Split Shared API Costs Across Teams Using Usage Metrics

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
    costory = {
      source  = "costory-io/costory"
      version = ">= 0.1.0"
    }
  }
}

variable "costory_token" {
  type        = string
  description = "Costory API token."
  sensitive   = true
}

variable "s3_name" {
  type        = string
  description = "Base name for the S3 bucket."
  default     = "costory-allocation-data"
}

provider "aws" {
}

provider "costory" {
  token = var.costory_token
}

data "aws_caller_identity" "current" {}
data "costory_service_account" "current" {}

locals {
  account_id  = data.aws_caller_identity.current.account_id
  bucket_name = "${var.s3_name}-${local.account_id}"
}

# --- S3 bucket ---

resource "aws_s3_bucket" "allocation" {
  bucket = local.bucket_name
}

resource "aws_s3_bucket_public_access_block" "allocation" {
  bucket = aws_s3_bucket.allocation.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# --- IAM policy: allow read on the bucket ---

data "aws_iam_policy_document" "read_s3" {
  statement {
    sid    = "AllowReadAllocation"
    effect = "Allow"

    actions = [
      "s3:ListBucket",
      "s3:GetObject",
    ]

    resources = [
      aws_s3_bucket.allocation.arn,
      "${aws_s3_bucket.allocation.arn}/*",
    ]
  }
}

resource "aws_iam_policy" "read_s3" {
  name        = "costory-read-s3-${var.s3_name}"
  description = "Allows Costory to read the allocation S3 bucket."
  policy      = data.aws_iam_policy_document.read_s3.json
}

data "aws_iam_policy_document" "federated_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]

    principals {
      type        = "Federated"
      identifiers = ["accounts.google.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "accounts.google.com:sub"
      values   = data.costory_service_account.current.sub_ids
    }
  }
}

resource "aws_iam_role" "federated" {
  name               = "costory-trust-link-${var.s3_name}"
  assume_role_policy = data.aws_iam_policy_document.federated_assume.json
}

resource "aws_iam_role_policy_attachment" "read_s3" {
  role       = aws_iam_role.federated.name
  policy_arn = aws_iam_policy.read_s3.arn
}