> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Allow read access to S3

The IAM roles used to create Terraform plans and deploying applications come with built-in restrictions by default. In some cases, it can be useful to relax some of these restrictions, for example if you have an S3 bucket containing non-sensitive configuration that your Terraform stack needs to fetch during plan/apply.

This optional guide shows how to allow CI/CD to read your S3 buckets. Skip it if the default access is enough.

## Before you begin

- [`cicd-common`](<https://km.oslo.systems/initial-setup-of-your-aws-environment/set-up-cicd-common/index.md>) is installed in the environment.
- Familiarize yourself with [the key points from the risk assessment analysis (ROS)](<https://github.com/oslokommune/golden-path-docs-internal/blob/main/oppsummering-ros-nytt-cicd-oppsett.md>).

We recommend the tag-based mechanism, but if that's difficult for some reason, or you want more granular control, specify specific objects instead. You can combine both option A and B.

## Option A: Tag the bucket

The bucket needs the `TerraformAutomationReadAccess = "true"` tag and ABAC enabled. Golden Path stacks set the `Environment` tag on every resource. If you create the bucket some other way, set the `Environment` tag yourself. For a bucket made with the public [`terraform-aws-modules/s3-bucket`](<https://km.oslo.systems/storage/s3-bucket/index.md>) module, add the `TerraformAutomationReadAccess` tag and enable ABAC yourself.

my-app-data/my-s3-bucket.tf

```
module "bucket" {
  # ...

  tags = {
    TerraformAutomationReadAccess = "true"
  }
}

resource "aws_s3_bucket_abac" "bucket" {
  bucket = module.bucket.s3_bucket_id

  abac_status {
    status = "Enabled"
  }
}
```

> [!WARNING]
>
> **ABAC changes how the bucket is tagged**
>
> Once ABAC is enabled, S3 refuses `PutBucketTagging` and `DeleteBucketTagging` on the bucket, and tags change only through `TagResource` and `UntagResource`.

## Option B: Allow specific S3 buckets

Grant read access to a bucket explicitly by adding S3 object ARN patterns:

repo-iac/environments/dev/cicd-common/config\_override.tf

```
locals {
  s3_read_exemptions = [
    "arn:aws:s3:::my-team-data/*",           # (1)!
    "arn:aws:s3:::my-team-config/settings/*", # (2)!
    "arn:aws:s3:::my-team-config/settings/application-settings.json", # (3)!
  ]
}
```

1. Every object in the bucket.
2. Only objects under one prefix. Keep the grant as narrow as the read needs.
3. Only a single object. The grant is as narrow as possible.

Each entry names one bucket and a key pattern.