Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Initial Implementation #1

Merged
merged 20 commits into from
Jan 23, 2019
Merged

Initial Implementation #1

merged 20 commits into from
Jan 23, 2019

Conversation

maximmi
Copy link
Contributor

@maximmi maximmi commented Jan 16, 2019 •
edited by aknysh
Loading

what

  • Terraform module that creates an S3 bucket with an optional IAM user

why

  • To use with external CI/CD systems

notes

  • Supports versioning
  • Supports encryption
  • Supports ACL
  • If user_enabled = true, the module provisions a basic IAM user with permissions to access the bucket
  • Supports enabled

@maximmi maximmi requested review from osterman and goruha January 16, 2019 04:28
osterman
osterman reviewed Jan 16, 2019
View reviewed changes
.travis.yml Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
README.yaml Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
README.yaml Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
README.yaml Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
main.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
main.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
main.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 16, 2019
View reviewed changes
Copy link
Member

@aknysh aknysh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comments

aknysh
aknysh requested changes Jan 17, 2019
View reviewed changes
Copy link
Member

@aknysh aknysh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
pin https://github.com/cloudposse/terraform-aws-iam-s3-user to the latest release

osterman
osterman reviewed Jan 18, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
osterman
osterman reviewed Jan 18, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
aknysh
aknysh reviewed Jan 18, 2019
View reviewed changes
main.tf Outdated Show resolved Hide resolved
aknysh
aknysh requested changes Jan 18, 2019
View reviewed changes
Copy link
Member

@aknysh aknysh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comments

aknysh
aknysh reviewed Jan 19, 2019
View reviewed changes
main.tf Outdated Show resolved Hide resolved
@osterman
Copy link
Member

@maximmi fix CI

terraform-aws-iam-s3-user version bumbed, s3_user respect bucket modu…
cf5d5a6 
…le enable flag, output improved, example added
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
examples/outputs.tf Outdated Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
examples/outputs.tf Outdated Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
outputs.tf Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
outputs.tf Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
docs/terraform.md Outdated Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
osterman
osterman reviewed Jan 21, 2019
View reviewed changes
variables.tf Outdated Show resolved Hide resolved
osterman
osterman requested changes Jan 21, 2019
View reviewed changes
Copy link
Member

@osterman osterman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comments. Rebuild readme.

@joshmyers
Output the S3 bucket ARN
043b16b
@joshmyers
Mark outputs relating to AWS keys as sensitive
0e20f29
@joshmyers
Change default ACL to private and update docs
e5fea63
@joshmyers
Add S3 bucket root to s3_resources list
77ef14f 
In the trello ticket for this @igor has stipulated the policy must
provide the following permissions:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": "arn:aws:s3:::S3_BUCKET_NAME"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::S3_BUCKET_NAME/*"
    }
  ]
}
```

Without passing in the bare bucket in `s3_resources` we will only end up
with:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::S3_BUCKET_NAME/*"
    }
  ]
}
```
Which means the user will be unable to list the contents of the bucket.
See [1].

Given the change in this commit the policy will end up being something
like:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::S3_BUCKET_NAME"
        "arn:aws:s3:::S3_BUCKET_NAME/*"
      ]
    }
  ]
}
```

Due to the current limitations of the underlying
`terraform-aws-iam-s3-user` module this means we may be giving more
permissions than we wanted to the entire bucket for said user and this
should not be used for shared buckets namespaced by a key prefix.

[1] https://github.com/cloudposse/terraform-aws-iam-s3-user/blob/master/main.tf#L1-L9
@joshmyers joshmyers mentioned this pull request Jan 21, 2019
Merged
@aknysh
Copy link
Member

aknysh commented Jan 21, 2019

@maximmi @joshmyers
address @osterman comments (add sensitive to the outputs).
good to go after that

@joshmyers
Copy link
Contributor

@aknysh I have added sensitive to those outputs as suggested

aknysh
aknysh previously approved these changes Jan 21, 2019
View reviewed changes
@aknysh aknysh requested a review from osterman January 21, 2019 17:05
aknysh
aknysh reviewed Jan 21, 2019
View reviewed changes
examples/basic/main.tf Outdated Show resolved Hide resolved
@joshmyers joshmyers force-pushed the feature/cp-34/terraform-aws-s3-bucket branch from e25e2d0 to eac2345 Compare January 21, 2019 17:32
@maximmi maximmi merged commit 2ff3c0d into master Jan 23, 2019
@aknysh aknysh deleted the feature/cp-34/terraform-aws-s3-bucket branch March 25, 2021 14:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@joshmyers joshmyers joshmyers left review comments

@aknysh aknysh aknysh approved these changes

@osterman osterman osterman approved these changes

@goruha goruha Awaiting requested review from goruha

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@maximmi @joshmyers @osterman @aknysh