Collin J. Doering
186d04041d
Create a classic static site deployment using cloudfront with a s3 origin. Provision, verify and utilize a ACM certificate to enable (and force) https for cloudfront. This assumes that the build resources are available at ./_site as a null_resource is used to sync it to the s3 origin backing cloudfront. A IAM user and policy is provisioned prior to the null_resource execution with least privilege access to the s3 bucket. Note: The required terraform backend resources were manually provisioned. Signed-off-by: Collin J. Doering <collin.doering@rekahsoft.ca>
34 lines
629 B
JSON
34 lines
629 B
JSON
{
|
|
"Version": "2008-10-17",
|
|
"Id": "StaticBucketPolicy",
|
|
"Statement": [
|
|
{
|
|
"Sid": "1",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "${cloudfront_arn}"
|
|
},
|
|
"Action": "s3:GetObject",
|
|
"Resource": "${bucket_arn}/*"
|
|
},
|
|
{
|
|
"Sid": "2",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "${user_arn}"
|
|
},
|
|
"Action": ["s3:ListBucket"],
|
|
"Resource": "${bucket_arn}"
|
|
},
|
|
{
|
|
"Sid": "3",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"AWS": "${user_arn}"
|
|
},
|
|
"Action": "s3:*",
|
|
"Resource": "${bucket_arn}/*"
|
|
}
|
|
]
|
|
}
|