adding build_user

docker.tf

@@ -47,7 +47,7 @@ module "docker" {
     }
   ]
   packer_source_type = "S3"
-  packer_config = "docker-base.pkr.hcl"
+  packer_config      = "docker-base.pkr.hcl"
   packer_bucket = {
     name = aws_s3_bucket.assets_bucket.bucket
     key  = "docker-image-pipeline.zip"
@@ -58,7 +58,7 @@ module "docker" {
     key  = "image-pipeline-ansible-playbooks.zip"
   }
   playbook         = "ubuntu-base.yaml"
-  goss_profile        = "docker-base"
+  goss_profile     = "docker-base"
   goss_source_type = "S3"
   goss_bucket = {
     name = aws_s3_bucket.assets_bucket.bucket
@@ -73,8 +73,8 @@ module "docker" {
     source_tag         = "24.10"
     source_docker_repo = "docker-image-pipeline"
     # destination image metadata
-    dest_image         = "pipeline-test"
-    dest_tag           = "latest"
-    dest_docker_repo   = "docker-image-pipeline"
+    dest_image       = "pipeline-test"
+    dest_tag         = "latest"
+    dest_docker_repo = "docker-image-pipeline"
   }
 }

linux.tf

@@ -13,6 +13,7 @@ module "amazon_linux" {
   ssh_user                  = "ec2-user"
   terraform_version         = "1.8.5"
   build_permissions_iam_doc = data.aws_iam_policy_document.s3_access
+  build_user_iam_policy     = data.aws_iam_policy_document.build_user_policy_document.json
   build_environment_variables = [
     for proxy_var in keys(local.proxy_env_vars) :
     {

main.tf

@@ -44,6 +44,27 @@ data "aws_iam_policy_document" "assets_bucket_policy_document" {
 }
 
 
+data "aws_iam_policy_document" "build_user_policy_document" {
+  statement {
+    actions = [
+      "s3:Get*",
+      "s3:List*",
+      "s3:ReplicateObject",
+      "s3:PutObject",
+      "s3:RestoreObject",
+      "s3:PutObjectVersionTagging",
+      "s3:PutObjectTagging",
+      "s3:PutObjectAcl"
+    ]
+
+    resources = [
+      aws_s3_bucket.assets_bucket.arn,
+      "${aws_s3_bucket.assets_bucket.arn}/*",
+    ]
+  }
+}
+
+
 resource "aws_s3_bucket_server_side_encryption_configuration" "state_bucket_encryption" {
   for_each = tomap({
     state_bucket  = aws_s3_bucket.state_bucket.bucket