#!/bin/bash

set -eo pipefail

ACCOUNT=$(aws sts get-caller-identity --query Account --output text)

read -p "username: " USERNAME
read -p "policy name: " POLICYNAME
read -p "bucket name: " BUCKETNAME
read -p "bucket region: " REGION

echo Creating bucket ${BUCKETNAME} in ${REGION}
aws s3 mb s3://${BUCKETNAME} --region ${REGION}

echo Creating user ${USERNAME}
aws iam create-user --user-name ${USERNAME}

echo Creating policy ${POLICYNAME}
aws iam create-policy --policy-name ${POLICYNAME} --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::'${BUCKETNAME}'",
                "arn:aws:s3:::'${BUCKETNAME}'/*"
            ]
        }
    ]
}'

echo Attaching policy ${POLICYNAME} to ${USERNAME}
aws iam attach-user-policy --user-name ${USERNAME} --policy-arn arn:aws:iam::${ACCOUNT}:policy/${POLICYNAME}

echo Creating access keys for ${USERNAME}
aws iam create-access-key --user-name ${USERNAME}

touch ~/.passwd-s3fs
chmod 600 ~/.passwd-s3fs
echo Save the access key ID and secret key into ~/.passwd-s3fs with a colon between them

echo You can then mount your bucket with the following command:
echo s3fs ${BUCKETNAME} /tmp/s3fs/ -o passwd_file=${HOME}/.passwd-s3fs -o url=https://s3.${REGION}.amazonaws.com/ -o dbglevel=info -o curldbg