Fix the rules publication Terraform configuration #742
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mcdonnnj
added
bug
mcdonnnj
requested review from
dav3r,
felddy,
jasonodoom and
jsf9k
as code owners
6 tasks
dav3r
approved these changes
Dec 28, 2023
Since we are serving this content with a CloudFront distribution now we no longer need the S3 bucket configured as a static website.
Create an Origin Access Identity and configure the CloudFront distribution for the rules bucket to use the newly created OAI.
Add a policy that will allow the CloudFront distribution to read from the rules bucket. This should allow hte distribution to correctly access the bucket's contents even though it is completely private.
The bucket that is storing these lists is now set to disallow any ACLs or policies that allow public access. Attempting to set an object that has been uploaded to `public-read` will throw an authorization error as a result.
Origin Access Control is the newer, improved way to secure S3 origins when using CloudFront. Since it effectively replaces Origin Access Identity it makes sense to use it instead.
mcdonnnj
force-pushed
the
bug/adjust_rules_bucket_access
branch
from
47fc163
to
0904ddd
Compare
12 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🗣 Description
This pull request updates the configuration in
terraform_egress_pub/that publishes the rules site listing the IP ranges we publish that are in use for assessments. This includes:💭 Motivation and context
When #654 was merged I apparently neglected to apply the changes in the
terraform_egress_pub/configuration. As a result a bug went unnoticed until @jsf9k applied his changes for #738 and suddenly the rules site was no longer working. I took a look and realized that the problem was due to the fact that although the bucket was set to use theprivatecanned ACL, the script that uploads objects to the bucket would set each uploaded object to use thepublic-readcanned ACL. With the addition of aaws_s3_bucket_public_access_blockfor the rules S3 bucket that disallowed any public access it broke access to the objects in the bucket. Adding an OAC and appropriate policy to the bucket allows the CloudFront distribution to access the S3 bucket even if it is completely private.The static website configuration was removed because
🧪 Testing
Automated tests pass. I applied this in production and verified that the rules site works once more.
✅ Pre-approval checklist