Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CDN for archived data in S3 #1264

Merged
merged 10 commits into from
Feb 1, 2023
Merged

Add CDN for archived data in S3 #1264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
1611408
Add CloudFront for accessing archived data in S3
Mr0grog Jan 30, 2023
a88fb20
Fix access identity (bad commit)
Mr0grog Jan 31, 2023
2d68f14
Try the Cloudposse module for S3+CloudFront
Mr0grog Jan 31, 2023
574f35e
More minimal settings for Cloudposse
Mr0grog Jan 31, 2023
8a1fce3
More cloudposse tweaking
Mr0grog Jan 31, 2023
58b4db8
It appears I am still misunderstanding how this manages DNS
Mr0grog Jan 31, 2023
933203f
It turns out you have to set a cert to use aliases
Mr0grog Jan 31, 2023
59cd0a0
Try using auto-created DNS from Cloudposse CDN
Mr0grog Jan 31, 2023
ffba9ec
Don't forward irrelevant headers
Mr0grog Feb 1, 2023
ea154cc
A little cleanup
Mr0grog Feb 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 37 additions & 1 deletion terraform/api-domains.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,24 @@
# by the `api_remote_domain_name` variable.

locals {
# The domain of the API service's load balancer (not for public use).
api_internal_subdomain = "api.internal"
api_internal_domain = (
var.domain_name != ""
? "${local.api_internal_subdomain}.${var.domain_name}"
: ""
)

# Domain at which to serve archived, historical data (stored in S3).
data_snapshots_subdomain = "archives"
data_snapshots_domain = (
var.domain_name != ""
? "${local.data_snapshots_subdomain}.${var.domain_name}"
: ""
)
}

# Domains ---------------------------------------------------------------------
# Domain DNS Recods -----------------------------------------------------------

data "aws_route53_zone" "domain_zone" {
count = var.domain_name != "" ? 1 : 0
Expand Down Expand Up @@ -224,3 +233,30 @@ resource "aws_cloudfront_distribution" "univaf_api_ecs" {
}
}
}

# Provide a protective caching layer and a nice domain name for the S3 bucket
# with historical data. (Allowing direct public access can get expensive.)
# Docs: https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn
module "univaf_data_snaphsots_cdn" {
count = (
var.domain_name != ""
&& var.ssl_certificate_arn != "" ? 1 : 0
)
source = "cloudposse/cloudfront-s3-cdn/aws"
version = "0.86.0"

origin_bucket = aws_s3_bucket.data_snapshots.bucket
dns_alias_enabled = true
aliases = [local.data_snapshots_domain]
parent_zone_id = data.aws_route53_zone.domain_zone[0].zone_id
acm_certificate_arn = var.ssl_certificate_arn
cloudfront_access_logging_enabled = false

default_ttl = 60 * 60 * 24 * 7 # 1 Week
http_version = "http2and3"
allowed_methods = ["GET", "HEAD", "OPTIONS"]
cached_methods = ["GET", "HEAD", "OPTIONS"]
# By default, CORS headers are forwarded, but we don't really care about them
# since the bucket is not operating in "website" mode.
forward_header_values = []
}
2 changes: 1 addition & 1 deletion terraform/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.11"
version = "~> 4.52"
}
}
}
Expand Down
2 changes: 2 additions & 0 deletions terraform/s3.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@ resource "aws_s3_bucket" "data_snapshots" {
bucket = "univaf-data-snapshots"
}

# FIXME: Change acl to "private" once we confirm CloudFront is working.
resource "aws_s3_bucket_acl" "data_snapshots_acl" {
bucket = aws_s3_bucket.data_snapshots.id
acl = "public-read"
}

# FIXME: Remove policy once we confirm CloudFront is working.
resource "aws_s3_bucket_policy" "data_snapshots" {
bucket = aws_s3_bucket.data_snapshots.id
policy = jsonencode({
Expand Down