////////////////////////////////
// Job Log Storage in S3
//
// Currently, we need to get a key and secret for this user and put
// those into the jobsrv config. In the future, we may be able to just
// use instance roles.
resource "aws_iam_user" "jobs" {
  name = "jobs-${var.env}"
}

// Job log storage; the server retrieves logs on behalf of requestors,
// so this can be pretty locked down.
resource "aws_s3_bucket" "jobs" {
  bucket = "habitat-jobs-${var.env}"
  acl    = "private"
  region = "${var.aws_region}"

  lifecycle {
    prevent_destroy = true
  }
}

// The job user (and only the job user) can put / get objects in the
// bucket!
resource "aws_s3_bucket_policy" "jobs" {
  bucket = "${aws_s3_bucket.jobs.id}"
  policy = <<EOF
{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "${aws_iam_user.jobs.arn}"
      },
      "Resource": "${aws_s3_bucket.jobs.arn}/*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ]
    }
  ]
}
EOF
}

////////////////////////////////
// Job Log Storage in S3
//
// Currently, we need to get a key and secret for this user and put
// those into the jobsrv config. In the future, we may be able to just
// use instance roles.

resource "aws_iam_user" "jobs" {
  name = "jobs-${var.env}"
}

// Job log storage; the server retrieves logs on behalf of requestors,
// so this can be pretty locked down.
resource "aws_s3_bucket" "jobs" {
  bucket = "habitat-jobs-${var.env}"
  acl    = "private"
  region = "${var.aws_region}"

  lifecycle {
    prevent_destroy = true
  }
}

data "aws_iam_policy_document" "job_user_can_get_and_put_logs" {
  statement = {
    effect = "Allow"
    actions = ["s3:GetObject", "s3:PutObject"]
    resources = ["${aws_s3_bucket.jobs.arn}/*"]
    principals = {
      type = "AWS"
      identifiers = ["${aws_iam_user.jobs.arn}"]
    }
  }
}

resource "aws_s3_bucket_policy" "jobs" {
  bucket = "${aws_s3_bucket.jobs.id}"
  policy = "${data.aws_iam_policy_document.job_user_can_get_and_put_logs.json}"
}

Use a policy document instead of embedded JSON
Use a policy document instead of embedded JSON

Just for easier manipulation and cleaner separation of concerns.

Signed-off-by: Christopher Maier <b4598f17a90ef80817bae8ad6c37249740caafb4@chef.io>

georgemarshall/habitat,georgemarshall/habitat,habitat-sh/habitat,habitat-sh/habitat,habitat-sh/habitat,rsertelon/habitat,nathenharvey/habitat,habitat-sh/habitat,habitat-sh/habitat,habitat-sh/habitat,georgemarshall/habitat,rsertelon/habitat,nathenharvey/habitat,rsertelon/habitat,rsertelon/habitat,georgemarshall/habitat,nathenharvey/habitat,georgemarshall/habitat,georgemarshall/habitat,nathenharvey/habitat,rsertelon/habitat,nathenharvey/habitat,rsertelon/habitat,nathenharvey/habitat,georgemarshall/habitat,georgemarshall/habitat,rsertelon/habitat,habitat-sh/habitat,habitat-sh/habitat