Fix bucket name in policy statements, fixing #81

main.tf

@@ -1,3 +1,20 @@
+locals {
+  enabled = module.this.enabled
+  # We do not use coalesce() here because it is OK if local.bucket_name is empty.
+  bucket_name = var.bucket_name == null || var.bucket_name == "" ? module.bucket_name.id : var.bucket_name
+}
+
+module "bucket_name" {
+  source  = "cloudposse/label/null"
+  version = "0.25.0"
+
+  enabled = local.enabled && try(length(var.bucket_name) == 0, false)
+
+  id_length_limit = 63 # https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
+
+  context = module.this.context
+}
+
 data "aws_elb_service_account" "default" {
   count = module.this.enabled ? 1 : 0
 }
@@ -16,7 +33,7 @@ data "aws_iam_policy_document" "default" {
       "s3:PutObject"
     ]
     resources = [
-      "arn:${data.aws_partition.current.partition}:s3:::${module.this.id}/*",
+      "arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}/*",
     ]
   }
 
@@ -31,7 +48,7 @@ data "aws_iam_policy_document" "default" {
       "s3:PutObject"
     ]
     resources = [
-      "arn:${data.aws_partition.current.partition}:s3:::${module.this.id}/*",
+      "arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}/*",
     ]
     condition {
       test     = "StringEquals"
@@ -51,7 +68,7 @@ data "aws_iam_policy_document" "default" {
       "s3:GetBucketAcl"
     ]
     resources = [
-      "arn:${data.aws_partition.current.partition}:s3:::${module.this.id}",
+      "arn:${data.aws_partition.current.partition}:s3:::${local.bucket_name}",
     ]
   }
 }