amadan
infra: blob mirror says production, not prod — Paul's naming call (unapplied, so free) (#1045)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+20
−20
infra/prod/blob-mirror.tf+20 −20
diff --git a/infra/prod/blob-mirror.tf b/infra/prod/blob-mirror.tf| index eb96741..c87d2a1 100644 |
| --- a/infra/prod/blob-mirror.tf |
| +++ b/infra/prod/blob-mirror.tf |
| @@ -11,12 +11,12 @@ |
| # media as noncurrent versions would quietly betray the deletion. When a |
| # blob goes, both copies actually go. |
| -resource "aws_s3_bucket" "prod_blob_mirror" { |
| - bucket = "eleven-prod-blob-mirror-${local.account_id}" |
| +resource "aws_s3_bucket" "production_blob_mirror" { |
| + bucket = "eleven-production-blob-mirror-${local.account_id}" |
| } |
| -resource "aws_s3_bucket_public_access_block" "prod_blob_mirror" { |
| - bucket = aws_s3_bucket.prod_blob_mirror.id |
| +resource "aws_s3_bucket_public_access_block" "production_blob_mirror" { |
| + bucket = aws_s3_bucket.production_blob_mirror.id |
| block_public_acls = true |
| block_public_policy = true |
| @@ -26,14 +26,14 @@ resource "aws_s3_bucket_public_access_block" "prod_blob_mirror" { |
| # TLS-only, same shape as the hibernation bucket: deny-only grants nothing |
| # public, so it attaches fine under the full access block above. |
| -data "aws_iam_policy_document" "prod_blob_mirror_tls_only" { |
| +data "aws_iam_policy_document" "production_blob_mirror_tls_only" { |
| statement { |
| sid = "DenyInsecureTransport" |
| effect = "Deny" |
| actions = ["s3:*"] |
| resources = [ |
| - aws_s3_bucket.prod_blob_mirror.arn, |
| - "${aws_s3_bucket.prod_blob_mirror.arn}/*", |
| + aws_s3_bucket.production_blob_mirror.arn, |
| + "${aws_s3_bucket.production_blob_mirror.arn}/*", |
| ] |
| principals { |
| @@ -49,9 +49,9 @@ data "aws_iam_policy_document" "prod_blob_mirror_tls_only" { |
| } |
| } |
| -resource "aws_s3_bucket_policy" "prod_blob_mirror" { |
| - bucket = aws_s3_bucket.prod_blob_mirror.id |
| - policy = data.aws_iam_policy_document.prod_blob_mirror_tls_only.json |
| +resource "aws_s3_bucket_policy" "production_blob_mirror" { |
| + bucket = aws_s3_bucket.production_blob_mirror.id |
| + policy = data.aws_iam_policy_document.production_blob_mirror_tls_only.json |
| } |
| # The instances' mirror credentials (LCHAT_BLOB_S3_MIRROR_ACCESS_KEY / |
| @@ -59,11 +59,11 @@ resource "aws_s3_bucket_policy" "prod_blob_mirror" { |
| # and audit sweeps address every object by id straight from the blobs table |
| # (HeadObject rides the s3:GetObject grant). Key minted by hand |
| # (`aws iam create-access-key`), sealed into the vault — never in tofu state. |
| -resource "aws_iam_user" "blob_mirror_prod" { |
| - name = "blob-mirror-prod" |
| +resource "aws_iam_user" "blob_mirror_production" { |
| + name = "blob-mirror-production" |
| } |
| -data "aws_iam_policy_document" "blob_mirror_prod" { |
| +data "aws_iam_policy_document" "blob_mirror_production" { |
| statement { |
| sid = "ReadWriteBlobMirrorObjects" |
| actions = [ |
| @@ -71,16 +71,16 @@ data "aws_iam_policy_document" "blob_mirror_prod" { |
| "s3:PutObject", |
| "s3:DeleteObject", |
| ] |
| - resources = ["${aws_s3_bucket.prod_blob_mirror.arn}/*"] |
| + resources = ["${aws_s3_bucket.production_blob_mirror.arn}/*"] |
| } |
| } |
| -resource "aws_iam_user_policy" "blob_mirror_prod" { |
| - name = "blob-mirror-prod-bucket" |
| - user = aws_iam_user.blob_mirror_prod.name |
| - policy = data.aws_iam_policy_document.blob_mirror_prod.json |
| +resource "aws_iam_user_policy" "blob_mirror_production" { |
| + name = "blob-mirror-production-bucket" |
| + user = aws_iam_user.blob_mirror_production.name |
| + policy = data.aws_iam_policy_document.blob_mirror_production.json |
| } |
| -output "prod_blob_mirror_bucket" { |
| - value = aws_s3_bucket.prod_blob_mirror.bucket |
| +output "production_blob_mirror_bucket" { |
| + value = aws_s3_bucket.production_blob_mirror.bucket |
| } |