Skip to content

Commit c0b176b

Browse files
Mia-Crossremyleone
Mia-Cross
and
remyleone
authored
doc(object): policy: fix invalid examples (#2280)
Co-authored-by: Rémy Léone <[email protected]>
1 parent 15e7710 commit c0b176b

File tree

1 file changed

+155
-19
lines changed

1 file changed

+155
-19
lines changed

‎docs/resources/object_bucket_policy.md‎

Lines changed: 155 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,37 +3,101 @@ subcategory: "Object Storage"
33
page_title: "Scaleway: scaleway_object_bucket_policy"
44
---
55

6-
# scaleway_object_bucket
6+
# scaleway_object_bucket_policy
77

88
Creates and manages Scaleway object storage bucket policy.
99
For more information, see [the documentation](https://www.scaleway.com/en/docs/storage/object/api-cli/bucket-policy/).
1010

1111
## Example Usage
1212

13+
### Example with an IAM user
14+
1315
```hcl
16+
# Project ID
17+
data "scaleway_account_project" "default" {
18+
name = "default"
19+
}
20+
21+
# IAM configuration
22+
data "scaleway_iam_user" "user" {
23+
email = "[email protected]"
24+
}
25+
resource "scaleway_iam_policy" "policy" {
26+
name = "object-storage-policy"
27+
user_id = data.scaleway_iam_user.user.id
28+
rule {
29+
project_ids = [data.scaleway_account_project.default.id]
30+
permission_set_names = ["ObjectStorageFullAccess"]
31+
}
32+
}
33+
34+
# Object storage configuration
1435
resource "scaleway_object_bucket" "bucket" {
1536
name = "some-unique-name"
1637
}
38+
resource "scaleway_object_bucket_policy" "policy" {
39+
bucket = scaleway_object_bucket.bucket.name
40+
policy = jsonencode({
41+
Version = "2023-04-17",
42+
Id = "MyBucketPolicy",
43+
Statement = [
44+
{
45+
Effect = "Allow"
46+
Action = ["s3:*"]
47+
Principal = { SCW = "user_id:${data.scaleway_iam_user.user.id}" }
48+
Resource = [
49+
scaleway_object_bucket.bucket.name,
50+
"${scaleway_object_bucket.bucket.name}/*",
51+
]
52+
},
53+
]
54+
})
55+
}
56+
```
1757

18-
resource "scaleway_iam_application" "main" {
19-
name = "My application"
20-
description = "a description"
58+
### Example with an IAM application
59+
60+
#### Creating a bucket and delegating read access to an application
61+
62+
```hcl
63+
# Project ID
64+
data "scaleway_account_project" "default" {
65+
name = "default"
2166
}
2267
68+
# IAM configuration
69+
resource "scaleway_iam_application" "reading-app" {
70+
name = "reading-app"
71+
}
72+
resource "scaleway_iam_policy" "policy" {
73+
name = "object-storage-policy"
74+
application_id = scaleway_iam_application.reading-app.id
75+
rule {
76+
project_ids = [data.scaleway_account_project.default.id]
77+
permission_set_names = ["ObjectStorageBucketsRead"]
78+
}
79+
}
80+
81+
# Object storage configuration
82+
resource "scaleway_object_bucket" "bucket" {
83+
name = "some-unique-name"
84+
}
2385
resource "scaleway_object_bucket_policy" "policy" {
2486
bucket = scaleway_object_bucket.bucket.id
2587
policy = jsonencode(
2688
{
2789
Version = "2023-04-17",
28-
Id = "MyBucketPolicy",
2990
Statement = [
3091
{
31-
Sid = "Delegate access",
92+
Sid = "Delegate read access",
3293
Effect = "Allow",
3394
Principal = {
34-
SCW = "application_id:${scaleway_iam_application.main.id}"
95+
SCW = "application_id:${scaleway_iam_application.reading-app.id}"
3596
},
36-
Action = "s3:ListBucket",
97+
Action = [
98+
"s3:ListBucket",
99+
"s3:GetObject",
100+
]
37101
Resource = [
38102
"${scaleway_object_bucket.bucket.name}",
39103
"${scaleway_object_bucket.bucket.name}/*"
@@ -45,33 +109,68 @@ resource "scaleway_object_bucket_policy" "policy" {
45109
}
46110
```
47111

48-
## Example with aws provider
112+
#### Reading the bucket with the application
49113

50114
```hcl
51-
resource "scaleway_object_bucket" "bucket" {
115+
data "scaleway_iam_application" "reading-app" {
116+
name = "reading-app"
117+
}
118+
resource "scaleway_iam_api_key" "reading-api-key" {
119+
application_id = data.scaleway_iam_application.reading-app.id
120+
}
121+
122+
provider "scaleway" {
123+
access_key = scaleway_iam_api_key.reading-api-key.access_key
124+
secret_key = scaleway_iam_api_key.reading-api-key.secret_key
125+
alias = "reading-profile"
126+
}
127+
128+
data scaleway_object_bucket bucket {
129+
provider = scaleway.reading-profile
52130
name = "some-unique-name"
131+
depends_on = [scaleway_iam_api_key.reading-api-key]
132+
}
133+
```
134+
135+
### Example with AWS provider
136+
137+
```hcl
138+
# AWS provider configuration (with Scaleway credentials)
139+
provider "aws" {
140+
shared_config_files = ["/home/user/.aws/config"]
141+
shared_credentials_files = ["/home/user/.aws/credentials"]
142+
profile = "aws-profile"
143+
144+
skip_region_validation = true
145+
skip_credentials_validation = true
146+
skip_requesting_account_id = true
147+
}
148+
149+
# Scaleway project ID
150+
data "scaleway_account_project" "default" {
151+
name = "default"
53152
}
54153
154+
# Object storage configuration
155+
resource "scaleway_object_bucket" "bucket" {
156+
name = "some-unique-name"
157+
}
55158
resource "scaleway_object_bucket_policy" "main" {
56159
bucket = scaleway_object_bucket.bucket.id
57160
policy = data.aws_iam_policy_document.policy.json
58161
}
59162
163+
# AWS data source
60164
data "aws_iam_policy_document" "policy" {
61-
version = "2023-04-17"
62-
id = "MyBucketPolicy"
63-
165+
version = "2012-10-17"
64166
statement {
65167
sid = "Delegate access"
66168
effect = "Allow"
67-
68169
principals {
69170
type = "SCW"
70-
identifiers = ["application_id:<APPLICATION_ID>"]
171+
identifiers = ["project_id:${data.scaleway_account_project.default.id}"]
71172
}
72-
73173
actions = ["s3:ListBucket"]
74-
75174
resources = [
76175
"${scaleway_object_bucket.bucket.name}",
77176
"${scaleway_object_bucket.bucket.name}/*"
@@ -80,13 +179,50 @@ data "aws_iam_policy_document" "policy" {
80179
}
81180
```
82181

182+
### Example with deprecated version 2012-10-17
183+
184+
```hcl
185+
# Project ID
186+
data "scaleway_account_project" "default" {
187+
name = "default"
188+
}
189+
190+
# Object storage configuration
191+
resource "scaleway_object_bucket" "bucket" {
192+
name = "mia-cross-crash-tests"
193+
region = "fr-par"
194+
}
195+
resource "scaleway_object_bucket_policy" "policy" {
196+
bucket = scaleway_object_bucket.bucket.name
197+
policy = jsonencode({
198+
Version = "2012-10-17",
199+
Statement = [
200+
{
201+
Effect = "Allow"
202+
Action = [
203+
"s3:ListBucket",
204+
"s3:GetObjectTagging"
205+
]
206+
Principal = { SCW = "project_id:${data.scaleway_account_project.default.id}" }
207+
Resource = [
208+
scaleway_object_bucket.bucket.name,
209+
"${scaleway_object_bucket.bucket.name}/*",
210+
]
211+
},
212+
]
213+
})
214+
}
215+
```
216+
217+
**NB:** To configure the AWS provider with Scaleway credentials, please visit this [tutorial](https://www.scaleway.com/en/docs/storage/object/api-cli/object-storage-aws-cli/).
218+
83219
## Arguments Reference
84220

85221
The following arguments are supported:
86222

87-
* `bucket` - (Required) The name of the bucket.
223+
* `bucket` - (Required) The name of the bucket, or its Terraform ID.
88224
* `policy` - (Required) The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, see the [AWS IAM Policy Document Guide](https://learn.hashicorp.com/tutorials/terraform/aws-iam-policy?_ga=2.164714495.1557487853.1659960650-563504983.1635944492).
89-
* `project_id` - (Defaults to [provider](../index.md#project_id) `project_id`) The ID of the project the bucket is associated with.
225+
* `project_id` - (Defaults to [provider](../index.md#arguments-reference) `project_id`) The ID of the project the bucket is associated with.
90226

91227
~> **Important:** The [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) data source may be used, so long as it specifies a principal.
92228

0 commit comments

Comments
 (0)