From 69d9259d260be837beeec5a6483223cb5a4419f8 Mon Sep 17 00:00:00 2001
From: Jacob Valdemar <jan@lunar.app>
Date: Thu, 11 Mar 2021 11:53:13 +0100
Subject: [PATCH] Create terraform.tf

Signed-off-by: Jacob Valdemar Andreasen <jan@lunar.app>
---
 .../techdocs-s3-storage/terraform.tf          | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 contrib/terraform/techdocs-s3-storage/terraform.tf

diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf
new file mode 100644
index 0000000000..d8d57e9cd6
--- /dev/null
+++ b/contrib/terraform/techdocs-s3-storage/terraform.tf
@@ -0,0 +1,73 @@
+#==========================
+# Variables
+#==========================
+
+variable "backstage" {
+  default = "backstage"
+}
+
+#==========================
+# Bucket
+#==========================
+
+resource "aws_s3_bucket" "backstage" {
+  bucket = var.backstage
+  acl    = "private"
+  provider = aws
+
+  lifecycle {
+    prevent_destroy = true
+  }
+
+  server_side_encryption_configuration {
+    rule {
+      apply_server_side_encryption_by_default {
+        sse_algorithm     = "AES256"
+      }
+    }
+  }
+
+  tags = {
+    Name                   = var.backstage
+    "Managed By Terraform" = var.shared-managed-tag-value
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "backstage" {
+  bucket = aws_s3_bucket.backstage.id
+
+  block_public_acls   = true
+  block_public_policy = true
+  ignore_public_acls = true
+  restrict_public_buckets = true
+}
+
+
+#==========================
+# IAM
+#==========================
+
+resource "aws_iam_user" "backstage" {
+  name = var.backstage
+}
+
+resource "aws_iam_user_policy" "backstage" {
+  name = var.backstage
+  user = aws_iam_user.backstage.name
+  policy = data.aws_iam_policy_document.backstage-policy.json
+}
+
+data "aws_iam_policy_document" "backstage-policy" {
+  statement {
+    actions = [
+      "s3:PutObject",
+      "s3:GetObject",
+      "s3:ListBucket"
+    ]
+    effect = "Allow"
+    resources = [
+      "${aws_s3_bucket.backstage.arn}",
+      "${aws_s3_bucket.backstage.arn}/*",
+    ]
+  }
+}