systems/infrastructure
1
Fork 0
Code Issues 1 Pull requests 17 Activity Actions

Restructure state IAM to use separate role

Browse source
This commit is contained in:
Jake Howard 2024-01-07 12:58:16 +00:00
parent 1555803d25
commit 9ac9380387
Signed by: jake
GPG key ID: 57AFB45680EDD477
1 changed files with 28 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
terraform/state.tf
View file

@ -20,8 +20,8 @@ resource "aws_s3_bucket" "tfstate" {
} }
resource "aws_iam_user_policy" "terraform" { resource "aws_iam_user_policy" "modify-terraform-user" {
name = "terraform" name = "modify-terraform-user"
user = aws_iam_user.terraform.name user = aws_iam_user.terraform.name
policy = <<EOF policy = <<EOF
@ -29,13 +29,26 @@ resource "aws_iam_user_policy" "terraform" {
"Version": "2012-10-17", "Version": "2012-10-17",
"Statement": [ "Statement": [
{ {
"Sid": "VisualEditor0", "Sid": "ModifyTerraformUser",
"Effect": "Allow", "Effect": "Allow",
"Action": "iam:*", "Action": "iam:*",
"Resource": "${aws_iam_user.terraform.arn}" "Resource": "*"
}, }
]
}
EOF
}
resource "aws_iam_policy" "terraform_state" {
name = "terraform-state"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{ {
"Sid": "VisualEditor1", "Sid": "TerraformState",
"Effect": "Allow", "Effect": "Allow",
"Action": "s3:*", "Action": "s3:*",
"Resource": [ "Resource": [
@ -47,3 +60,12 @@ resource "aws_iam_user_policy" "terraform" {
} }
EOF EOF
} }
resource "aws_iam_user_policy_attachment" "terraform-state" {
for_each = toset([
aws_iam_user.terraform.name
])
user = each.key
policy_arn = aws_iam_policy.terraform_state.arn
}