https://blog.serverworks.co.jp/2022/02/01/144012
https://docs.aws.amazon.com/waf/latest/developerguide/getting-started.html
-- 1. コマンド等のインストール
-- 1.1 aws cli version 2 インストール
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version
-- 1.2 jqインストール
sudo yum -y install jq
-- 2. S3 バケットを作成する
aws s3 ls
aws s3 mb s3://bucket123
-- 3. インデックスドキュメントの設定
vim index.html
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title>My Website Home Page</title>
</head>
<body>
<h1>Welcome to my website</h1>
<p>Now hosted on Amazon S3!</p>
</body>
</html>
aws s3api put-object --bucket bucket123 --key index.html --body index.html --content-type text/html
-- 4. ディストリビューションの作成
aws cloudfront create-distribution \
--origin-domain-name bucket123.s3.ap-northeast-1.amazonaws.com \
--default-root-object index.html
aws cloudfront list-distributions
aws cloudfront get-distribution \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000
-- 5. OAIの作成
aws cloudfront create-cloud-front-origin-access-identity \
--cloud-front-origin-access-identity-config '{
"CallerReference": "caller01",
"Comment": "oai01"
}'
aws cloudfront list-cloud-front-origin-access-identities
aws cloudfront get-cloud-front-origin-access-identity \
--id 11111111111111
-- 6. OAIをディストリビューションに追加する
aws cloudfront get-distribution \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .DistributionConfig > distribution.json
Origins -> Items -> CustomHeaders の下の
CustomOriginConfigを削除して下記S3OriginConfigを追加
"S3OriginConfig": {
"OriginAccessIdentity": "origin-access-identity/cloudfront/11111111111111"
},
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .ETag
aws cloudfront update-distribution \
--id 0000000000000 \
--if-match 22222222222222 \
--distribution-config file://distribution.json
-- 7. OAI に Amazon S3 バケット内のファイルの読み込みアクセス許可を付与する
{
"Version": "2012-10-17",
"Id": "PolicyForCloudFrontPrivateContent",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity 11111111111111"
},
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::bucket123/*"
}
]
}
aws s3api put-bucket-policy \
--bucket bucket123 \
--policy file://b.json
aws s3api get-bucket-policy \
--bucket bucket123
-- 8. 動作確認(web ACL設定前)
curl -v -X GET http://xxxxxxxxxxxxxx.cloudfront.net/index.html
-- 9. web ACL作成
aws wafv2 create-web-acl \
--name acl01 \
--scope CLOUDFRONT \
--region us-east-1 \
--default-action '{
"Allow": {}
}' \
--rules ' [
{
"Name": "rule01",
"Priority": 0,
"Statement": {
"GeoMatchStatement": {
"CountryCodes": [
"JP"
]
}
},
"Action": {
"Block": {}
},
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "rule01"
}
}
]' \
--visibility-config '{
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "acl01"
}'
aws wafv2 list-web-acls \
--scope CLOUDFRONT \
--region us-east-1
aws wafv2 get-web-acl \
--name acl01 \
--scope CLOUDFRONT \
--region us-east-1 \
--id 33333333-3333-3333-3333-333333333333
-- 10. web ACLをディストリビューションへ関連付ける
aws cloudfront get-distribution \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .DistributionConfig > distribution.json
WebACLIdにARNを設定
"WebACLId": "arn:aws:wafv2:us-east-1:999999999999:global/webacl/acl01/44444444-4444-4444-4444-444444444444",
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .ETag
aws cloudfront update-distribution \
--id 0000000000000 \
--if-match 5555555555555 \
--distribution-config file://distribution.json
-- 11. 動作確認(web ACL設定後)
curl -v -X GET http://xxxxxxxxxxxxxx.cloudfront.net/index.html
-- 12. クリーンアップ
-- ディストリビューションの無効化
aws cloudfront get-distribution \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000
※ distribution.jsonはget-distribution-configコマンドのDistributionConfigから取得し、Enabledをfalseに変更する
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .DistributionConfig > distribution.json
sed -i 's/"Enabled": true/"Enabled": false/' distribution.json
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .ETag
aws cloudfront update-distribution \
--id 0000000000000 \
--if-match 66666666666666 \
--distribution-config file://distribution.json
※ if-matchにはETagの値をセット
無効化されるまで待つ
-- ディストリビューションの削除
aws cloudfront get-distribution \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000
aws cloudfront get-distribution-config \
--id 0000000000000 | jq -r .ETag
aws cloudfront delete-distribution \
--id 0000000000000 \
--if-match 7777777777777
aws cloudfront list-distributions
-- OAIの削除
aws cloudfront list-cloud-front-origin-access-identities
aws cloudfront get-cloud-front-origin-access-identity \
--id 11111111111111
aws cloudfront delete-cloud-front-origin-access-identity \
--id 11111111111111 \
--if-match 88888888888888
aws s3 rb s3://bucket123 --force
-- web ACLの削除
aws wafv2 list-web-acls \
--scope CLOUDFRONT \
--region us-east-1
aws wafv2 get-web-acl \
--name acl01 \
--scope CLOUDFRONT \
--region us-east-1 \
--id 33333333-3333-3333-3333-333333333333
aws wafv2 delete-web-acl \
--name acl01 \
--scope CLOUDFRONT \
--region us-east-1 \
--id 33333333-3333-3333-3333-333333333333 \
--lock-token aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
※lock-tokenはget-web-aclの出力値から取得する