feat: add additional bucket policy

terraform/aws/buckets.tf

@@ -57,6 +57,17 @@ locals {
 # ref: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document
 data "aws_iam_policy_document" "bucket_access" {
   for_each = { for bp in local.bucket_permissions : "${bp.hub_name}.${bp.bucket_name}" => bp }
+  source_policy_documents = compact([
+    try(
+      replace(
+        var.user_buckets[each.value.bucket_name].bucket_policy,
+        "__BUCKET_ARN__",
+        aws_s3_bucket.user_buckets[each.value.bucket_name].arn
+      ),
+      null
+    )
+  ])
+
   statement {
     effect  = "Allow"
     actions = ["s3:*"]

terraform/aws/projects/nasa-veda.tfvars

@@ -13,6 +13,34 @@ user_buckets = {
   },
   "scratch" : {
     "delete_after" : 7,
+    "bucket_policy" : <<-EOT
+      {
+        "Version": "2012-10-17",
+        "Statement": [
+          {
+            "Sid": "MAAPHubAllowReadOnly",
+            "Effect": "Allow",
+            "Principal": {
+              "AWS": [
+                "arn:aws:iam::916098889494:role/maap-staging",
+                "arn:aws:iam::916098889494:role/maap-prod"
+              ]
+            },
+            "Action": [
+              "s3:GetObject",
+              "s3:GetObjectTagging",
+              "s3:ListBucketVersions",
+              "s3:ListBucket",
+              "s3:GetBucketLocation"
+            ],
+            "Resource": [
+              "__BUCKET_ARN__",
+              "__BUCKET_ARN__/*"
+            ]
+          }
+        ]
+      }
+    EOT,
     "tags" : { "2i2c:hub-name" : "prod" },
   },
   "scratch-binder" : {

terraform/aws/variables.tf

@@ -24,6 +24,7 @@ variable "user_buckets" {
     object({
       delete_after : optional(number, null),
       archival_storageclass_after : optional(number, null),
+      bucket_policy : optional(string, null),
       tags : optional(map(string), {}),
     })
   )
@@ -41,7 +42,10 @@ variable "user_buckets" {
   2. `archival_storageclass_after` - number of days after *creation* an
      object in this bucket will be automatically transitioned to a cheaper,
      slower storageclass for cost savings. Set to null to not transition.
-  3. `tags` - bucket specific tags to be merged into the general tags variable.
+  3. `bucket_policy` - optional AWS IAM policy document JSON to be merged into
+     this bucket's policy. __BUCKET_ARN__ in the policy will be string replaced
+     with the actual arn of the bucket.
+  4. `tags` - bucket specific tags to be merged into the general tags variable.
   EOT
 }
 
@@ -313,4 +317,4 @@ variable "enable_nfs_backup" {
   description = <<-EOT
   Enable backup of NFS home directories on EBS using Data Lifecycle Manager (DLM).
   EOT
-}
+}