From 13b5ebc18ba68119b768d673def8e264801d5d55 Mon Sep 17 00:00:00 2001 From: Crystal Gomes Date: Mon, 27 Apr 2026 14:25:07 -0400 Subject: [PATCH 1/3] docs(object-storage): Scope bucket policy examples by org condition Made-with: Cursor --- .../object_storage_bucket_policy_document.md | 26 ++++++++++-- .../resources/object_storage_bucket_policy.md | 42 +++++++++++++++---- .../data-source.tf | 26 ++++++++++-- .../resource.tf | 42 +++++++++++++++---- 4 files changed, 110 insertions(+), 26 deletions(-) diff --git a/docs/data-sources/object_storage_bucket_policy_document.md b/docs/data-sources/object_storage_bucket_policy_document.md index 61008eec..aa677b30 100644 --- a/docs/data-sources/object_storage_bucket_policy_document.md +++ b/docs/data-sources/object_storage_bucket_policy_document.md @@ -13,16 +13,34 @@ description: |- ## Example Usage ```terraform +variable "bucket_name" { + type = string + description = "Name of the bucket to allow access to." +} + +variable "org_id" { + type = string + description = "CoreWeave organization ID to match in the bucket policy condition." +} + data "coreweave_object_storage_bucket_policy_document" "default" { version = "2012-10-17" statement { - sid = "allow-all" - effect = "Allow" - action = ["s3:*"] - resource = ["arn:aws:s3:::*"] + sid = "AllowAllInOrg" + effect = "Allow" + action = ["s3:*"] + resource = [ + "arn:aws:s3:::${var.bucket_name}", + "arn:aws:s3:::${var.bucket_name}/*", + ] principal = { "CW" : ["*"] } + condition = { + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } + } } } ``` diff --git a/docs/resources/object_storage_bucket_policy.md b/docs/resources/object_storage_bucket_policy.md index 0c5a95ed..39c50d14 100644 --- a/docs/resources/object_storage_bucket_policy.md +++ b/docs/resources/object_storage_bucket_policy.md @@ -15,18 +15,31 @@ description: |- ```terraform ## Example using jsonencode to pass a raw JSON string to the policy attribute +variable "org_id" { + type = string + description = "CoreWeave organization ID to match in the bucket policy condition." +} + locals { bucket_policy = { Version = "2012-10-17" Statement = [ { - Sid = "allow-all" + Sid = "AllowAllInOrg" Effect = "Allow" Principal = { - "CW" : "*" + "CW" : ["*"] + } + Action = ["s3:*"] + Resource = [ + "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}", + "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}/*", + ] + Condition = { + "StringEquals" = { + "cw:PrincipalOrgID" = [var.org_id] + } } - Action = ["s3:*"] - Resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}"] }, ] } @@ -52,17 +65,25 @@ resource "coreweave_object_storage_bucket" "doc" { data "coreweave_object_storage_bucket_policy_document" "doc" { version = "2012-10-17" statement { - sid = "allow-all" - effect = "Allow" - action = ["s3:*"] - resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] + sid = "AllowAllInOrg" + effect = "Allow" + action = ["s3:*"] + resource = [ + "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}", + "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*", + ] principal = { "CW" : ["*"] } + condition = { + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } + } } statement { - sid = "DenyIfPrefixEquals" + sid = "DenyIfPrefixNotEquals" effect = "Deny" action = ["s3:ListBucket"] resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] @@ -73,6 +94,9 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { "StringNotEquals" : { "s3:prefix" : "projects" } + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } } } } diff --git a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf index 794b86ff..92163a4c 100644 --- a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf +++ b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf @@ -1,12 +1,30 @@ +variable "bucket_name" { + type = string + description = "Name of the bucket to allow access to." +} + +variable "org_id" { + type = string + description = "CoreWeave organization ID to match in the bucket policy condition." +} + data "coreweave_object_storage_bucket_policy_document" "default" { version = "2012-10-17" statement { - sid = "allow-all" - effect = "Allow" - action = ["s3:*"] - resource = ["arn:aws:s3:::*"] + sid = "AllowAllInOrg" + effect = "Allow" + action = ["s3:*"] + resource = [ + "arn:aws:s3:::${var.bucket_name}", + "arn:aws:s3:::${var.bucket_name}/*", + ] principal = { "CW" : ["*"] } + condition = { + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } + } } } diff --git a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf index 47827028..d4da27c5 100644 --- a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf +++ b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf @@ -1,17 +1,30 @@ ## Example using jsonencode to pass a raw JSON string to the policy attribute +variable "org_id" { + type = string + description = "CoreWeave organization ID to match in the bucket policy condition." +} + locals { bucket_policy = { Version = "2012-10-17" Statement = [ { - Sid = "allow-all" + Sid = "AllowAllInOrg" Effect = "Allow" Principal = { - "CW" : "*" + "CW" : ["*"] + } + Action = ["s3:*"] + Resource = [ + "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}", + "arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}/*", + ] + Condition = { + "StringEquals" = { + "cw:PrincipalOrgID" = [var.org_id] + } } - Action = ["s3:*"] - Resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.raw.name}"] }, ] } @@ -37,17 +50,25 @@ resource "coreweave_object_storage_bucket" "doc" { data "coreweave_object_storage_bucket_policy_document" "doc" { version = "2012-10-17" statement { - sid = "allow-all" - effect = "Allow" - action = ["s3:*"] - resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] + sid = "AllowAllInOrg" + effect = "Allow" + action = ["s3:*"] + resource = [ + "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}", + "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*", + ] principal = { "CW" : ["*"] } + condition = { + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } + } } statement { - sid = "DenyIfPrefixEquals" + sid = "DenyIfPrefixNotEquals" effect = "Deny" action = ["s3:ListBucket"] resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] @@ -58,6 +79,9 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { "StringNotEquals" : { "s3:prefix" : "projects" } + "StringEquals" : { + "cw:PrincipalOrgID" : var.org_id + } } } } From 3b2ce7dd6b211aad7cfa52034e7c277a65fbe416 Mon Sep 17 00:00:00 2001 From: Crystal Gomes Date: Thu, 30 Jul 2026 12:17:36 -0400 Subject: [PATCH 2/3] docs(object-storage): Make policy examples self-contained Declare the CoreWeave provider source so copied examples resolve the correct provider and support Terraform initialization. Co-authored-by: Cursor --- .../data-sources/object_storage_bucket_policy_document.md | 8 ++++++++ docs/resources/object_storage_bucket_policy.md | 8 ++++++++ .../data-source.tf | 8 ++++++++ .../coreweave_object_storage_bucket_policy/resource.tf | 8 ++++++++ 4 files changed, 32 insertions(+) diff --git a/docs/data-sources/object_storage_bucket_policy_document.md b/docs/data-sources/object_storage_bucket_policy_document.md index aa677b30..66c4839f 100644 --- a/docs/data-sources/object_storage_bucket_policy_document.md +++ b/docs/data-sources/object_storage_bucket_policy_document.md @@ -13,6 +13,14 @@ description: |- ## Example Usage ```terraform +terraform { + required_providers { + coreweave = { + source = "coreweave/coreweave" + } + } +} + variable "bucket_name" { type = string description = "Name of the bucket to allow access to." diff --git a/docs/resources/object_storage_bucket_policy.md b/docs/resources/object_storage_bucket_policy.md index 39c50d14..c747df29 100644 --- a/docs/resources/object_storage_bucket_policy.md +++ b/docs/resources/object_storage_bucket_policy.md @@ -15,6 +15,14 @@ description: |- ```terraform ## Example using jsonencode to pass a raw JSON string to the policy attribute +terraform { + required_providers { + coreweave = { + source = "coreweave/coreweave" + } + } +} + variable "org_id" { type = string description = "CoreWeave organization ID to match in the bucket policy condition." diff --git a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf index 92163a4c..2854bb26 100644 --- a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf +++ b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf @@ -1,3 +1,11 @@ +terraform { + required_providers { + coreweave = { + source = "coreweave/coreweave" + } + } +} + variable "bucket_name" { type = string description = "Name of the bucket to allow access to." diff --git a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf index d4da27c5..0dfe5fcd 100644 --- a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf +++ b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf @@ -1,5 +1,13 @@ ## Example using jsonencode to pass a raw JSON string to the policy attribute +terraform { + required_providers { + coreweave = { + source = "coreweave/coreweave" + } + } +} + variable "org_id" { type = string description = "CoreWeave organization ID to match in the bucket policy condition." From 6af0a9306e59c77f1ab8dd3148c643d2b68253b3 Mon Sep 17 00:00:00 2001 From: Crystal Gomes Date: Fri, 31 Jul 2026 12:19:28 -0400 Subject: [PATCH 3/3] docs(object-storage): Use named principals in bucket policy examples Replace org-wide CW wildcard principals with one console user and one SAML group ARN, keeping cw:PrincipalOrgID as an extra safety measure. Co-authored-by: Cursor --- .../object_storage_bucket_policy_document.md | 5 +++-- docs/resources/object_storage_bucket_policy.md | 13 ++++++++----- .../data-source.tf | 5 +++-- .../resource.tf | 13 ++++++++----- 4 files changed, 22 insertions(+), 14 deletions(-) diff --git a/docs/data-sources/object_storage_bucket_policy_document.md b/docs/data-sources/object_storage_bucket_policy_document.md index 66c4839f..730a301d 100644 --- a/docs/data-sources/object_storage_bucket_policy_document.md +++ b/docs/data-sources/object_storage_bucket_policy_document.md @@ -34,7 +34,7 @@ variable "org_id" { data "coreweave_object_storage_bucket_policy_document" "default" { version = "2012-10-17" statement { - sid = "AllowAllInOrg" + sid = "AllowUserAndGroup" effect = "Allow" action = ["s3:*"] resource = [ @@ -42,7 +42,8 @@ data "coreweave_object_storage_bucket_policy_document" "default" { "arn:aws:s3:::${var.bucket_name}/*", ] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringEquals" : { diff --git a/docs/resources/object_storage_bucket_policy.md b/docs/resources/object_storage_bucket_policy.md index c747df29..eac5dc15 100644 --- a/docs/resources/object_storage_bucket_policy.md +++ b/docs/resources/object_storage_bucket_policy.md @@ -33,10 +33,11 @@ locals { Version = "2012-10-17" Statement = [ { - Sid = "AllowAllInOrg" + Sid = "AllowUserAndGroup" Effect = "Allow" Principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } Action = ["s3:*"] Resource = [ @@ -73,7 +74,7 @@ resource "coreweave_object_storage_bucket" "doc" { data "coreweave_object_storage_bucket_policy_document" "doc" { version = "2012-10-17" statement { - sid = "AllowAllInOrg" + sid = "AllowUserAndGroup" effect = "Allow" action = ["s3:*"] resource = [ @@ -81,7 +82,8 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*", ] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringEquals" : { @@ -96,7 +98,8 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { action = ["s3:ListBucket"] resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringNotEquals" : { diff --git a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf index 2854bb26..45b56d98 100644 --- a/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf +++ b/examples/data-sources/coreweave_object_storage_bucket_policy_document/data-source.tf @@ -19,7 +19,7 @@ variable "org_id" { data "coreweave_object_storage_bucket_policy_document" "default" { version = "2012-10-17" statement { - sid = "AllowAllInOrg" + sid = "AllowUserAndGroup" effect = "Allow" action = ["s3:*"] resource = [ @@ -27,7 +27,8 @@ data "coreweave_object_storage_bucket_policy_document" "default" { "arn:aws:s3:::${var.bucket_name}/*", ] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringEquals" : { diff --git a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf index 0dfe5fcd..06d6bf25 100644 --- a/examples/resources/coreweave_object_storage_bucket_policy/resource.tf +++ b/examples/resources/coreweave_object_storage_bucket_policy/resource.tf @@ -18,10 +18,11 @@ locals { Version = "2012-10-17" Statement = [ { - Sid = "AllowAllInOrg" + Sid = "AllowUserAndGroup" Effect = "Allow" Principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } Action = ["s3:*"] Resource = [ @@ -58,7 +59,7 @@ resource "coreweave_object_storage_bucket" "doc" { data "coreweave_object_storage_bucket_policy_document" "doc" { version = "2012-10-17" statement { - sid = "AllowAllInOrg" + sid = "AllowUserAndGroup" effect = "Allow" action = ["s3:*"] resource = [ @@ -66,7 +67,8 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { "arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}/*", ] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringEquals" : { @@ -81,7 +83,8 @@ data "coreweave_object_storage_bucket_policy_document" "doc" { action = ["s3:ListBucket"] resource = ["arn:aws:s3:::${coreweave_object_storage_bucket.doc.name}"] principal = { - "CW" : ["*"] + "CW" = ["arn:aws:iam::[ORG-ID]:coreweave/[USER-ID]"] + "AWS" = ["arn:aws:iam::[ORG-ID]:saml/[SAML-GROUP-ID]"] } condition = { "StringNotEquals" : {