terraform-contour-mirror/modules/yc-s3/main.tf

locals {
  buckets_map             = { for bucket in var.buckets : bucket.name => bucket }
  yc_service_accounts_map = { for sa in var.yc_service_accounts : sa.name => sa }

  yc_service_account_folder_roles = length(local.yc_service_accounts_map) > 0 ? merge([
    for sa_name, sa in local.yc_service_accounts_map : {
      for role in try(sa.folder_roles, []) : "${sa_name}:${role}" => {
        sa_name = sa_name
        role    = role
      }
    }
  ]...) : {}

  yc_service_accounts_with_static_key = {
    for sa_name, sa in local.yc_service_accounts_map : sa_name => sa
    if try(sa.create_static_access_key, true)
  }
}

resource "yandex_iam_service_account" "sa" {
  for_each = local.buckets_map

  name        = "${each.key}-sa"
  description = "Service account for ${each.key} bucket"
}

resource "yandex_iam_service_account_static_access_key" "sa_key" {
  for_each = local.buckets_map

  service_account_id = yandex_iam_service_account.sa[each.key].id
  description        = "Static access key for ${each.key} bucket"
}

resource "yandex_storage_bucket" "this" {
  for_each = local.buckets_map

  bucket    = each.key
  acl       = each.value.acl
  folder_id = var.folder_id

  dynamic "versioning" {
    for_each = try(each.value.versioning.enabled, false) ? [1] : []
    content {
      enabled = true
    }
  }

  dynamic "cors_rule" {
    for_each = try(each.value.cors.enabled, false) ? [1] : []
    content {
      allowed_headers = try(each.value.cors.allowed_headers, [])
      allowed_methods = try(each.value.cors.allowed_methods, [])
      allowed_origins = try(each.value.cors.allowed_origins, [])
      expose_headers  = try(each.value.cors.expose_headers, [])
      max_age_seconds = try(each.value.cors.max_age_seconds, 3600)
    }
  }
}

resource "yandex_storage_bucket_iam_binding" "uploader" {
  for_each = local.buckets_map

  bucket = yandex_storage_bucket.this[each.key].bucket
  role   = coalesce(each.value.role, var.default_bucket_role)

  members = [
    "serviceAccount:${yandex_iam_service_account.sa[each.key].id}"
  ]

  depends_on = [yandex_storage_bucket.this]
}

resource "yandex_iam_service_account" "custom_sa" {
  for_each = local.yc_service_accounts_map

  name        = each.value.name
  description = try(each.value.description, "")
}

resource "yandex_resourcemanager_folder_iam_member" "custom_sa_role" {
  for_each = local.yc_service_account_folder_roles

  folder_id = var.folder_id
  role      = each.value.role
  member    = "serviceAccount:${yandex_iam_service_account.custom_sa[each.value.sa_name].id}"
}

resource "yandex_iam_service_account_static_access_key" "custom_sa_key" {
  for_each = local.yc_service_accounts_with_static_key

  service_account_id = yandex_iam_service_account.custom_sa[each.key].id
  description        = "Static access key for ${each.key}"
}