diff --git a/management-team-account/billing/s3/backend.tf b/management-team-account/billing/s3/backend.tf new file mode 100644 index 0000000..812631e --- /dev/null +++ b/management-team-account/billing/s3/backend.tf @@ -0,0 +1,9 @@ +terraform { + backend "s3" { + bucket = "cloudfence-management-state" + key = "billing/s3.tfstate" + region = "ap-northeast-2" + encrypt = true + dynamodb_table = "s3-management-lock" + } +} diff --git a/management-team-account/billing/s3/main.tf b/management-team-account/billing/s3/main.tf new file mode 100644 index 0000000..65a3240 --- /dev/null +++ b/management-team-account/billing/s3/main.tf @@ -0,0 +1,28 @@ + +# billing을 담을 bucket 생성 +resource "aws_s3_bucket" "billing" { + bucket = "billing-report-bucket" + lifecycle { + prevent_destroy = false + } + + tags = { + Name = "Billing Bucket" + Environment = "management" + } +} + +# billing에서 bucket에 putobject를 하는 것을 허용 +resource "aws_s3_bucket_policy" "allow_billing_upload" { + bucket = aws_s3_bucket.billing.id + + policy = jsonencode({ + Version = "2012-10-17", + Statement = [{ + Effect = "Allow", + Principal = { Service = "billingreports.amazonaws.com" }, + Action = "s3:PutObject", + Resource = "${aws_s3_bucket.billing.arn}/*" + }] + }) +} diff --git a/management-team-account/billing/s3/outputs.tf b/management-team-account/billing/s3/outputs.tf new file mode 100644 index 0000000..54f6907 --- /dev/null +++ b/management-team-account/billing/s3/outputs.tf @@ -0,0 +1,7 @@ +output "bucket_id" { + value = aws_s3_bucket.billing.id +} + +output "bucket_arn" { + value = aws_s3_bucket.billing.arn +} \ No newline at end of file