tools/salt-install/terraform/aws/data-storage/main.tf

   1 # Copyright (C) The Arvados Authors. All rights reserved.
   2 #
   3 # SPDX-License-Identifier: CC-BY-SA-3.0
   4
   5 terraform {
   6   required_providers {
   7     aws = {
   8       source = "hashicorp/aws"
   9     }
  10   }
  11 }
  12
  13 provider "aws" {
  14   region = local.region_name
  15   default_tags {
  16     tags = {
  17       Arvados = local.cluster_name
  18     }
  19   }
  20 }
  21
  22 # S3 bucket and access resources for Keep blocks
  23 resource "aws_s3_bucket" "keep_volume" {
  24   bucket = "${local.cluster_name}-nyw5e-000000000000000-volume"
  25 }
  26
  27 resource "aws_s3_bucket_acl" "keep_volume_acl" {
  28   bucket = aws_s3_bucket.keep_volume.id
  29   acl = "private"
  30 }
  31
  32 # Avoid direct public access to Keep blocks
  33 resource "aws_s3_bucket_public_access_block" "keep_volume_public_access" {
  34   bucket = aws_s3_bucket.keep_volume.id
  35
  36   block_public_acls   = true
  37   block_public_policy = true
  38   ignore_public_acls  = true
  39 }
  40
  41 resource "aws_iam_role" "keepstore_iam_role" {
  42   name = "${local.cluster_name}-keepstore-00-iam-role"
  43   assume_role_policy = "${file("../assumerolepolicy.json")}"
  44 }
  45
  46 resource "aws_iam_policy" "s3_full_access" {
  47   name = "${local.cluster_name}_s3_full_access"
  48   policy = jsonencode({
  49     Version: "2012-10-17",
  50     Id: "arvados-keepstore policy",
  51     Statement: [{
  52       Effect: "Allow",
  53       Action: [
  54         "s3:*",
  55       ],
  56       Resource: [
  57         "arn:aws:s3:::${local.cluster_name}-nyw5e-000000000000000-volume",
  58         "arn:aws:s3:::${local.cluster_name}-nyw5e-000000000000000-volume/*"
  59       ]
  60     }]
  61   })
  62 }
  63
  64 resource "aws_iam_policy_attachment" "s3_full_access_policy_attachment" {
  65   name = "${local.cluster_name}_s3_full_access_attachment"
  66   roles = [ aws_iam_role.keepstore_iam_role.name ]
  67   policy_arn = aws_iam_policy.s3_full_access.arn
  68 }
  69