fix(yc-s3): use iam_binding instead of bucket_policy

Replace yandex_storage_bucket_policy with yandex_storage_bucket_iam_binding
for proper Yandex Cloud access bindings on bucket level

README.md

@@ -98,14 +98,14 @@ namespace → database → s3 → secrets
 
 **Особенности:**
 - Каждый бакет получает отдельный Service Account
-- SA не имеет глобальных IAM ролей на storage
-- Доступ к бакету только через bucket policy
+- SA не имеет глобальных IAM ролей на storage на уровне folder
+- Доступ к бакету через IAM binding (`yandex_storage_bucket_iam_binding`)
 - SA может работать только со своим бакетом
 
-**Роли:**
-- `storage.uploader` (default) — PutObject, DeleteObject, GetObject
-- `storage.viewer` — GetObject, ListBucket
-- `storage.editor` — все операции
+**Роли (Yandex Cloud IAM):**
+- `storage.uploader` (default) — загрузка объектов
+- `storage.viewer` — чтение объектов
+- `storage.editor` — полный доступ
 
 **Пример:**
 ```yaml

modules/yc-s3/main.tf

@@ -1,18 +1,12 @@
 locals {
   buckets_map = { for bucket in var.buckets : bucket.name => bucket }
-
-  role_actions = {
-    "storage.uploader" = ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"]
-    "storage.viewer"   = ["s3:GetObject", "s3:ListBucket"]
-    "storage.editor"   = ["s3:*"]
-  }
 }
 
 resource "yandex_iam_service_account" "sa" {
   for_each = local.buckets_map
 
   name        = "${each.key}-sa"
-  description = "Service account for ${each.key} bucket (access via bucket policy only)"
+  description = "Service account for ${each.key} bucket"
 }
 
 resource "yandex_iam_service_account_static_access_key" "sa_key" {
@@ -48,28 +42,15 @@ resource "yandex_storage_bucket" "this" {
   }
 }
 
-resource "yandex_storage_bucket_policy" "this" {
+resource "yandex_storage_bucket_iam_binding" "uploader" {
   for_each = local.buckets_map
 
   bucket = yandex_storage_bucket.this[each.key].bucket
+  role   = coalesce(each.value.role, var.default_bucket_role)
 
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "AllowServiceAccountAccess"
-        Effect = "Allow"
-        Principal = {
-          CanonicalUser = [yandex_iam_service_account.sa[each.key].id]
-        }
-        Action = local.role_actions[coalesce(each.value.role, var.default_bucket_role)]
-        Resource = [
-          "arn:aws:s3:::${each.key}",
-          "arn:aws:s3:::${each.key}/*"
+  members = [
+    "serviceAccount:${yandex_iam_service_account.sa[each.key].id}"
   ]
-      }
-    ]
-  })
 
   depends_on = [yandex_storage_bucket.this]
 }