infra: add acls for google_storage_objects create via tf (digital-ass…

…et#2460) This ensures objects in the google storage bucket created by terraform have the proper publicRead acl.
axman6 · Aug 8, 2019 · 14ecfd7 · 14ecfd7
1 parent 8fc5b62
commit 14ecfd7
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/infra/bazel_cache.tf b/infra/bazel_cache.tf
@@ -29,6 +29,13 @@ resource "google_storage_bucket_object" "index_bazel_cache" {
   depends_on   = ["module.nix_cache"]
 }
 
+// Set ACL for ./index.html
+resource "google_storage_object_acl" "index_bazel_cache-acl" {
+  bucket         = "${module.bazel_cache.bucket_name}"
+  object         = "${google_storage_bucket_object.index_bazel_cache.name}"
+  predefined_acl = "publicRead"
+}
+
 // allow rw access for CI writer (see writer.tf)
 resource "google_storage_bucket_iam_member" "bazel_cache_writer" {
   bucket = "${module.bazel_cache.bucket_name}"

diff --git a/infra/nix_cache.tf b/infra/nix_cache.tf
@@ -38,6 +38,13 @@ resource "google_storage_bucket_object" "index_nix_cache" {
   depends_on   = ["module.nix_cache"]
 }
 
+// Set ACL for ./index.html
+resource "google_storage_object_acl" "index_nix_cache-acl" {
+  bucket         = "${module.nix_cache.bucket_name}"
+  object         = "${google_storage_bucket_object.index_nix_cache.name}"
+  predefined_acl = "publicRead"
+}
+
 // provide a nix-cache-info file setting a higher priority
 // than cache.nixos.org, so we prefer it
 resource "google_storage_bucket_object" "nix-cache-info" {
@@ -53,6 +60,13 @@ Priority: 10
   content_type = "text/plain"
 }
 
+// Set ACL for ./nix-cache-info
+resource "google_storage_object_acl" "nix-cache-info-acl" {
+  bucket         = "${module.nix_cache.bucket_name}"
+  object         = "${google_storage_bucket_object.nix-cache-info.name}"
+  predefined_acl = "publicRead"
+}
+
 output "nix_cache_ip" {
   value = "${module.nix_cache.external_ip}"
 }