Aws s3

.gitignore

@@ -58,3 +58,23 @@ vendor/bundle
 /yarn-error.log
 yarn-debug.log*
 .yarn-integrity
+
+# Terraform state files
+*.tfstate
+*.tfstate.backup
+
+# Terraform variable files (actual, not examples)
+*.tfvars
+*.auto.tfvars
+
+# .terraform directory
+.terraform/
+
+# Sensitive credentials
+*.pem
+*.key
+*.secret
+*.env
+
+# Plan files
+*.tfplan

infra/main.tf

@@ -0,0 +1,118 @@
+provider "aws" {
+  region = "eu-north-1"
+}
+
+# Create the IAM user who will assume the basic role
+resource "aws_iam_user" "basic_user" {
+  name = "basic-user"
+}
+
+# Basic Role - trust the specific IAM user to assume this role
+resource "aws_iam_role" "basic_role" {
+  name = "terraform-basic-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          AWS = aws_iam_user.basic_user.arn  # <--- Trust this IAM user
+        },
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+# Policy allowing the basic role to assume the admin role
+resource "aws_iam_policy" "assume_admin_policy" {
+  name = "AssumeTerraformAdminRole"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = "sts:AssumeRole",
+        Resource = aws_iam_role.admin_role.arn
+      }
+    ]
+  })
+}
+
+# Attach the assume admin role policy to the basic role
+resource "aws_iam_role_policy_attachment" "basic_assume_admin_attach" {
+  role       = aws_iam_role.basic_role.name
+  policy_arn = aws_iam_policy.assume_admin_policy.arn
+}
+
+# Admin role (trusts the basic role)
+resource "aws_iam_role" "admin_role" {
+  name = "terraform-admin-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Principal = {
+          AWS = aws_iam_role.basic_role.arn
+        },
+        Action = "sts:AssumeRole"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "admin_attach" {
+  role       = aws_iam_role.admin_role.name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}
+
+# 1. S3 Bucket (private by default)
+resource "aws_s3_bucket" "auth_bucket" {
+  bucket = "codebar-planner-auth-bucket"
+}
+
+# 2. IAM User for Heroku app
+resource "aws_iam_user" "heroku_role" {
+  name = "heroku-s3-access"
+}
+
+# 3. IAM Policy: Read-only access to just this bucket
+resource "aws_iam_policy" "read_write_policy" {
+  name = "HerokuS3ReadWrite"
+
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect = "Allow",
+        Action = [
+          "s3:ListBucket",       # List files in bucket
+          "s3:GetObject",        # Read/download files
+          "s3:PutObject",        # Upload files
+          "s3:DeleteObject",      # Optional: allow deleting files
+          "s3:ListAllMyBuckets"  # enable user to list all buckets
+        ],
+        Resource = [
+          aws_s3_bucket.auth_bucket.arn,
+          "${aws_s3_bucket.auth_bucket.arn}/*"
+        ]
+      }
+    ]
+  })
+}
+
+
+# 4. Attach the policy to the user
+resource "aws_iam_user_policy_attachment" "attach_policy" {
+  user       = aws_iam_user.heroku_role.name
+  policy_arn = aws_iam_policy.read_write_policy.arn
+}
+
+# 5. Create access keys for the user
+resource "aws_iam_access_key" "heroku_user_keys" {
+  user = aws_iam_user.heroku_role.name
+}

infra/terraform.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.92"
+    }
+  }
+
+  required_version = ">= 1.2"
+}