53 lines
1.0 KiB
HCL
53 lines
1.0 KiB
HCL
resource "aws_iam_role" "ec2_role" {
|
|
name = "ec2_role_${var.region}"
|
|
|
|
assume_role_policy = <<EOF
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": "sts:AssumeRole",
|
|
"Principal": {
|
|
"Service": "ec2.amazonaws.com"
|
|
},
|
|
"Effect": "Allow",
|
|
"Sid": ""
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
|
|
}
|
|
|
|
resource "aws_iam_instance_profile" "ec2_profile" {
|
|
name = "ec2_profile_${var.region}"
|
|
role = aws_iam_role.ec2_role.name
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "ec2_policy" {
|
|
name = "ec2_policy_${var.region}"
|
|
role = aws_iam_role.ec2_role.id
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Action = [
|
|
"s3:ListBucket"
|
|
]
|
|
Effect = "Allow"
|
|
Resource = "arn:aws:s3:::${aws_s3_bucket.openvpn_config_bucket.bucket}"
|
|
},
|
|
{
|
|
Action = [
|
|
"s3:PutObject",
|
|
"s3:GetObject",
|
|
"s3:DeleteObject"
|
|
]
|
|
Effect = "Allow"
|
|
Resource = "arn:aws:s3:::${aws_s3_bucket.openvpn_config_bucket.bucket}/*"
|
|
},
|
|
]
|
|
})
|
|
}
|