[DOM-56489] Add CORS configuration for Flyte S3 buckets (#243)

* Add CORS configuration to the Flyte data bucket to support the UI directly accessing links * Use * for the host to allows the browser pointed at the Domino ingress to load content from S3 buckets directly via either GET or HEAD requests --------- Co-authored-by: ddl-ebrown <[email protected]> Co-authored-by: Ethan Brown (Domino) <[email protected]>
dominodatalab · Apr 26, 2024 · 0b94be5 · 0b94be5
1 parent 730b398
commit 0b94be5
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 1 deletion.
diff --git a/modules/flyte/README.md b/modules/flyte/README.md
@@ -31,6 +31,7 @@ No modules.
 | [aws_iam_role_policy_attachment.flyte_dataplane](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_s3_bucket.flyte_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
 | [aws_s3_bucket.flyte_metadata](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
+| [aws_s3_bucket_cors_configuration.flyte_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource |
 | [aws_s3_bucket_policy.flyte_data](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_policy.flyte_metadata](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
 | [aws_s3_bucket_server_side_encryption_configuration.flye_metadata_encryption](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |

diff --git a/modules/flyte/s3.tf b/modules/flyte/s3.tf
@@ -106,3 +106,14 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "flyte_data_encryp
     ]
   }
 }
+
+resource "aws_s3_bucket_cors_configuration" "flyte_data" {
+  bucket = aws_s3_bucket.flyte_data.id
+
+  cors_rule {
+    allowed_headers = []
+    allowed_methods = ["GET", "HEAD"]
+    allowed_origins = ["*"]
+    max_age_seconds = 3000
+  }
+}
diff --git a/modules/flyte/variables.tf b/modules/flyte/variables.tf
@@ -82,7 +82,6 @@ variable "region" {
   }
 }
 
-
 variable "use_fips_endpoint" {
   description = "Use aws FIPS endpoints"
   type        = bool

diff --git a/modules/iam-bootstrap/bootstrap-0.json b/modules/iam-bootstrap/bootstrap-0.json
@@ -27,6 +27,7 @@
         "s3:*Object",
         "s3:PutAccountPublicAccessBlock",
         "s3:PutBucketAcl",
+        "s3:PutBucketCORS",
         "s3:PutBucketLogging",
         "s3:PutBucketNotification",
         "s3:PutBucketOwnershipControls",
-Original file line number
+Diff line change
@@ Expand Up / @@ -82,7 +82,6 @@ variable "region" { @@
       }
     }
     variable "use_fips_endpoint" {
       description = "Use aws FIPS endpoints"
       type        = bool
@@ Expand Down @@