Merge branch 'trs/forecasts-ncov-special-case'

nextstrain · Jun 6, 2024 · 747d26d · 747d26d
2 parents aecb955 + 4bccaf0
commit 747d26d
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 0 deletions.
diff --git a/env/production/aws-iam-policy-NextstrainPathogenNcovPrivate.tf b/env/production/aws-iam-policy-NextstrainPathogenNcovPrivate.tf
@@ -41,3 +41,41 @@ resource "aws_iam_policy" "NextstrainPathogenNcovPrivate" {
     ]
   })
 }
+
+resource "aws_iam_policy" "NextstrainPathogenNcovPrivateReadOnly" {
+  name = "NextstrainPathogen@ncov+private-read-only"
+  description = "Provides permissions to read datasets, workflow files, etc. in the ncov-private bucket for the Nextstrain ncov pathogen"
+
+  policy = jsonencode({
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Sid": "NcovPrivateList",
+        "Effect": "Allow",
+        "Action": [
+          "s3:ListBucket",
+          "s3:ListBucketVersions",
+          "s3:GetBucketLocation",
+          "s3:GetBucketVersioning",
+        ],
+        "Resource": [
+          "arn:aws:s3:::nextstrain-ncov-private",
+        ],
+      },
+      {
+        "Sid": "NcovPrivateReadWrite",
+        "Effect": "Allow",
+        "Action": [
+          "s3:GetObject",
+          "s3:GetObjectTagging",
+          "s3:GetObjectVersion",
+          "s3:GetObjectVersionTagging",
+        ],
+        "Resource": [
+          # This bucket is akin to nextstrain-data-private/files/{workflows,datasets}/ncov/.
+          "arn:aws:s3:::nextstrain-ncov-private/*",
+        ],
+      },
+    ]
+  })
+}
diff --git a/env/production/aws-iam-role-GitHubActionsRoleNextstrainRepo@.tf b/env/production/aws-iam-role-GitHubActionsRoleNextstrainRepo@.tf
@@ -35,6 +35,11 @@ resource "aws_iam_role" "GitHubActionsRoleNextstrainRepo" {
       ? [aws_iam_policy.NextstrainPathogenNcovPrivate.arn]
       : [],
 
+    # Special-case forecasts-ncov
+    each.key == "forecasts-ncov"
+      ? [aws_iam_policy.NextstrainPathogenNcovPrivateReadOnly.arn]
+      : [],
+
     # Builds inside the AWS Batch runtime need access to the jobs bucket.
     aws_iam_policy.NextstrainJobsAccessToBucket.arn,
   ])