eleven / ocho Public

infra: dev-box role gains version listing/deletion on the instances bucket (#646)

The live test's cleanup lists and deletes object versions; the role had
only ListBucket/DeleteObject. Found running the hibernation money test on
the box itself.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 4 months ago b865a5d2daa0a5a4355a8a81e8fdabc823be157a parent ce4a9a9

1 file changed, +2 −1

infra/dev/compute.tf +2 −1

diff --git a/infra/dev/compute.tf b/infra/dev/compute.tf

index 4a250ee..947722b 100644

--- a/infra/dev/compute.tf

+++ b/infra/dev/compute.tf

@@ -83,7 +83,7 @@ resource "aws_iam_role" "dev_box" {

data "aws_iam_policy_document" "dev_box" {

statement {

sid = "ListInstancesBucket"

- actions = ["s3:ListBucket"]

+ actions = ["s3:ListBucket", "s3:ListBucketVersions"]

resources = [aws_s3_bucket.state["instances"].arn]

}

@@ -93,6 +93,7 @@ data "aws_iam_policy_document" "dev_box" {

"s3:GetObject",

"s3:PutObject",

"s3:DeleteObject",

+ "s3:DeleteObjectVersion",

]

resources = ["${aws_s3_bucket.state["instances"].arn}/*"]

}