Refactor Terraform AWS IAC config to include bucket policies

terraform/k8sapps/buckets.tf

@@ -39,7 +39,42 @@ resource "scaleway_object_bucket" "backup" {
       days = local.cloud_backup_retention_days
     }
   }
+}
 
+resource "scaleway_object_bucket_policy" "backup" {
+  bucket = scaleway_object_bucket.backup.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.backup_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ]
+      },
+    ]
+  })
 }
 
 resource "scaleway_object_bucket" "nextcloud" {
@@ -47,3 +82,39 @@ resource "scaleway_object_bucket" "nextcloud" {
   project_id = var.scaleway_project_id
   region     = "fr-par"
 }
+
+resource "scaleway_object_bucket_policy" "nextcloud" {
+  bucket = scaleway_object_bucket.nextcloud.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.nextcloud.name,
+          "${scaleway_object_bucket.nextcloud.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.nextcloud_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.nextcloud.name,
+          "${scaleway_object_bucket.nextcloud.name}/*",
+        ]
+      },
+    ]
+  })
+}

terraform/k8sapps/iam.tf

@@ -1,19 +1,19 @@
 resource "scaleway_iam_application" "backup_app" {
-  name            = "k8s_backup_app"
+  name = "k8s_backup_app"
 }
 
 resource "scaleway_iam_application" "mail_app" {
-  name            = "mail_app"
+  name = "mail_app"
 }
 
 resource "scaleway_iam_application" "nextcloud_app" {
-  name            = "nextcloud_app"
+  name = "nextcloud_app"
 }
 
 resource "scaleway_iam_policy" "object_read_write_backup" {
-  name            = "K8s backup app policy"
-  description     = "Gives k8s backup job access to object storage in project"
-  application_id  = scaleway_iam_application.backup_app.id
+  name           = "K8s backup app policy"
+  description    = "Gives k8s backup job access to object storage in project"
+  application_id = scaleway_iam_application.backup_app.id
 
   rule {
     project_ids = [data.scaleway_account_project.default.id]
@@ -27,9 +27,9 @@ resource "scaleway_iam_policy" "object_read_write_backup" {
 }
 
 resource "scaleway_iam_policy" "email_full_access" {
-  name            = "Email full access policy"
-  description     = "Gives access to transactional email in project"
-  application_id  = scaleway_iam_application.mail_app.id
+  name           = "Email full access policy"
+  description    = "Gives access to transactional email in project"
+  application_id = scaleway_iam_application.mail_app.id
 
   rule {
     project_ids = [data.scaleway_account_project.default.id]
@@ -40,9 +40,9 @@ resource "scaleway_iam_policy" "email_full_access" {
 }
 
 resource "scaleway_iam_policy" "object_read_write_nextcloud" {
-  name            = "Nextcloud app policy"
-  description     = "Gives nextcloud job access to object storage in project"
-  application_id  = scaleway_iam_application.nextcloud_app.id
+  name           = "Nextcloud app policy"
+  description    = "Gives nextcloud job access to object storage in project"
+  application_id = scaleway_iam_application.nextcloud_app.id
 
   rule {
     project_ids = [data.scaleway_account_project.default.id]

terraform/k8sapps/sectool.env

@@ -3,6 +3,7 @@ AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY
 TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY
 TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
 TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
+TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
 TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
 TF_VAR_mysql_root_password=$MYSQL_ROOT_PASSWORD
 TF_VAR_wordpress_mysql_password=$MYSQL_WORDPRESS_PASSWORD

terraform/k8sapps/variables.tf

@@ -23,6 +23,12 @@ variable "scaleway_secret_key" {
   type        = string
 }
 
+variable "scaleway_user_id" {
+  description = "Scaleway User Id"
+  type        = string
+  sensitive   = true
+}
+
 variable "scaleway_project_id" {
   description = "Scaleway Project Id"
   type        = string
@@ -33,6 +39,7 @@ variable "scaleway_organization_id" {
   type        = string
 }
 
+
 variable "nextcloud_mysql_password" {
   description = "MySQL access password"
   type        = string