Skip to content

Commit 630c248

Browse files
Stretch96Stretch96
committed
Configure single s3 bucket for logs
* Cloudfront logs go into '/cloudfront/*' * S3 logs go into '/s3/*' * Reduces the amount of s3 buckets required
1 parent 1af20bc commit 630c248

File tree

8 files changed

+75
-233
lines changed

8 files changed

+75
-233
lines changed

‎README.md‎

Lines changed: 9 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -29,48 +29,29 @@ Terraform module to host a static site generated by Publii
2929
| [aws_iam_policy.publii_s3_frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
3030
| [aws_iam_user.publii_s3_frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource |
3131
| [aws_iam_user_policy_attachment.publii_s3_frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy_attachment) | resource |
32-
| [aws_kms_key.s3_bucket_cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
33-
| [aws_kms_key.s3_bucket_cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
32+
| [aws_kms_key.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
3433
| [aws_kms_key.s3_bucket_frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
35-
| [aws_kms_key.s3_bucket_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
36-
| [aws_s3_bucket.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
37-
| [aws_s3_bucket.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
3834
| [aws_s3_bucket.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
39-
| [aws_s3_bucket.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
40-
| [aws_s3_bucket_acl.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
41-
| [aws_s3_bucket_acl.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
35+
| [aws_s3_bucket.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
4236
| [aws_s3_bucket_acl.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
43-
| [aws_s3_bucket_acl.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
44-
| [aws_s3_bucket_logging.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
37+
| [aws_s3_bucket_acl.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
4538
| [aws_s3_bucket_logging.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
46-
| [aws_s3_bucket_policy.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
47-
| [aws_s3_bucket_policy.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
4839
| [aws_s3_bucket_policy.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
49-
| [aws_s3_bucket_policy.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
50-
| [aws_s3_bucket_public_access_block.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
51-
| [aws_s3_bucket_public_access_block.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
40+
| [aws_s3_bucket_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
5241
| [aws_s3_bucket_public_access_block.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
53-
| [aws_s3_bucket_public_access_block.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
54-
| [aws_s3_bucket_server_side_encryption_configuration.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
55-
| [aws_s3_bucket_server_side_encryption_configuration.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
42+
| [aws_s3_bucket_public_access_block.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource |
5643
| [aws_s3_bucket_server_side_encryption_configuration.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
57-
| [aws_s3_bucket_server_side_encryption_configuration.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
58-
| [aws_s3_bucket_versioning.cloudfront_frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
59-
| [aws_s3_bucket_versioning.cloudfront_frontend_logging_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
44+
| [aws_s3_bucket_server_side_encryption_configuration.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
6045
| [aws_s3_bucket_versioning.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
61-
| [aws_s3_bucket_versioning.frontend_logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
46+
| [aws_s3_bucket_versioning.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource |
6247
| [aws_s3_bucket_website_configuration.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_website_configuration) | resource |
6348
| [aws_wafv2_web_acl.cloudfront_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource |
6449
| [random_id.project](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
65-
| [template_file.cloudfront_frontend_logging_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
66-
| [template_file.cloudfront_frontend_logging_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
67-
| [template_file.cloudfront_frontend_logging_logging_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
68-
| [template_file.cloudfront_frontend_logging_logging_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
6950
| [template_file.frontend_bucket_cloudfront_read](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7051
| [template_file.frontend_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7152
| [template_file.frontend_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
72-
| [template_file.frontend_logging_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
73-
| [template_file.frontend_logging_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
53+
| [template_file.logs_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
54+
| [template_file.logs_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7455
| [template_file.publii_s3_frontend_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7556

7657
## Inputs

‎cloudfront-frontend-logging-logging.tf‎

Lines changed: 0 additions & 61 deletions
This file was deleted.

‎cloudfront-frontend-logging.tf‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎cloudfront-frontend.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ resource "aws_cloudfront_distribution" "frontend" {
7272

7373
logging_config {
7474
include_cookies = false
75-
bucket = aws_s3_bucket.cloudfront_frontend_logging.bucket_domain_name
76-
prefix = "log/"
75+
bucket = aws_s3_bucket.logs.bucket_domain_name
76+
prefix = "cloudfront/frontend/"
7777
}
7878
}

‎kms.tf‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,8 @@ resource "aws_kms_key" "s3_bucket_frontend" {
44
enable_key_rotation = true
55
}
66

7-
resource "aws_kms_key" "s3_bucket_frontend_logging" {
8-
description = "This key is used to encrypt bucket objects within ${aws_s3_bucket.frontend_logging.id}"
9-
deletion_window_in_days = 10
10-
enable_key_rotation = true
11-
}
12-
13-
resource "aws_kms_key" "s3_bucket_cloudfront_frontend_logging" {
14-
description = "This key is used to encrypt bucket objects within ${aws_s3_bucket.cloudfront_frontend_logging.id}"
15-
deletion_window_in_days = 10
16-
enable_key_rotation = true
17-
}
18-
19-
resource "aws_kms_key" "s3_bucket_cloudfront_frontend_logging_logging" {
20-
description = "This key is used to encrypt bucket objects within ${aws_s3_bucket.cloudfront_frontend_logging_logging.id}"
7+
resource "aws_kms_key" "logs" {
8+
description = "This key is used to encrypt bucket objects within ${aws_s3_bucket.logs.id}"
219
deletion_window_in_days = 10
2210
enable_key_rotation = true
2311
}

‎s3-frontend-logging.tf‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎s3-frontend.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ resource "aws_s3_bucket_versioning" "frontend" {
3535

3636
resource "aws_s3_bucket_logging" "frontend" {
3737
bucket = aws_s3_bucket.frontend.id
38-
target_bucket = aws_s3_bucket.frontend_logging.id
39-
target_prefix = "log/"
38+
target_bucket = aws_s3_bucket.logs.id
39+
target_prefix = "s3/frontend/"
4040
}
4141

4242
resource "aws_s3_bucket_acl" "frontend" {

‎s3-logs.tf‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
resource "aws_s3_bucket" "logs" {
2+
bucket = "${local.project_name}-logs"
3+
force_destroy = false
4+
}
5+
6+
resource "aws_s3_bucket_versioning" "logs" {
7+
bucket = aws_s3_bucket.logs.id
8+
versioning_configuration {
9+
status = "Enabled"
10+
}
11+
}
12+
13+
resource "aws_s3_bucket_acl" "logs" {
14+
bucket = aws_s3_bucket.logs.id
15+
acl = "log-delivery-write"
16+
}
17+
18+
resource "aws_s3_bucket_public_access_block" "logs" {
19+
bucket = aws_s3_bucket.logs.id
20+
block_public_acls = true
21+
block_public_policy = true
22+
ignore_public_acls = true
23+
restrict_public_buckets = true
24+
}
25+
26+
resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
27+
bucket = aws_s3_bucket.logs.bucket
28+
29+
rule {
30+
apply_server_side_encryption_by_default {
31+
kms_master_key_id = aws_kms_key.logs.arn
32+
sse_algorithm = "aws:kms"
33+
}
34+
}
35+
}
36+
37+
data "template_file" "logs_bucket_enforce_tls_statement" {
38+
template = file("${path.module}/policies/s3-bucket-policy-statements/enforce-tls.json.tpl")
39+
40+
vars = {
41+
bucket_arn = aws_s3_bucket.logs.arn
42+
}
43+
}
44+
45+
data "template_file" "logs_bucket_policy" {
46+
template = file("${path.module}/policies/s3-bucket-policy.json.tpl")
47+
48+
vars = {
49+
statement = <<EOT
50+
[
51+
${data.template_file.logs_bucket_enforce_tls_statement.rendered}
52+
]
53+
EOT
54+
}
55+
}
56+
57+
resource "aws_s3_bucket_policy" "logs" {
58+
bucket = aws_s3_bucket.logs.id
59+
policy = data.template_file.logs_bucket_policy.rendered
60+
}

0 commit comments

Comments
 (0)