From 183caebd5af04b924ed73fd622ae72a5dad24984 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 5 Feb 2026 16:31:16 +0100 Subject: [PATCH] Deploy S3 bucket and policy for Grafana backups --- main.tf | 54 +++++++++++++++++++++++++++++++++++++++++++++++ outputs.tf | 4 ++-- terraform.tfvars | 2 +- tfplan | Bin 0 -> 4641 bytes tfplan.json | 1 + variables.tf | 4 ++-- 6 files changed, 60 insertions(+), 5 deletions(-) create mode 100644 tfplan create mode 100644 tfplan.json diff --git a/main.tf b/main.tf index fc60f38..650c676 100644 --- a/main.tf +++ b/main.tf @@ -1,3 +1,57 @@ # 1. Deploy an S3 storage bucket # 2. Confugure bucket policy to allow grafana iam role to use storage + + +# ---------- helpers for unique bucket name ---------- +data "aws_caller_identity" "current" {} +data "aws_region" "current" {} + +# 1) Deploy an S3 storage bucket +resource "aws_s3_bucket" "grafana_backups" { + # S3 bucket name must be globally unique + bucket = "mate-aws-grafana-backups-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}" + force_destroy = true + + tags = { + Name = "mate-aws-grafana-backups" + } +} + +# 2) Configure bucket policy to allow grafana iam role to use storage +data "aws_iam_policy_document" "grafana_backups_policy" { + # Statement 1: allow ListBucket + statement { + sid = "AllowGrafanaListBucket" + effect = "Allow" + + principals { + type = "AWS" + identifiers = [var.grafana_iam_role_arn] + } + + actions = ["s3:ListBucket"] + resources = [aws_s3_bucket.grafana_backups.arn] + } + + # Statement 2: allow GetObject + PutObject on all objects + statement { + sid = "AllowGrafanaGetPutObject" + effect = "Allow" + + principals { + type = "AWS" + identifiers = [var.grafana_iam_role_arn] + } + + actions = ["s3:GetObject", "s3:PutObject"] + resources = [ + "${aws_s3_bucket.grafana_backups.arn}/*" + ] + } +} + +resource "aws_s3_bucket_policy" "grafana_backups" { + bucket = aws_s3_bucket.grafana_backups.id + policy = data.aws_iam_policy_document.grafana_backups_policy.json +} diff --git a/outputs.tf b/outputs.tf index df85631..155847c 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,4 +1,4 @@ output "bucket_name" { - value = aws_s3_bucket.grafana_backups.bucket - sensitive = false + value = aws_s3_bucket.grafana_backups.bucket + sensitive = false } diff --git a/terraform.tfvars b/terraform.tfvars index 7f7bb12..06d42fe 100644 --- a/terraform.tfvars +++ b/terraform.tfvars @@ -1 +1 @@ -grafana_iam_role_arn = "" +grafana_iam_role_arn = "arn:aws:iam::123456789012:role/mate-aws-grafana-lab/" \ No newline at end of file diff --git a/tfplan b/tfplan new file mode 100644 index 0000000000000000000000000000000000000000..888f5b67d0d76bc4240abb725ee0e83355eb5add GIT binary patch literal 4641 zcmb7HcTkhr+YKNk5CjncrMvXrL4fce$>$QuIA6&?TxKtSNu zCbrsIxBx6fg)ekayB9|Np7QZ++o#G>~mXFj50yb5v64^=tgi7_$8$V7_no7Qs(k;nDE47Lg@mvIt8HapiS#d2D=C5Pal}k|gTOceWLU61s z@2FNd^m&wEe2g6|nH!hh97U|IL^;@Kw?;pJ(vdRhCTnEKUdjv&GQ6Gfnzx`qehj{s zf;{!xY4Y7_Jtz`x>smPJz6Oq03Xd^P$06S{z3LI{1O2dMoCT9<}*)yGF;lFu`m6F=81 zd+^PPo|K4YuXMzAR!L{^&~#)*om)6H9$q7JxY1HTDHjDv+u1vvb$JU^ddN@owY7LVqcG6fQtUE!$PMVLLEKs=}vKAo&dNEb)1AU<+^ zhd5UXR&DVhuT| zp6xon0h0-$=YDMolGpZ=C6^CV*HhvX-V9F+4ZSua*?D3&R|g(cn&S0XY)t$=591cW$&X-FjgDn zofbfIxX>hnws9P%6MX$4mXPsK3NP!)tNS%_>uy&`gc&w0@o|Rn#wc>iiA9U-Yh|(m zEw8@pYu8?Ar?>VI3YcG?&0-nXrx2xx>8C(9ta$y2c3ygH{8^)}dQ7(!o2Of}`|eF^ zrxEG?)bCu;(!MLA1ooO6C6FKz^{1ayp_$C+60r!=b#FsloQD+Exys*>wK0dXp5??e zc?Vw1gU$}r3avUTSj!2n+z)RLR%z^*+3<`wALyGaMKw?b-vj;^o67+Ob9VztDmVsiwqJkXai0a)~O>nvV{{+oF(k zV=H|tRx+1uj$*3%%12|53IA#O(o#Y~1r`7xi2J*ygMK!h8*Xpz^rQ1~$Zo=Sd?2rN zcVt)z$X{$nTTX%feqd2_#-_mTTEFwi=HVzdz(c9D6nW*LQfc45`FCt>lz|P87tgiE`3D01V+D3VAlJUWE-0S0y zn(&t`J9QOzTCile;Ci3yZY5L(+ls=h3$z1`r5$ZjiX2NBW&28fN^WJ{+rIlTK&~{A z&TXdJWWK2A^2ddBJ5%A(nd_Qbz|j zY|8np48qn)g)C==&4;sa9>$VNd$lEYVIxysFZs0C;o3k6LL!N1ca)SYrEuC8)RNIoE=6vmVr&)MSem=6M-oW3(qUDJzsu36vxSY6= zzWZgOPrgxOQ#x^2yZo5N8;1WahO=046Vl9~%Eo>$@Bx~RkS*(dB4tUPT=s2lIjJi= zRhv3#&c*ML{wwmnQh!_`TYH>8-6S#a9f#l#6t#y-X1-a!7Wr7uw@dG*xN zW^Z>0JlkAJ-0tYIFL*~8rz(A$LOw$l^m-F-ai9I#Fp7X zi46dJ{q2dMxG-QaM+Dpv;c$M&m^%0`W6p-(mx(OrC9G<`JubA>Y#Iln+{k5|={15` zdQbP>pk#0J-gI5dnPv*NOH}#L{R(f`!-hqn<>U8}!PQ%AqwYxtfQq??hRtukJaLSC zbA%!G_c_S5P$bpIoB`wCo&%~2G~xCzC+HJ%`(KC(bzz8tK{$QlS#M9Uy!?s`api5m zf>KD?PpJoqwC-%O8EqQ7o%iZ+*GDd)#4WOjhXacCjk{o=h4_VC`nK3n>b}&V`1HM| z#cZor6O?8ycjFs)Md;Nfv-=B?N5l8^fdHj#gRw!R(olB)$q}rT$xH*M9k?uqTdZq@Fs!ex`EdoF+IM z^I+}CsS)h# z%8zus=iwSlB~ug1J&9ijb}2uC*CfXnuAA!hcGea82NwEo$kX$-y4K}CSYJz~aMj<9 z5lIpX%{nv}&yP9oUK{#xk|Nai~itJl7Zem_j`s|OV-8=fB5)@1Hh%*yY#{t5FqqL`{X6{)W|O_6kS-apxy zuaK93-Lp)A#F1i+9;F77TC9F5sJyk%rRN5g`S=-(#j8U!_BO;J zL{HWICXsfBy_E1``ma@t7Z9%#^9dkNWPyQe;_3>kbhi?l;kXa<;1 z1+IKPK*)g~b}Ma2;boz$OH+88avAIJQi&38{J4yP76;S#24{!z5RI>owr;b#bBs4$ zTspaY^NsFS_)Z!(F)I}@yiqH^^tFAgmvf*JiY~ny%P>!Bxmj5?je@QnIl@|$r@_V% zL6zGt9Q8C~FoHcd^G-g9f_8=LRu^aH9fh2dSA>^{yDJ0R2Wiq5%TYc2PdN)@9zFp4 z+23QUUdK_{d;dk8s!IH{VSY#uUigg%*)1;w%z{$m3Jg@s&V0&4NmGHu7UEodtfv+7cpP9M%geeR!-XI0FD(w@Bb z7(FgKWc^2!o_$z1x{CtbmOSlHx%pLg){!T9VB{%c*hk%Lu!-F!Y^on_~r<%h}I z2*|HV`r_{MY3D42{VW%ZVg29kUnAK?i1U7S7K?rsCnowMApaebE+U<`oHPIXSwWb^ zd8B`F!;4_&UEs{6ewH96oSp~!SI@c#cV4=Ggl4(`5kW{Xjqf#`&Lo{ literal 0 HcmV?d00001 diff --git a/tfplan.json b/tfplan.json new file mode 100644 index 0000000..91848bd --- /dev/null +++ b/tfplan.json @@ -0,0 +1 @@ +{"format_version":"1.2","terraform_version":"1.14.3","variables":{"grafana_iam_role_arn":{"value":"arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"}},"planned_values":{"outputs":{"bucket_name":{"sensitive":false,"type":"string","value":"mate-aws-grafana-backups-377510221501-eu-central-1"}},"root_module":{"resources":[{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bucket":"mate-aws-grafana-backups-377510221501-eu-central-1","force_destroy":true,"tags":{"Name":"mate-aws-grafana-backups"},"tags_all":{"Name":"mate-aws-grafana-backups"},"timeouts":null},"sensitive_values":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"sensitive_values":{}},{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaListBucket"},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaGetPutObject"}],"version":null},"sensitive_values":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}}]}},"resource_changes":[{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["read"],"before":null,"after":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaListBucket"},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaGetPutObject"}],"version":null},"after_unknown":{"id":true,"json":true,"minified_json":true,"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]}]},"before_sensitive":false,"after_sensitive":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}},"action_reason":"read_because_config_unknown"},{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bucket":"mate-aws-grafana-backups-377510221501-eu-central-1","force_destroy":true,"tags":{"Name":"mate-aws-grafana-backups"},"tags_all":{"Name":"mate-aws-grafana-backups"},"timeouts":null},"after_unknown":{"acceleration_status":true,"acl":true,"arn":true,"bucket_domain_name":true,"bucket_prefix":true,"bucket_regional_domain_name":true,"cors_rule":true,"grant":true,"hosted_zone_id":true,"id":true,"lifecycle_rule":true,"logging":true,"object_lock_configuration":true,"object_lock_enabled":true,"policy":true,"region":true,"replication_configuration":true,"request_payer":true,"server_side_encryption_configuration":true,"tags":{},"tags_all":{},"versioning":true,"website":true,"website_domain":true,"website_endpoint":true},"before_sensitive":false,"after_sensitive":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}}},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{},"after_unknown":{"bucket":true,"id":true,"policy":true},"before_sensitive":false,"after_sensitive":{}}}],"output_changes":{"bucket_name":{"actions":["create"],"before":null,"after":"mate-aws-grafana-backups-377510221501-eu-central-1","after_unknown":false,"before_sensitive":false,"after_sensitive":false}},"prior_state":{"format_version":"1.0","terraform_version":"1.14.3","values":{"outputs":{"bucket_name":{"sensitive":false,"value":"mate-aws-grafana-backups-377510221501-eu-central-1","type":"string"}},"root_module":{"resources":[{"address":"data.aws_caller_identity.current","mode":"data","type":"aws_caller_identity","name":"current","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"account_id":"377510221501","arn":"arn:aws:iam::377510221501:root","id":"377510221501","user_id":"377510221501"},"sensitive_values":{}},{"address":"data.aws_region.current","mode":"data","type":"aws_region","name":"current","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"description":"Europe (Frankfurt)","endpoint":"ec2.eu-central-1.amazonaws.com","id":"eu-central-1","name":"eu-central-1"},"sensitive_values":{}}]}}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","version_constraint":"~\u003e 5.0"}},"root_module":{"outputs":{"bucket_name":{"expression":{"references":["aws_s3_bucket.grafana_backups.bucket","aws_s3_bucket.grafana_backups"]}}},"resources":[{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_config_key":"aws","expressions":{"bucket":{"references":["data.aws_caller_identity.current.account_id","data.aws_caller_identity.current","data.aws_region.current.name","data.aws_region.current"]},"force_destroy":{"constant_value":true},"tags":{"constant_value":{"Name":"mate-aws-grafana-backups"}}},"schema_version":0},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.grafana_backups.id","aws_s3_bucket.grafana_backups"]},"policy":{"references":["data.aws_iam_policy_document.grafana_backups_policy.json","data.aws_iam_policy_document.grafana_backups_policy"]}},"schema_version":0},{"address":"data.aws_caller_identity.current","mode":"data","type":"aws_caller_identity","name":"current","provider_config_key":"aws","schema_version":0},{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_config_key":"aws","expressions":{"statement":[{"actions":{"constant_value":["s3:ListBucket"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.grafana_backups.arn","aws_s3_bucket.grafana_backups"]},"sid":{"constant_value":"AllowGrafanaListBucket"}},{"actions":{"constant_value":["s3:GetObject","s3:PutObject"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.grafana_backups.arn","aws_s3_bucket.grafana_backups"]},"sid":{"constant_value":"AllowGrafanaGetPutObject"}}]},"schema_version":0},{"address":"data.aws_region.current","mode":"data","type":"aws_region","name":"current","provider_config_key":"aws","schema_version":0}],"variables":{"grafana_iam_role_arn":{}}}},"relevant_attributes":[{"resource":"data.aws_caller_identity.current","attribute":["account_id"]},{"resource":"data.aws_region.current","attribute":["name"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["arn"]},{"resource":"data.aws_iam_policy_document.grafana_backups_policy","attribute":["json"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["id"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["bucket"]}],"timestamp":"2026-02-05T15:29:56Z","applyable":true,"complete":true,"errored":false} diff --git a/variables.tf b/variables.tf index cea62a6..17fc6c5 100644 --- a/variables.tf +++ b/variables.tf @@ -1,4 +1,4 @@ variable "grafana_iam_role_arn" { - type = string - description = "" + type = string + description = "" }