How do I set up S3 backend access using AWS IAM?

In this guide, we will set up an S3 backend access using AWS IAM with Pulumi. We will create an S3 bucket, an IAM role, and attach a policy to allow access to the S3 bucket. This setup is useful for applications that need to read from or write to an S3 bucket securely.

Key Points:

Create an S3 bucket to store objects.
Create an IAM role that can be assumed by applications or services.
Attach a policy to the IAM role to allow S3 bucket access.

import * as aws from "@pulumi/aws";

// Create an S3 bucket
const bucket = new aws.s3.Bucket("my-bucket", {
    acl: "private",
});

// Create an IAM role
const role = new aws.iam.Role("s3AccessRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "ec2.amazonaws.com" }),
});

// Attach a policy to the role to allow S3 access
const policy = new aws.iam.RolePolicy("s3AccessPolicy", {
    role: role.id,
    policy: bucket.arn.apply(arn => JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket",
            ],
            Effect: "Allow",
            Resource: [
                arn,
                `${arn}/*`,
            ],
        }],
    })),
});

// Export the bucket name and role ARN
export const bucketName = bucket.bucket;
export const roleArn = role.arn;

Summary:

In this program, we created an S3 bucket and an IAM role with a policy that grants access to the S3 bucket. This setup allows secure access to the S3 bucket for applications or services that assume the IAM role. The bucket name and role ARN are exported for use in other parts of your infrastructure.

Deploy this code

Want to deploy this code? Sign up for a free Pulumi account to deploy in a few clicks.

New to Pulumi?

Want to deploy this code? Sign up with Pulumi to deploy in a few clicks.