qumulo_s3_bucket_policy (Resource)

Manages the policy for an S3 bucket on a Qumulo cluster.

Bucket policies use a JSON format similar to AWS S3 bucket policies. The policy document specifies principals and the S3 actions they're allowed or denied.

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic Public Read Policy

resource "qumulo_s3_bucket_policy" "public_read" {
  connection_profile = "prod"

  bucket_name = qumulo_s3_bucket.data.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject"]
      Resource  = ["arn:aws:s3:::${qumulo_s3_bucket.data.name}/*"]
    }]
  })
}

Restrictive Policy for Specific User

resource "qumulo_s3_bucket_policy" "app_access" {
  connection_profile = "prod"

  bucket_name = qumulo_s3_bucket.data.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "local:app-user"
      Action    = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
      Resource  = ["arn:aws:s3:::${qumulo_s3_bucket.data.name}/*"]
    }]
  })
}

Multi-Cluster with for_each

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_s3_bucket_policy" "data" {
  for_each = var.clusters

  connection_profile = each.value

  bucket_name = "data-bucket"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject"]
      Resource  = ["arn:aws:s3:::data-bucket/*"]
    }]
  })
}

Schema

Required

• bucket_name (String) The name of the S3 bucket to apply the policy to.
• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- policy (String) The bucket policy in JSON format. Use jsonencode() to create the policy document. See Qumulo documentation for supported policy syntax.

Optional

• allow_remove_self (Boolean) Allow setting a policy that removes your own access to set bucket policies. WARNING: This can lock you out of the bucket. Defaults to false.

Read-Only

• etag (String) The ETag of the policy for optimistic concurrency. Used internally to detect concurrent modifications.