Manage S3 CORS headers in Terraform and add them for production

[tadhg-ohiggins]

Background

We manually added the required CORS headers to the S3 buckets for fac-dev.app.cloud.gov and fac-staging.app.cloud.gov but should manage this with Terraform.

WE DID NOT DO THIS FOR THE PRODUCTION ENVIRONMENT. So that still needs to be set up, preferably by the Terraform process that will cover all of the environments.

We used this command to set the CORS headers:

aws s3api put-bucket-cors --bucket [BUCKET_NAME] --cors-configuration file://cors.json

where [BUCKET_NAME] is the name of the bucket for that environment. The contents of cors.json were:

{
   "CORSRules": [
      {
         "AllowedHeaders": [
            "Authorization"
         ],
         "AllowedMethods": [
            "HEAD",
            "GET"
         ],
         "AllowedOrigins": [
            "https://[ENV_DOMAIN]"
         ],
         "ExposeHeaders": [
            "ETag"
         ]
      }
   ]
}

where [ENV_DOMAIN] was fac-dev.app.cloud.gov for dev and fac-staging.app.cloud.gov for staging.

For reference, the commands for this are included below:

SERVICE_INSTANCE_NAME=fac-public-s3;
KEY_NAME=fac-public-s3-key;
cf create-service-key "${SERVICE_INSTANCE_NAME}" "${KEY_NAME}";
S3_CREDENTIALS=`cf service-key "${SERVICE_INSTANCE_NAME}" "${KEY_NAME}" | tail -n +2`;
export AWS_ACCESS_KEY_ID=`echo "${S3_CREDENTIALS}" | jq -r .access_key_id`;
export AWS_SECRET_ACCESS_KEY=`echo "${S3_CREDENTIALS}" | jq -r .secret_access_key`;
export BUCKET_NAME=`echo "${S3_CREDENTIALS}" | jq -r .bucket`;
export AWS_DEFAULT_REGION=`echo "${S3_CREDENTIALS}" | jq -r '.region'`;
echo $BUCKET_NAME;
aws s3api put-bucket-cors --bucket $BUCKET_NAME --cors-configuration file://cors.json;
aws s3api get-bucket-cors --bucket $BUCKET_NAME;
cf delete-service-key "${SERVICE_INSTANCE_NAME}" "${KEY_NAME}";

Acceptance Criteria (We'll know we're done when...)

• Setting the CORS headers for the S3 buckets for each environment is handled by Terraform.
• The CORS headers have been set for the S3 bucket for the production environment.

[tadhg-ohiggins]

Also, we had to manually run cf bind-service for the private S3 bucket for both dev and staging, that should also probably be handled by terraform? Do we need a separate ticket for that?

[mogul]

Also, we had to manually run cf bind-service for the private S3 bucket for both dev and staging, that should also probably be handled by terraform? Do we need a separate ticket for that?

We should specify that in the application manifest, as we do for the public bucket.

[tadhg-ohiggins]

Also, we had to manually run cf bind-service for the private S3 bucket for both dev and staging, that should also probably be handled by terraform? Do we need a separate ticket for that?

We should specify that in the application manifest, as we do for the public bucket.

@mogul I added that here: #1374

[mogul]

Noting for later: We would do this by having a null_resource with a local-exec provisioner call a local script that basically performs the commands Tadhg listed. The null_resource will needs a depends_on for the module that creates the S3 bucket.

[jadudm]

@tadhg-ohiggins , is this... debt? Something we should flag as revisit and come back to?

[tadhg-ohiggins]

@jadudm No, this is something that appears to still be causing problems in production, or at least there are images failing to load that report CORS errors in the browser console, so I strongly suspect those are due to this not having been done.

[jadudm]

I have not yet been able to prioritize this, given many other needs. It should remain in the pile for @dan Swick - Q2ABD ***@***.***> and I to map in as part of our continued board cleanup.

…

On Wed, Nov 29, 2023 at 2:09 PM tadhg-ohiggins ***@***.***> wrote: @jadudm <https://github.com/jadudm> No, this is something that appears to still be causing problems in production, or at least there are images failing to load that report CORS errors in the browser console, so I strongly suspect those are due to this not having been done. — Reply to this email directly, view it on GitHub <#1352 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAJLEQL4FWFY2PT2KYCX4DYG6B5NAVCNFSM6AAAAAAZWG5F46VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMZSGUZTGOJYHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>