Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add bucket policy for uploads in testing #10395

Merged
merged 10 commits into from
Jan 11, 2024
Merged

Add bucket policy for uploads in testing #10395

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
445fadc
Add bucket policy for uploads in testing
Dec 14, 2023
1e2b496
temp commit deploy test
sean1588 Dec 14, 2023
d9fcf7b
fix up bucket policy
Dec 14, 2023
351578f
Update policy
Dec 18, 2023
9910c14
Update policy again
Dec 18, 2023
87f6f6d
Update policy
Dec 20, 2023
19e73c6
Update policy
Dec 20, 2023
7fb19b0
Enable in prod/staging
Jan 9, 2024
5ce7694
Empty-Commit
Jan 9, 2024
09c35f3
Empty-Commit
Jan 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/testing-build-and-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: Build and deploy testing
on:
push:
pull_request:
branches:
- master
permissions:
Expand Down
7 changes: 4 additions & 3 deletions infrastructure/Pulumi.www-production.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,12 @@ config:
www.pulumi.com:addSecurityHeaders: "true"
www.pulumi.com:certificateArn: "arn:aws:acm:us-east-1:388588623842:certificate/9db6a76b-f7ba-465b-ab96-ce1d3b8ae02c"
www.pulumi.com:doEdgeRedirects: "true"
www.pulumi.com:hostedZone: www.pulumi.com
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are all these values in the stack config files the same as they were before except for the marketingPortalStack? I guess it was the ordering that was switched up.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah they are all the same, I guess when I added the new config value it sorted them alphabetically.

www.pulumi.com:makeFallbackBucket: "false"
www.pulumi.com:marketingPortalStack: pulumi/marketing-db/production
www.pulumi.com:originBucketNameOverride: ""
www.pulumi.com:pathToOriginBucketMetadata: ../origin-bucket-metadata.json
www.pulumi.com:registryStack: "pulumi/registry/production"
www.pulumi.com:setRootRecord: "true"
www.pulumi.com:websiteDomain: www.pulumi.com
www.pulumi.com:websiteLogsBucketName: www-prod.pulumi.com-website-logs
www.pulumi.com:hostedZone: www.pulumi.com
www.pulumi.com:setRootRecord: true
www.pulumi.com:registryStack: "pulumi/registry/production"
7 changes: 4 additions & 3 deletions infrastructure/Pulumi.www-testing.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,11 @@ config:
www.pulumi.com:addSecurityHeaders: "true"
www.pulumi.com:certificateArn: "arn:aws:acm:us-east-1:571684982431:certificate/dacf95ab-d4dd-4370-9c93-6ce0b9dda7c0"
www.pulumi.com:doEdgeRedirects: "true"
www.pulumi.com:hostedZone: www.pulumi-test.io
www.pulumi.com:makeFallbackBucket: "false"
www.pulumi.com:marketingPortalStack: pulumi/marketing-db/staging
www.pulumi.com:pathToOriginBucketMetadata: ../origin-bucket-metadata.json
www.pulumi.com:registryStack: "pulumi/registry/testing"
www.pulumi.com:setRootRecord: "true"
www.pulumi.com:websiteDomain: www.pulumi-test.io
www.pulumi.com:websiteLogsBucketName: pulumi-test-io-website-logs
www.pulumi.com:hostedZone: www.pulumi-test.io
www.pulumi.com:setRootRecord: true
www.pulumi.com:registryStack: "pulumi/registry/testing"
41 changes: 41 additions & 0 deletions infrastructure/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,10 @@ const config = {

// the registry stack to reference to route traffic to for `/registry` routes.
registryStack: stackConfig.get("registryStack"),

// the marketing portal stack to reference to allow the marketing portal
// to add items to the uploads bucket.
marketingPortalStack: stackConfig.get("marketingPortalStack"),
};

const aiAppStack = new pulumi.StackReference('pulumi/pulumi-ai-app-infra/prod');
Expand Down Expand Up @@ -94,6 +98,43 @@ const uploadsBucket = new aws.s3.Bucket("uploads-bucket", {
}],
});

if (config.marketingPortalStack) {
const marketingAppStack = new pulumi.StackReference(config.marketingPortalStack);
const ecsRoleArn = marketingAppStack.getOutput("ecsRoleArn");

const uploadsBucketPolicy = new aws.s3.BucketPolicy("uploads-bucket-policy", {
bucket: uploadsBucket.bucket,
policy: pulumi.all([uploadsBucket.arn, ecsRoleArn])
.apply(([bucketArn, roleArn]) => JSON.stringify({
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Principal": {
"AWS": roleArn,
},
"Effect": "Allow",
"Resource": bucketArn,
},
{
"Effect": "Allow",
"Principal": {
"AWS": roleArn,
},
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": `${bucketArn}/*`,
},
]
})),
});
}

// This needs to be set in order to allow the use of ACLs. This was added to update our infrastructure to be
// compatible with the default S3 settings from AWS' April update. `ObjectWriter` was the prior default, so
// changing it to that here to match the configuration prior to the update.
Expand Down
Loading