S3 helm repo

iam.tf

data "aws_iam_policy_document" "helm_repo_bucket_policy" {
	statement {
		actions = [
			"s3:*",
		]
		condition {
			test = "NotIpAddress"
			variable = "aws:SourceIp"
			values = [
				var.remote_network,
			]
		}
		condition {
			test = "StringNotEquals"
			variable = "aws:sourceVpce"
			values = [
				data.terraform_remote_state.vpc.outputs.s3_endpoint_id,
			]
		}
		effect = "Deny"
		principals {
			type = "AWS"
			identifiers = [
				"*",
			]
		}
		resources = [
			aws_s3_bucket.helm_repo.arn,
			"${aws_s3_bucket.helm_repo.arn}/*",
		]
	}
}

s3.tf

resource "aws_s3_bucket" "helm_repo" {
	bucket = var.helm_repo_domain
	acl = "public-read"
	force_destroy = true
	website {
		index_document = "index.yaml"
	}
}

resource "aws_s3_bucket_policy" "helm_repo" {
	bucket = aws_s3_bucket.helm_repo.id
	policy = data.aws_iam_policy_document.helm_repo_bucket_policy.json
}