-
Notifications
You must be signed in to change notification settings - Fork 0
/
iam.tf
50 lines (43 loc) · 1.21 KB
/
iam.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
resource "aws_iam_user" "laa_s3_deploy" {
name = "laa_s3_deploy"
}
data "aws_iam_policy_document" "laa_s3_policy_data" {
statement {
sid = "1"
actions = [
"s3:*",
]
resources = [
"${aws_s3_bucket.www.arn}",
"${aws_s3_bucket.www.arn}/*",
]
}
statement {
actions = [
"acm:ListCertificates",
"cloudfront:GetDistribution",
"cloudfront:GetStreamingDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:ListDistributions",
"cloudfront:ListCloudFrontOriginAccessIdentities",
"cloudfront:CreateInvalidation",
"cloudfront:GetInvalidation",
"cloudfront:ListInvalidations",
"elasticloadbalancing:DescribeLoadBalancers",
"iam:ListServerCertificates",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics",
"waf:GetWebACL",
"waf:ListWebACLs",
]
resources = ["*"]
}
}
resource "aws_iam_policy" "laa_deploy_policy" {
name = "laa_deploy_policy"
policy = "${data.aws_iam_policy_document.laa_s3_policy_data.json}"
}
resource "aws_iam_user_policy_attachment" "test-attach" {
user = "${aws_iam_user.laa_s3_deploy.name}"
policy_arn = "${aws_iam_policy.laa_deploy_policy.arn}"
}