add arcus data storage and kms key to glue IAM role (#2550)

timburke-hackit · web-flow · commit a68734fb83be · 2025-11-10T11:27:13.000Z
diff --git a/terraform/core/10-aws-iam-glue.tf b/terraform/core/10-aws-iam-glue.tf
@@ -153,7 +153,8 @@ data "aws_iam_policy_document" "access_to_s3_iam_and_secrets" {
       "${module.glue_scripts.bucket_arn}/*",
       "${module.glue_temp_storage.bucket_arn}/*",
       "${module.noiseworks_data_storage.bucket_arn}/*",
-      "${module.spark_ui_output_storage.bucket_arn}/*"
+      "${module.spark_ui_output_storage.bucket_arn}/*",
+      "${module.arcus_data_storage.bucket_arn}/*",
     ]
   }
   statement {
@@ -173,7 +174,8 @@ data "aws_iam_policy_document" "access_to_s3_iam_and_secrets" {
       module.trusted_zone.kms_key_arn,
       module.noiseworks_data_storage.kms_key_arn,
       module.spark_ui_output_storage.kms_key_arn,
-      aws_kms_key.secrets_manager_key.arn
+      module.arcus_data_storage.kms_key_arn,
+      aws_kms_key.secrets_manager_key.arn,
     ]
   }
   statement {

Original file line number	Diff line number	Diff line change
`@@ -153,7 +153,8 @@ data "aws_iam_policy_document" "access_to_s3_iam_and_secrets" {`
`153`	`153`	`"${module.glue_scripts.bucket_arn}/*",`
`154`	`154`	`"${module.glue_temp_storage.bucket_arn}/*",`
`155`	`155`	`"${module.noiseworks_data_storage.bucket_arn}/*",`
`156`		`- "${module.spark_ui_output_storage.bucket_arn}/*"`
	`156`	`+ "${module.spark_ui_output_storage.bucket_arn}/*",`
	`157`	`+ "${module.arcus_data_storage.bucket_arn}/*",`
`157`	`158`	`]`
`158`	`159`	`}`
`159`	`160`	`statement {`
`@@ -173,7 +174,8 @@ data "aws_iam_policy_document" "access_to_s3_iam_and_secrets" {`
`173`	`174`	`module.trusted_zone.kms_key_arn,`
`174`	`175`	`module.noiseworks_data_storage.kms_key_arn,`
`175`	`176`	`module.spark_ui_output_storage.kms_key_arn,`
`176`		`- aws_kms_key.secrets_manager_key.arn`
	`177`	`+ module.arcus_data_storage.kms_key_arn,`
	`178`	`+ aws_kms_key.secrets_manager_key.arn,`
`177`	`179`	`]`
`178`	`180`	`}`
`179`	`181`	`statement {`