Add s3 buckets, and infra for making more

scripts/getaws.sh

@@ -3,3 +3,8 @@
 curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"
 unzip awscli-bundle.zip
 sudo ./awscli-bundle/install -i /usr/local/aws -b /usr/local/bin/aws
+
+#Add SSM agent for AWS
+sudo dnf install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm 
+sudo systemctl enable amazon-ssm-agent 
+sudo systemctl start amazon-ssm-agent

terraform/init_template.tpl

@@ -16,6 +16,20 @@ BRANCH=main
 mkdir -p /mnt/efs/fs1
 sudo yum -y -q install git 
 
+#Install mountpoint-s3 and mount buckets:
+
+for a in ioos-coastalsb-inputs  ioos-transfers  ioos-und-transfer
+do
+  sudo mkdir -p /inputs/$a
+  sudo mount-s3 --read-only --allow-other $a /inputs/$a
+done
+sudo mkdir -p /outputs_bucket
+sudo yum -y install https://s3.amazonaws.com/mountpoint-s3-release/latest/x86_64/mount-s3.rpm
+sudo mount-s3 --allow-delete --allow-overwrite --allow-other ioos-coastalsb-outputs /outputs_bucket
+
+#Install AWS Utils
+sudo yum -y install https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
+
 sudo yum -y install amazon-efs-utils
 
 if [ $? -ne 0 ]; then

terraform/ioos-s3.tf

@@ -0,0 +1,115 @@
+resource "aws_iam_user" "noaa-ioos-users" {
+  count = length(var.noaa-ioos-users)
+  name  = element(var.noaa-ioos-users, count.index)
+  path  = "/external-users/"
+}
+
+variable "noaa-ioos-users" {
+  type    = list(string)
+  default = ["OWP", "GLERL", "NOS", "CORA", "LiveOcean"]
+}
+
+resource "aws_iam_policy" "input-policy" {
+  name        = "noaa-ioos_bucket_input_policy"
+  path        = "/"
+  description = "policy allowing noaa-ioos sources to put data into their bucket locations"
+
+  # Terraform's "jsonencode" function converts a
+  # Terraform expression result to valid JSON syntax.
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "S3:*",
+        ]
+        Effect   = "Allow"
+        Resource = "arn:aws:s3:::noaa-ioos/$${aws:username}"
+      },
+    ]
+  })
+}
+
+# resource "aws_s3_bucket" "noaa-ioos" {
+#   bucket = "noaa-ioos"
+#   tags = {
+#     Name        = "noaa-ioos"
+#   }
+# }
+
+data "aws_s3_bucket" "noaa-ioos" {
+  bucket = ioos-coastalsb-inputs
+   tags = {
+     Name        = "ioos-coastalsb-inputs"
+   }
+}
+
+
+resource "aws_iam_group" "noaa-ioos" {
+  name = "noaa-ioos"
+  path = "/"
+}
+
+resource "aws_iam_group_policy_attachment" "noaa-ioos-attach" {
+  group      = aws_iam_group.noaa-ioos.name
+  policy_arn = aws_iam_policy.input-policy.arn
+}
+
+resource "aws_iam_user_group_membership" "Users" {
+#  user = aws_iam_user.NERFC.name
+  count = length(var.noaa-ioos-users)
+  user  = element(var.noaa-ioos-users, count.index)
+  groups = [
+    aws_iam_group.noaa-ioos.name,
+  ]
+}
+
+
+# data "aws_iam_policy" "input-policy" {
+#   name        = "noaa-ioos_bucket_input_policy"
+#   path        = "/"
+#   description = "policy allowing noaa-ioos sources to put data into their bucket locations"
+
+#   # Terraform's "jsonencode" function converts a
+#   # Terraform expression result to valid JSON syntax.
+#   policy = jsonencode({
+#     Version = "2012-10-17"
+#     Statement = [
+#       {
+#         Action = [
+#           "S3:*",
+#         ]
+#         Effect   = "Allow"
+#         Resource = "arn:aws:s3:::noaa-ioos/$${aws:username}"
+#       },
+#     ]
+#   })
+# }
+
+# data "aws_s3_bucket" "noaa-ioos" {
+#   bucket = var.mount_bucket_name
+#   # bucket = "noaa-ioos"
+
+#   tags = {
+#     Name        = "noaa-ioos"
+#   }
+# }
+
+# data "aws_iam_group" "noaa-ioos" {
+#   name = "noaa-ioos"
+#   path = "/"
+# }
+
+#data "aws_iam_group_policy_attachment" "noaa-ioos-attach" {
+#   group      = aws_iam_group.noaa-ioos.name
+#   policy_arn = aws_iam_policy.input-policy.arn
+# }
+
+# data "aws_iam_user_group_membership" "NERFC" {
+# #  user = aws_iam_user.NERFC.name
+#   count = length(var.noaa-ioos-users)
+#   user  = element(var.noaa-ioos-users, count.index)
+#   groups = [
+#     aws_iam_group.noaa-ioos.name,
+#   ]
+# }