Allow read access to S3

The IAM roles used to create Terraform plans and deploying applications come with built-in restrictions by default. In some cases, it can be useful to relax some of these restrictions - like if you have an S3 bucket containing non-sensitive configuration that your Terraform stack needs to fetch during plan/apply.

This guide shows how to allow CI/CD to read your S3 buckets. It is optional: skip it if the default access is enough.

Before you begin

• cicd-common is installed in the environment.
• Familiarize yourself with the key points from the risk assessment analysis (ROS).

We recommend the tag-based mechanism, but if that's difficult for some reason, or you want more granular control, specify specific objects instead. You can combine both option A and B.

Option A: Tag the bucket

The bucket needs the TerraformAutomationReadAccess = "true" tag and ABAC enabled. Golden Path stacks set the Environment tag on every resource. If you create the bucket some other way, set the Environment tag yourself. For a bucket made with the public terraform-aws-modules/s3-bucket module, add the TerraformAutomationReadAccess tag and enable ABAC yourself.

module "bucket" {
  # ...

  tags = {
    TerraformAutomationReadAccess = "true"
  }
}

resource "aws_s3_bucket_abac" "bucket" {
  bucket = module.bucket.s3_bucket_id

  abac_status {
    status = "Enabled"
  }
}

Option B: Allow specific S3 buckets

Grant read access to a bucket explicitly by adding S3 object ARN patterns:

locals {
  s3_read_exemptions = [
    "arn:aws:s3:::my-team-data/*",           # (1)!
    "arn:aws:s3:::my-team-config/settings/*", # (2)!
    "arn:aws:s3:::my-team-config/settings/application-settings.json", # (3)!
  ]
}

1. Every object in the bucket.
2. Only objects under one prefix. Keep the grant as narrow as the read needs.
3. Only a single object. The grant is as narrow as possible.

Each entry names one bucket and a key pattern.