From d7d6154bd43bcd1d13673f194bce0a44189a4089 Mon Sep 17 00:00:00 2001
From: vinay <vg@ivdata.dev>
Date: Sat, 4 Apr 2026 22:03:31 -0400
Subject: [PATCH] Add personas-iam-user.yaml

CloudFormation template
---
 personas-iam-user.yaml | 77 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 personas-iam-user.yaml

diff --git a/personas-iam-user.yaml b/personas-iam-user.yaml
new file mode 100644
index 0000000..64b0279
--- /dev/null
+++ b/personas-iam-user.yaml
@@ -0,0 +1,77 @@
+AWSTemplateFormatVersion: '2010-09-09'
+  Description: >
+    persoNAS — IAM user with scoped S3 access for mapped-drive style use.
+  Parameters:
+    UserName:
+      Type: String
+      Default: personas-storage-user
+      Description: IAM user name for S3 access
+      AllowedPattern: '[a-zA-Z0-9_+=,.@-]+'
+  Resources:
+    PersoNASUser:
+      Type: AWS::IAM::User
+      Properties:
+        UserName: !Ref UserName
+        Tags:
+          - Key: Purpose
+            Value: persoNAS-storage-integration
+          - Key: ManagedBy
+            Value: CloudFormation
+    PersoNASUserPolicy:
+      Type: AWS::IAM::Policy
+      Properties:
+        PolicyName: !Sub '${UserName}-persoNAS-s3-scoped'
+        Users:
+          - !Ref PersoNASUser
+        PolicyDocument:
+          Version: '2012-10-17'
+          Statement:
+            - Sid: ListAccountBuckets
+              Effect: Allow
+              Action:
+                - s3:ListAllMyBuckets
+                - s3:GetBucketLocation
+              Resource: '*'
+            - Sid: BucketMetadata
+              Effect: Allow
+              Action:
+                - s3:ListBucket
+                - s3:ListBucketVersions
+                - s3:ListBucketMultipartUploads
+                - s3:GetBucketVersioning
+                - s3:PutBucketVersioning
+              Resource: 'arn:aws:s3:::*'
+            - Sid: ObjectReadWrite
+              Effect: Allow
+              Action:
+                - s3:GetObject
+                - s3:PutObject
+                - s3:DeleteObject
+                - s3:AbortMultipartUpload
+                - s3:ListMultipartUploadParts
+                - s3:GetObjectVersion
+                - s3:DeleteObjectVersion
+              Resource: 'arn:aws:s3:::*/*'
+            - Sid: CreateBucket
+              Effect: Allow
+              Action:
+                - s3:CreateBucket
+              Resource: 'arn:aws:s3:::*'
+    PersoNASAccessKey:
+      Type: AWS::IAM::AccessKey
+      Properties:
+        UserName: !Ref PersoNASUser
+      DependsOn: PersoNASUser
+  Outputs:
+    UserName:
+      Description: IAM user name
+      Value: !Ref PersoNASUser
+    AccessKeyId:
+      Description: Access Key ID — copy into persoNAS
+      Value: !Ref PersoNASAccessKey
+    SecretAccessKey:
+      Description: Secret Access Key — copy once into persoNAS
+      Value: !GetAtt PersoNASAccessKey.SecretAccessKey
+    DeepLinkExample:
+      Description: Example deep link pattern (replace placeholders; treat as secret)
+      Value: !Sub 'personas://connect?provider=aws&accessKeyId=${PersoNASAccessKey}&secretAccessKey=${PersoNASAccessKey.SecretAccessKey}&region=${AWS::Region}'
\ No newline at end of file