環境
Cloud9環境を使用しました。
- Terraform 1.3.4
- AWS Provider 4.37.0
Terraform環境をAWS Cloud9で構築する方法
手順
Terraformプロバイダーを指定
使用するバージョンを指定します。
provider.tf
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "4.37.0"
}
}
required_version = "1.3.4"
}
provider "aws" {
region = "ap-northeast-1"
}S3にサイトをアップロード
サンプルです。
index.html
<!DOCTYPE html>
<html>
<body>
<h1>Hello World!</h1>
</body>
</html>バケットポリシーでCloudFrontからのアクセスのみ許可しています。
s3.tf
resource "aws_s3_bucket" "static_website" {
bucket_prefix = "static-website"
}
resource "aws_s3_bucket_public_access_block" "static_website" {
bucket = aws_s3_bucket.static_website.bucket
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
resource "aws_s3_object" "index" {
bucket = aws_s3_bucket.static_website.bucket
key = "index.html"
source = "./index.html"
content_type = "text/html"
}
resource "aws_s3_bucket_policy" "static_website" {
bucket = aws_s3_bucket.static_website.id
policy = data.aws_iam_policy_document.allow_cloudfront_service_principal_s3_readonly.json
}
data "aws_iam_policy_document" "allow_cloudfront_service_principal_s3_readonly" {
statement {
sid = "AllowCloudFrontServicePrincipalReadOnly"
effect = "Allow"
actions = ["s3:GetObject"]
principals {
type = "Service"
identifiers = ["cloudfront.amazonaws.com"]
}
condition {
test = "StringEquals"
variable = "AWS:SourceArn"
values = [aws_cloudfront_distribution.static_website.arn]
}
resources = ["${aws_s3_bucket.static_website.arn}/*"]
}
}CloudFront ディストリビューションを作成
OAIではなくOACを使用。
cloudfront.tf
resource "aws_cloudfront_distribution" "static_website" {
origin {
domain_name = aws_s3_bucket.static_website.bucket_regional_domain_name
origin_id = aws_s3_bucket.static_website.id
origin_access_control_id = aws_cloudfront_origin_access_control.static_website.id
}
enabled = true
default_root_object = "index.html"
default_cache_behavior {
allowed_methods = ["GET", "HEAD"]
cached_methods = ["GET", "HEAD"]
target_origin_id = aws_s3_bucket.static_website.id
forwarded_values {
query_string = false
cookies {
forward = "none"
}
}
viewer_protocol_policy = "allow-all"
min_ttl = 0
default_ttl = 3600
max_ttl = 86400
}
restrictions {
geo_restriction {
restriction_type = "whitelist"
locations = ["JP"]
}
}
viewer_certificate {
cloudfront_default_certificate = true
}
}
resource "aws_cloudfront_origin_access_control" "static_website" {
name = "static_website"
description = "Example Policy"
origin_access_control_origin_type = "s3"
signing_behavior = "always"
signing_protocol = "sigv4"
}実行
bash
terraform init
terraform apply
yes
