resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.this.id
  acl    = var.access_policy
}

resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id

  versioning_configuration {
    status = var.versioning ? "Enabled" : "Suspended"
  }
}

resource "aws_s3_bucket_cors_configuration" "this" {
  count  = length(var.cors_origins) > 0 ? 1 : 0
  bucket = aws_s3_bucket.this.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "PUT", "POST"]
    allowed_origins = var.cors_origins
    max_age_seconds = 3600
  }
}

resource "aws_s3_bucket_policy" "read_only" {
  count  = var.access_policy == "public-read" ? 1 : 0
  bucket = aws_s3_bucket.this.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "PublicReadGetObject"
        Effect    = "Allow"
        Principal = "*"
        Action    = "s3:GetObject"
        Resource  = "${aws_s3_bucket.this.arn}/*"
      }
    ]
  })
}

variable "bucket_name" {
  description = "Storage container name"
  type        = string
}

variable "access_policy" {
  description = "Bucket access policy (private, public-read, public-read-write)"
  type        = string
  default     = "private"
}

variable "cors_origins" {
  description = "Allowed CORS origins"
  type        = list(string)
  default     = []
}

variable "versioning" {
  description = "Enable object versioning"
  type        = bool
  default     = false
}

variable "s3_endpoint" {
  description = "Quake AI S3-compatible endpoint URL"
  type        = string
  default     = "https://object.us-east-1.rumble.cloud"
}

variable "s3_region" {
  description = "S3 region identifier"
  type        = string
  default     = "us-east-1"
}

terraform {
  required_version = ">= 1.6.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region                      = var.s3_region
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true

  endpoints {
    s3 = var.s3_endpoint
  }
}

# S3 Storage ACL

S3-compatible object storage bucket with access policies, optional versioning, and optional CORS configuration for Quake AI object storage.

## Prerequisites

- OpenTofu >= 1.6.0 or Terraform >= 1.6.0
- Quake AI EC2-compatible credentials for the HashiCorp AWS provider. See [Credential bootstrap](#credential-bootstrap) for how to mint and export them; the template will not run without them.

## Credential bootstrap

The AWS provider needs EC2-compat credentials issued by Keystone. The Quake AI OpenStack application credential is a separate credential type and will not satisfy the AWS provider. Create an EC2-compat pair and export the standard AWS variables before running `tofu plan`:

```bash
openstack ec2 credentials create
# Capture the `access` and `secret` values from the output table.
export AWS_ACCESS_KEY_ID=<access>
export AWS_SECRET_ACCESS_KEY=<secret>
export AWS_ENDPOINT_URL_S3=https://object.us-east-1.rumble.cloud
```

The EC2 credential is project-scoped. Rotate it like any AWS access key; revoke with `openstack ec2 credentials delete <access>`.

## Usage

1. Clone or copy this template directory
2. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in your values
3. Complete the [Credential bootstrap](#credential-bootstrap) so `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_ENDPOINT_URL_S3` are exported in your shell
4. Initialize: `tofu init`
5. Preview: `tofu plan`
6. Apply: `tofu apply`

## Variables

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `bucket_name` | string | yes | n/a | Storage container (bucket) name |
| `access_policy` | string | no | `private` | Bucket ACL (`private`, `public-read`, `public-read-write`) |
| `cors_origins` | list(string) | no | `[]` | Allowed CORS origins (empty disables CORS resource) |
| `versioning` | bool | no | `false` | Enable object versioning |
| `s3_endpoint` | string | no | `https://object.us-east-1.rumble.cloud` | S3-compatible endpoint URL |
| `s3_region` | string | no | `us-east-1` | Region identifier passed to the provider |

## Documentation

Full documentation: [S3 storage ACL template](/docs/automation/templates/s3-storage-acl)

<!-- last_validated: 2026-05-19 -->