start setting up a place to log bucket access
Graham Christensen committed
Jun 22, 2022 at 16:42 UTC
96ed6d56c1c291eefd94feec2ac3873a0629a4ea
4 files changed
+71
terraform/fastlylog/main.tf
new
+61
@@ -0,0 +1,61 @@
1
+
2
+
3
+resource "aws_s3_bucket" "logs" {
4
+ bucket_prefix = "fastly-logs"
5
+
6
+ lifecycle_rule {
7
+ enabled = true
8
+
9
+ expiration {
10
+ days = 365
11
+ }
12
+ }
13
+}
14
+
15
+resource "aws_iam_role" "fastly_log_forwarder" {
16
+ name = "FastlyLogForwarder"
17
+ path = "/system/"
18
+
19
+ assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
20
+}
21
+
22
+resource "aws_iam_policy" "policy" {
23
+ name_prefix = "FastlyLogForwarder"
24
+ path = "/system"
25
+ description = "Allow Fastly to write logs to ${aws_s3_bucket.logs.bucket}."
26
+
27
+ policy = data.aws_iam_policy_document.fastly_write.json
28
+}
29
+
30
+resource "aws_iam_role_policy_attachment" "attachment" {
31
+ role = aws_iam_role.fastly_log_forwarder.name
32
+ policy_arn = aws_iam_policy.policy.arn
33
+}
34
+
35
+data "aws_iam_policy_document" "assume_role_policy" {
36
+ statement {
37
+ actions = ["sts:AssumeRole"]
38
+
39
+ condition {
40
+ test = "StringEquals"
41
+ variable = "sts:ExternalId"
42
+
43
+ # this is our Fastly customer ID
44
+ values = [var.fastly_customer_id]
45
+ }
46
+
47
+ principals {
48
+ type = "AWS"
49
+
50
+ # This is the ID of the Fastly AWS account
51
+ identifiers = ["717331877981"]
52
+ }
53
+ }
54
+}
55
+
56
+data "aws_iam_policy_document" "fastly_write" {
57
+ statement {
58
+ actions = ["s3:PutObject"]
59
+ resources = ["${aws_s3_bucket.logs.arn}/*"]
60
+ }
61
+}
terraform/fastlylog/variables.tf
new
+3
@@ -0,0 +1,3 @@
1
+variable "fastly_customer_id" {
2
+ type = string
3
+}
terraform/locals.tf
+2
@@ -1,4 +1,6 @@
1
locals {
2
+ fastly_customer_id = "1RhOVUmKLBjCFTU4i9Cekx"
3
+
4
# TLS v1.2, protocols HTTP/1.1 and HTTP/2
5
fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
6
terraform/terraform.tf
+5
@@ -21,3 +21,8 @@ terraform {
21
}
22
}
23
}
24
+
25
+module "fastlylogs" {
26
+ source = "./fastlylog"
27
+ fastly_customer_id = local.fastly_customer_id
28
+}
\ No newline at end of file