Deploy S3 bucket and policy for Grafana backups

main.tf

@@ -1,3 +1,57 @@
 # 1. Deploy an S3 storage bucket 
 
 # 2. Confugure bucket policy to allow grafana iam role to use storage 
+
+
+# ---------- helpers for unique bucket name ----------
+data "aws_caller_identity" "current" {}
+data "aws_region" "current" {}
+
+# 1) Deploy an S3 storage bucket
+resource "aws_s3_bucket" "grafana_backups" {
+  # S3 bucket name must be globally unique
+  bucket        = "mate-aws-grafana-backups-${data.aws_caller_identity.current.account_id}-${data.aws_region.current.name}"
+  force_destroy = true
+
+  tags = {
+    Name = "mate-aws-grafana-backups"
+  }
+}
+
+# 2) Configure bucket policy to allow grafana iam role to use storage
+data "aws_iam_policy_document" "grafana_backups_policy" {
+  # Statement 1: allow ListBucket
+  statement {
+    sid    = "AllowGrafanaListBucket"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = [var.grafana_iam_role_arn]
+    }
+
+    actions   = ["s3:ListBucket"]
+    resources = [aws_s3_bucket.grafana_backups.arn]
+  }
+
+  # Statement 2: allow GetObject + PutObject on all objects
+  statement {
+    sid    = "AllowGrafanaGetPutObject"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = [var.grafana_iam_role_arn]
+    }
+
+    actions = ["s3:GetObject", "s3:PutObject"]
+    resources = [
+      "${aws_s3_bucket.grafana_backups.arn}/*"
+    ]
+  }
+}
+
+resource "aws_s3_bucket_policy" "grafana_backups" {
+  bucket = aws_s3_bucket.grafana_backups.id
+  policy = data.aws_iam_policy_document.grafana_backups_policy.json
+}

outputs.tf

@@ -1,4 +1,4 @@
 output "bucket_name" {
-    value = aws_s3_bucket.grafana_backups.bucket
-    sensitive = false
+  value     = aws_s3_bucket.grafana_backups.bucket
+  sensitive = false
 }

terraform.tfvars

@@ -1 +1 @@
-grafana_iam_role_arn = ""
+grafana_iam_role_arn = "arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"

tfplan.json

@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.14.3","variables":{"grafana_iam_role_arn":{"value":"arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"}},"planned_values":{"outputs":{"bucket_name":{"sensitive":false,"type":"string","value":"mate-aws-grafana-backups-377510221501-eu-central-1"}},"root_module":{"resources":[{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bucket":"mate-aws-grafana-backups-377510221501-eu-central-1","force_destroy":true,"tags":{"Name":"mate-aws-grafana-backups"},"tags_all":{"Name":"mate-aws-grafana-backups"},"timeouts":null},"sensitive_values":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"sensitive_values":{}},{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaListBucket"},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaGetPutObject"}],"version":null},"sensitive_values":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}}]}},"resource_changes":[{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["read"],"before":null,"after":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaListBucket"},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::123456789012:role/mate-aws-grafana-lab/"],"type":"AWS"}],"resources":[null],"sid":"AllowGrafanaGetPutObject"}],"version":null},"after_unknown":{"id":true,"json":true,"minified_json":true,"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]}]},"before_sensitive":false,"after_sensitive":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}},"action_reason":"read_because_config_unknown"},{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bucket":"mate-aws-grafana-backups-377510221501-eu-central-1","force_destroy":true,"tags":{"Name":"mate-aws-grafana-backups"},"tags_all":{"Name":"mate-aws-grafana-backups"},"timeouts":null},"after_unknown":{"acceleration_status":true,"acl":true,"arn":true,"bucket_domain_name":true,"bucket_prefix":true,"bucket_regional_domain_name":true,"cors_rule":true,"grant":true,"hosted_zone_id":true,"id":true,"lifecycle_rule":true,"logging":true,"object_lock_configuration":true,"object_lock_enabled":true,"policy":true,"region":true,"replication_configuration":true,"request_payer":true,"server_side_encryption_configuration":true,"tags":{},"tags_all":{},"versioning":true,"website":true,"website_domain":true,"website_endpoint":true},"before_sensitive":false,"after_sensitive":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}}},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{},"after_unknown":{"bucket":true,"id":true,"policy":true},"before_sensitive":false,"after_sensitive":{}}}],"output_changes":{"bucket_name":{"actions":["create"],"before":null,"after":"mate-aws-grafana-backups-377510221501-eu-central-1","after_unknown":false,"before_sensitive":false,"after_sensitive":false}},"prior_state":{"format_version":"1.0","terraform_version":"1.14.3","values":{"outputs":{"bucket_name":{"sensitive":false,"value":"mate-aws-grafana-backups-377510221501-eu-central-1","type":"string"}},"root_module":{"resources":[{"address":"data.aws_caller_identity.current","mode":"data","type":"aws_caller_identity","name":"current","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"account_id":"377510221501","arn":"arn:aws:iam::377510221501:root","id":"377510221501","user_id":"377510221501"},"sensitive_values":{}},{"address":"data.aws_region.current","mode":"data","type":"aws_region","name":"current","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"description":"Europe (Frankfurt)","endpoint":"ec2.eu-central-1.amazonaws.com","id":"eu-central-1","name":"eu-central-1"},"sensitive_values":{}}]}}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","version_constraint":"~\u003e 5.0"}},"root_module":{"outputs":{"bucket_name":{"expression":{"references":["aws_s3_bucket.grafana_backups.bucket","aws_s3_bucket.grafana_backups"]}}},"resources":[{"address":"aws_s3_bucket.grafana_backups","mode":"managed","type":"aws_s3_bucket","name":"grafana_backups","provider_config_key":"aws","expressions":{"bucket":{"references":["data.aws_caller_identity.current.account_id","data.aws_caller_identity.current","data.aws_region.current.name","data.aws_region.current"]},"force_destroy":{"constant_value":true},"tags":{"constant_value":{"Name":"mate-aws-grafana-backups"}}},"schema_version":0},{"address":"aws_s3_bucket_policy.grafana_backups","mode":"managed","type":"aws_s3_bucket_policy","name":"grafana_backups","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.grafana_backups.id","aws_s3_bucket.grafana_backups"]},"policy":{"references":["data.aws_iam_policy_document.grafana_backups_policy.json","data.aws_iam_policy_document.grafana_backups_policy"]}},"schema_version":0},{"address":"data.aws_caller_identity.current","mode":"data","type":"aws_caller_identity","name":"current","provider_config_key":"aws","schema_version":0},{"address":"data.aws_iam_policy_document.grafana_backups_policy","mode":"data","type":"aws_iam_policy_document","name":"grafana_backups_policy","provider_config_key":"aws","expressions":{"statement":[{"actions":{"constant_value":["s3:ListBucket"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.grafana_backups.arn","aws_s3_bucket.grafana_backups"]},"sid":{"constant_value":"AllowGrafanaListBucket"}},{"actions":{"constant_value":["s3:GetObject","s3:PutObject"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.grafana_backups.arn","aws_s3_bucket.grafana_backups"]},"sid":{"constant_value":"AllowGrafanaGetPutObject"}}]},"schema_version":0},{"address":"data.aws_region.current","mode":"data","type":"aws_region","name":"current","provider_config_key":"aws","schema_version":0}],"variables":{"grafana_iam_role_arn":{}}}},"relevant_attributes":[{"resource":"data.aws_caller_identity.current","attribute":["account_id"]},{"resource":"data.aws_region.current","attribute":["name"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["arn"]},{"resource":"data.aws_iam_policy_document.grafana_backups_policy","attribute":["json"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["id"]},{"resource":"aws_s3_bucket.grafana_backups","attribute":["bucket"]}],"timestamp":"2026-02-05T15:29:56Z","applyable":true,"complete":true,"errored":false}

variables.tf

@@ -1,4 +1,4 @@
 variable "grafana_iam_role_arn" {
-    type = string
-    description = ""
+  type        = string
+  description = ""
 }