nasa-veda, terraform: add permissions to read USGS Landsat bucket

[freitagb]

No description provided.

[consideRatio]

@freitagb this should be added for staging also right? I pushed a commit.

This still needs to be applied, I'm not doing that right now having on time off.

[freitagb]

yes. Please apply it to both prod and staging. Thanks @consideRatio!

[sgibson91]

Output of terraform plan

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated
with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.extra_user_policy["prod"] will be updated in-place
  ~ resource "aws_iam_policy" "extra_user_policy" {
        id          = "arn:aws:iam::444055461661:policy/nasa-veda-prod-extra-user-policy"
        name        = "nasa-veda-prod-extra-user-policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                            # (23 unchanged elements hidden)
                            "arn:aws:s3:::sdap-dev-zarr/*",
                          + "arn:aws:s3:::usgs-landsat",
                          + "arn:aws:s3:::usgs-landsat/*",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = "s3:ListAllMyBuckets"
                        Effect   = "Allow"
                        Resource = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

  # aws_iam_policy.extra_user_policy["staging"] will be updated in-place
  ~ resource "aws_iam_policy" "extra_user_policy" {
        id          = "arn:aws:iam::444055461661:policy/nasa-veda-staging-extra-user-policy"
        name        = "nasa-veda-staging-extra-user-policy"
      ~ policy      = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = [
                            # (23 unchanged elements hidden)
                            "arn:aws:s3:::sdap-dev-zarr/*",
                          + "arn:aws:s3:::usgs-landsat",
                          + "arn:aws:s3:::usgs-landsat/*",
                        ]
                        # (2 unchanged attributes hidden)
                    },
                    {
                        Action   = "s3:ListAllMyBuckets"
                        Effect   = "Allow"
                        Resource = "*"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        tags        = {}
        # (5 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

[sgibson91]

Successfully applied