S3

aws/sponsor-app/apprunner.tf

@@ -9,9 +9,6 @@ resource "aws_apprunner_service" "sponsor_app" {
 
         # See also kaigionrails/sponsor-app/deploy/task_definition.jsonnet
         runtime_environment_variables = {
-          AWS_ACCESS_KEY_ID        = "sample"
-          AWS_REGION               = "ap-northeast-1"
-          AWS_SECRET_ACCESS_KEY    = "sample"
           DEFAULT_EMAIL_ADDRESS    = "sponsorships@kaigionrails.org"
           DEFAULT_EMAIL_HOST       = "sponsorships.kaigionrails.org"
           DEFAULT_URL_HOST         = "sponsorships.kaigionrails.org"
@@ -22,6 +19,8 @@ resource "aws_apprunner_service" "sponsor_app" {
           RAILS_ENV                = "production"
           RAILS_LOG_TO_STDOUT      = "enabled"
           RAILS_SERVE_STATIC_FILES = "enabled"
+          S3_FILES_REGION          = "ap-northeast-1"
+          S3_FILES_ROLE            = aws_iam_role.sponsor_app_user.arn
           SENTRY_ENV               = "production"
         }
 
@@ -88,9 +87,6 @@ resource "aws_apprunner_service" "sponsor_app_staging" {
 
         # See also kaigionrails/sponsor-app/deploy/staging/task_definition.jsonnet
         runtime_environment_variables = {
-          AWS_ACCESS_KEY_ID        = "sample"
-          AWS_REGION               = "ap-northeast-1"
-          AWS_SECRET_ACCESS_KEY    = "sample"
           DEFAULT_EMAIL_ADDRESS    = "sponsorships-staging@kaigionrails.org"
           DEFAULT_EMAIL_HOST       = "sponsorships-staging.kaigionrails.org"
           DEFAULT_URL_HOST         = "sponsorships-staging.kaigionrails.org"
@@ -101,6 +97,8 @@ resource "aws_apprunner_service" "sponsor_app_staging" {
           RAILS_ENV                = "production"
           RAILS_LOG_TO_STDOUT      = "enabled"
           RAILS_SERVE_STATIC_FILES = "enabled"
+          S3_FILES_REGION          = "ap-northeast-1"
+          S3_FILES_ROLE            = aws_iam_role.sponsor_app_staging_user.arn
           SENTRY_ENV               = "staging"
         }
 

aws/sponsor-app/iam.tf

@@ -132,6 +132,17 @@ data "aws_iam_policy_document" "sponsor_app" {
   #   # resources = ["arn:aws:iam::${local.kaigionrails_aws_account_id}:role/*"]
   #   resources = ["*"]
   # }
+  statement {
+    effect = "Allow"
+    actions = [
+      "sts:AssumeRole",
+    ]
+    resources = [
+      aws_iam_role.sponsor_app_user.arn,
+      aws_iam_role.sponsor_app_staging_user.arn,
+    ]
+  }
+
   statement {
     effect  = "Allow"
     actions = ["ssm:GetParameters"]
@@ -155,6 +166,21 @@ data "aws_iam_policy_document" "sponsor_app" {
     ]
     resources = ["*"]
   }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "s3:GetObject",
+      "s3:PutObject",
+      "s3:ListBucket",
+    ]
+    resources = [
+      aws_s3_bucket.sponsor_app.arn,
+      "${aws_s3_bucket.sponsor_app.arn}/*",
+      aws_s3_bucket.sponsor_app_staging.arn,
+      "${aws_s3_bucket.sponsor_app_staging.arn}/*",
+    ]
+  }
 }
 
 resource "aws_iam_role" "sponsor_app_deployer" {
@@ -271,3 +297,77 @@ data "aws_iam_policy_document" "sponsor_app_deployer" {
     ]
   }
 }
+
+resource "aws_iam_role" "sponsor_app_user" {
+  name                 = "SponsorAppUser"
+  description          = "SponsorAppUser"
+  assume_role_policy   = data.aws_iam_policy_document.sponsor_app_user_trust.json
+  max_session_duration = 43200
+}
+
+data "aws_iam_policy_document" "sponsor_app_user_trust" {
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+    principals {
+      type = "AWS"
+      identifiers = [
+        "arn:aws:iam::${local.kaigionrails_aws_account_id}:root"
+      ]
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "sponsor_app_user" {
+  role   = aws_iam_role.sponsor_app_user.name
+  policy = data.aws_iam_policy_document.sponsor_app_user.json
+}
+
+data "aws_iam_policy_document" "sponsor_app_user" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "s3:PutObject",
+    ]
+    resources = [
+      "${aws_s3_bucket.sponsor_app.arn}/*",
+    ]
+  }
+}
+
+resource "aws_iam_role" "sponsor_app_staging_user" {
+  name                 = "SponsorAppStagingUser"
+  description          = "SponsorAppStagingUser"
+  assume_role_policy   = data.aws_iam_policy_document.sponsor_app_staging_user_trust.json
+  max_session_duration = 43200
+}
+
+data "aws_iam_policy_document" "sponsor_app_staging_user_trust" {
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+    principals {
+      type = "AWS"
+      identifiers = [
+        "arn:aws:iam::${local.kaigionrails_aws_account_id}:root"
+      ]
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "sponsor_app_staging_user" {
+  role   = aws_iam_role.sponsor_app_staging_user.name
+  policy = data.aws_iam_policy_document.sponsor_app_staging_user.json
+}
+
+data "aws_iam_policy_document" "sponsor_app_staging_user" {
+  statement {
+    effect = "Allow"
+    actions = [
+      "s3:PutObject",
+    ]
+    resources = [
+      "${aws_s3_bucket.sponsor_app_staging.arn}/*",
+    ]
+  }
+}

aws/sponsor-app/s3.tf

@@ -0,0 +1,45 @@
+resource "aws_s3_bucket" "sponsor_app" {
+  bucket = "kor-sponsor-app-production"
+}
+
+resource "aws_s3_bucket_ownership_controls" "sponsor_app" {
+  bucket = aws_s3_bucket.sponsor_app.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_cors_configuration" "sponsor_app" {
+  bucket = aws_s3_bucket.sponsor_app.id
+
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://sponsorships.kaigionrails.org"]
+    max_age_seconds = 3000
+  }
+}
+
+resource "aws_s3_bucket" "sponsor_app_staging" {
+  bucket = "kor-sponsor-app-staging"
+}
+
+resource "aws_s3_bucket_ownership_controls" "sponsor_app_staging" {
+  bucket = aws_s3_bucket.sponsor_app_staging.id
+
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_cors_configuration" "sponsor_app_staging" {
+  bucket = aws_s3_bucket.sponsor_app_staging.id
+
+  cors_rule {
+    allowed_headers = ["*"]
+    allowed_methods = ["PUT", "POST"]
+    allowed_origins = ["https://sponsorships-staging.kaigionrails.org"]
+    max_age_seconds = 3000
+  }
+}