restrict direct access to the website S3 bucket

Author: chgasparoto

03-site-estatico/terraform/cloudfront.tf

@@ -1,4 +1,4 @@
-resource "aws_cloudfront_origin_access_identity" "origin_access_identity" {
+resource "aws_cloudfront_origin_access_identity" "this" {
   comment = local.domain
 }
 
@@ -38,7 +38,7 @@ resource "aws_cloudfront_distribution" "this" {
     origin_id   = local.regional_domain
 
     s3_origin_config {
-      origin_access_identity = aws_cloudfront_origin_access_identity.origin_access_identity.cloudfront_access_identity_path
+      origin_access_identity = aws_cloudfront_origin_access_identity.this.cloudfront_access_identity_path
     }
   }
 

03-site-estatico/terraform/policy.json

@@ -5,7 +5,7 @@
       "Sid": "PublicReadForGetBucketObjects",
       "Effect": "Allow",
       "Principal": {
-        "AWS": "*"
+        "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity ${cdn_oai}"
       },
       "Action": "s3:GetObject",
       "Resource": "arn:aws:s3:::${bucket_name}/*"

03-site-estatico/terraform/s3.tf

@@ -1,6 +1,9 @@
 data "template_file" "s3-public-policy" {
   template = file("policy.json")
-  vars     = { bucket_name = local.domain }
+  vars = {
+    bucket_name = local.domain
+    cdn_oai     = aws_cloudfront_origin_access_identity.this.id
+  }
 }
 
 module "logs" {