Uly.me

cloud engineer

terraform

AWS Terraform Create Policy and Attach

Here’s the Terraform code that creates an AWS IAM policy and attaches it to an existing role (ROLENAME).

# CREDENTIALS
provider "aws" {
  shared_credentials_files = ["~/.aws/credentials"]
  shared_config_files      = ["~/.aws/config"]
  profile                  = "default"
  region                   = "us-east-1"
}
# CREATE POLICY
resource "aws_iam_policy" "s3-policy" {
    name        = "s3-policy"
    description = "Allow role to write to bucket"
    policy = "${file("policy.json")}"
}
# ATTACH POLICY TO ROLE
resource "aws_iam_role_policy_attachment" "s3-policy-attachment" {
  role       = "ROLENAME"
  policy_arn = aws_iam_policy.s3-policy.arn
}

Here’s the policy.json file.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject"
             ],
            "Resource":"arn:aws:s3:::your-bucket/*"
            }
        }
    ]
}

Add Snapshot Schedules to Disks

How to add Snapshot Schedules to disks in Terraform. Add this to your existing VM.

resource "google_compute_disk_resource_policy_attachment" "hourly_attachment" {
  name = "hourly-snapshots"
  disk = google_compute_instance.test.name
  zone = "us-central1-c"
}
 
resource "google_compute_disk_resource_policy_attachment" "daily_attachment" {
  name = "daily-snapshots"
  disk = google_compute_instance.test.name
  zone = "us-central1-c"
}