| 1 | resource "aws_s3_bucket" "logs" { |
| 2 | bucket_prefix = "fastly-logs-" |
| 3 | |
| 4 | lifecycle_rule { |
| 5 | enabled = true |
| 6 | |
| 7 | expiration { |
| 8 | days = 365 |
| 9 | } |
| 10 | } |
| 11 | |
| 12 | lifecycle_rule { |
| 13 | id = "move-to-glacier" |
| 14 | |
| 15 | enabled = true |
| 16 | |
| 17 | transition { |
| 18 | days = 120 |
| 19 | storage_class = "DEEP_ARCHIVE" |
| 20 | } |
| 21 | } |
| 22 | } |
| 23 | |
| 24 | resource "aws_s3_bucket_policy" "logs" { |
| 25 | bucket = aws_s3_bucket.logs.id |
| 26 | policy = <<EOF |
| 27 | { |
| 28 | "Version": "2008-10-17", |
| 29 | "Statement": [ |
| 30 | { |
| 31 | "Sid": "AllowNixOSOrgRead", |
| 32 | "Effect": "Allow", |
| 33 | "Principal": { |
| 34 | "AWS": "arn:aws:iam::008826681144:user/fastly-log-processor" |
| 35 | }, |
| 36 | "Action": [ |
| 37 | "s3:GetObject", |
| 38 | "s3:ListBucket" |
| 39 | ], |
| 40 | "Resource": [ |
| 41 | "arn:aws:s3:::${aws_s3_bucket.logs.id}/*", |
| 42 | "arn:aws:s3:::${aws_s3_bucket.logs.id}" |
| 43 | ] |
| 44 | } |
| 45 | ] |
| 46 | } |
| 47 | EOF |
| 48 | } |
| 49 | |
| 50 | |
| 51 | resource "aws_iam_role" "fastly_log_forwarder" { |
| 52 | name = "FastlyLogForwarder" |
| 53 | path = "/system/" |
| 54 | |
| 55 | assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json |
| 56 | } |
| 57 | |
| 58 | resource "aws_iam_policy" "policy" { |
| 59 | name_prefix = "FastlyLogForwarder" |
| 60 | path = "/system/" |
| 61 | description = "Allow Fastly to write logs to ${aws_s3_bucket.logs.bucket}." |
| 62 | |
| 63 | policy = data.aws_iam_policy_document.fastly_write.json |
| 64 | } |
| 65 | |
| 66 | resource "aws_iam_role_policy_attachment" "attachment" { |
| 67 | role = aws_iam_role.fastly_log_forwarder.name |
| 68 | policy_arn = aws_iam_policy.policy.arn |
| 69 | } |
| 70 | |
| 71 | data "aws_iam_policy_document" "assume_role_policy" { |
| 72 | statement { |
| 73 | actions = ["sts:AssumeRole"] |
| 74 | |
| 75 | condition { |
| 76 | test = "StringEquals" |
| 77 | variable = "sts:ExternalId" |
| 78 | |
| 79 | # this is our Fastly customer ID |
| 80 | values = [var.fastly_customer_id] |
| 81 | } |
| 82 | |
| 83 | principals { |
| 84 | type = "AWS" |
| 85 | |
| 86 | # This is the ID of the Fastly AWS account |
| 87 | identifiers = ["717331877981"] |
| 88 | } |
| 89 | } |
| 90 | } |
| 91 | |
| 92 | data "aws_iam_policy_document" "fastly_write" { |
| 93 | statement { |
| 94 | actions = ["s3:PutObject"] |
| 95 | resources = ["${aws_s3_bucket.logs.arn}/*"] |
| 96 | } |
| 97 | } |