terraform-contour-mirror/modules/yc-s3/main.tf

# Создание сервисного аккаунта для S3
resource "yandex_iam_service_account" "sa" {
  name        = "${var.bucket_name}-sa"
  description = "Service account for ${var.bucket_name} bucket"
}

# Назначение роли storage.editor сервисному аккаунту
resource "yandex_resourcemanager_folder_iam_member" "storage_editor" {
  folder_id = var.folder_id
  role      = "storage.editor"
  member    = "serviceAccount:${yandex_iam_service_account.sa.id}"
}

# Создание статического ключа доступа
resource "yandex_iam_service_account_static_access_key" "sa_key" {
  service_account_id = yandex_iam_service_account.sa.id
  description        = "Static access key for ${var.bucket_name} bucket"
}

# Создание S3 бакета с публичным доступом
resource "yandex_storage_bucket" "pulse" {
  bucket     = var.bucket_name
  access_key = yandex_iam_service_account_static_access_key.sa_key.access_key
  secret_key = yandex_iam_service_account_static_access_key.sa_key.secret_key

  # Публичный доступ для чтения
  acl = "public-read"

  # Настройка CORS для внешнего доступа
  cors_rule {
    allowed_headers  = ["*"]
    allowed_methods  = ["GET", "PUT", "POST", "DELETE", "HEAD"]
    allowed_origins  = ["*"]
    expose_headers   = ["ETag"]
    max_age_seconds  = 3600
  }

  # Версионирование объектов
  versioning {
    enabled = var.versioning_enabled
  }

  depends_on = [yandex_resourcemanager_folder_iam_member.storage_editor]
}