terraform - 如何使用 terraform 编辑 AWS CloudFront 设置以编辑源和源组设置

Question

我特别在寻找具有以下设置的方法，如下图所示。我想限制 S3 存储桶并选择创建新的源访问身份，如下所示。

它还应该在 S3 存储桶策略中进行更新，但图像中的设置可能看起来不同。

简而言之，我找不到或者可能是我不了解实现它的官方 terraform 文档。

Answer 1

您可以使用下面的一个作为参考，

resource "aws_cloudfront_distribution" "www" {
  origin {
    domain_name = "${var.bucket_name}.s3.amazonaws.com"
    origin_id   = "wwwS3Origin"

    s3_origin_config {
      origin_access_identity = "${aws_cloudfront_origin_access_identity.origin_access_identity.cloudfront_access_identity_path}"
    }
  }

  enabled             = true
  is_ipv6_enabled     = true
  comment             = "Some comment"
  default_root_object = "index.html"

......

resource "aws_cloudfront_origin_access_identity" "origin_access_identity" {
  comment = "S3 bucket OAI"
}

更新存储桶策略

data "aws_iam_policy_document" "s3_policy" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.example.arn}/*"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }

  statement {
    actions   = ["s3:ListBucket"]
    resources = ["${aws_s3_bucket.example.arn}"]

    principals {
      type        = "AWS"
      identifiers = ["${aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn}"]
    }
  }
}

resource "aws_s3_bucket_policy" "example" {
  bucket = "${aws_s3_bucket.example.id}"
  policy = "${data.aws_iam_policy_document.s3_policy.json}"
}

请参阅以下链接以获取更多详细信息

https://www.terraform.io/docs/providers/aws/r/cloudfront_origin_access_identity.html#updating-your-bucket-policy