From 2fedaa3b6778a85b36a2eb761a0fefdf1645ff92 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 15 May 2024 01:26:33 +0200 Subject: [PATCH 1/2] terraform: configure authn for fastly<->releases This happens in preparation for enabling requester pays on the S3 bucket. --- terraform/cache.tf | 6 +++--- terraform/locals.tf | 4 +++- terraform/releases.tf | 14 ++++++++++++++ terraform/{cache => }/s3-authn.vcl | 0 4 files changed, 20 insertions(+), 4 deletions(-) rename terraform/{cache => }/s3-authn.vcl (100%) diff --git a/terraform/cache.tf b/terraform/cache.tf index 26ee1d5f..088853d5 100644 --- a/terraform/cache.tf +++ b/terraform/cache.tf @@ -220,11 +220,11 @@ resource "fastly_service_vcl" "cache" { name = "Authenticate S3 requests" type = "miss" priority = 100 - content = templatefile("${path.module}/cache/s3-authn.vcl", { + content = templatefile("${path.module}/s3-authn.vcl", { aws_region = aws_s3_bucket.cache.region backend_domain = aws_s3_bucket.cache.bucket_domain_name - access_key = local.cache-iam.key - secret_key = local.cache-iam.secret + access_key = local.fastly-iam.key + secret_key = local.fastly-iam.secret }) } diff --git a/terraform/locals.tf b/terraform/locals.tf index d8ba43a4..90ac5d2e 100644 --- a/terraform/locals.tf +++ b/terraform/locals.tf @@ -4,7 +4,9 @@ locals { # TLS v1.2, protocols HTTP/1.1 and HTTP/2 fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA" - cache-iam = data.terraform_remote_state.terraform-iam.outputs.cache + # Used for authenticating fastly against S3 buckets + fastly-iam = data.terraform_remote_state.terraform-iam.outputs.cache + fastlylogs = data.terraform_remote_state.terraform-iam.outputs.fastlylogs # fastlylogs = { diff --git a/terraform/releases.tf b/terraform/releases.tf index fa780251..f11d5bf4 100644 --- a/terraform/releases.tf +++ b/terraform/releases.tf @@ -181,6 +181,20 @@ resource "fastly_service_vcl" "releases" { status = 404 } + # Authenticate Fastly<->S3 requests. See Fastly documentation: + # https://docs.fastly.com/en/guides/amazon-s3#using-an-amazon-s3-private-bucket + snippet { + name = "Authenticate S3 requests" + type = "miss" + priority = 100 + content = templatefile("${path.module}/s3-authn.vcl", { + aws_region = aws_s3_bucket.releases.region + backend_domain = aws_s3_bucket.releases.bucket_domain_name + access_key = local.fastly-iam.key + secret_key = local.fastly-iam.secret + }) + } + snippet { content = "set req.url = querystring.remove(req.url);" name = "Remove all query strings" diff --git a/terraform/cache/s3-authn.vcl b/terraform/s3-authn.vcl similarity index 100% rename from terraform/cache/s3-authn.vcl rename to terraform/s3-authn.vcl From 2102f822570202658de76345884753d740e3df64 Mon Sep 17 00:00:00 2001 From: zimbatm Date: Thu, 16 May 2024 12:01:42 +0200 Subject: [PATCH 2/2] switch to using the regional domain name --- terraform/releases.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/terraform/releases.tf b/terraform/releases.tf index f11d5bf4..3c31edf2 100644 --- a/terraform/releases.tf +++ b/terraform/releases.tf @@ -189,7 +189,7 @@ resource "fastly_service_vcl" "releases" { priority = 100 content = templatefile("${path.module}/s3-authn.vcl", { aws_region = aws_s3_bucket.releases.region - backend_domain = aws_s3_bucket.releases.bucket_domain_name + backend_domain = aws_s3_bucket.releases.bucket_regional_domain_name access_key = local.fastly-iam.key secret_key = local.fastly-iam.secret })