2

I currently have one IAM Role with a Policy attached to it in the following way:

data aws_iam_policy_document bucket_access {
  statement {
    actions = [
      "s3:AbortMultipartUpload",
      "s3:CreateMultipartUpload",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
      "s3:PutObjectAcl",
    ]

    resources = [
      "arn:aws:s3:::bucket.domain.net/*",
    ]
  }

  statement {
    actions = [
      "s3:CreateMultipartUpload",
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]

    resources = [
      "arn:aws:s3:::bucket.domain.net",

    ]
  }
}

resource aws_iam_policy bucket_access {
  description = "Allow instances to write and delete in S3 bucket."
  name_prefix = "bucket_access-"
  policy      = "${data.aws_iam_policy_document.bucket_access.json}"
}

resource aws_iam_role_policy_attachment gitlab_runner_bucket_access {
  role       = "${aws_iam_role.gitlab_runner.name}"
  policy_arn = "${aws_iam_policy.bucket_access.arn}"
}

Now I want to have a second Policy that will allow the IAM user to delete objects in a different bucket. I added the following in the same file:

data aws_iam_policy_document bucket_access_with_delete {
  statement {
    actions = [
      "s3:AbortMultipartUpload",
      "s3:CreateMultipartUpload",
      "s3:GetBucketAcl",
      "s3:GetBucketLocation",
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:ListBucketMultipartUploads",
      "s3:PutObject",
      "s3:PutObjectAcl",
      "s3:DeleteObject",
    ]

    resources = [
      "arn:aws:s3:::bucket2.domain.net/*",
    ]
  }

  statement {
    actions = [
      "s3:CreateMultipartUpload",
      "s3:GetBucketLocation",
      "s3:ListBucket",
      "s3:ListBucketMultipartUploads",
      "s3:ListMultipartUploadParts",
    ]

    resources = [
      "arn:aws:s3:::bucket2.domain.net",

    ]
  }
}

resource aws_iam_policy bucket_access_with_delete {
  description = "Allow instances to write and delete in S3 bucket."
  name_prefix = "bucket_access_with_delete-"
  policy      = "${data.aws_iam_policy_document.bucket_access_with_delete.json}"
}

resource aws_iam_role_policy_attachment gitlab_runner_bucket_access_width_delete {
  role       = "${aws_iam_role.gitlab_runner.name}"
  policy_arn = "${aws_iam_policy.bucket_access_with_delete.arn}"
}

It's practically the same, but I've changed the following:

1) Added the action "s3:DeleteObject" 2) Changed the bucket to bucket2.domain.net 3) Changed the names of the names of the policy and arn to _with_delete

When the file has only the first one, it works properly. When I add mine, it doesn't pass the automated checks and I'm really not sure why. I don't have access to actual debug information since it's remote, but is this a proper way to add a second Policy in Terraform?

0

You must log in to answer this question.

Browse other questions tagged .