59 lines
1.1 KiB
HCL
59 lines
1.1 KiB
HCL
data "aws_iam_policy_document" "this" {
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"s3:ListBucket"
|
|
]
|
|
|
|
resources = [
|
|
"arn:aws:s3:::${var.bucket_name}",
|
|
]
|
|
}
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"s3:GetObject",
|
|
"s3:PutObject",
|
|
"s3:DeleteObject",
|
|
]
|
|
|
|
resources = [
|
|
"arn:aws:s3:::${var.bucket_name}",
|
|
]
|
|
|
|
condition {
|
|
test = "StringLike"
|
|
variable = "s3:prefix"
|
|
|
|
values = var.prefixes
|
|
}
|
|
}
|
|
statement {
|
|
effect = "Allow"
|
|
actions = [
|
|
"dynamodb:GetItem",
|
|
"dynamodb:PutItem",
|
|
"dynamodb:DeleteItem",
|
|
]
|
|
resources = [
|
|
"arn:aws:dynamodb:*:*:table/${var.dynamodb_table}",
|
|
]
|
|
}
|
|
}
|
|
|
|
|
|
resource "aws_iam_role" "this" {
|
|
count = var.create_role ? 1 : 0
|
|
name = var.role_name
|
|
|
|
inline_policy {
|
|
name = "Allow access for remote states s3 and dynamo"
|
|
policy = data.aws_iam_policy_document.this.json
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_policy" "this" {
|
|
count = var.create_policy ? 1 : 0
|
|
name = var.policy_name
|
|
path = var.policy_path
|
|
} |