infrastructure/terraform/state.tf
Jake Howard 9f13ace88c
Some checks failed
/ terraform (push) Successful in 1m14s
/ ansible (push) Failing after 2m3s
Use newer S3 configuration resources
2024-01-07 13:49:35 +00:00

94 lines
1.8 KiB
HCL

resource "aws_iam_user" "terraform" {
name = "terraform"
}
resource "aws_s3_bucket" "tfstate" {
bucket = "0rng-terraform"
}
resource "aws_s3_bucket_versioning" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
versioning_configuration {
status = "Enabled"
}
}
resource "aws_s3_bucket_server_side_encryption_configuration" "tfstate" {
bucket = aws_s3_bucket.tfstate.bucket
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}
resource "aws_s3_bucket_lifecycle_configuration" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
rule {
id = "Delete old non-current versions"
status = "Enabled"
noncurrent_version_expiration {
noncurrent_days = 30
}
}
}
resource "aws_s3_bucket_acl" "tfstate" {
bucket = aws_s3_bucket.tfstate.id
acl = "private"
}
resource "aws_iam_user_policy" "modify-terraform-user" {
name = "modify-terraform-user"
user = aws_iam_user.terraform.name
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ModifyTerraformUser",
"Effect": "Allow",
"Action": "iam:*",
"Resource": "*"
}
]
}
EOF
}
resource "aws_iam_policy" "terraform_state" {
name = "terraform-state"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "TerraformState",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"${aws_s3_bucket.tfstate.arn}",
"${aws_s3_bucket.tfstate.arn}/*"
]
}
]
}
EOF
}
resource "aws_iam_user_policy_attachment" "terraform-state" {
for_each = toset([
aws_iam_user.terraform.name,
aws_iam_user.minio.name,
])
user = each.key
policy_arn = aws_iam_policy.terraform_state.arn
}