diff --git a/infra/main.tf b/infra/main.tf index a48a706..fa4a555 100644 --- a/infra/main.tf +++ b/infra/main.tf @@ -7,6 +7,7 @@ module "iam" { } module "s3" { - source = "./modules/s3" - lambda_role_arn = module.iam.iam_lambda_role_arn + source = "./modules/s3" + lambda_role_arn = module.iam.iam_lambda_role_arn + lambda_role_name = module.iam.iam_lambda_role_name } diff --git a/infra/modules/iam/outputs.tf b/infra/modules/iam/outputs.tf index 95e212c..ff2d26d 100644 --- a/infra/modules/iam/outputs.tf +++ b/infra/modules/iam/outputs.tf @@ -1,3 +1,7 @@ output "iam_lambda_role_arn" { value = aws_iam_role.lambda_role.arn } + +output "iam_lambda_role_name" { + value = aws_iam_role.lambda_role.name +} diff --git a/infra/modules/s3/inputs.tf b/infra/modules/s3/inputs.tf index 6b82ad4..7e99c33 100644 --- a/infra/modules/s3/inputs.tf +++ b/infra/modules/s3/inputs.tf @@ -1,3 +1,7 @@ variable "lambda_role_arn" { type = string } + +variable "lambda_role_name" { + type = string +} diff --git a/infra/modules/s3/main.tf b/infra/modules/s3/main.tf index d3e9271..05fb068 100644 --- a/infra/modules/s3/main.tf +++ b/infra/modules/s3/main.tf @@ -43,19 +43,42 @@ resource "aws_s3_bucket_policy" "playwright_traces" { policy = data.aws_iam_policy_document.playwright_traces_bucket_policy.json } -data "aws_iam_policy_document" "playwright_traces_put_object_policy" { - statement { - actions = ["s3:PutObject"] - resources = ["${aws_s3_bucket.playwright_traces.arn}/*"] - effect = "Allow" - principals { - type = "AWS" - identifiers = [var.lambda_role_arn] - } - } +// + +resource "aws_iam_policy" "lambda_s3_policy" { + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = "s3:PutObject" + Effect = "Allow" + Resource = "${aws_s3_bucket.playwright_traces.arn}/*" + } + ] + }) } -resource "aws_s3_bucket_policy" "playwright_traces_put_object_policy" { - bucket = aws_s3_bucket.playwright_traces.id - policy = data.aws_iam_policy_document.playwright_traces_put_object_policy.json +# Attach the policy to the role +resource "aws_iam_role_policy_attachment" "lambda_s3_policy_attachment" { + role = var.lambda_role_name + policy_arn = aws_iam_policy.lambda_s3_policy.arn } + +// + +# data "aws_iam_policy_document" "playwright_traces_put_object_policy" { +# statement { +# actions = ["s3:PutObject"] +# resources = ["${aws_s3_bucket.playwright_traces.arn}/*"] +# effect = "Allow" +# principals { +# type = "AWS" +# identifiers = [var.lambda_role_arn] +# } +# } +# } + +# resource "aws_s3_bucket_policy" "playwright_traces_put_object_policy" { +# bucket = aws_s3_bucket.playwright_traces.id +# policy = data.aws_iam_policy_document.playwright_traces_put_object_policy.json +# }