Skip to content

Commit

Permalink
terraform, aws: refactor iam policy indentation
Browse files Browse the repository at this point in the history
  • Loading branch information
@consideRatio
consideRatio committed Apr 19, 2024
1 parent a59ff1d commit 08f70ce
Show file tree
Hide file tree
Showing 5 changed files with 273 additions and 273 deletions.
44 changes: 22 additions & 22 deletions terraform/aws/projects/jupyter-meets-the-earth.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,17 +21,17 @@ hub_cloud_permissions = {
# FIXME: Previously, users were granted full S3 permissions.
# Keep it the same for now
extra_iam_policy : <<-EOT
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::*"]
}
]
}
EOT
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::*"]
}
]
}
EOT
},
},
"prod" : {
Expand All @@ -40,17 +40,17 @@ EOT
# FIXME: Previously, users were granted full S3 permissions.
# Keep it the same for now
extra_iam_policy : <<-EOT
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::*"]
}
]
}
EOT
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::*"]
}
]
}
EOT
},
},
}
4 changes: 2 additions & 2 deletions terraform/aws/projects/nasa-cryo.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ hub_cloud_permissions = {
}
]
}
EOT
EOT
},
},
"prod" : {
Expand Down Expand Up @@ -90,7 +90,7 @@ hub_cloud_permissions = {
}
]
}
EOT
EOT
},
},
}
106 changes: 53 additions & 53 deletions terraform/aws/projects/nasa-esdis.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,62 +25,62 @@ hub_cloud_permissions = {
"user-sa" : {
bucket_admin_access : ["scratch"],
extra_iam_policy : <<-EOT
{
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:CreateBucket",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::veda-nex-gddp-cmip6-public",
"arn:aws:s3:::veda-nex-gddp-cmip6-public/*",
"arn:aws:s3:::cmip6-staging",
"arn:aws:s3:::cmip6-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*",
"arn:aws:s3:::pangeo-forge-veda-output",
"arn:aws:s3:::pangeo-forge-veda-output/*",
"arn:aws:s3:::podaac-ops-cumulus-public",
"arn:aws:s3:::podaac-ops-cumulus-public/*",
"arn:aws:s3:::podaac-ops-cumulus-protected",
"arn:aws:s3:::podaac-ops-cumulus-protected/*",
"arn:aws:s3:::maap-ops-workspace",
"arn:aws:s3:::maap-ops-workspace/*",
"arn:aws:s3:::nasa-maap-data-store",
"arn:aws:s3:::nasa-maap-data-store/*",
"arn:aws:s3:::grss-veda-data-store",
"arn:aws:s3:::grss-veda-data-store/*",
"arn:aws:s3:::sentinel-cogs",
"arn:aws:s3:::sentinel-cogs/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:CreateBucket",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::veda-nex-gddp-cmip6-public",
"arn:aws:s3:::veda-nex-gddp-cmip6-public/*",
"arn:aws:s3:::cmip6-staging",
"arn:aws:s3:::cmip6-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*",
"arn:aws:s3:::pangeo-forge-veda-output",
"arn:aws:s3:::pangeo-forge-veda-output/*",
"arn:aws:s3:::podaac-ops-cumulus-public",
"arn:aws:s3:::podaac-ops-cumulus-public/*",
"arn:aws:s3:::podaac-ops-cumulus-protected",
"arn:aws:s3:::podaac-ops-cumulus-protected/*",
"arn:aws:s3:::maap-ops-workspace",
"arn:aws:s3:::maap-ops-workspace/*",
"arn:aws:s3:::nasa-maap-data-store",
"arn:aws:s3:::nasa-maap-data-store/*",
"arn:aws:s3:::grss-veda-data-store",
"arn:aws:s3:::grss-veda-data-store/*",
"arn:aws:s3:::sentinel-cogs",
"arn:aws:s3:::sentinel-cogs/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
EOT
}
EOT
},
},
}
176 changes: 88 additions & 88 deletions terraform/aws/projects/nasa-ghg.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,106 +19,106 @@ hub_cloud_permissions = {
"user-sa" : {
bucket_admin_access : ["scratch-staging"],
extra_iam_policy : <<-EOT
{
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::ghgc-data-staging",
"arn:aws:s3:::ghgc-data-staging/*",
"arn:aws:s3:::ghgc-data-store-dev",
"arn:aws:s3:::ghgc-data-store-dev/*",
"arn:aws:s3:::ghgc-data-store",
"arn:aws:s3:::ghgc-data-store/*",
"arn:aws:s3:::ghgc-data-store-staging",
"arn:aws:s3:::ghgc-data-store-staging/*",
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*",
"arn:aws:s3:::podaac-ops-cumulus-public",
"arn:aws:s3:::podaac-ops-cumulus-public/*",
"arn:aws:s3:::podaac-ops-cumulus-protected",
"arn:aws:s3:::podaac-ops-cumulus-protected/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::ghgc-data-staging",
"arn:aws:s3:::ghgc-data-staging/*",
"arn:aws:s3:::ghgc-data-store-dev",
"arn:aws:s3:::ghgc-data-store-dev/*",
"arn:aws:s3:::ghgc-data-store",
"arn:aws:s3:::ghgc-data-store/*",
"arn:aws:s3:::ghgc-data-store-staging",
"arn:aws:s3:::ghgc-data-store-staging/*",
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*",
"arn:aws:s3:::podaac-ops-cumulus-public",
"arn:aws:s3:::podaac-ops-cumulus-public/*",
"arn:aws:s3:::podaac-ops-cumulus-protected",
"arn:aws:s3:::podaac-ops-cumulus-protected/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
EOT
}
EOT
},
},
"prod" : {
"user-sa" : {
bucket_admin_access : ["scratch"],
extra_iam_policy : <<-EOT
{
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::ghgc-data-staging",
"arn:aws:s3:::ghgc-data-staging/*",
"arn:aws:s3:::ghgc-data-store-dev",
"arn:aws:s3:::ghgc-data-store-dev/*",
"arn:aws:s3:::ghgc-data-store",
"arn:aws:s3:::ghgc-data-store/*",
"arn:aws:s3:::ghgc-data-store-staging",
"arn:aws:s3:::ghgc-data-store-staging/*",
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListBucketVersions",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:ListMultipartUploadParts"
],
"Resource": [
"arn:aws:s3:::ghgc-data-staging",
"arn:aws:s3:::ghgc-data-staging/*",
"arn:aws:s3:::ghgc-data-store-dev",
"arn:aws:s3:::ghgc-data-store-dev/*",
"arn:aws:s3:::ghgc-data-store",
"arn:aws:s3:::ghgc-data-store/*",
"arn:aws:s3:::ghgc-data-store-staging",
"arn:aws:s3:::ghgc-data-store-staging/*",
"arn:aws:s3:::veda-data-store-staging",
"arn:aws:s3:::veda-data-store-staging/*",
"arn:aws:s3:::lp-prod-protected",
"arn:aws:s3:::lp-prod-protected/*",
"arn:aws:s3:::gesdisc-cumulus-prod-protected",
"arn:aws:s3:::gesdisc-cumulus-prod-protected/*",
"arn:aws:s3:::nsidc-cumulus-prod-protected",
"arn:aws:s3:::nsidc-cumulus-prod-protected/*",
"arn:aws:s3:::ornl-cumulus-prod-protected",
"arn:aws:s3:::ornl-cumulus-prod-protected/*"
]
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
EOT
}
EOT
},
},
}
Loading

0 comments on commit 08f70ce

Please sign in to comment.