terraform-contour-mirror/modules/minio-buckets/main.tf

# In-cluster MinIO implementation of the `buckets` entity contract. Per bucket:
# create the bucket, a dedicated access user (access_key/secret_key) and a policy
# granting that user full access to only its bucket — mirroring yc-s3, which
# creates a per-bucket service account + static key. Output shape matches yc-s3
# so the shared k8s-secret module resolves s3 credentials identically.

locals {
  buckets_map = { for b in var.buckets : b.name => b }
}

resource "random_password" "secret_key" {
  for_each = local.buckets_map

  length  = 40
  special = false
  upper   = true
  lower   = true
  numeric = true

  lifecycle {
    ignore_changes = all
  }
}

resource "minio_s3_bucket" "this" {
  for_each = local.buckets_map

  bucket = each.key
  acl    = try(each.value.acl, "private")
}

resource "minio_s3_bucket_versioning" "this" {
  for_each = { for name, b in local.buckets_map : name => b if try(b.versioning.enabled, false) }

  bucket = minio_s3_bucket.this[each.key].bucket
  versioning_configuration {
    status = "Enabled"
  }
}

resource "minio_iam_user" "this" {
  for_each = local.buckets_map

  name          = "${each.key}${var.user_suffix}"
  secret        = random_password.secret_key[each.key].result
  force_destroy = true
}

resource "minio_iam_policy" "this" {
  for_each = local.buckets_map

  name = "${each.key}-rw"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:*"]
      Resource = ["arn:aws:s3:::${each.key}", "arn:aws:s3:::${each.key}/*"]
    }]
  })
}

resource "minio_iam_user_policy_attachment" "this" {
  for_each = local.buckets_map

  user_name  = minio_iam_user.this[each.key].name
  policy_name = minio_iam_policy.this[each.key].name
}