Corrected TF file

data-proc-nat-gateway.tf

@@ -54,15 +54,15 @@ resource "yandex_vpc_security_group" "data-proc-security-group" {
   }
 
   ingress {
-    description       = "Allow any traffic within the security group"
+    description       = "Allow any incoming traffic within the security group"
     protocol          = "ANY"
     from_port         = 0
     to_port           = 65535
     predefined_target = "self_security_group"
   }
 
   egress {
-    description       = "Allow any traffic within the security group"
+    description       = "Allow any outgoing traffic within the security group"
     protocol          = "ANY"
     from_port         = 0
     to_port           = 65535
@@ -77,17 +77,23 @@ resource "yandex_vpc_security_group" "data-proc-security-group" {
   }
 }
 
-# Create a service account
+# Create a service account for Data Processing cluster
 resource "yandex_iam_service_account" "dataproc-sa" {
   folder_id = local.folder_id
   name      = "data-proc-sa"
 }
 
+# Create a service account for S3 Bucket
+resource "yandex_iam_service_account" "bucket-sa" {
+  folder_id = local.folder_id
+  name      = "bucket-sa"
+}
+
 # Grant permissions to the service account
-resource "yandex_resourcemanager_folder_iam_member" "sa-editor" {
+resource "yandex_resourcemanager_folder_iam_member" "sa-admin" {
   folder_id = local.folder_id
-  role      = "storage.editor"
-  member    = "serviceAccount:${yandex_iam_service_account.dataproc-sa.id}"
+  role      = "storage.admin"
+  member    = "serviceAccount:${yandex_iam_service_account.bucket-sa.id}"
 }
 
 resource "yandex_resourcemanager_folder_iam_member" "dataproc-sa-role-dataproc-agent" {
@@ -104,11 +110,21 @@ resource "yandex_resourcemanager_folder_iam_member" "dataproc-sa-role-dataproc-p
 
 resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
   description        = "Static access key for Object Storage"
-  service_account_id = yandex_iam_service_account.dataproc-sa.id
+  service_account_id = yandex_iam_service_account.bucket-sa.id
 }
 
 # Use keys to create a bucket
 resource "yandex_storage_bucket" "obj-storage-bucket" {
+  depends_on = [
+    yandex_resourcemanager_folder_iam_member.sa-admin
+  ]
+
+  grant {
+    id          = yandex_iam_service_account.dataproc-sa.id
+    type        = "CanonicalUser"
+    permissions = ["READ","WRITE"]
+  }
+
   access_key = yandex_iam_service_account_static_access_key.sa-static-key.access_key
   secret_key = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
   bucket     = local.bucket
@@ -125,11 +141,16 @@ resource "yandex_dataproc_cluster" "dataproc-cluster" {
     yandex_vpc_security_group.data-proc-security-group.id
   ]
 
+  depends_on = [
+    yandex_resourcemanager_folder_iam_member.dataproc-sa-role-dataproc-provisioner,
+    yandex_resourcemanager_folder_iam_member.dataproc-sa-role-dataproc-agent
+  ]
+
   cluster_config {
     hadoop {
       services = ["HDFS", "YARN", "SPARK", "TEZ", "MAPREDUCE", "HIVE"]
       ssh_public_keys = [
-        file(local.path_to_ssh_public_key)
+        "${file(local.path_to_ssh_public_key)}"
       ]
     }