S3 archive update role for metrics bucket [CDS-982] (#131)

* Update main.tf * Update CHANGELOG.md
coralogix · Jan 17, 2024 · 5039add · 5039add
1 parent 6304672
commit 5039add
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Changelog
 
+## v1.0.82
+### 🧰 Bug fixes 🧰
+#### **s3-archive**  
+- Update the role for the metrics bucket
+
 ## v1.0.81
 ### 🧰 Bug fixes 🧰
 #### **ecs-ec2**  

diff --git a/modules/provisioning/s3-archive/main.tf b/modules/provisioning/s3-archive/main.tf
@@ -9,7 +9,8 @@ locals {
   metrics_validations    = local.is_metrics_bucket_name_empty && !local.is_same_bucket_name && (local.is_valid_region || var.bypass_valid_region != "")
   kms_logs_validation    = local.logs_validations && var.logs_kms_arn != "" && contains(split(":", var.logs_kms_arn), var.aws_region)
   kms_metrics_validation = local.metrics_validations && var.metrics_kms_arn != "" && contains(split(":", var.metrics_kms_arn), var.aws_region)
-  coralogix_arn          = var.custom_coralogix_arn != "" ? "arn:aws:iam::${var.custom_coralogix_arn}:role/coralogix-archive-${local.coralogix_role_region}" : var.bypass_valid_region != "" ? "arn:aws:iam::${var.coralogix_arn_mapping[""]}:role/coralogix-archive-${local.coralogix_role_region}" : "arn:aws:iam::${var.coralogix_arn_mapping[var.aws_region]}:role/coralogix-archive-${local.coralogix_role_region}"
+  coralogix_log_role_arn = var.custom_coralogix_arn != "" ? "arn:aws:iam::${var.custom_coralogix_arn}:role/coralogix-archive-${local.coralogix_role_region}" : var.bypass_valid_region != "" ? "arn:aws:iam::${var.coralogix_arn_mapping[""]}:role/coralogix-archive-${local.coralogix_role_region}" : "arn:aws:iam::${var.coralogix_arn_mapping[var.aws_region]}:role/coralogix-archive-${local.coralogix_role_region}"
+  coralogix_metrics_role_arn = var.custom_coralogix_arn != "" ? "arn:aws:iam::${var.custom_coralogix_arn}:root" : var.bypass_valid_region != "" ? "arn:aws:iam::${var.coralogix_arn_mapping[""]}:root" : "arn:aws:iam::${var.coralogix_arn_mapping[var.aws_region]}:root"
 }
 
 data "aws_region" "current" {}
@@ -39,7 +40,7 @@ resource "aws_s3_bucket_policy" "logs_bucket_policy" {
       {
         Effect = "Allow"
         Principal = {
-          AWS = local.coralogix_arn
+          AWS = local.coralogix_log_role_arn
         }
         Action = [
           "s3:GetObject",
@@ -78,7 +79,7 @@ resource "aws_s3_bucket_policy" "metrics_bucket_policy" {
       {
         Effect = "Allow"
         Principal = {
-          AWS = local.coralogix_arn
+          AWS = local.coralogix_metrics_role_arn
         }
         Action = [
           "s3:GetObject",
@@ -107,4 +108,4 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "metrics_encryptio
     }
     bucket_key_enabled = true
   }
-}
+}