systems/infrastructure
1
Fork 0
Code Issues 1 Pull requests 17 Activity Actions

Restructure state IAM to use separate role

Browse source
This commit is contained in:
Jake Howard 2024-01-07 12:58:16 +00:00
parent 1555803d25
commit 9ac9380387
Signed by: jake
GPG key ID: 57AFB45680EDD477
1 changed files with 28 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
terraform/state.tf
View file

@ -20,8 +20,8 @@ resource "aws_s3_bucket" "tfstate" {
}
resource "aws_iam_user_policy" "terraform" {
name = "terraform"
resource "aws_iam_user_policy" "modify-terraform-user" {
name = "modify-terraform-user"
user = aws_iam_user.terraform.name
policy = <<EOF
@ -29,13 +29,26 @@ resource "aws_iam_user_policy" "terraform" {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Sid": "ModifyTerraformUser",
"Effect": "Allow",
"Action": "iam:*",
"Resource": "${aws_iam_user.terraform.arn}"
},
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_policy" "terraform_state" {
name = "terraform-state"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor1",
"Sid": "TerraformState",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
@ -47,3 +60,12 @@ resource "aws_iam_user_policy" "terraform" {
}
EOF
}
resource "aws_iam_user_policy_attachment" "terraform-state" {
for_each = toset([
aws_iam_user.terraform.name
])
user = each.key
policy_arn = aws_iam_policy.terraform_state.arn
}