WEBVTT

00:00.940 --> 00:04.060
-Now that we have learned the basics
of the S3 service,

00:04.400 --> 00:06.800
let's see how to use it within Terraform.

00:08.320 --> 00:11.400
First,
let's create an S3 bucket with Terraform.

00:12.100 --> 00:14.060
Just like we did with IAM,

00:14.280 --> 00:16.480
let's make use
of the Terraform documentation

00:16.480 --> 00:20.700
for AWS to look up the appropriate resource
and the Argument Reference.

00:21.680 --> 00:23.080
To create an S3 bucket,

00:23.380 --> 00:26.740
we'll make use of the aws_s3_bucket resource.

00:27.760 --> 00:28.660
In this example,

00:28.880 --> 00:31.280
we are using finance as the resource name.

00:32.180 --> 00:33.900
The bucket name has to be unique.

00:34.160 --> 00:39.020
In this case,
we have called it finance-21092020.

00:40.220 --> 00:44.440
Optionally, we have also added a tag
to add a description of this bucket.

00:45.360 --> 00:48.040
This bucket will be used
by the finance and the payroll team

00:48.080 --> 00:50.020
so we have used this as the value.

00:51.760 --> 00:54.600
Both the arguments
that we have specified here are optional.

00:55.300 --> 00:57.140
If a bucket name is not provided,

00:57.340 --> 01:00.980
Terraform will use a random
but unique name to create the bucket.

01:02.140 --> 01:02.900
All right.

01:03.120 --> 01:05.080
We have now created an S3 bucket.

01:05.180 --> 01:07.800
Let's now try to upload some files into it.

01:08.480 --> 01:11.380
To do this, we'll have to make use
of another resource type

01:11.680 --> 01:14.040
called aws_s3_bucket_object.

01:15.120 --> 01:19.160
The aws_s3_bucket_object resource
has three required arguments:

01:20.020 --> 01:22.320
the bucket named to upload the data to,

01:23.040 --> 01:26.160
the content, which is the part of the file,
and the key,

01:26.480 --> 01:29.180
which is the name of the object
which is being uploaded.

01:30.720 --> 01:33.120
We can now update
our Terraform configuration

01:33.200 --> 01:35.360
with the new resource block like this.

01:36.480 --> 01:37.720
For the bucket ID,

01:37.800 --> 01:41.200
we can make use of a reference expression
to point to the bucket resource

01:41.200 --> 01:42.400
that we created earlier.

01:43.180 --> 01:46.460
Once we apply it,
the file should be uploaded to the S3 bucket.

01:48.080 --> 01:50.180
So far, we have created two resources:

01:50.500 --> 01:52.820
a bucket and a bucket object.

01:53.120 --> 01:56.340
Both of these have been created
in the AWS Infrastructure.

01:57.420 --> 02:02.520
The state of these resources as recorded
in our local terraform.tfstate file.

02:03.720 --> 02:06.860
Next,
let us see how to make use of a bucket policy

02:07.020 --> 02:09.040
to define who can access this bucket.

02:10.120 --> 02:12.040
Let's say that we have an IAM group

02:12.040 --> 02:15.860
called finance-analysts which
was created manually in this AWS account.

02:16.740 --> 02:18.940
This group needs access
to the finance bucket

02:18.940 --> 02:20.260
that we created with Terraform.

02:21.360 --> 02:23.680
Since this group was not created
by Terraform,

02:23.900 --> 02:26.300
the Terraform state is unaware
of such a group.

02:27.380 --> 02:30.540
First,
we must create a data source for this group.

02:30.860 --> 02:34.760
This will allow Terraform to read
the attributes of this IAM group.

02:35.740 --> 02:38.340
Let us know update
our Terraform configuration file

02:38.560 --> 02:42.520
and add a data block of type aws_iam_group.

02:42.920 --> 02:45.080
Let's call it finance-data.

02:45.960 --> 02:46.920
Once applied,

02:46.920 --> 02:49.760
this data source reads information
about the IAM group

02:50.020 --> 02:54.180
and it is now available for use
within our local Terraform state file.

02:55.300 --> 02:58.400
We can now make use
of the ARN of the IAM group

02:58.400 --> 03:01.200
within the bucket policy resource
that we want to create.

03:02.760 --> 03:07.040
Let us now create another resource block
called aws_s3_bucket_policy.

03:08.380 --> 03:11.960
This new resource is used to attach
a bucket policy to the bucket.

03:13.040 --> 03:15.160
It expects two mandatory arguments.

03:15.880 --> 03:19.620
The first one is the bucket name
to which we want to attach the policy.

03:20.360 --> 03:21.880
Using the reference expression,

03:21.880 --> 03:24.440
we can set the value
of the bucket name like this next.

03:25.440 --> 03:29.320
Next, we will define the policy document
using heredoc syntax.

03:30.240 --> 03:32.740
Earlier, when we discussed
about bucket policies,

03:32.900 --> 03:36.340
we saw a sample of the JSON document
used to create a policy.

03:37.040 --> 03:40.400
We can now move this document
inside the policy like this.

03:41.580 --> 03:43.240
Within the policy document,

03:43.240 --> 03:45.560
we are making use of reference expression

03:45.560 --> 03:48.760
and interpolation for both resource
and the principal.

03:49.860 --> 03:53.380
Using these expressions,
make sure that the values are not hardcoded.

03:54.480 --> 03:57.560
The bucket ID is retrieved
from the S3 bucket resource

03:57.800 --> 04:01.240
and the IAM group ARN number is retrieved
from the data source

04:01.240 --> 04:04.560
that we created for the IAM group
called finance-data.

04:05.460 --> 04:08.440
Finally,
once we apply the Terraform configuration,

04:08.700 --> 04:11.020
the bucket policy should be attached
to the bucket

04:11.020 --> 04:14.140
called finance-21092020

04:14.380 --> 04:18.360
giving full access to the members
of the IAM group called finance-analysts.

04:20.040 --> 04:21.340
That's it for this lecture.

04:21.560 --> 04:23.380
Let's head over to the hands on labs

04:23.380 --> 04:26.140
and practice working
with S3 using Terraform.