# Allow read access to S3

The IAM roles used to create Terraform plans and deploying applications come with built-in restrictions by default. In some cases, it can be useful to relax some of these restrictions - like if you have an S3 bucket containing non-sensitive configuration that your Terraform stack needs to fetch during plan/apply.

This guide shows how to allow CI/CD to read your S3 buckets. It is optional: skip it if the default access is enough.

## Before you begin

- [`cicd-common`](../initial-setup-of-your-aws-environment/set-up-cicd-common.md) is installed in the environment.
- Familiarize yourself with [the key points from the risk assessment analysis (ROS)](https://github.com/oslokommune/golden-path-docs-internal/blob/main/oppsummering-ros-nytt-cicd-oppsett.md).

We recommend the tag-based mechanism, but if that's difficult for some reason, or you want more granular control, specify specific objects instead. You can combine both option A and B.

## Option A: Tag the bucket

The bucket needs the `TerraformAutomationReadAccess = "true"` tag and ABAC enabled. Golden Path stacks set the `Environment` tag on every resource. If you create the bucket some other way, set the `Environment` tag yourself.
For a bucket made with the public [`terraform-aws-modules/s3-bucket`](../storage/s3-bucket.md) module, add the `TerraformAutomationReadAccess` tag and enable ABAC yourself.

```hcl title="my-app-data/my-s3-bucket.tf"
module "bucket" {
  # ...

  tags = {
    TerraformAutomationReadAccess = "true"
  }
}

resource "aws_s3_bucket_abac" "bucket" {
  bucket = module.bucket.s3_bucket_id

  abac_status {
    status = "Enabled"
  }
}
```

<!-- prettier-ignore-start -->
!!! warning "ABAC changes how the bucket is tagged"
    Once ABAC is enabled, S3 refuses `PutBucketTagging` and `DeleteBucketTagging` on the bucket, and tags change only through `TagResource` and `UntagResource`.
<!-- prettier-ignore-end -->

## Option B: Allow specific S3 buckets

Grant read access to a bucket explicitly by adding S3 object ARN patterns:

```hcl title="repo-iac/environments/dev/cicd-common/config_override.tf"
locals {
  s3_read_exemptions = [
    "arn:aws:s3:::my-team-data/*",           # (1)!
    "arn:aws:s3:::my-team-config/settings/*", # (2)!
    "arn:aws:s3:::my-team-config/settings/application-settings.json", # (3)!
  ]
}
```

1. Every object in the bucket.
2. Only objects under one prefix. Keep the grant as narrow as the read needs.
3. Only a single object. The grant is as narrow as possible.

Each entry names one bucket and a key pattern.