refactor: s3 Stack lifecycle

Author: ayuki-joto

bin/decidim-cfj-cdk.ts

@@ -9,7 +9,6 @@ import {ElasticacheStack} from "../lib/elasticache-stack";
 import {DecidimStack} from "../lib/decidim-stack";
 import {CloudFrontStack} from "../lib/cloudfront";
 import {Tags} from 'aws-cdk-lib';
-import {S3PolicyStack} from "../lib/s3-policy";
 
 const app = new cdk.App();
 
@@ -99,13 +98,6 @@ const distribution = new CloudFrontStack(app, `${stage}${serviceName}CloudFrontS
 distribution.addDependency(service)
 distribution.addDependency(s3Stack)
 
-new S3PolicyStack(app, `${stage}${serviceName}S3PolicyStack`, {
-    stage,
-    serviceName,
-    env,
-    bucket: s3Stack.bucket
-})
-
 Tags.of(app).add('Project', 'Decidim')
 Tags.of(app).add('Repository', 'decidim-cfj-cdk')
 Tags.of(app).add('GovernmentName', 'code4japan')

lib/s3-policy.ts

@@ -1,4 +1,4 @@
-import {aws_s3, RemovalPolicy, Stack} from "aws-cdk-lib";
+import {aws_iam as iam, aws_s3, aws_ssm as ssm, RemovalPolicy, Stack} from "aws-cdk-lib";
 import {Construct} from "constructs";
 import {BaseStackProps} from "./props";
 import {HttpMethods} from "aws-cdk-lib/aws-s3";
@@ -34,5 +34,18 @@ export class S3Stack extends Stack {
                 }
             ]
         });
+
+        const distArn = ssm.StringParameter.valueForStringParameter(
+            this, `/decidim-cfj/${props.stage}/CLOUDFRONT_DISTRIBUTION_ARN`
+        );
+
+        this.bucket.addToResourcePolicy(new iam.PolicyStatement({
+            sid: "AllowCloudFrontOACRead",
+            effect: iam.Effect.ALLOW,
+            principals: [ new iam.ServicePrincipal("cloudfront.amazonaws.com") ],
+            actions: ["s3:GetObject"],
+            resources: [ `${this.bucket.bucketArn}/*` ],
+            conditions: { StringEquals: { "AWS:SourceArn": distArn } },
+        }));
     }
 }