blog-rekahsoft-ca/infra/templates/s3_origin_policy.json
Collin J. Doering 186d04041d
Site infrastructure and deployment now managed with terraform
Create a classic static site deployment using cloudfront with a s3 origin. Provision, verify and
utilize a ACM certificate to enable (and force) https for cloudfront.

This assumes that the build resources are available at ./_site as a null_resource is used to
sync it to the s3 origin backing cloudfront. A IAM user and policy is provisioned prior to the
null_resource execution with least privilege access to the s3 bucket.

Note: The required terraform backend resources were manually provisioned.

Signed-off-by: Collin J. Doering <collin.doering@rekahsoft.ca>
2018-07-15 03:01:18 -04:00

34 lines
629 B
JSON

{
"Version": "2008-10-17",
"Id": "StaticBucketPolicy",
"Statement": [
{
"Sid": "1",
"Effect": "Allow",
"Principal": {
"AWS": "${cloudfront_arn}"
},
"Action": "s3:GetObject",
"Resource": "${bucket_arn}/*"
},
{
"Sid": "2",
"Effect": "Allow",
"Principal": {
"AWS": "${user_arn}"
},
"Action": ["s3:ListBucket"],
"Resource": "${bucket_arn}"
},
{
"Sid": "3",
"Effect": "Allow",
"Principal": {
"AWS": "${user_arn}"
},
"Action": "s3:*",
"Resource": "${bucket_arn}/*"
}
]
}