Merge pull request #1151 from NHSDigital/feature/made14-NRL-1904-add-ci-access-to-legacy-bucket

mattdean3-nhs · web-flow · commit 051fdf372901 · 2026-02-24T15:22:05.000Z
[NRL-1904] Add permissions for legacy CI bucket for deploying old ver…
diff --git a/terraform/account-wide-infrastructure/mgmt/data.tf b/terraform/account-wide-infrastructure/mgmt/data.tf
@@ -60,3 +60,7 @@ data "aws_secretsmanager_secret_version" "test_restore_account_id" {
 data "aws_secretsmanager_secret_version" "prod_account_id" {
   secret_id = data.aws_secretsmanager_secret.prod_account_id.name
 }
+
+data "aws_s3_bucket" "legacy_ci_data" {
+  bucket = "${local.project}--mgmt--github-ci-logging"
+}
diff --git a/terraform/account-wide-infrastructure/mgmt/iam_github-ci.tf b/terraform/account-wide-infrastructure/mgmt/iam_github-ci.tf
@@ -102,7 +102,9 @@ resource "aws_iam_policy" "github_ci_policy" {
         Effect = "Allow"
         Resource = [
           aws_s3_bucket.ci_data.arn,
-          "${aws_s3_bucket.ci_data.arn}/*"
+          "${aws_s3_bucket.ci_data.arn}/*",
+          data.aws_s3_bucket.legacy_ci_data.arn,
+          "${data.aws_s3_bucket.legacy_ci_data.arn}/*"
         ]
       }
     ]

Original file line number	Diff line number	Diff line change
`@@ -60,3 +60,7 @@ data "aws_secretsmanager_secret_version" "test_restore_account_id" {`
`60`	`60`	`data "aws_secretsmanager_secret_version" "prod_account_id" {`
`61`	`61`	`secret_id = data.aws_secretsmanager_secret.prod_account_id.name`
`62`	`62`	`}`
	`63`	`+`
	`64`	`+data "aws_s3_bucket" "legacy_ci_data" {`
	`65`	`+ bucket = "${local.project}--mgmt--github-ci-logging"`
	`66`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -102,7 +102,9 @@ resource "aws_iam_policy" "github_ci_policy" {`
`102`	`102`	`Effect = "Allow"`
`103`	`103`	`Resource = [`
`104`	`104`	`aws_s3_bucket.ci_data.arn,`
`105`		`- "${aws_s3_bucket.ci_data.arn}/*"`
	`105`	`+ "${aws_s3_bucket.ci_data.arn}/*",`
	`106`	`+ data.aws_s3_bucket.legacy_ci_data.arn,`
	`107`	`+ "${data.aws_s3_bucket.legacy_ci_data.arn}/*"`
`106`	`108`	`]`
`107`	`109`	`}`
`108`	`110`	`]`