1 files changed, 28 insertions, 34 deletions

diff --git a/jinwei.me/infra/s3.tf b/jinwei.me/infra/s3.tf
index 5626390..58e0502 100644
--- a/jinwei.me/infra/s3.tf
+++ b/jinwei.me/infra/s3.tf
@@ -3,7 +3,7 @@ resource "random_id" "s3_bucket_suffix" {
 }
 
 resource "aws_s3_bucket" "main" {
-  bucket = "${var.name}-${random_id.s3_bucket_suffix.hex}"
+  bucket = "static.jinwei.me"
 }
 
 resource "aws_s3_bucket_public_access_block" "main" {
@@ -12,43 +12,37 @@ resource "aws_s3_bucket_public_access_block" "main" {
   # https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
   block_public_acls       = false
   ignore_public_acls      = true
-  block_public_policy     = true
+  block_public_policy     = false
   restrict_public_buckets = true
 }
 
-#resource "aws_s3_bucket_policy" "main" {
-#  bucket = aws_s3_bucket.main.id
-#  policy = data.aws_iam_policy_document.bucket_policy.json
-#}
-
-#data "aws_iam_policy_document" "bucket_policy" {
-#  # Allow CloudFront to read from the bucket
-#  statement {
-#    principals {
-#      type = "Service"
-#      identifiers = [
-#        "cloudfront.amazonaws.com"
-#      ]
-#    }
-#    actions = [
-#      "s3:GetObject"
-#    ]
-#    resources = [
-#      "${aws_s3_bucket.main.arn}/*",
-#    ]
-#    condition {
-#      test     = "StringEquals"
-#      variable = "AWS:SourceArn"
-#      values   = [aws_cloudfront_distribution.main.arn]
-#    }
-#  }
-#}
+resource "aws_s3_bucket_policy" "main" {
+  bucket = aws_s3_bucket.main.id
+  policy = data.aws_iam_policy_document.bucket_policy.json
+}
 
-#resource "aws_ssm_parameter" "s3_bucket" {
-#  name  = "/${local.name}/s3_bucket"
-#  type  = "String"
-#  value = aws_s3_bucket.main.bucket
-#}
+data "aws_iam_policy_document" "bucket_policy" {
+  # Allow Cloudflare to read from the bucket
+  statement {
+    principals {
+      type = "AWS"
+      identifiers = [
+        "*"
+      ]
+    }
+    actions = [
+      "s3:GetObject"
+    ]
+    resources = [
+      "${aws_s3_bucket.main.arn}/*",
+    ]
+    condition {
+      test     = "IpAddress"
+      variable = "AWS:SourceIp"
+      values   = data.cloudflare_ip_ranges.cloudflare.cidr_blocks
+    }
+  }
+}
 
 resource "aws_s3_object" "healthcheck" {
   bucket       = aws_s3_bucket.main.id