-Now that we have learned the basics of the S3 service,
let's see how to use it within Terraform.
First, let's create an S3 bucket with Terraform.
Just like we did with IAM,
let's make use of the Terraform documentation
for AWS to look up the appropriate resource and the Argument Reference.
To create an S3 bucket,
we'll make use of the aws_s3_bucket resource.
In this example,
we are using finance as the resource name.
The bucket name has to be unique.
In this case, we have called it finance-21092020.
Optionally, we have also added a tag to add a description of this bucket.
This bucket will be used by the finance and the payroll team
so we have used this as the value.
Both the arguments that we have specified here are optional.
If a bucket name is not provided,
Terraform will use a random but unique name to create the bucket.
All right.
We have now created an S3 bucket.
Let's now try to upload some files into it.
To do this, we'll have to make use of another resource type
called aws_s3_bucket_object.
The aws_s3_bucket_object resource has three required arguments:
the bucket named to upload the data to,
the content, which is the part of the file, and the key,
which is the name of the object which is being uploaded.
We can now update our Terraform configuration
with the new resource block like this.
For the bucket ID,
we can make use of a reference expression to point to the bucket resource
that we created earlier.
Once we apply it, the file should be uploaded to the S3 bucket.
So far, we have created two resources:
a bucket and a bucket object.
Both of these have been created in the AWS Infrastructure.
The state of these resources as recorded in our local terraform.tfstate file.
Next, let us see how to make use of a bucket policy
to define who can access this bucket.
Let's say that we have an IAM group
called finance-analysts which was created manually in this AWS account.
This group needs access to the finance bucket
that we created with Terraform.
Since this group was not created by Terraform,
the Terraform state is unaware of such a group.
First, we must create a data source for this group.
This will allow Terraform to read the attributes of this IAM group.
Let us know update our Terraform configuration file
and add a data block of type aws_iam_group.
Let's call it finance-data.
Once applied,
this data source reads information about the IAM group
and it is now available for use within our local Terraform state file.
We can now make use of the ARN of the IAM group
within the bucket policy resource that we want to create.
Let us now create another resource block called aws_s3_bucket_policy.
This new resource is used to attach a bucket policy to the bucket.
It expects two mandatory arguments.
The first one is the bucket name to which we want to attach the policy.
Using the reference expression,
we can set the value of the bucket name like this next.
Next, we will define the policy document using heredoc syntax.
Earlier, when we discussed about bucket policies,
we saw a sample of the JSON document used to create a policy.
We can now move this document inside the policy like this.
Within the policy document,
we are making use of reference expression
and interpolation for both resource and the principal.
Using these expressions, make sure that the values are not hardcoded.
The bucket ID is retrieved from the S3 bucket resource
and the IAM group ARN number is retrieved from the data source
that we created for the IAM group called finance-data.
Finally, once we apply the Terraform configuration,
the bucket policy should be attached to the bucket
called finance-21092020
giving full access to the members of the IAM group called finance-analysts.
That's it for this lecture.
Let's head over to the hands on labs
and practice working with S3 using Terraform.