terraform: configure authn for fastly<->releases

This happens in preparation for enabling requester pays on the S3 bucket.
NixOS · May 15, 2024 · 2fedaa3 · 2fedaa3
1 parent 6d666f0
commit 2fedaa3
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 4 deletions.
diff --git a/terraform/cache.tf b/terraform/cache.tf
@@ -220,11 +220,11 @@ resource "fastly_service_vcl" "cache" {
     name     = "Authenticate S3 requests"
     type     = "miss"
     priority = 100
-    content = templatefile("${path.module}/cache/s3-authn.vcl", {
+    content = templatefile("${path.module}/s3-authn.vcl", {
       aws_region     = aws_s3_bucket.cache.region
       backend_domain = aws_s3_bucket.cache.bucket_domain_name
-      access_key     = local.cache-iam.key
-      secret_key     = local.cache-iam.secret
+      access_key     = local.fastly-iam.key
+      secret_key     = local.fastly-iam.secret
     })
   }
 

diff --git a/terraform/locals.tf b/terraform/locals.tf
@@ -4,7 +4,9 @@ locals {
   # TLS v1.2, protocols HTTP/1.1 and HTTP/2
   fastly_tls12_sni_configuration_id = "5PXBTa6c01Xoh54ylNwmVA"
 
-  cache-iam  = data.terraform_remote_state.terraform-iam.outputs.cache
+  # Used for authenticating fastly against S3 buckets
+  fastly-iam = data.terraform_remote_state.terraform-iam.outputs.cache
+
   fastlylogs = data.terraform_remote_state.terraform-iam.outputs.fastlylogs
 
   # fastlylogs = {

diff --git a/terraform/releases.tf b/terraform/releases.tf
@@ -181,6 +181,20 @@ resource "fastly_service_vcl" "releases" {
     status          = 404
   }
 
+  # Authenticate Fastly<->S3 requests. See Fastly documentation:
+  # https://docs.fastly.com/en/guides/amazon-s3#using-an-amazon-s3-private-bucket
+  snippet {
+    name     = "Authenticate S3 requests"
+    type     = "miss"
+    priority = 100
+    content = templatefile("${path.module}/s3-authn.vcl", {
+      aws_region     = aws_s3_bucket.releases.region
+      backend_domain = aws_s3_bucket.releases.bucket_domain_name
+      access_key     = local.fastly-iam.key
+      secret_key     = local.fastly-iam.secret
+    })
+  }
+
   snippet {
     content  = "set req.url = querystring.remove(req.url);"
     name     = "Remove all query strings"

diff --git a/terraform/cache/s3-authn.vcl → terraform/s3-authn.vcl b/terraform/cache/s3-authn.vcl → terraform/s3-authn.vcl