[NRL-1158] Allow AWS Backup to write to backup-reports bucket

Author: mattdean3-nhs

terraform/account-wide-infrastructure/dev/aws-backup.tf

@@ -1,5 +1,4 @@
 
-# First, we create an S3 bucket for compliance reports.
 resource "aws_s3_bucket" "backup_reports" {
   bucket_prefix = "${local.prefix}-backup-reports"
 }
@@ -45,6 +44,22 @@ resource "aws_s3_bucket_policy" "backup_reports_bucket_policy" {
           }
         }
       },
+      {
+        Sid    = "AllowBackupReportsWrite"
+        Effect = "Allow"
+        Principal = {
+          AWS = "arn:aws:iam::${local.account_id}:role/aws-service-role/reports.backup.amazonaws.com/AWSServiceRoleForBackupReports"
+        }
+        Action = "s3:PutObject"
+        Resource = [
+          "${aws_s3_bucket.backup_reports.arn}/*",
+        ]
+        Condition = {
+          StringEquals = {
+            "s3:x-amz-acl" = "bucket-owner-full-control"
+          }
+        }
+      }
     ]
   })
 }

terraform/account-wide-infrastructure/dev/data.tf

@@ -1,5 +1,7 @@
 data "aws_region" "current" {}
 
+data "aws_caller_identity" "current" {}
+
 data "aws_secretsmanager_secret_version" "identities_account_id" {
   secret_id = aws_secretsmanager_secret.identities_account_id.name
 }

terraform/account-wide-infrastructure/dev/locals.tf

@@ -3,6 +3,7 @@ locals {
   project     = "nhsd-nrlf"
   environment = terraform.workspace
   prefix      = "${local.project}--${local.environment}"
+  account_id  = data.aws_caller_identity.current.account_id
 
   notification_emails = tolist(jsondecode(data.aws_secretsmanager_secret_version.emails.secret_string))
 }