From b6885228faa628b4ba11dc903eef54a8547fc8ff Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 20 Oct 2024 22:19:36 +0200 Subject: [PATCH] Refactor Terraform AWS IAC config to include bucket policies --- terraform/k8sapps/buckets.tf | 71 ++++++++++++++++++++++++++++++++++ terraform/k8sapps/iam.tf | 24 ++++++------ terraform/k8sapps/sectool.env | 1 + terraform/k8sapps/variables.tf | 7 ++++ 4 files changed, 91 insertions(+), 12 deletions(-) diff --git a/terraform/k8sapps/buckets.tf b/terraform/k8sapps/buckets.tf index 2c9b910..bcb2cbe 100644 --- a/terraform/k8sapps/buckets.tf +++ b/terraform/k8sapps/buckets.tf @@ -39,7 +39,42 @@ resource "scaleway_object_bucket" "backup" { days = local.cloud_backup_retention_days } } +} +resource "scaleway_object_bucket_policy" "backup" { + bucket = scaleway_object_bucket.backup.name + policy = jsonencode({ + Version = "2023-04-17", + Id = "AllowAccess", + Statement = [ + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "user_id:${var.scaleway_user_id}" + } + Resource = [ + scaleway_object_bucket.backup.name, + "${scaleway_object_bucket.backup.name}/*", + ] + }, + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "application_id:${scaleway_iam_application.backup_app.id}" + } + Resource = [ + scaleway_object_bucket.backup.name, + "${scaleway_object_bucket.backup.name}/*", + ] + }, + ] + }) } resource "scaleway_object_bucket" "nextcloud" { @@ -47,3 +82,39 @@ resource "scaleway_object_bucket" "nextcloud" { project_id = var.scaleway_project_id region = "fr-par" } + +resource "scaleway_object_bucket_policy" "nextcloud" { + bucket = scaleway_object_bucket.nextcloud.name + policy = jsonencode({ + Version = "2023-04-17", + Id = "AllowAccess", + Statement = [ + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "user_id:${var.scaleway_user_id}" + } + Resource = [ + scaleway_object_bucket.nextcloud.name, + "${scaleway_object_bucket.nextcloud.name}/*", + ] + }, + { + Effect = "Allow" + Action = [ + "s3:*", + ] + Principal = { + SCW = "application_id:${scaleway_iam_application.nextcloud_app.id}" + } + Resource = [ + scaleway_object_bucket.nextcloud.name, + "${scaleway_object_bucket.nextcloud.name}/*", + ] + }, + ] + }) +} diff --git a/terraform/k8sapps/iam.tf b/terraform/k8sapps/iam.tf index 7fb624e..681eead 100644 --- a/terraform/k8sapps/iam.tf +++ b/terraform/k8sapps/iam.tf @@ -1,19 +1,19 @@ resource "scaleway_iam_application" "backup_app" { - name = "k8s_backup_app" + name = "k8s_backup_app" } resource "scaleway_iam_application" "mail_app" { - name = "mail_app" + name = "mail_app" } resource "scaleway_iam_application" "nextcloud_app" { - name = "nextcloud_app" + name = "nextcloud_app" } resource "scaleway_iam_policy" "object_read_write_backup" { - name = "K8s backup app policy" - description = "Gives k8s backup job access to object storage in project" - application_id = scaleway_iam_application.backup_app.id + name = "K8s backup app policy" + description = "Gives k8s backup job access to object storage in project" + application_id = scaleway_iam_application.backup_app.id rule { project_ids = [data.scaleway_account_project.default.id] @@ -27,9 +27,9 @@ resource "scaleway_iam_policy" "object_read_write_backup" { } resource "scaleway_iam_policy" "email_full_access" { - name = "Email full access policy" - description = "Gives access to transactional email in project" - application_id = scaleway_iam_application.mail_app.id + name = "Email full access policy" + description = "Gives access to transactional email in project" + application_id = scaleway_iam_application.mail_app.id rule { project_ids = [data.scaleway_account_project.default.id] @@ -40,9 +40,9 @@ resource "scaleway_iam_policy" "email_full_access" { } resource "scaleway_iam_policy" "object_read_write_nextcloud" { - name = "Nextcloud app policy" - description = "Gives nextcloud job access to object storage in project" - application_id = scaleway_iam_application.nextcloud_app.id + name = "Nextcloud app policy" + description = "Gives nextcloud job access to object storage in project" + application_id = scaleway_iam_application.nextcloud_app.id rule { project_ids = [data.scaleway_account_project.default.id] diff --git a/terraform/k8sapps/sectool.env b/terraform/k8sapps/sectool.env index e58fbd0..f60a11c 100644 --- a/terraform/k8sapps/sectool.env +++ b/terraform/k8sapps/sectool.env @@ -3,6 +3,7 @@ AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID +TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID TF_VAR_mysql_root_password=$MYSQL_ROOT_PASSWORD TF_VAR_wordpress_mysql_password=$MYSQL_WORDPRESS_PASSWORD diff --git a/terraform/k8sapps/variables.tf b/terraform/k8sapps/variables.tf index 0768ea5..553caf0 100644 --- a/terraform/k8sapps/variables.tf +++ b/terraform/k8sapps/variables.tf @@ -23,6 +23,12 @@ variable "scaleway_secret_key" { type = string } +variable "scaleway_user_id" { + description = "Scaleway User Id" + type = string + sensitive = true +} + variable "scaleway_project_id" { description = "Scaleway Project Id" type = string @@ -33,6 +39,7 @@ variable "scaleway_organization_id" { type = string } + variable "nextcloud_mysql_password" { description = "MySQL access password" type = string