qumulo_s3_bucket_policy (Resource)¶

Manages the policy for an S3 bucket on a Qumulo cluster.

Bucket policies use a JSON format similar to AWS S3 bucket policies. The policy document specifies principals and the S3 actions they're allowed or denied.

Example Usage¶

Basic Public Read Policy¶

resource "qumulo_s3_bucket_policy" "public_read" {
  connection_profile = "prod"

  bucket_name = qumulo_s3_bucket.data.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject"]
      Resource  = ["arn:aws:s3:::${qumulo_s3_bucket.data.name}/*"]
    }]
  })
}

Restrictive Policy for Specific User¶

resource "qumulo_s3_bucket_policy" "app_access" {
  connection_profile = "prod"

  bucket_name = qumulo_s3_bucket.data.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "local:app-user"
      Action    = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
      Resource  = ["arn:aws:s3:::${qumulo_s3_bucket.data.name}/*"]
    }]
  })
}

Multi-Cluster with for_each¶

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_s3_bucket_policy" "data" {
  for_each = var.clusters

  connection_profile = each.value

  bucket_name = "data-bucket"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject"]
      Resource  = ["arn:aws:s3:::data-bucket/*"]
    }]
  })
}

Schema¶

Required¶

bucket_name (String) The name of the S3 bucket to apply the policy to.
connection_profile (String) Name of a connection profile from the provider block. See the provider reference for how to define profiles.
policy (String) The bucket policy in JSON format. Use jsonencode() to create the policy document. See Qumulo documentation for supported policy syntax.

Optional¶

allow_remove_self (Boolean) Allow setting a policy that removes your own access to set bucket policies. WARNING: This can lock you out of the bucket. Defaults to false.

Read-Only¶

etag (String) The ETag of the policy for optimistic concurrency. Used internally to detect concurrent modifications.