add permissions for MAAP and PODAAC buckets

[freitagb]

No description provided.

[sgibson91]

I got the following error trying to deploy this:

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply" which may have affected this plan:

  # aws_iam_access_key.continuous_deployer has been deleted
  - resource "aws_iam_access_key" "continuous_deployer" {
      - id                   = "AKIAWOY6ET4OXVGERYVK" -> null
      - secret               = (sensitive value) -> null
        # (4 unchanged attributes hidden)
    }

And similarly, running deployer deploy nasa-veda staging fails:

An error occurred (UnrecognizedClientException) when calling the DescribeCluster operation: The security token included in the request is invalid.

I'll regenerate the continuous deployer and hopefully that will resolve this.

[sgibson91]

As you can see, the plan from this apply will create the deployer credentials again and update the policies in place

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_access_key.continuous_deployer will be created
  + resource "aws_iam_access_key" "continuous_deployer" {
      + create_date                    = (known after apply)
      + encrypted_secret               = (known after apply)
      + encrypted_ses_smtp_password_v4 = (known after apply)
      + id                             = (known after apply)
      + key_fingerprint                = (known after apply)
      + secret                         = (sensitive value)
      + ses_smtp_password_v4           = (sensitive value)
      + status                         = "Active"
      + user                           = "hub-continuous-deployer"
    }

  # aws_iam_policy.extra_user_policy["prod"] will be updated in-place
  ~ resource "aws_iam_policy" "extra_user_policy" {
        id          = "arn:aws:iam::444055461661:policy/nasa-veda-prod-extra-user-policy"
        name        = "nasa-veda-prod-extra-user-policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                            # (13 unchanged elements hidden)
                            "arn:aws:s3:::ornl-cumulus-prod-protected/*",
                          + "arn:aws:s3:::podaac-ops-cumulus-public",
                          + "arn:aws:s3:::podaac-ops-cumulus-public/*",
                          + "arn:aws:s3:::podaac-ops-cumulus-protected",
                          + "arn:aws:s3:::podaac-ops-cumulus-protected/*",
                          + "arn:aws:s3:::maap-ops-workspace",
                          + "arn:aws:s3:::nasa-maap-data-store",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = "s3:ListAllMyBuckets"
                        Effect   = "Allow"
                        Resource = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

  # aws_iam_policy.extra_user_policy["staging"] will be updated in-place
  ~ resource "aws_iam_policy" "extra_user_policy" {
        id          = "arn:aws:iam::444055461661:policy/nasa-veda-staging-extra-user-policy"
        name        = "nasa-veda-staging-extra-user-policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                            # (17 unchanged elements hidden)
                            "arn:aws:s3:::podaac-ops-cumulus-protected/*",
                          + "arn:aws:s3:::maap-ops-workspace",
                          + "arn:aws:s3:::nasa-maap-data-store",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = "s3:ListAllMyBuckets"
                        Effect   = "Allow"
                        Resource = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 1 to add, 2 to change, 0 to destroy.

[sgibson91]

Applied successfully! I'll open another PR to sort out the deployer creds