terraform: add s3://nix-cache access log
The logs will be useful to better understand the access patters, and compare notes with the Fastly logs.
zimbatm committed
Nov 4, 2023 at 14:54 UTC
a805ea48f6bfa864faf53832c28f7efe75f19279
1 file changed
+88
terraform/cache_log.tf
new
+88
@@ -0,0 +1,88 @@
1
+resource "aws_s3_bucket" "cache_log" {
2
+ provider = aws.us
3
+
4
+ bucket = "nix-cache-log"
5
+}
6
+
7
+resource "aws_s3_bucket_logging" "cache_log" {
8
+ provider = aws.us
9
+
10
+ bucket = aws_s3_bucket.cache.id
11
+
12
+ target_bucket = aws_s3_bucket.cache_log.id
13
+ target_prefix = "log/"
14
+}
15
+
16
+resource "aws_s3_bucket_lifecycle_configuration" "cache_log" {
17
+ provider = aws.us
18
+
19
+ bucket = aws_s3_bucket.cache_log.id
20
+
21
+ rule {
22
+ id = "rule-1"
23
+ status = "Enabled"
24
+
25
+ transition {
26
+ days = 30
27
+ storage_class = "ONEZONE_IA"
28
+ }
29
+
30
+ expiration {
31
+ days = "120"
32
+ }
33
+ }
34
+}
35
+
36
+data "aws_iam_policy_document" "cache_log" {
37
+ statement {
38
+ sid = "AWSLogDeliveryWrite"
39
+
40
+ principals {
41
+ type = "Service"
42
+ identifiers = ["delivery.logs.amazonaws.com"]
43
+ }
44
+
45
+ effect = "Allow"
46
+
47
+ actions = [
48
+ "s3:PutObject",
49
+ ]
50
+
51
+ resources = [
52
+ "${aws_s3_bucket.cache_log.arn}/*",
53
+ ]
54
+
55
+ condition {
56
+ test = "StringEquals"
57
+ variable = "s3:x-amz-acl"
58
+ values = ["bucket-owner-full-control"]
59
+ }
60
+ }
61
+
62
+ statement {
63
+ sid = "AWSLogDeliveryAclCheck"
64
+
65
+ effect = "Allow"
66
+
67
+ principals {
68
+ type = "Service"
69
+ identifiers = ["delivery.logs.amazonaws.com"]
70
+ }
71
+
72
+ actions = [
73
+ "s3:GetBucketAcl",
74
+ ]
75
+
76
+ resources = [
77
+ aws_s3_bucket.cache_log.arn,
78
+ ]
79
+
80
+ }
81
+}
82
+
83
+resource "aws_s3_bucket_policy" "cache_log" {
84
+ provider = aws.us
85
+
86
+ bucket = aws_s3_bucket.cache_log.id
87
+ policy = data.aws_iam_policy_document.cache_log.json
88
+}