Support Bucket Replication (#10)

* Added permissions to accept replication messages * Added documentation * Simplify master perms * Simplify master perms * Address PR comments * Address comments
cloudposse · Oct 9, 2017 · 234fca4 · 234fca4
1 parent e92d02d
commit 234fca4
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -68,6 +68,7 @@ module "website_with_cname" {
 | `logs_standard_transition_days`     | `30`           | Number of days to persist in the standard storage tier before moving to the glacier tier                        | No       |
 | `logs_glacier_transition_days`      | `60`           | Number of days after which to move the data to the glacier storage tier                                         | No       |
 | `logs_expiration_days`              | `90`           | Number of days after which to expunge the objects                                                               | No       |
+| `replication_source_principal_arn`  | `[]`           | List of principal ARNs to grant replication access from different aws account.                                  | No       |
 | `deployment_arns`                   | `[]`           | List of ARNs to grant `deployment_actions` permissions on this bucket                                           | No       |
 | `deployment_actions`                | read/write/ls  | List of actions to permit deployment ARNs to perform                                                            | No       |
 

diff --git a/main.tf b/main.tf
@@ -64,6 +64,7 @@ resource "aws_s3_bucket" "default" {
       days = "${var.noncurrent_version_expiration_days}"
     }
   }
+
 }
 
 # AWS only supports a single bucket policy on a bucket. You can combine multiple Statements into a single policy, but not attach multiple policies.
@@ -74,8 +75,7 @@ resource "aws_s3_bucket_policy" "default" {
 }
 
 data "aws_iam_policy_document" "default" {
-  # Allow public access to this bucket (website)
-  statement {
+  statement = [{
     actions = ["s3:GetObject"]
 
     resources = ["${aws_s3_bucket.default.arn}/*"]
@@ -84,6 +84,31 @@ data "aws_iam_policy_document" "default" {
       type        = "AWS"
       identifiers = ["*"]
     }
+  }]
+
+  statement = ["${flatten(data.aws_iam_policy_document.replication.*.statement)}"]
+}
+
+data "aws_iam_policy_document" "replication" {
+  count = "${signum(length(var.replication_source_principal_arn))}"
+
+  statement {
+    principals {
+      type = "AWS"
+      identifiers = ["${var.replication_source_principal_arn}"]
+    }
+
+    actions = [
+      "s3:GetBucketVersioning",
+      "s3:PutBucketVersioning",
+      "s3:ReplicateObject",
+      "s3:ReplicateDelete",
+    ]
+
+    resources = [
+      "${aws_s3_bucket.default.arn}",
+      "${aws_s3_bucket.default.arn}/*",
+    ]
   }
 
   # Support deployment ARNs

diff --git a/variables.tf b/variables.tf
@@ -101,6 +101,13 @@ variable "region" {
   default = ""
 }
 
+variable "replication_source_principal_arn" {
+  type        = "list"
+  default     = []
+  description = "(Optional) List of principal ARNs to grant replication access from different aws account."
+}
+
+
 variable "versioning_enabled" {
   default = ""
 }