infrastructure/terraform/state.tf

99 lines
1.9 KiB
Terraform
Raw Normal View History

resource "aws_iam_user" "terraform" {
name = "terraform"
}
resource "aws_iam_user" "minio" {
name = "minio"
}
resource "aws_s3_bucket" "tfstate" {
bucket = "0rng-terraform"
2024-01-07 13:49:35 +00:00
}
resource "aws_s3_bucket_versioning" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
versioning_configuration {
status = "Enabled"
}
}
2020-04-02 18:26:18 +01:00
2024-01-07 13:49:35 +00:00
resource "aws_s3_bucket_server_side_encryption_configuration" "tfstate" {
bucket = aws_s3_bucket.tfstate.bucket
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
2020-04-02 18:26:18 +01:00
}
2024-01-07 13:49:35 +00:00
}
2020-04-02 18:26:18 +01:00
2024-01-07 13:49:35 +00:00
resource "aws_s3_bucket_lifecycle_configuration" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
rule {
id = "Delete old non-current versions"
status = "Enabled"
2020-04-02 18:26:18 +01:00
noncurrent_version_expiration {
2024-01-07 13:49:35 +00:00
noncurrent_days = 30
2020-04-02 18:26:18 +01:00
}
}
2024-01-07 13:49:35 +00:00
}
2020-04-02 18:26:18 +01:00
2024-01-07 13:49:35 +00:00
resource "aws_s3_bucket_acl" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
acl = "private"
}
resource "aws_iam_user_policy" "modify-terraform-user" {
name = "modify-terraform-user"
user = aws_iam_user.terraform.name
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ModifyTerraformUser",
"Effect": "Allow",
"Action": "iam:*",
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_policy" "terraform_state" {
name = "terraform-state"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "TerraformState",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"${aws_s3_bucket.tfstate.arn}",
"${aws_s3_bucket.tfstate.arn}/*"
]
}
]
}
EOF
}
resource "aws_iam_user_policy_attachment" "terraform-state" {
for_each = toset([
2024-01-07 13:04:09 +00:00
aws_iam_user.terraform.name,
aws_iam_user.minio.name,
])
user = each.key
policy_arn = aws_iam_policy.terraform_state.arn
}