I currently have one IAM Role with a Policy attached to it in the following way:
data aws_iam_policy_document bucket_access {
statement {
actions = [
"s3:AbortMultipartUpload",
"s3:CreateMultipartUpload",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListBucketMultipartUploads",
"s3:PutObject",
"s3:PutObjectAcl",
]
resources = [
"arn:aws:s3:::bucket.domain.net/*",
]
}
statement {
actions = [
"s3:CreateMultipartUpload",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
]
resources = [
"arn:aws:s3:::bucket.domain.net",
]
}
}
resource aws_iam_policy bucket_access {
description = "Allow instances to write and delete in S3 bucket."
name_prefix = "bucket_access-"
policy = "${data.aws_iam_policy_document.bucket_access.json}"
}
resource aws_iam_role_policy_attachment gitlab_runner_bucket_access {
role = "${aws_iam_role.gitlab_runner.name}"
policy_arn = "${aws_iam_policy.bucket_access.arn}"
}
Now I want to have a second Policy that will allow the IAM user to delete objects in a different bucket. I added the following in the same file:
data aws_iam_policy_document bucket_access_with_delete {
statement {
actions = [
"s3:AbortMultipartUpload",
"s3:CreateMultipartUpload",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:ListBucketMultipartUploads",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:DeleteObject",
]
resources = [
"arn:aws:s3:::bucket2.domain.net/*",
]
}
statement {
actions = [
"s3:CreateMultipartUpload",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
]
resources = [
"arn:aws:s3:::bucket2.domain.net",
]
}
}
resource aws_iam_policy bucket_access_with_delete {
description = "Allow instances to write and delete in S3 bucket."
name_prefix = "bucket_access_with_delete-"
policy = "${data.aws_iam_policy_document.bucket_access_with_delete.json}"
}
resource aws_iam_role_policy_attachment gitlab_runner_bucket_access_width_delete {
role = "${aws_iam_role.gitlab_runner.name}"
policy_arn = "${aws_iam_policy.bucket_access_with_delete.arn}"
}
It's practically the same, but I've changed the following:
1) Added the action "s3:DeleteObject" 2) Changed the bucket to bucket2.domain.net 3) Changed the names of the names of the policy and arn to _with_delete
When the file has only the first one, it works properly. When I add mine, it doesn't pass the automated checks and I'm really not sure why. I don't have access to actual debug information since it's remote, but is this a proper way to add a second Policy in Terraform?