feat: add user_policy_document parameter

[dod38fr]

what

This parameter allows the user to specify policies that are applied to the S3 bucket with the policies defined by this module.

why

We want to add policies that forbid non admin users to access the bucket containing tfstates.

This commit allow us to specify a policy that implement these restriction without clobbering the policies put in place by this module.

Note that I have no problem to change the name of this new parameter if you want another.

references

Closes: #115

[dod38fr]

Hi
Any news ?

[dod38fr]

Hi

Any news about this PR ? Is there a problem preventing a review ?

All the best

[osterman]

Best way to get attention is in #pr-reviews channel in slack

[aknysh]

@dod38fr thank you for the PR, it looks good

please run the following commands and commit the changes:

make init
make github/init
make readme

[aknysh]

please see comments

[Nuru]

Sorry for the delay reviewing this. We were hoping to make these changes and more by now as part of a overhaul, but obviously we have not gotten to it yet.

Please make the requested changes so that this feature works just like source_policy_documents in terraform-aws-s3-bucket.

[Nuru]

Move to separate policy document which overrides the default bucket policy. See s3-bucket implementation for example:

https://github.com/cloudposse/terraform-aws-s3-bucket/blob/d7a49439ea48dfd91c06830fb5d9419329bd927d/main.tf#L454-L466

[dod38fr]

Done.

Unfortunately, I won't be able to test this change on my client's system before October.

[alixinne]

I can confirm that the change works as expected on said client's system where we are running the changed version in this PR, thanks @dod38fr!

[dod38fr]

All set then, @Nuru , can you resume the review ?

All the best

[dod38fr]

please run the following commands and commit the changes:

make init
make github/init
make readme

Done.

All the best

[Nuru]

/terratest

[Nuru]

This is failing the Terratest. I'm not sure why, something to do with order of operations or waiting. You can compare with our s3-bucket module. It might be a while before I get to look into this further.

[dod38fr]

@Nuru The terratest job (https://github.com/cloudposse/terraform-aws-tfstate-backend/actions/runs/6303986183) is now marked as successful.

I don't really know what went on. I guess that he failure you've seen was a temporary failure and that the job was restarted.

In any case, I cannot investigate further as I cannot see any error message.

Is there something more I can do ?

[dod38fr]

Hi

I've successfully run the test that failed in your CI:

$ make -C test/src/
make: Entering directory '/home/domi/terraform-stuff/terraform-aws-tfstate-backend/test/src'
go mod download
go test -v -timeout 60m
=== RUN   TestExamplesComplete
=== PAUSE TestExamplesComplete
=== RUN   TestExamplesCompleteDisabled
=== PAUSE TestExamplesCompleteDisabled
=== CONT  TestExamplesComplete
=== CONT  TestExamplesCompleteDisabled
TestExamplesComplete 2023-10-18T17:53:30+02:00 test_structure.go:130: Copied terraform folder ../../examples/complete to /tmp/TestExamplesComplete578001989/terraform-aws-tfstate-backend/examples/complete
TestExamplesComplete 2023-10-18T17:53:30+02:00 retry.go:91: terraform [init -upgrade=true]
TestExamplesComplete 2023-10-18T17:53:30+02:00 logger.go:66: Running command terraform with args [init -upgrade=true]

[ snip]

TestExamplesComplete 2023-10-18T17:59:00+02:00 logger.go:66: module.tfstate_backend.aws_s3_bucket.default[0]: Still destroying... [id=eg-use2-test-terraform-tfstate-backend-rxcfw2, 4m40s elapsed]
TestExamplesComplete 2023-10-18T17:59:10+02:00 logger.go:66: module.tfstate_backend.aws_s3_bucket.default[0]: Still destroying... [id=eg-use2-test-terraform-tfstate-backend-rxcfw2, 4m50s elapsed]
TestExamplesComplete 2023-10-18T17:59:20+02:00 logger.go:66: module.tfstate_backend.aws_s3_bucket.default[0]: Still destroying... [id=eg-use2-test-terraform-tfstate-backend-rxcfw2, 5m0s elapsed]
TestExamplesComplete 2023-10-18T17:59:21+02:00 logger.go:66: module.tfstate_backend.aws_s3_bucket.default[0]: Destruction complete after 5m2s
TestExamplesComplete 2023-10-18T17:59:21+02:00 logger.go:66: 
TestExamplesComplete 2023-10-18T17:59:21+02:00 logger.go:66: Destroy complete! Resources: 9 destroyed.
TestExamplesComplete 2023-10-18T17:59:21+02:00 logger.go:66: 
--- PASS: TestExamplesComplete (351.46s)
PASS
ok      github.com/cloudposse/terraform-aws-tfstate-backend     351.483s
make: Leaving directory '/home/domi/terraform-stuff/terraform-aws-tfstate-backend/test/src'

I really don't know what can be done to unblock this PR.

Any idea ?

[Nuru]

/terratest