S3 Bucket Example for Permissions Toggle

bucket.tf

variable "enable_object_editor" {
  default     = false
  type        = bool
  description = "enables object editor for current aws account"
}

data "aws_caller_identity" "current" {}

resource "aws_s3_bucket" "my_bucket" {
  bucket = "my_bucket"
}

locals {
  my_bucket_policy = [
    {
      actions = [
        "s3:ListBucket",
      ]

      resources = [
        "arn:aws:s3:::${aws_s3_bucket.my_bucket.bucket}",
      ]

      principals = [
        "*"
      ]
    }
  ]
  edit_statement = [
    {
      actions = [
        "s3:*Object",
      ]

      resources = [
        "arn:aws:s3:::${aws_s3_bucket.my_bucket.bucket}",
      ]

      principals = [
        "${data.aws_caller_identity.current.arn}"
      ]
    }
  ]
  statements = var.enable_object_editor ? concat(local.my_bucket_policy, local.edit_statement) : local.my_bucket_policy
}

data "aws_iam_policy_document" "my_bucket" {
  dynamic "statement" {
    for_each = local.statements
    content {
      actions   = statement.value["actions"]
      resources = statement.value["resources"]
      principals {
        type        = "AWS"
        identifiers = statement.value["principals"]
      }
    }
  }
}

resource "aws_s3_bucket_policy" "my_bucket" {
  bucket = aws_s3_bucket.my_bucket.id

  policy = data.aws_iam_policy_document.my_bucket.json
}