From 0363d95f4a3aabac89c7580797510d57e9fdd04f Mon Sep 17 00:00:00 2001
From: VolodymyrKaraniuk <volodimirkaranuk7@gmail.com>
Date: Mon, 1 Dec 2025 14:43:59 +0100
Subject: [PATCH] Solution

---
 main.tf          | 35 +++++++++++++++++++++++++++++++++--
 outputs.tf       |  2 +-
 terraform.tfvars |  2 +-
 3 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/main.tf b/main.tf
index fc60f38..5e0575c 100644
--- a/main.tf
+++ b/main.tf
@@ -1,3 +1,34 @@
-# 1. Deploy an S3 storage bucket 
+# 1. Deploy an S3 storage bucket
+resource "aws_s3_bucket" "my_grafana_backups" {
+  bucket = "my-grafana-backups-data"
 
-# 2. Confugure bucket policy to allow grafana iam role to use storage 
+  tags = {
+    Name        = "My bucket"
+    Environment = "Dev"
+  }
+}
+# 2. Confugure bucket policy to allow grafana iam role to use storage
+resource "aws_s3_bucket_policy" "grafana-access" {
+  bucket = aws_s3_bucket.my_grafana_backups.id
+  policy = data.aws_iam_policy_document.example.json
+}
+data "aws_iam_policy_document" "example" {
+    statement {
+        principals {
+          type = "AWS"
+          identifiers = [var.grafana_iam_role_arn]
+        }
+
+        actions = ["s3:ListBucket"]
+        resources = ["arn:aws:s3:::${aws_s3_bucket.my_grafana_backups.bucket}"]
+    }
+    statement {
+        principals {
+          type = "AWS"
+          identifiers = [var.grafana_iam_role_arn]
+        }
+
+        actions = ["s3:GetObject","s3:PutObject"]
+        resources = ["arn:aws:s3:::${aws_s3_bucket.my_grafana_backups.bucket}/*"]
+    }
+}
\ No newline at end of file
diff --git a/outputs.tf b/outputs.tf
index df85631..813339f 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -1,4 +1,4 @@
 output "bucket_name" {
-    value = aws_s3_bucket.grafana_backups.bucket
+    value = aws_s3_bucket.my_grafana_backups.bucket
     sensitive = false
 }
diff --git a/terraform.tfvars b/terraform.tfvars
index 7f7bb12..da518ae 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -1 +1 @@
-grafana_iam_role_arn = ""
+grafana_iam_role_arn = "arn:aws:iam::891146181442:role/grafana_role"