import * as pulumi from "@pulumi/pulumi"; /** * The `scaleway.object.BucketPolicy` resource allows you to create and manage * bucket policies for [Scaleway Object storage](https://www.scaleway.com/en/docs/object-storage/). * * Refer to the [dedicated documentation](https://www.scaleway.com/en/docs/object-storage/api-cli/bucket-policy/) for more information on Object Storage * bucket policies. * * > **Warning:** The `awsIamPolicyDocument` resource is only compatible with * the deprecated `2012-10-17` version. Use the Scaleway-specific `2023-04-17` * recommended version, with a `jsonencode` bloc instead. See examples below. * * ## Example Usage * * ### Example Usage with an IAM user * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as scaleway from "@pulumiverse/scaleway"; * * // Project ID * const _default = scaleway.account.getProject({ * name: "default", * }); * // IAM configuration * const user = scaleway.iam.getUser({ * email: "user@scaleway.com", * }); * const policy = new scaleway.iam.Policy("policy", { * name: "object-storage-policy", * userId: user.then(user => user.id), * rules: [{ * projectIds: [_default.then(_default => _default.id)], * permissionSetNames: ["ObjectStorageFullAccess"], * }], * }); * // Object storage configuration * const bucket = new scaleway.object.Bucket("bucket", {name: "some-unique-name"}); * const policyBucketPolicy = new scaleway.object.BucketPolicy("policy", { * bucket: bucket.name, * policy: pulumi.jsonStringify({ * Version: "2023-04-17", * Id: "MyBucketPolicy", * Statement: [{ * Effect: "Allow", * Action: ["s3:*"], * Principal: { * SCW: user.then(user => `user_id:${user.id}`), * }, * Resource: [ * bucket.name, * pulumi.interpolate`${bucket.name}/*`, * ], * }], * }), * }); * ``` * * ### Example with an IAM application * * ### Creating a bucket and delegating read access to an application * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as scaleway from "@pulumiverse/scaleway"; * * // Project ID * const _default = scaleway.account.getProject({ * name: "default", * }); * // IAM configuration * const reading_app = new scaleway.iam.Application("reading-app", {name: "reading-app"}); * const policy = new scaleway.iam.Policy("policy", { * name: "object-storage-policy", * applicationId: reading_app.id, * rules: [{ * projectIds: [_default.then(_default => _default.id)], * permissionSetNames: ["ObjectStorageBucketsRead"], * }], * }); * // Object storage configuration * const bucket = new scaleway.object.Bucket("bucket", {name: "some-unique-name"}); * const policyBucketPolicy = new scaleway.object.BucketPolicy("policy", { * bucket: bucket.id, * policy: pulumi.jsonStringify({ * Version: "2023-04-17", * Statement: [{ * Sid: "Delegate read access", * Effect: "Allow", * Principal: { * SCW: pulumi.interpolate`application_id:${reading_app.id}`, * }, * Action: [ * "s3:ListBucket", * "s3:GetObject", * ], * Resource: [ * bucket.name, * pulumi.interpolate`${bucket.name}/*`, * ], * }], * }), * }); * ``` * * ### Reading the bucket with the application * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as scaleway from "@pulumiverse/scaleway"; * * const reading_app = scaleway.iam.getApplication({ * name: "reading-app", * }); * const reading_api_key = new scaleway.iam.ApiKey("reading-api-key", {applicationId: reading_app.then(reading_app => reading_app.id)}); * const bucket = scaleway.object.getBucket({ * name: "some-unique-name", * }); * ``` * * ### Example with deprecated version 2012-10-17 * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as scaleway from "@pulumiverse/scaleway"; * * // Project ID * const _default = scaleway.account.getProject({ * name: "default", * }); * // Object storage configuration * const bucket = new scaleway.object.Bucket("bucket", { * name: "mia-cross-crash-tests", * region: "fr-par", * }); * const policy = new scaleway.object.BucketPolicy("policy", { * bucket: bucket.name, * policy: pulumi.jsonStringify({ * Version: "2012-10-17", * Statement: [{ * Effect: "Allow", * Action: [ * "s3:ListBucket", * "s3:GetObjectTagging", * ], * Principal: { * SCW: _default.then(_default => `project_id:${_default.id}`), * }, * Resource: [ * bucket.name, * pulumi.interpolate`${bucket.name}/*`, * ], * }], * }), * }); * ``` * * **NB:** To configure the AWS provider with Scaleway credentials, refer to the [dedicated documentation](https://www.scaleway.com/en/docs/object-storage/api-cli/object-storage-aws-cli/). * * ## Import * * Bucket policies can be imported using the `{region}/{bucketName}` identifier, as shown below: * * ```sh * $ pulumi import scaleway:index/objectBucketPolicy:ObjectBucketPolicy some_bucket fr-par/some-bucket * ``` * * > **Important:** The `projectId` attribute has a particular behavior with s3 products because the s3 API is scoped by project. * If you are using a project different from the default one, you have to specify the project ID at the end of the import command. * * ```sh * $ pulumi import scaleway:index/objectBucketPolicy:ObjectBucketPolicy some_bucket fr-par/some-bucket@xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx * ``` * * * * [1]: https://www.scaleway.com/en/docs/object-storage/ * [2]: https://www.scaleway.com/en/docs/object-storage/api-cli/bucket-policy/ * * @deprecated scaleway.index/objectbucketpolicy.ObjectBucketPolicy has been deprecated in favor of scaleway.object/bucketpolicy.BucketPolicy */ export declare class ObjectBucketPolicy extends pulumi.CustomResource { /** * Get an existing ObjectBucketPolicy resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: ObjectBucketPolicyState, opts?: pulumi.CustomResourceOptions): ObjectBucketPolicy; /** * Returns true if the given object is an instance of ObjectBucketPolicy. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is ObjectBucketPolicy; /** * The name of the bucket, or its Terraform ID. */ readonly bucket: pulumi.Output; /** * The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, refer to the official documentation. */ readonly policy: pulumi.Output; /** * `projectId`) The ID of the project the bucket is associated with. * * > **Important:** The `projectId` attribute has a particular behavior with s3 products because the s3 API is scoped by project. * If you are using a project different from the default one, you have to specify the `projectId` for every child resource of the bucket, * like bucket policies. Otherwise, Terraform will try to create the child resource with the default project ID and you will get a 403 error. * * > **Important:** The awsIamPolicyDocument data source may be used, as long as it specifies a principal. */ readonly projectId: pulumi.Output; /** * The Scaleway region this bucket resides in. */ readonly region: pulumi.Output; /** * Create a ObjectBucketPolicy resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ /** @deprecated scaleway.index/objectbucketpolicy.ObjectBucketPolicy has been deprecated in favor of scaleway.object/bucketpolicy.BucketPolicy */ constructor(name: string, args: ObjectBucketPolicyArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering ObjectBucketPolicy resources. */ export interface ObjectBucketPolicyState { /** * The name of the bucket, or its Terraform ID. */ bucket?: pulumi.Input; /** * The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, refer to the official documentation. */ policy?: pulumi.Input; /** * `projectId`) The ID of the project the bucket is associated with. * * > **Important:** The `projectId` attribute has a particular behavior with s3 products because the s3 API is scoped by project. * If you are using a project different from the default one, you have to specify the `projectId` for every child resource of the bucket, * like bucket policies. Otherwise, Terraform will try to create the child resource with the default project ID and you will get a 403 error. * * > **Important:** The awsIamPolicyDocument data source may be used, as long as it specifies a principal. */ projectId?: pulumi.Input; /** * The Scaleway region this bucket resides in. */ region?: pulumi.Input; } /** * The set of arguments for constructing a ObjectBucketPolicy resource. */ export interface ObjectBucketPolicyArgs { /** * The name of the bucket, or its Terraform ID. */ bucket: pulumi.Input; /** * The policy document. This is a JSON formatted string. For more information about building AWS IAM policy documents with Terraform, refer to the official documentation. */ policy: pulumi.Input; /** * `projectId`) The ID of the project the bucket is associated with. * * > **Important:** The `projectId` attribute has a particular behavior with s3 products because the s3 API is scoped by project. * If you are using a project different from the default one, you have to specify the `projectId` for every child resource of the bucket, * like bucket policies. Otherwise, Terraform will try to create the child resource with the default project ID and you will get a 403 error. * * > **Important:** The awsIamPolicyDocument data source may be used, as long as it specifies a principal. */ projectId?: pulumi.Input; /** * The Scaleway region this bucket resides in. */ region?: pulumi.Input; } //# sourceMappingURL=objectBucketPolicy.d.ts.map