Allow copy from multiple resources (#137)

uktrade · Oct 4, 2024 · 6a1c9ed · 6a1c9ed
1 parent 92ba92c
commit 6a1c9ed
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/infra/airflow_s3.tf b/infra/airflow_s3.tf
@@ -66,9 +66,7 @@ data "aws_iam_policy_document" "airflow" {
         identifiers = var.airflow_dag_processors[count.index].assume_roles
       }
 
-      resources = [
-        "arn:aws:s3:::${aws_s3_bucket.airflow[count.index].id}/${var.s3_prefix_for_external_role_copy}/*",
-      ]
+      resources = [for prefix in var.s3_prefixes_for_external_role_copy : "arn:aws:s3:::${aws_s3_bucket.airflow[count.index].id}/${prefix}/*"]
 
       actions = [
         "s3:GetObject",

diff --git a/infra/main.tf b/infra/main.tf
@@ -254,7 +254,10 @@ variable "arango_instance_type" { default = "" }
 variable "arango_image_id" { default = "" }
 variable "arango_container_memory" { default = 1024 }
 
-variable "s3_prefix_for_external_role_copy" { default = "export-data" }
+variable "s3_prefixes_for_external_role_copy" {
+  type    = list(string)
+  default = ["import-data", "export-data"]
+}
 
 locals {
   admin_container_name   = "jupyterhub-admin"