terraform，s3 存储桶策略答案

【问题标题】：terraform, s3 bucket policyterraform，s3 存储桶策略
【发布时间】：2020-12-04 01:26:15
【问题描述】：

我正在使用这个模块 https://github.com/turnerlabs/terraform-s3-user 创建一些 s3 存储桶和相关的 iam 用户。

这很好用：

module "my_bucket" {
  source = "github.com/turnerlabs/terraform-s3-user?ref=v2.1"

  bucket_name = "my-bucket"

  tag_team          = "developers"
  tag_contact-email = "xxxxx"
  tag_application   = "xxxxx"
  tag_environment   = "prod"
  tag_customer      = "xxxxx"
}

现在我想修复此模块创建的 s3 存储桶的默认策略。

terrafom show 给我看这个：

module.my_bucket.aws_s3_bucket_policy.bucket_policy:
  id = my-bucket
  bucket = my-bucket
  policy = {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::____________:user/srv_my-bucket"
      },
      "Action": [ "s3:*" ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

我应该如何修改我的 .tf 以获得另一个策略？

【问题讨论】：

你为什么使用那个模块？除了原始用户的意图之外，它看起来对任何人都毫无用处，并且对开源毫无意义。桶策略也是一个坏主意。相反，用户/角色应该能够通过 IAM 权限访问完全私有的存储桶，而不是这种过时且令人困惑的方法。
我更容易使用该模块，而不是手动创建存储桶、用户、iam。我需要一个修改后的存储桶策略来公开所有对象：它是一个图像目录。 iam 用户只需上传即可。

标签： amazon-s3 terraform

【解决方案1】：

我喜欢使用 IAM 角色。例如，如果使用 Kubernetes，您可以为您的 pod 分配一个 IAM 角色。

下面的基本示例展示了如何向 S3 存储桶授予读取权限。为简单起见硬编码值，但最好使用合适的变量。

resource "aws_iam_role_policy" "my-s3-read-policy" {
  name   = "inline-policy-name-that-will-show-on-aws"
  role   = "some-existing-iam-role-name"
  policy = data.aws_iam_policy_document.s3_read_permissions.json
}


data "aws_iam_policy_document" "s3_read_permissions" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:GetObjectAcl",
      "s3:ListBucket",
    ]

    resources = ["arn:aws:s3:::my-bucket-1",
                  "arn:aws:s3:::my-bucket-1/*",
                  "arn:aws:s3:::my-bucket-2",
                  "arn:aws:s3:::mybucket-2/*",
    ]
  }
}

您可以按如下方式设置目标plan：

terraform plan -target=aws_iam_role_policy.my-s3-read-policy

哪个会输出：

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_role_policy.my-s3-read-policy will be created
  + resource "aws_iam_role_policy" "my-s3-read-policy" {
      + id     = (known after apply)
      + name   = "inline-policy-name-that-will-show-on-aws"
      + policy = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:ListBucket",
                          + "s3:GetObjectAcl",
                          + "s3:GetObject",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:s3:::mybucket-2/*",
                          + "arn:aws:s3:::my-bucket-2",
                          + "arn:aws:s3:::my-bucket-1/*",
                          + "arn:aws:s3:::my-bucket-1",
                        ]
                      + Sid      = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role   = "some-existing-iam-role-name"
    }

Plan: 1 to add, 0 to change, 0 to destroy.

【讨论】：

【解决方案2】：

我同意@ydeatskcoR 对您的想法的看法。但是，如果您坚持通过存储桶策略执行此操作，则可以直接将模块复制到您的 repo 中，并根据您的环境调整资源 aws_s3_bucket_policy。

resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = "${aws_s3_bucket.bucket.id}"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "${aws_iam_user.user.arn}"
      },
      "Action": [ "s3:*" ],
      "Resource": [
        "${aws_s3_bucket.bucket.arn}",
        "${aws_s3_bucket.bucket.arn}/*"
      ]
    }
  ]
}
EOF
}

【讨论】：