-
-
Notifications
You must be signed in to change notification settings - Fork 49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Partition and restrict S3 paths across SFTP users #9
Conversation
variables.tf
Outdated
@@ -14,6 +14,12 @@ variable "sftp_users" { | |||
description = "List of SFTP usernames and public keys" | |||
} | |||
|
|||
variable "sftp_restricted" { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's call it restricted home
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
home_directory_type
would keep it consistent with the argument.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm leaning towards restricted_home
because home_directory_type
on the aws_transfer_user
resource doesn't entirely control whether or not the user will be restricted to their home directory.
main.tf
Outdated
|
||
name = module.iam_label.id | ||
policy = join("", data.aws_iam_policy_document.allows_s3[*].json) | ||
name = "${module.iam_label.id}-${each.value}" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this use a separate label module reference in case someone changes the delimiter?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yup! oops
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It would also be OK to replace the -
with ${module.iam_label.delimiter}
, but a new label module is better because it will also handle case conversion and forbidden character removal on each.value
.
what
why
references