Solution

main.tf

@@ -1,3 +1,43 @@
-# 1. Deploy an S3 storage bucket 
+resource "random_id" "suffix" {
+  byte_length = 4
+}
 
-# 2. Confugure bucket policy to allow grafana iam role to use storage 
+data "aws_caller_identity" "current" {}
+
+resource "aws_s3_bucket" "backups" {
+  bucket        = "grafana-backups-${data.aws_caller_identity.current.account_id}-${random_id.suffix.hex}"
+  force_destroy = true
+}
+
+data "aws_iam_policy_document" "bucket" {
+  statement {
+    sid     = "AllowListBucketFromGrafanaRole"
+    effect  = "Allow"
+    actions = ["s3:ListBucket"]
+
+    principals {
+      type        = "AWS"
+      identifiers = [var.grafana_iam_role_arn]
+    }
+
+    resources = [aws_s3_bucket.backups.arn]
+  }
+
+  statement {
+    sid     = "AllowObjectReadWriteFromGrafanaRole"
+    effect  = "Allow"
+    actions = ["s3:GetObject", "s3:PutObject"]
+
+    principals {
+      type        = "AWS"
+      identifiers = [var.grafana_iam_role_arn]
+    }
+
+    resources = ["${aws_s3_bucket.backups.arn}/*"]
+  }
+}
+
+resource "aws_s3_bucket_policy" "this" {
+  bucket = aws_s3_bucket.backups.id
+  policy = data.aws_iam_policy_document.bucket.json
+}

outputs.tf

@@ -1,4 +1,9 @@
-output "bucket_name" {
-    value = aws_s3_bucket.grafana_backups.bucket
-    sensitive = false
+output "s3_bucket_name" {
+  description = "Name of the S3 bucket for Grafana backups"
+  value       = aws_s3_bucket.backups.bucket
+}
+
+output "s3_bucket_arn" {
+  description = "ARN of the S3 bucket for Grafana backups"
+  value       = aws_s3_bucket.backups.arn
 }

terraform.tfvars

@@ -1 +1 @@
-grafana_iam_role_arn = ""
+grafana_iam_role_arn = "arn:aws:iam::162646919043:role/grafana-ec2-role"