Set appropriate AWS ARN for S3 bucket policies in GovCloud

[ericamador]

What

• Parameterize the ARN prefix used for S3 bucket policies such that if we are deploying in an AWS GovCloud region, the ARN prefix is arn:aws-us-gov:s3. Otherwise, the ARN prefix is arn:aws:s3.

Why

• These changes allow successful deployment in GovCloud (tested in us-gov-west-1). Prior to this change, attempting to deploy in GovCloud would fail with:

Error: Error putting S3 policy: MalformedPolicy: Policy has invalid resource status code: 400

References

• https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-arns.html

[gloterman]

Hi @ericamador, I've encountered the same issue with the ARN prefix.
I made also a PR #41 .
Maybe we can discuss with the maintainers for a global solution (manage the GOV and China ARN). ?

Regards,

[ericamador]

@gloterman Thanks for reaching out! If it sounds good to the maintainers, I'll update my PR to move s3_arn_prefix out of locals and make it default to arn:aws:s3, with documentation that states if you're deploying in GovCloud/China, you need to update the value of the variable accordingly.

[osterman]

Another idea might be to define an arn_format variable?

e.g.

variable "arn_format" {
  default = "arn:aws:s3:::%s/*"
}

Then define the bucket_arn like this:

local bucket_arn = format(arn_format, local.bucket_name)

[osterman]

This will allow callers to define any format for the arn required by their region (E.g. china or govcloud)

[ericamador]

Sounds good. I'll work on an update to this PR this evening. Thanks for the feedback.

[ericamador]

@osterman Sorry for the delay. I've made the requested changes. Let me know what you think.

[RothAndrew]

+1. This will be the perfect solution for me as well.

[maximmi]

/codefresh run test

[maximmi]

/rebuild-readme

[maximmi]

@ericamador
Looks good, but please rebuild README by executing these commands:

make init
make readme/deps
make readme

It will add the new variables and outputs to README.md automatically.
In general, any changes to README should be made in README.yaml (not in this case), and after that executing the commands above will rebuild README.yaml into README.md and add all new variables and outputs to README.md

or you can open repository, so bot can do it for you, right now there is no permissions to update your fork

thanks

[ericamador]

@maximmi Thanks, I've made those requested changed to build the docs and have force pushed over my branch.

[maximmi]

/codefresh run test

[maximmi]

thanks @ericamador

[maximmi]

@ericamador here is new release
https://github.com/cloudposse/terraform-aws-tfstate-backend/releases/tag/0.15.0