zo/GenderDysphoria.fyi
1
0
Fork 0
mirror of https://github.com/GenderDysphoria/GenderDysphoria.fyi.git synced 2025-01-31 07:16:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixing broken cloudwatch log permissions

Browse Source
This commit is contained in:
Jocelyn Badgley (Twipped) 2021-03-02 16:20:35 -08:00
parent a73274d74c
commit 1cc9c88a3a
2 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
terraform/lambda.tf
View File

@ -33,11 +33,10 @@ EOF
# ----------------------------------------------------------------------------------------------------------- # -----------------------------------------------------------------------------------------------------------
# IAM Role for Log Parsing Lambda # IAM Role for Log Parsing Lambda
data "aws_iam_policy_document" "s3_bucket_readonly" { data "aws_iam_policy_document" "s3_bucket_access" {
statement { statement {
actions = [ actions = [
"s3:Get*", "s3:*",
"s3:List*",
] ]
resources = [ resources = [
@ -80,6 +79,7 @@ resource "aws_iam_role_policy_attachment" "ipixel_parser" {
policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
} }
resource "aws_iam_role_policy" "ipixel_parser_cloudwatch_log_group" { resource "aws_iam_role_policy" "ipixel_parser_cloudwatch_log_group" {
name = "cloudwatch-log-group" name = "cloudwatch-log-group"
role = aws_iam_role.ipixel_parser.name role = aws_iam_role.ipixel_parser.name
@ -89,5 +89,5 @@ resource "aws_iam_role_policy" "ipixel_parser_cloudwatch_log_group" {
resource "aws_iam_role_policy" "lambda_s3_bucket_readonly" { resource "aws_iam_role_policy" "lambda_s3_bucket_readonly" {
name = "s3-bucket-readonly" name = "s3-bucket-readonly"
role = aws_iam_role.ipixel_parser.name role = aws_iam_role.ipixel_parser.name
policy = data.aws_iam_policy_document.s3_bucket_readonly.json policy = data.aws_iam_policy_document.s3_bucket_access.json
} }

16
terraform/tracking.tf
View File

@ -30,9 +30,25 @@ resource "aws_s3_bucket_object" "ipixel" {
content_type = "image/gif" content_type = "image/gif"
} }
data "aws_canonical_user_id" "current" {}
resource "aws_s3_bucket" "ipixel_logs" { resource "aws_s3_bucket" "ipixel_logs" {
bucket = "${var.site}-analytics" bucket = "${var.site}-analytics"
grant {
id = data.aws_canonical_user_id.current.id
permissions = ["FULL_CONTROL"]
type = "CanonicalUser"
}
grant {
# Grant CloudFront awslogsdelivery logs access to your Amazon S3 Bucket
# https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html#AccessLogsBucketAndFileOwnership
id = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
permissions = ["FULL_CONTROL"]
type = "CanonicalUser"
}
lifecycle_rule { lifecycle_rule {
id = "logfiles" id = "logfiles"
enabled = true enabled = true