unlayer-bucket.ts

import '@echobox/pulumi-autotag'
import * as aws from '@pulumi/aws'
import * as pulumi from '@pulumi/pulumi'

const bucket = new aws.s3.Bucket('ebx-unlayer', {})

new aws.s3.BucketPublicAccessBlock('public', {
  bucket: bucket.id,
  blockPublicAcls: false,
  blockPublicPolicy: false,
  ignorePublicAcls: false,
  restrictPublicBuckets: false,
  skipDestroy: true,
})

new aws.s3.BucketOwnershipControls('ownership', {
  bucket: bucket.id,
  rule: {
    objectOwnership: 'ObjectWriter',
  }
})

new aws.s3.BucketCorsConfiguration('cors', {
  bucket: bucket.id,
  corsRules: [{
    allowedHeaders: ['*'],
    allowedMethods: ['GET', 'PUT', 'POST', 'DELETE'],
    allowedOrigins: ['https://*.unlayer.com'],
    exposeHeaders: [],
  }]
})

const user = new aws.iam.User('unlayer-integration-user', {})

new aws.iam.UserPolicy('unlayer-integration-user-policy', {
  user: user.name,
  policy: aws.iam.getPolicyDocumentOutput({
    statements: [{
      actions: [
        's3:GetBucketPublicAccessBlock',
        's3:PutObject',
        's3:GetObject',
        's3:PutBucketPublicAccessBlock',
        's3:GetBucketCORS',
        's3:ListBucket',
        's3:PutBucketCORS',
        's3:GetBucketAcl',
        's3:GetBucketLocation',
        's3:PutObjectAcl',
        's3:PutBucketTagging',
      ],
      resources: [
        bucket.arn,
        pulumi.interpolate`${bucket.arn}/*`,
      ],
    }, {
      actions: [
        's3:ListAllMyBuckets',
      ],
      resources: ['*'],
    }],
  }).json,
})

const keys = new aws.iam.AccessKey('unlayer', {
  user: user.name,
  status: 'Active'
})

export const bucketName = bucket.bucket
export const accessKeyId = keys.id
export const secretAccessKey = keys.secret