketVersioning", | ||
| "s3:GetBucketWebsite", | ||
| "s3:GetEncryptionConfiguration", | ||
| "s3:GetLifecycleConfiguration", |
There was a problem hiding this comment.
add
"s3:GetObject",
"s3:GetObjectVersion",
Needed for moving the state form local to s3
| "Sid": "CreateTfStateLockTableStatement1", | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "dynamodb:CreateTable", |
There was a problem hiding this comment.
add "dynamodb:DeleteItem",
to work with the remote state
|
I appreciate all of your feedback. When I created this example policy, I specifically targeted only the actions required to apply the module. Some of actions you've suggested are required to perform the actual migration to remote state, which are in the official documention here: https://developer.hashicorp.com/terraform/language/settings/backends/s3. I believe it would be good to provide a separate policy example in this README that also demonstrated the actions required to perform the migration but I do not think they should be included in the original policy example. As for the actions that allow you to manipulate/mutate the remote state, I agree that they should be added to the original example policy. What do you think? |
|
I agree with that, seems good to have it separate |
Change description
Type of change
Checklists
Development
Security
Code review