title: Configure AWS S3 bucket for Django static files with Terraform
body: <p>I'm new to Terraform.</p>
  
  <p>I'm trying to configure S3 bucket to serve Django static files.<br>
  There should be unrestricted access for HTTP GET requests for these static files but there should also be AWS user - this user account will be used by Django to upload updated static files to S3 bucket.</p>
  
  <p>I've written this:</p>
  
  <pre><code>resource "aws_iam_user" "integrations_lite_staticfiles_s3_bucket_user" {
    name = "Integrations-Lite-staticfiles-user"
  }
  
  resource "aws_iam_access_key" "integrations_lite_staticfiles_s3_bucket_user_key" {
    user = "${aws_iam_user.integrations_lite_staticfiles_s3_bucket_user.name}"
  }
  
  data "aws_iam_policy_document" "integrations_lite_staticfiles_s3_user_policy" {
    statement {
      effect = "Allow"
      actions = ["s3:*"]
      resources = ["${aws_s3_bucket.integrations_lite_staticfiles_s3_bucket.arn}"]
    }
  }
  
  resource "aws_iam_user_policy" "integrations_lite_staticfiles_s3_user_policy" {
    name = "Integrations-Lite-staticfiles-user-policy"
    user = "${aws_iam_user.integrations_lite_staticfiles_s3_bucket_user.name}"
    policy = "${data.aws_iam_policy_document.integrations_lite_staticfiles_s3_user_policy.json}"
  }
  
  data "aws_iam_policy_document" "integrations_lite_staticfiles_s3_bucket_policy" {
    "statement" {
      sid = "PublicReadForGetBucketObjects"
      effect = "Allow"
      actions = ["s3:GetObject"]
      resources = ["${aws_s3_bucket.integrations_lite_staticfiles_s3_bucket.arn}"]
      principals {
        identifiers = ["*"]
        type = "AWS"
      }
    }
  }
  
  resource "aws_s3_bucket_policy" "integrations_lite_staticfiles_s3_bucket_policy" {
    bucket = "${aws_s3_bucket.integrations_lite_staticfiles_s3_bucket.id}"
    policy = "${data.aws_iam_policy_document.integrations_lite_staticfiles_s3_user_policy.json}"
  }
  
  resource "aws_s3_bucket" "integrations_lite_staticfiles_s3_bucket" {
    region = "${var.region}"
    bucket = "integrations-lite-staticfiles"
    acl = "public-read"
    cors_rule {
      allowed_headers = ["*"]
      allowed_methods = ["PUT","POST"]
      allowed_origins = ["*"]
      expose_headers = ["ETag"]
      max_age_seconds = 3000
    }
    website {
      index_document = "index.html"
    }
  }
  </code></pre>
  
  <p>but <code>terraform apply</code> results in:  </p>
  
  <pre><code>* aws_s3_bucket_policy.integrations_lite_staticfiles_s3_bucket_policy: 1 error(s) occurred:
  
  * aws_s3_bucket_policy.integrations_lite_staticfiles_s3_bucket_policy: Error putting S3 policy: MalformedPolicy: Missing required field Principal
      status code: 400, request id: 724BC650DFFCE3B7, host id: ####
  </code></pre>
  
  <p>However adding <code>principals</code>  to <code>aws_s3_bucket_policy.integrations_lite_staticfiles_s3_bucket_policy</code> results in:</p>
  
  <pre><code>Error: aws_s3_bucket_policy.integrations_lite_staticfiles_s3_bucket_policy: : invalid or unknown key: principals
  </code></pre>