Opinionated S3 bucket module

cloud/aws/s3_bucket/bucket.tf

@@ -0,0 +1,4 @@
+resource "aws_s3_bucket" "bucket" {
+  bucket_prefix = var.bucket_name_prefix
+  tags          = local.tags
+}

cloud/aws/s3_bucket/iam.tf

@@ -0,0 +1,29 @@
+resource "aws_iam_user" "db_storage" {
+  for_each = toset(var.users)
+  name     = each.value
+}
+
+resource "aws_iam_user_policy" "db_storage" {
+  for_each = toset(var.users)
+  name     = "s3_policy_${each.value}_to_${aws_s3_bucket.bucket.bucket}"
+  user     = aws_iam_user.db_storage[each.key].name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "s3:*"
+        ]
+        Effect = "Allow"
+        Resource = [
+          aws_s3_bucket.bucket.arn,
+          "${aws_s3_bucket.bucket.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+resource "aws_iam_access_key" "db_storage" {
+  for_each = toset(var.users)
+  user     = aws_iam_user.db_storage[each.key].name
+}

cloud/aws/s3_bucket/inputs.tf

@@ -0,0 +1,20 @@
+variable "bucket_name_prefix" {
+  type        = string
+  description = "The prefix for the bucket name"
+}
+
+variable "tags" {
+  type        = map(string)
+  default     = {}
+  description = "AWS Resource Tags to apply to this bucket"
+}
+locals {
+  tags = merge({
+
+  }, var.tags)
+}
+variable "users" {
+  type        = list(string)
+  default     = []
+  description = "List of users to generate S3 API keys for. Will be used as the IAM name."
+}

cloud/aws/s3_bucket/outputs.tf

@@ -0,0 +1,14 @@
+output "users" {
+  value = {
+    for user in var.users : user => { name = user, access_key = aws_iam_access_key.db_storage[user].id, secret_key = aws_iam_access_key.db_storage[user].secret }
+  }
+}
+output "bucket" {
+  value = aws_s3_bucket.bucket.bucket
+}
+output "arn" {
+  value = aws_s3_bucket.bucket.arn
+}
+output "region" {
+  value = aws_s3_bucket.bucket.region
+}

cloud/aws/s3_bucket/terraform.tf

@@ -0,0 +1,18 @@
+terraform {
+  required_version = "~> 1.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.6.2"
+    }
+  }
+}