feat(aws): add Orthodox Channel public S3 website origin

README.md

@@ -39,6 +39,7 @@ No modules.
 | [aws_iam_role_policy.github_actions_channel_project_site_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.github_actions_channel_project_site_public_origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_sops_kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_twilio_state](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |

aws-channel-project-site-public-origin.tf

@@ -0,0 +1,32 @@
+# The public Orthodox Channel website origin follows the existing
+# makeitwork.cloud S3 website class. It is intentionally separate from the
+# private OAC-protected artifact bucket, which remains the rollback origin.
+# Publication remains limited to channel-project's main-only deployment role.
+resource "aws_iam_role_policy" "github_actions_channel_project_site_public_origin" {
+  name = "channel-project-site-public-origin"
+  role = aws_iam_role.github_actions_channel_project_site_deploy.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid      = "ListPublicSiteOrigin"
+        Effect   = "Allow"
+        Action   = ["s3:ListBucket"]
+        Resource = aws_s3_bucket.web["orthodox.channel"].arn
+      },
+      {
+        Sid    = "PublishPublicSiteAssets"
+        Effect = "Allow"
+        Action = [
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject",
+          "s3:GetObject",
+          "s3:ListMultipartUploadParts",
+          "s3:PutObject",
+        ]
+        Resource = "${aws_s3_bucket.web["orthodox.channel"].arn}/*"
+      },
+    ]
+  })
+}

main.tf

@@ -28,6 +28,7 @@ locals {
   s3_public_buckets = toset([])
   s3_web_buckets = toset([
     "makeitwork.cloud",
-    "onion.makeitwork.cloud"
+    "onion.makeitwork.cloud",
+    "orthodox.channel",
   ])
 }