From 0b793b6717a631fa2bd7650b670834e5268e8ae6 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Date: Thu, 11 Mar 2021 11:53:13 +0100 Subject: [PATCH 01/11] Create terraform.tf Signed-off-by: Jacob Valdemar Andreasen --- .../techdocs-s3-storage/terraform.tf | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 contrib/terraform/techdocs-s3-storage/terraform.tf diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf new file mode 100644 index 0000000000..d8d57e9cd6 --- /dev/null +++ b/contrib/terraform/techdocs-s3-storage/terraform.tf @@ -0,0 +1,73 @@ +#========================== +# Variables +#========================== + +variable "backstage" { + default = "backstage" +} + +#========================== +# Bucket +#========================== + +resource "aws_s3_bucket" "backstage" { + bucket = var.backstage + acl = "private" + provider = aws + + lifecycle { + prevent_destroy = true + } + + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "AES256" + } + } + } + + tags = { + Name = var.backstage + "Managed By Terraform" = var.shared-managed-tag-value + } +} + +resource "aws_s3_bucket_public_access_block" "backstage" { + bucket = aws_s3_bucket.backstage.id + + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} + + +#========================== +# IAM +#========================== + +resource "aws_iam_user" "backstage" { + name = var.backstage +} + +resource "aws_iam_user_policy" "backstage" { + name = var.backstage + user = aws_iam_user.backstage.name + policy = data.aws_iam_policy_document.backstage-policy.json +} + +data "aws_iam_policy_document" "backstage-policy" { + statement { + actions = [ + "s3:PutObject", + "s3:GetObject", + "s3:ListBucket" + ] + effect = "Allow" + resources = [ + "${aws_s3_bucket.backstage.arn}", + "${aws_s3_bucket.backstage.arn}/*", + ] + } +} From 602cb4152285c70324e1fdcea01fed3d3565f0a4 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Date: Thu, 11 Mar 2021 11:59:45 +0100 Subject: [PATCH 02/11] Create readme.md Signed-off-by: Jacob Valdemar Andreasen --- contrib/terraform/techdocs-s3-storage/readme.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 contrib/terraform/techdocs-s3-storage/readme.md diff --git a/contrib/terraform/techdocs-s3-storage/readme.md b/contrib/terraform/techdocs-s3-storage/readme.md new file mode 100644 index 0000000000..9615cc8d13 --- /dev/null +++ b/contrib/terraform/techdocs-s3-storage/readme.md @@ -0,0 +1 @@ +This terraform file should create a S3 bucket and setup IAM with a user with an inline policy which gives the user access to the bucket. After you have created the bucket, user and policy you should go to the user in the AWS console and create an access key. This access key should be used as the env variables in step 3a [here](https://backstage.io/docs/features/techdocs/using-cloud-storage#configuring-aws-s3-bucket-with-techdocs). From 3eb3f81a4d177ad324ac2684637c31a0af8e9dff Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Thu, 11 Mar 2021 12:22:06 +0100 Subject: [PATCH 03/11] Update documentation Signed-off-by: Jacob Valdemar Andreasen --- docs/features/techdocs/using-cloud-storage.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md index fd8f320859..2f5828331d 100644 --- a/docs/features/techdocs/using-cloud-storage.md +++ b/docs/features/techdocs/using-cloud-storage.md @@ -120,6 +120,7 @@ techdocs: Create a dedicated AWS S3 bucket for the storage of TechDocs sites. [Refer to the official documentation](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-bucket.html). +[Terraform example](https://github.com/backstage/backstage/blob/master/contrib/terraform/techdocs-s3-storage/terraform.tf). TechDocs will publish documentation to this bucket and will fetch files from here to serve documentation in Backstage. Note that the bucket names are @@ -142,7 +143,9 @@ variables** You should follow the [AWS security best practices guide for authentication](https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html). -TechDocs needs access to read files and metadata of the S3 bucket. +TechDocs needs access to read files and metadata of the S3 bucket. So if you are +creating a policy for a user you want to make sure it is granted access to +ListBucket, GetObject and PutObject. If the environment variables From 65a4980f3f1afec0e7431189a6367e9581dd35c9 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Thu, 11 Mar 2021 12:30:01 +0100 Subject: [PATCH 04/11] Fix typo Signed-off-by: Jacob Valdemar Andreasen --- docs/features/techdocs/using-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md index 2f5828331d..f10b379757 100644 --- a/docs/features/techdocs/using-cloud-storage.md +++ b/docs/features/techdocs/using-cloud-storage.md @@ -145,7 +145,7 @@ You should follow the TechDocs needs access to read files and metadata of the S3 bucket. So if you are creating a policy for a user you want to make sure it is granted access to -ListBucket, GetObject and PutObject. +ListObjects, GetObject and PutObject. If the environment variables From f22a8edaafcba019cf4dcc3b53e0e56a81f3590c Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Wed, 17 Mar 2021 10:15:48 +0100 Subject: [PATCH 05/11] Add and change terraform variables Signed-off-by: Jacob Valdemar Andreasen --- contrib/terraform/techdocs-s3-storage/terraform.tf | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf index d8d57e9cd6..6dea091492 100644 --- a/contrib/terraform/techdocs-s3-storage/terraform.tf +++ b/contrib/terraform/techdocs-s3-storage/terraform.tf @@ -3,9 +3,17 @@ #========================== variable "backstage" { + default = "backstage_bucket_for_my_corp" +} + +variable "backstage-iam" { default = "backstage" } +variable "shared-managed-tag-value" { + default = "terraform_for_my_corp" +} + #========================== # Bucket #========================== @@ -48,11 +56,11 @@ resource "aws_s3_bucket_public_access_block" "backstage" { #========================== resource "aws_iam_user" "backstage" { - name = var.backstage + name = var.backstage-iam } resource "aws_iam_user_policy" "backstage" { - name = var.backstage + name = var.backstage-iam user = aws_iam_user.backstage.name policy = data.aws_iam_policy_document.backstage-policy.json } From 69d9259d260be837beeec5a6483223cb5a4419f8 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Date: Thu, 11 Mar 2021 11:53:13 +0100 Subject: [PATCH 06/11] Create terraform.tf Signed-off-by: Jacob Valdemar Andreasen --- .../techdocs-s3-storage/terraform.tf | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 contrib/terraform/techdocs-s3-storage/terraform.tf diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf new file mode 100644 index 0000000000..d8d57e9cd6 --- /dev/null +++ b/contrib/terraform/techdocs-s3-storage/terraform.tf @@ -0,0 +1,73 @@ +#========================== +# Variables +#========================== + +variable "backstage" { + default = "backstage" +} + +#========================== +# Bucket +#========================== + +resource "aws_s3_bucket" "backstage" { + bucket = var.backstage + acl = "private" + provider = aws + + lifecycle { + prevent_destroy = true + } + + server_side_encryption_configuration { + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "AES256" + } + } + } + + tags = { + Name = var.backstage + "Managed By Terraform" = var.shared-managed-tag-value + } +} + +resource "aws_s3_bucket_public_access_block" "backstage" { + bucket = aws_s3_bucket.backstage.id + + block_public_acls = true + block_public_policy = true + ignore_public_acls = true + restrict_public_buckets = true +} + + +#========================== +# IAM +#========================== + +resource "aws_iam_user" "backstage" { + name = var.backstage +} + +resource "aws_iam_user_policy" "backstage" { + name = var.backstage + user = aws_iam_user.backstage.name + policy = data.aws_iam_policy_document.backstage-policy.json +} + +data "aws_iam_policy_document" "backstage-policy" { + statement { + actions = [ + "s3:PutObject", + "s3:GetObject", + "s3:ListBucket" + ] + effect = "Allow" + resources = [ + "${aws_s3_bucket.backstage.arn}", + "${aws_s3_bucket.backstage.arn}/*", + ] + } +} From 74748a99a0790fb28431282809a5eda14ba4506d Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Date: Thu, 11 Mar 2021 11:59:45 +0100 Subject: [PATCH 07/11] Create readme.md Signed-off-by: Jacob Valdemar Andreasen --- contrib/terraform/techdocs-s3-storage/readme.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 contrib/terraform/techdocs-s3-storage/readme.md diff --git a/contrib/terraform/techdocs-s3-storage/readme.md b/contrib/terraform/techdocs-s3-storage/readme.md new file mode 100644 index 0000000000..9615cc8d13 --- /dev/null +++ b/contrib/terraform/techdocs-s3-storage/readme.md @@ -0,0 +1 @@ +This terraform file should create a S3 bucket and setup IAM with a user with an inline policy which gives the user access to the bucket. After you have created the bucket, user and policy you should go to the user in the AWS console and create an access key. This access key should be used as the env variables in step 3a [here](https://backstage.io/docs/features/techdocs/using-cloud-storage#configuring-aws-s3-bucket-with-techdocs). From 26e8254ef289ef16cb0a3ac43e7318869f3833d6 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Thu, 11 Mar 2021 12:22:06 +0100 Subject: [PATCH 08/11] Update documentation Signed-off-by: Jacob Valdemar Andreasen --- docs/features/techdocs/using-cloud-storage.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md index fd8f320859..2f5828331d 100644 --- a/docs/features/techdocs/using-cloud-storage.md +++ b/docs/features/techdocs/using-cloud-storage.md @@ -120,6 +120,7 @@ techdocs: Create a dedicated AWS S3 bucket for the storage of TechDocs sites. [Refer to the official documentation](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-bucket.html). +[Terraform example](https://github.com/backstage/backstage/blob/master/contrib/terraform/techdocs-s3-storage/terraform.tf). TechDocs will publish documentation to this bucket and will fetch files from here to serve documentation in Backstage. Note that the bucket names are @@ -142,7 +143,9 @@ variables** You should follow the [AWS security best practices guide for authentication](https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html). -TechDocs needs access to read files and metadata of the S3 bucket. +TechDocs needs access to read files and metadata of the S3 bucket. So if you are +creating a policy for a user you want to make sure it is granted access to +ListBucket, GetObject and PutObject. If the environment variables From 5da1459aeae6b196203fba71b0c0473211a083d6 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Thu, 11 Mar 2021 12:30:01 +0100 Subject: [PATCH 09/11] Fix typo Signed-off-by: Jacob Valdemar Andreasen --- docs/features/techdocs/using-cloud-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md index 2f5828331d..f10b379757 100644 --- a/docs/features/techdocs/using-cloud-storage.md +++ b/docs/features/techdocs/using-cloud-storage.md @@ -145,7 +145,7 @@ You should follow the TechDocs needs access to read files and metadata of the S3 bucket. So if you are creating a policy for a user you want to make sure it is granted access to -ListBucket, GetObject and PutObject. +ListObjects, GetObject and PutObject. If the environment variables From ea0723fd5f4bcc656b3d219cad335341f7fec6d8 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Wed, 17 Mar 2021 10:15:48 +0100 Subject: [PATCH 10/11] Add and change terraform variables Signed-off-by: Jacob Valdemar Andreasen --- contrib/terraform/techdocs-s3-storage/terraform.tf | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf index d8d57e9cd6..6dea091492 100644 --- a/contrib/terraform/techdocs-s3-storage/terraform.tf +++ b/contrib/terraform/techdocs-s3-storage/terraform.tf @@ -3,9 +3,17 @@ #========================== variable "backstage" { + default = "backstage_bucket_for_my_corp" +} + +variable "backstage-iam" { default = "backstage" } +variable "shared-managed-tag-value" { + default = "terraform_for_my_corp" +} + #========================== # Bucket #========================== @@ -48,11 +56,11 @@ resource "aws_s3_bucket_public_access_block" "backstage" { #========================== resource "aws_iam_user" "backstage" { - name = var.backstage + name = var.backstage-iam } resource "aws_iam_user_policy" "backstage" { - name = var.backstage + name = var.backstage-iam user = aws_iam_user.backstage.name policy = data.aws_iam_policy_document.backstage-policy.json } From c65a85afb691700ddb795f2a4b9d9dc0b2648a13 Mon Sep 17 00:00:00 2001 From: Jacob Valdemar Andreasen Date: Wed, 7 Apr 2021 12:32:43 +0200 Subject: [PATCH 11/11] Change terraform variable and fix typo in docs Signed-off-by: Jacob Valdemar Andreasen --- contrib/terraform/techdocs-s3-storage/terraform.tf | 6 +++--- docs/features/techdocs/using-cloud-storage.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/contrib/terraform/techdocs-s3-storage/terraform.tf b/contrib/terraform/techdocs-s3-storage/terraform.tf index 6dea091492..ca267f0f12 100644 --- a/contrib/terraform/techdocs-s3-storage/terraform.tf +++ b/contrib/terraform/techdocs-s3-storage/terraform.tf @@ -2,7 +2,7 @@ # Variables #========================== -variable "backstage" { +variable "backstage-bucket" { default = "backstage_bucket_for_my_corp" } @@ -19,7 +19,7 @@ variable "shared-managed-tag-value" { #========================== resource "aws_s3_bucket" "backstage" { - bucket = var.backstage + bucket = var.backstage-bucket acl = "private" provider = aws @@ -36,7 +36,7 @@ resource "aws_s3_bucket" "backstage" { } tags = { - Name = var.backstage + Name = var.backstage-bucket "Managed By Terraform" = var.shared-managed-tag-value } } diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md index f10b379757..2f5828331d 100644 --- a/docs/features/techdocs/using-cloud-storage.md +++ b/docs/features/techdocs/using-cloud-storage.md @@ -145,7 +145,7 @@ You should follow the TechDocs needs access to read files and metadata of the S3 bucket. So if you are creating a policy for a user you want to make sure it is granted access to -ListObjects, GetObject and PutObject. +ListBucket, GetObject and PutObject. If the environment variables