qontract-reconcile 0.10.2.dev58__py3-none-any.whl → 0.10.2.dev59__py3-none-any.whl

{qontract_reconcile-0.10.2.dev58.dist-info → qontract_reconcile-0.10.2.dev59.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qontract-reconcile
-Version: 0.10.2.dev58
+Version: 0.10.2.dev59
 Summary: Collection of tools to reconcile services with their desired state as defined in the app-interface DB.
 Project-URL: homepage, https://github.com/app-sre/qontract-reconcile
 Project-URL: repository, https://github.com/app-sre/qontract-reconcile

{qontract_reconcile-0.10.2.dev58.dist-info → qontract_reconcile-0.10.2.dev59.dist-info}/RECORD

@@ -637,7 +637,7 @@ reconcile/utils/state.py,sha256=az4tBmZ0EdbFcAGiBVUxs3cr2-BVWsuDQiNTvjjQq8s,1637
 reconcile/utils/structs.py,sha256=LcbLEg8WxfRqM6nW7NhcWN0YeqF7SQzxOgntmLs1SgY,352
 reconcile/utils/template.py,sha256=wTvRU4AnAV_o042tD4Mwls2dwWMuk7MKnde3MaCjaYg,331
 reconcile/utils/terraform_client.py,sha256=H8frsS370y8xfivKLNBD1dwlBLHvfuR6JSN_syBL5Qc,36033
-reconcile/utils/terrascript_aws_client.py,sha256=UdEM3JeTMiE0VRqtz7gcBWR-c0fouORtPFrniRJ3pao,283505
+reconcile/utils/terrascript_aws_client.py,sha256=faAluZnn7yvPqfxnYH4gvKukpX7a_KwHHoA9usBlSNM,284706
 reconcile/utils/three_way_diff_strategy.py,sha256=oQcHXd9LVhirJfoaOBoHUYuZVGfyL2voKr6KVI34zZE,4833
 reconcile/utils/throughput.py,sha256=iP4UWAe2LVhDo69mPPmgo9nQ7RxHD6_GS8MZe-aSiuM,344
 reconcile/utils/vault.py,sha256=aSA8l9cJlPUHpChFGl27nSY-Mpq9FMjBo7Dcgb1BVfM,15036
@@ -777,7 +777,7 @@ tools/saas_promotion_state/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJ
 tools/saas_promotion_state/saas_promotion_state.py,sha256=UfwwRLS5Ya4_Nh1w5n1dvoYtchQvYE9yj1VANt2IKqI,3925
 tools/sre_checkpoints/__init__.py,sha256=CDaDaywJnmRCLyl_NCcvxi-Zc0hTi_3OdwKiFOyS39I,145
 tools/sre_checkpoints/util.py,sha256=zEDbGr18ZeHNQwW8pUsr2JRjuXIPz--WAGJxZo9sv_Y,894
-qontract_reconcile-0.10.2.dev58.dist-info/METADATA,sha256=rQJYMzaII94AgfVybASnf6jWezt2vOg4-p1vRIuKKyc,24665
-qontract_reconcile-0.10.2.dev58.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-qontract_reconcile-0.10.2.dev58.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
-qontract_reconcile-0.10.2.dev58.dist-info/RECORD,,
+qontract_reconcile-0.10.2.dev59.dist-info/METADATA,sha256=Yk3AHwZzFbLs4byLAW2xefKgAtlZ3s3Ap3Y8OUuCQEE,24665
+qontract_reconcile-0.10.2.dev59.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+qontract_reconcile-0.10.2.dev59.dist-info/entry_points.txt,sha256=5i9l54La3vQrDLAdwDKQWC0iG4sV9RRfOb1BpvzOWLc,698
+qontract_reconcile-0.10.2.dev59.dist-info/RECORD,,

reconcile/utils/terrascript_aws_client.py

@@ -5261,6 +5261,31 @@ class TerrascriptClient:  # pylint: disable=too-many-public-methods
             )
             tf_resources.append(lb_access_logs_s3_bucket_tf_resource)
 
+            policy_identifier = f"{identifier}-s3-bucket-policy"
+            # https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html#access-log-create-bucket
+            policy = {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Effect": "Allow",
+                        "Principal": {
+                            "AWS": f"arn:aws:iam::{self.accounts[account]['uid']}:root"
+                        },
+                        "Action": "s3:PutObject",
+                        "Resource": f"{{{lb_access_logs_s3_bucket_tf_resource.arn}}}/*",
+                    }
+                ],
+            }
+            lb_access_logs_s3_bucket_policy_values = {
+                "provider": provider,
+                "bucket": f"${{{lb_access_logs_s3_bucket_tf_resource.id}}}",
+                "policy": json.dumps(policy, sort_keys=True),
+            }
+            lb_access_logs_s3_bucket_policy_tf_resource = aws_s3_bucket_policy(
+                policy_identifier, **lb_access_logs_s3_bucket_policy_values
+            )
+            tf_resources.append(lb_access_logs_s3_bucket_policy_tf_resource)
+
             lb_values["access_logs"] = {
                 "enabled": True,
                 "bucket": f"${{{lb_access_logs_s3_bucket_tf_resource.id}}}",