diff --git a/main.tf b/main.tf index fc60f38..66a6201 100644 --- a/main.tf +++ b/main.tf @@ -1,3 +1,47 @@ -# 1. Deploy an S3 storage bucket +resource "aws_s3_bucket" "backups_bucket" { + bucket = var.bucket_name -# 2. Confugure bucket policy to allow grafana iam role to use storage + tags = var.bucket_tags +} + +resource "aws_s3_bucket_policy" "bucket_policy" { + bucket = aws_s3_bucket.backups_bucket.id + policy = data.aws_iam_policy_document.policy-document.json +} + +data "aws_iam_policy_document" "policy-document" { + statement { + effect = "Allow" + + principals { + type = "AWS" + identifiers = [var.grafana_iam_role_arn] + } + + actions = [ + "s3:ListBucket" + ] + + resources = [ + aws_s3_bucket.backups_bucket.arn + ] + } + + statement { + effect = "Allow" + + principals { + type = "AWS" + identifiers = [var.grafana_iam_role_arn] + } + + actions = [ + "s3:GetObject", + "s3:PutObject" + ] + + resources = [ + "${aws_s3_bucket.backups_bucket.arn}/*" + ] + } +} diff --git a/outputs.tf b/outputs.tf index df85631..dd4684a 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,4 +1,4 @@ output "bucket_name" { - value = aws_s3_bucket.grafana_backups.bucket - sensitive = false + value = aws_s3_bucket.backups_bucket.bucket + sensitive = false } diff --git a/terraform.tfvars b/terraform.tfvars index 7f7bb12..59569a3 100644 --- a/terraform.tfvars +++ b/terraform.tfvars @@ -1 +1,6 @@ -grafana_iam_role_arn = "" +grafana_iam_role_arn = "arn:aws:iam::668751951204:role/grafana_role" +bucket_name = "grafana-storage-bucket-54985" +bucket_tags = { + Name = "Grafana Storage Bucket" + Environment = "Dev" +} diff --git a/tfplan.json b/tfplan.json new file mode 100644 index 0000000..d4e4f7f --- /dev/null +++ b/tfplan.json @@ -0,0 +1 @@ +{"format_version":"1.2","terraform_version":"1.14.4","variables":{"bucket_name":{"value":"grafana-storage-bucket-54985"},"bucket_tags":{"value":{"Environment":"Dev","Name":"Grafana Storage Bucket"}},"grafana_iam_role_arn":{"value":"arn:aws:iam::668751951204:role/grafana_role"}},"planned_values":{"outputs":{"bucket_name":{"sensitive":false,"type":"string","value":"grafana-storage-bucket-54985"}},"root_module":{"resources":[{"address":"aws_s3_bucket.backups_bucket","mode":"managed","type":"aws_s3_bucket","name":"backups_bucket","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"bucket":"grafana-storage-bucket-54985","force_destroy":false,"tags":{"Environment":"Dev","Name":"Grafana Storage Bucket"},"tags_all":{"Environment":"Dev","Name":"Grafana Storage Bucket"},"timeouts":null},"sensitive_values":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}},{"address":"aws_s3_bucket_policy.bucket_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"bucket_policy","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"sensitive_values":{}},{"address":"data.aws_iam_policy_document.policy-document","mode":"data","type":"aws_iam_policy_document","name":"policy-document","provider_name":"registry.terraform.io/hashicorp/aws","schema_version":0,"values":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::668751951204:role/grafana_role"],"type":"AWS"}],"resources":[null],"sid":null},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::668751951204:role/grafana_role"],"type":"AWS"}],"resources":[null],"sid":null}],"version":null},"sensitive_values":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}}]}},"resource_changes":[{"address":"data.aws_iam_policy_document.policy-document","mode":"data","type":"aws_iam_policy_document","name":"policy-document","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["read"],"before":null,"after":{"override_json":null,"override_policy_documents":null,"policy_id":null,"source_json":null,"source_policy_documents":null,"statement":[{"actions":["s3:ListBucket"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::668751951204:role/grafana_role"],"type":"AWS"}],"resources":[null],"sid":null},{"actions":["s3:GetObject","s3:PutObject"],"condition":[],"effect":"Allow","not_actions":null,"not_principals":[],"not_resources":null,"principals":[{"identifiers":["arn:aws:iam::668751951204:role/grafana_role"],"type":"AWS"}],"resources":[null],"sid":null}],"version":null},"after_unknown":{"id":true,"json":true,"minified_json":true,"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[true]}]},"before_sensitive":false,"after_sensitive":{"statement":[{"actions":[false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]},{"actions":[false,false],"condition":[],"not_principals":[],"principals":[{"identifiers":[false]}],"resources":[false]}]}},"action_reason":"read_because_config_unknown"},{"address":"aws_s3_bucket.backups_bucket","mode":"managed","type":"aws_s3_bucket","name":"backups_bucket","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{"bucket":"grafana-storage-bucket-54985","force_destroy":false,"tags":{"Environment":"Dev","Name":"Grafana Storage Bucket"},"tags_all":{"Environment":"Dev","Name":"Grafana Storage Bucket"},"timeouts":null},"after_unknown":{"acceleration_status":true,"acl":true,"arn":true,"bucket_domain_name":true,"bucket_prefix":true,"bucket_regional_domain_name":true,"cors_rule":true,"grant":true,"hosted_zone_id":true,"id":true,"lifecycle_rule":true,"logging":true,"object_lock_configuration":true,"object_lock_enabled":true,"policy":true,"region":true,"replication_configuration":true,"request_payer":true,"server_side_encryption_configuration":true,"tags":{},"tags_all":{},"versioning":true,"website":true,"website_domain":true,"website_endpoint":true},"before_sensitive":false,"after_sensitive":{"cors_rule":[],"grant":[],"lifecycle_rule":[],"logging":[],"object_lock_configuration":[],"replication_configuration":[],"server_side_encryption_configuration":[],"tags":{},"tags_all":{},"versioning":[],"website":[]}}},{"address":"aws_s3_bucket_policy.bucket_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"bucket_policy","provider_name":"registry.terraform.io/hashicorp/aws","change":{"actions":["create"],"before":null,"after":{},"after_unknown":{"bucket":true,"id":true,"policy":true},"before_sensitive":false,"after_sensitive":{}}}],"output_changes":{"bucket_name":{"actions":["create"],"before":null,"after":"grafana-storage-bucket-54985","after_unknown":false,"before_sensitive":false,"after_sensitive":false}},"prior_state":{"format_version":"1.0","terraform_version":"1.14.4","values":{"outputs":{"bucket_name":{"sensitive":false,"value":"grafana-storage-bucket-54985","type":"string"}},"root_module":{}}},"configuration":{"provider_config":{"aws":{"name":"aws","full_name":"registry.terraform.io/hashicorp/aws","version_constraint":"~\u003e 5.0"}},"root_module":{"outputs":{"bucket_name":{"expression":{"references":["aws_s3_bucket.backups_bucket.bucket","aws_s3_bucket.backups_bucket"]}}},"resources":[{"address":"aws_s3_bucket.backups_bucket","mode":"managed","type":"aws_s3_bucket","name":"backups_bucket","provider_config_key":"aws","expressions":{"bucket":{"references":["var.bucket_name"]},"tags":{"references":["var.bucket_tags"]}},"schema_version":0},{"address":"aws_s3_bucket_policy.bucket_policy","mode":"managed","type":"aws_s3_bucket_policy","name":"bucket_policy","provider_config_key":"aws","expressions":{"bucket":{"references":["aws_s3_bucket.backups_bucket.id","aws_s3_bucket.backups_bucket"]},"policy":{"references":["data.aws_iam_policy_document.policy-document.json","data.aws_iam_policy_document.policy-document"]}},"schema_version":0},{"address":"data.aws_iam_policy_document.policy-document","mode":"data","type":"aws_iam_policy_document","name":"policy-document","provider_config_key":"aws","expressions":{"statement":[{"actions":{"constant_value":["s3:ListBucket"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.backups_bucket.arn","aws_s3_bucket.backups_bucket"]}},{"actions":{"constant_value":["s3:GetObject","s3:PutObject"]},"effect":{"constant_value":"Allow"},"principals":[{"identifiers":{"references":["var.grafana_iam_role_arn"]},"type":{"constant_value":"AWS"}}],"resources":{"references":["aws_s3_bucket.backups_bucket.arn","aws_s3_bucket.backups_bucket"]}}]},"schema_version":0}],"variables":{"bucket_name":{"description":"Name for the Grafana S3 bucket"},"bucket_tags":{"description":"Tags to apply to the Grafana S3 bucket"},"grafana_iam_role_arn":{}}}},"relevant_attributes":[{"resource":"data.aws_iam_policy_document.policy-document","attribute":["json"]},{"resource":"aws_s3_bucket.backups_bucket","attribute":["arn"]},{"resource":"aws_s3_bucket.backups_bucket","attribute":["bucket"]},{"resource":"aws_s3_bucket.backups_bucket","attribute":["id"]}],"timestamp":"2026-03-16T13:24:16Z","applyable":true,"complete":true,"errored":false} diff --git a/variables.tf b/variables.tf index cea62a6..8b653b9 100644 --- a/variables.tf +++ b/variables.tf @@ -1,4 +1,14 @@ variable "grafana_iam_role_arn" { - type = string - description = "" + type = string + description = "" +} + +variable "bucket_name" { + type = string + description = "Name for the Grafana S3 bucket" +} + +variable "bucket_tags" { + type = map(string) + description = "Tags to apply to the Grafana S3 bucket" }