-
-
Notifications
You must be signed in to change notification settings - Fork 6
/
main.tf
78 lines (63 loc) · 1.59 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
locals {
resources = formatlist("%s/%s/*", var.bucket_arn, var.services)
}
data "aws_iam_policy_document" "resource_readonly_access" {
statement {
sid = "ReadonlyAccess"
effect = "Allow"
resources = local.resources
actions = [
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:GetBucketLocation",
"s3:AbortMultipartUpload"
]
}
}
data "aws_iam_policy_document" "resource_full_access" {
statement {
sid = "FullAccess"
effect = "Allow"
resources = local.resources
actions = [
"s3:PutObject",
"s3:PutObjectAcl",
"s3:GetObject",
"s3:DeleteObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:GetBucketLocation",
"s3:AbortMultipartUpload"
]
}
}
data "aws_iam_policy_document" "base" {
statement {
sid = "BaseAccess"
effect = "Allow"
resources = [
var.bucket_arn
]
actions = [
"s3:ListBucket",
"s3:ListBucketVersions"
]
}
}
module "role" {
source = "cloudposse/iam-role/aws"
version = "0.13.0"
enabled = module.this.enabled && var.role_enabled ? true : false
principals = {
"AWS" : var.principals_arns
}
policy_documents = [
var.read_only ? data.aws_iam_policy_document.resource_readonly_access.json : data.aws_iam_policy_document.resource_full_access.json,
data.aws_iam_policy_document.base.json
]
max_session_duration = var.max_session_duration
role_description = var.role_description
policy_description = var.policy_description
context = module.this.context
}