LGTM画像を配信する為のCDNを作成

modules/aws/acm/main.tf

@@ -0,0 +1,7 @@
+data "aws_acm_certificate" "main" {
+  domain = var.main_domain_name
+}
+
+data "aws_acm_certificate" "sub" {
+  domain = "*.${var.main_domain_name}"
+}

modules/aws/acm/outputs.tf

@@ -0,0 +1,7 @@
+output "main_domain_acm_arn" {
+  value = data.aws_acm_certificate.main.arn
+}
+
+output "sub_domain_acm_arn" {
+  value = data.aws_acm_certificate.sub.arn
+}

modules/aws/acm/variables.tf

@@ -0,0 +1,3 @@
+variable "main_domain_name" {
+  type = string
+}

modules/aws/images/main.tf

@@ -20,3 +20,117 @@ resource "aws_s3_bucket" "lgtm_images_bucket" {
     }
   }
 }
+
+resource "aws_cloudfront_origin_access_identity" "lgtm_images_bucket" {
+  comment = "${aws_s3_bucket.lgtm_images_bucket.bucket} origin access identity"
+}
+
+data "aws_iam_policy_document" "read_lgtm_images" {
+  statement {
+    actions   = ["s3:GetObject"]
+    resources = ["${aws_s3_bucket.lgtm_images_bucket.arn}/*"]
+
+    principals {
+      identifiers = [aws_cloudfront_origin_access_identity.lgtm_images_bucket.iam_arn]
+      type        = "AWS"
+    }
+  }
+
+  statement {
+    actions   = ["s3:ListBucket"]
+    resources = [aws_s3_bucket.lgtm_images_bucket.arn]
+
+    principals {
+      identifiers = [aws_cloudfront_origin_access_identity.lgtm_images_bucket.iam_arn]
+      type        = "AWS"
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "read_lgtm_images" {
+  bucket = aws_s3_bucket.lgtm_images_bucket.id
+  policy = data.aws_iam_policy_document.read_lgtm_images.json
+}
+
+resource "aws_s3_bucket" "lgtm_images_access_logs" {
+  bucket        = "${var.lgtm_images_bucket_name}-logs"
+  force_destroy = true
+
+  lifecycle_rule {
+    enabled                                = true
+    abort_incomplete_multipart_upload_days = 7
+  }
+}
+
+resource "aws_cloudfront_distribution" "lgtm_images_cdn" {
+  default_cache_behavior {
+    allowed_methods = ["GET", "HEAD"]
+    cached_methods  = ["GET", "HEAD"]
+
+    forwarded_values {
+      cookies {
+        forward = "none"
+      }
+
+      query_string = false
+    }
+
+    target_origin_id       = "S3-${aws_s3_bucket.lgtm_images_bucket.bucket}"
+    viewer_protocol_policy = "redirect-to-https"
+  }
+
+  enabled         = true
+  is_ipv6_enabled = true
+  comment         = "LGTMeow Images"
+
+  aliases = [var.lgtm_images_cdn_domain]
+
+  logging_config {
+    bucket          = aws_s3_bucket.lgtm_images_access_logs.bucket_domain_name
+    include_cookies = false
+    prefix          = "raw/"
+  }
+
+  origin {
+    domain_name = aws_s3_bucket.lgtm_images_bucket.bucket_domain_name
+    origin_id   = "S3-${aws_s3_bucket.lgtm_images_bucket.bucket}"
+
+    s3_origin_config {
+      origin_access_identity = aws_cloudfront_origin_access_identity.lgtm_images_bucket.cloudfront_access_identity_path
+    }
+
+    custom_header {
+      name  = "Accept"
+      value = "image/png,image/jpeg,image/webp"
+    }
+
+    custom_header {
+      name  = "Content-Type"
+      value = "image/png,image/jpeg,image/webp"
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    acm_certificate_arn      = var.lgtm_images_cdn_acm_arn
+    minimum_protocol_version = "TLSv1.2_2019"
+    ssl_support_method       = "sni-only"
+  }
+}
+
+resource "aws_route53_record" "lgtm_images" {
+  name    = var.lgtm_images_cdn_sub_domain
+  type    = "A"
+  zone_id = var.main_host_zone
+
+  alias {
+    evaluate_target_health = false
+    name                   = aws_cloudfront_distribution.lgtm_images_cdn.domain_name
+    zone_id                = aws_cloudfront_distribution.lgtm_images_cdn.hosted_zone_id
+  }
+}

modules/aws/images/variables.tf

@@ -1,3 +1,19 @@
 variable "lgtm_images_bucket_name" {
   type = string
 }
+
+variable "lgtm_images_cdn_sub_domain" {
+  type = string
+}
+
+variable "lgtm_images_cdn_domain" {
+  type = string
+}
+
+variable "lgtm_images_cdn_acm_arn" {
+  type = string
+}
+
+variable "main_host_zone" {
+  type = string
+}

providers/aws/environments/prod/10-acm/backend.tf

@@ -0,0 +1,8 @@
+terraform {
+  backend "s3" {
+    bucket  = "lgtm-cat-tfstate"
+    key     = "acm/terraform.tfstate"
+    region  = "ap-northeast-1"
+    profile = "lgtm-cat"
+  }
+}

providers/aws/environments/prod/10-acm/main.tf

@@ -0,0 +1,15 @@
+module "ap_northeast_1_acm" {
+  source = "../../../../../modules/aws/acm"
+
+  main_domain_name = local.main_domain_name
+}
+
+module "us_east_1_acm" {
+  source = "../../../../../modules/aws/acm"
+
+  main_domain_name = local.main_domain_name
+
+  providers = {
+    aws = aws.us-east-1
+  }
+}

providers/aws/environments/prod/10-acm/outputs.tf

@@ -0,0 +1,15 @@
+output "ap_northeast_1_main_domain_acm_arn" {
+  value = module.ap_northeast_1_acm.main_domain_acm_arn
+}
+
+output "ap_northeast_1_sub_domain_acm_arn" {
+  value = module.ap_northeast_1_acm.sub_domain_acm_arn
+}
+
+output "us_east_1_main_domain_acm_arn" {
+  value = module.us_east_1_acm.main_domain_acm_arn
+}
+
+output "us_east_1_sub_domain_acm_arn" {
+  value = module.us_east_1_acm.sub_domain_acm_arn
+}

providers/aws/environments/prod/10-acm/provider.tf

@@ -0,0 +1,10 @@
+provider "aws" {
+  region  = "ap-northeast-1"
+  profile = "lgtm-cat"
+}
+
+provider "aws" {
+  region  = "us-east-1"
+  profile = "lgtm-cat"
+  alias   = "us-east-1"
+}

providers/aws/environments/prod/10-acm/variables.tf

@@ -0,0 +1,4 @@
+locals {
+  env              = "prod"
+  main_domain_name = "lgtmeow.com"
+}

providers/aws/environments/prod/10-acm/versions.tf

@@ -0,0 +1,7 @@
+terraform {
+  required_version = "0.14.7"
+
+  required_providers {
+    aws = "3.29.0"
+  }
+}

providers/aws/environments/prod/11-images/backend.tf

@@ -6,3 +6,14 @@ terraform {
     profile = "lgtm-cat"
   }
 }
+
+data "terraform_remote_state" "acm" {
+  backend = "s3"
+
+  config = {
+    bucket  = "lgtm-cat-tfstate"
+    key     = "acm/terraform.tfstate"
+    region  = "ap-northeast-1"
+    profile = "lgtm-cat"
+  }
+}

providers/aws/environments/prod/11-images/main.tf

@@ -1,4 +1,8 @@
 module "images" {
-  source                  = "../../../../../modules/aws/images"
-  lgtm_images_bucket_name = local.lgtm_images_bucket_name
+  source                     = "../../../../../modules/aws/images"
+  lgtm_images_bucket_name    = local.lgtm_images_bucket_name
+  lgtm_images_cdn_sub_domain = local.lgtm_images_cdn_sub_domain
+  lgtm_images_cdn_domain     = local.lgtm_images_cdn_domain
+  lgtm_images_cdn_acm_arn    = local.lgtm_images_cdn_acm_arn
+  main_host_zone             = data.aws_route53_zone.main_host_zone.zone_id
 }

providers/aws/environments/prod/11-images/variables.tf

@@ -1,5 +1,18 @@
 locals {
-  env                     = "prod"
-  name                    = "lgtmeow"
-  lgtm_images_bucket_name = "${local.env}-${local.name}-images"
+  env                        = "prod"
+  name                       = "lgtmeow"
+  lgtm_images_bucket_name    = "${local.env}-${local.name}-images"
+  lgtm_images_cdn_sub_domain = "lgtm-images"
+  lgtm_images_cdn_domain     = "${local.lgtm_images_cdn_sub_domain}.${var.main_domain_name}"
+  lgtm_images_cdn_acm_arn    = data.terraform_remote_state.acm.outputs.us_east_1_sub_domain_acm_arn
+  main_host_zone             = data.aws_route53_zone.main_host_zone
+}
+
+variable "main_domain_name" {
+  type    = string
+  default = "lgtmeow.com"
+}
+
+data "aws_route53_zone" "main_host_zone" {
+  name = var.main_domain_name
 }

terraform-init.sh

@@ -1,6 +1,7 @@
 #!/bin/sh
 
 tfstateDirList='
+/data/providers/aws/environments/prod/10-acm
 /data/providers/aws/environments/prod/11-images
 '