Refactor Terraform AWS IAC config to include bucket policies

terraform/k8sapps/buckets.tf

@@ -39,7 +39,42 @@ resource "scaleway_object_bucket" "backup" {
       days = local.cloud_backup_retention_days
     }
   }
+}
 
+resource "scaleway_object_bucket_policy" "backup" {
+  bucket = scaleway_object_bucket.backup.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.backup_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.backup.name,
+          "${scaleway_object_bucket.backup.name}/*",
+        ]
+      },
+    ]
+  })
 }
 
 resource "scaleway_object_bucket" "nextcloud" {
@@ -47,3 +82,39 @@ resource "scaleway_object_bucket" "nextcloud" {
   project_id = var.scaleway_project_id
   region     = "fr-par"
 }
+
+resource "scaleway_object_bucket_policy" "nextcloud" {
+  bucket = scaleway_object_bucket.nextcloud.name
+  policy = jsonencode({
+    Version = "2023-04-17",
+    Id      = "AllowAccess",
+    Statement = [
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "user_id:${var.scaleway_user_id}"
+        }
+        Resource = [
+          scaleway_object_bucket.nextcloud.name,
+          "${scaleway_object_bucket.nextcloud.name}/*",
+        ]
+      },
+      {
+        Effect = "Allow"
+        Action = [
+          "s3:*",
+        ]
+        Principal = {
+          SCW = "application_id:${scaleway_iam_application.nextcloud_app.id}"
+        }
+        Resource = [
+          scaleway_object_bucket.nextcloud.name,
+          "${scaleway_object_bucket.nextcloud.name}/*",
+        ]
+      },
+    ]
+  })
+}

terraform/k8sapps/sectool.env

@@ -3,6 +3,7 @@ AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY
 TF_VAR_scaleway_access_key=$SCALEWAY_ACCESS_KEY
 TF_VAR_scaleway_secret_key=$SCALEWAY_SECRET_KEY
 TF_VAR_scaleway_project_id=$SCALEWAY_PROJECT_ID
+TF_VAR_scaleway_user_id=$SCALEWAY_USER_ID
 TF_VAR_scaleway_organization_id=$SCALEWAY_ORGANIZATION_ID
 TF_VAR_mysql_root_password=$MYSQL_ROOT_PASSWORD
 TF_VAR_wordpress_mysql_password=$MYSQL_WORDPRESS_PASSWORD

terraform/k8sapps/variables.tf

@@ -23,6 +23,12 @@ variable "scaleway_secret_key" {
   type        = string
 }
 
+variable "scaleway_user_id" {
+  description = "Scaleway User Id"
+  type        = string
+  sensitive   = true
+}
+
 variable "scaleway_project_id" {
   description = "Scaleway Project Id"
   type        = string
@@ -33,6 +39,7 @@ variable "scaleway_organization_id" {
   type        = string
 }
 
+
 variable "nextcloud_mysql_password" {
   description = "MySQL access password"
   type        = string