We have a specific usecase with OBS, that is currently not working with the terraform provider:
KMS key is provisioned with terraform in an IAM project (let's say eu-west-0_proj_name)
OBS bucket is provisioned with terraform
Bucket is encrypted with the above mentioned KMS key
IAM user is provisioned with terraform
IAM policies are configured to give the user access to the bucket and KMS
Currently this is not working, because we can't set kms_key_project_id for the bucket, which seems to be required. I have built the provider with a following patch, which have solved our issues (it is loosely based on the implementation in huaweicloud provider).
Hello there,
We have a specific usecase with OBS, that is currently not working with the terraform provider:
eu-west-0_proj_name
)Currently this is not working, because we can't set
kms_key_project_id
for the bucket, which seems to be required. I have built the provider with a following patch, which have solved our issues (it is loosely based on the implementation in huaweicloud provider).Terraform Version
Affected Resource(s)
Please list the resources as a list, for example:
Terraform Configuration Files
Resources
```hcl provider "flexibleengine" { } data "flexibleengine_identity_projects" "current" { name = "eu-west-0_proj_name" } data "flexibleengine_identity_projects" "obs" { name = "MOS" // The project for OBS Billing } data "flexibleengine_identity_group" "admins" { name = "admin" } resource "flexibleengine_kms_key_v1" "mm-key-test" { key_alias = "mm-key-test2" pending_days = "7" realm = "eu-west-0" is_enabled = true } resource "flexibleengine_kms_grant" "mm-key" { for_each = toset(data.flexibleengine_identity_group.admins.users[*].id) key_id = flexibleengine_kms_key_v1.mm-key-test.id type = "user" grantee_principal = each.value operations = ["describe-key"] } resource "flexibleengine_obs_bucket" "mm-test" { bucket = "mm-test-tf" acl = "private" storage_class = "STANDARD" encryption = true kms_key_id = flexibleengine_kms_key_v1.mm-key-test.id kms_key_project_id = data.flexibleengine_identity_projects.current.projects[0].id } resource "flexibleengine_identity_user_v3" "bucket-user" { name = "mm-test-tf" } resource "flexibleengine_identity_role_v3" "bucket-role" { name = "mm-test-tf" description = "TF provisioned role" type = "AX" policy = <Expected Behavior
IAM user should be able to download/upload files to a bucket with SSE enabled.
Actual Behavior
IAM user is getting
No privilege to this kms operation
error upon object upload/download.Steps to Reproduce
Please list the steps required to reproduce the issue, for example:
mc
akaminio client
)