Skip to content

Commit ba3dc9f

Browse files
furkantektasfurkantektas
committed
Initial commit
0 parents  commit ba3dc9f

14 files changed

Lines changed: 612 additions & 0 deletions

File tree

‎.gitignore‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
.terraform
2+
3+
# use a backend!
4+
*.tfstate*
5+
6+
sftp-idp.zip
7+
8+
# not using lockfiles for the moment
9+
.terraform.lock.hcl
10+
11+
.vscode/
12+
.idea/
13+
*/plan.out
14+
.DS_Store

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2022 Bubo.AI
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# SFTP Server with custom domain on AWS
2+
3+
This terraform module creates an SFTP server with a custom subdomain and multiple users. Each user has its own directory under the same bucket created upon deployment. You can deploy this module several times in the same account using different prefixes. Each deployment creates an S3 bucket to keep users data but different users can not see each others files.
4+
5+
This module creates a public AWS Transfer Service configured to use a lambda as an identity provider to authenticate one or more users against stored credentials in the AWS Secrets.
6+
7+
> After deploying this service, go to the secret manager and replace the secret key `Password` for each user with a bcrypt hash. Default value for password is `REPLACE_ME` (as plain text). To generate a bcrypt hash, use the command below and replace `PASSWORDHERE` with your own password.
8+
> ```python
9+
> python -c 'import bcrypt; print(bcrypt.hashpw("PASSWORDHERE".encode("utf-8"), bcrypt.gensalt()))'
10+
> ```
11+
12+
## Requirements
13+
14+
This module assumes you have a DNS Zone in AWS. An alias (CNAME) record will be created for every member of `subdomains` variable.
15+
16+
> **This module is only available in \*nix environment where python3 is available.**
17+
>
18+
> In order to deploy the lambda script with `bcrypt` dependency, you need to have `python` available in the `PATH`. `bcrypt` and its dependencies will be installed via `python -m pip` command. This module install dependencies to match with lambda runtime which is Python 3.9. For more information, please refer to [python packager module](https://github.com/Bubo-AI/terraform-python-packager).
19+
20+
21+
## Usage
22+
23+
$ terraform init
24+
$ terraform plan
25+
$ terraform apply
26+
27+
## Example User Configuration
28+
29+
Once the service has been deployed, a sample user will be created in the secret manager with the following configuration:
30+
31+
Secret Name: `prefix`-SFTP/user1
32+
33+
34+
| UserId | HomeDirectoryDetails | Role | Password | _AcceptedIpNetwork*_ |
35+
|--------|----------------------|------|----------|-------------------|
36+
| user1 | `[{\"Entry\": \"/\", \"Target\": \"/s3_bucket/user1\"}]` | arn:aws:iam::`ACCOUNT_ID`:role/`prefix`-transfer-user-iam-role-user1 | `BCRPYT_HASH` | `192.168.1.0/24` |
37+
38+
**user1** is chroot'd to the **/s3_bucket/user1** directory in S3.
39+
40+
\* **_AcceptedIpNetwork_** is an optional CIDR for the allowed client source IP address range. You can specify multiple CIDR by separating with comma, e.g.: `192.0.0.0/24, 224.0.0.0/16`. Please note that ignored bits in the CIDR should be zero. For instance, 192.168.1.1/24 is an invalid CIDR as 24th bith onwards should be zero. Therefore the correct version is `192.168.1.0/24`.
41+
42+
43+
## Example Usage
44+
45+
```hcl
46+
module "sftp_server" {
47+
source = "github.com/Bubo-AI/terraform-aws-transfer-s3-route53?ref=v0.1.0"
48+
usernames = ["sftp_user_1", "sftp_user_2"]
49+
prefix = "acme"
50+
subdomains = ["sftp"]
51+
r53_zone = "acme.com"
52+
logging_bucket = "acme-sftp-access-logs"
53+
}
54+
55+
```
56+
57+
Fully working example can be found in [`examples`](examples/).
58+
59+
60+
## Outputs
61+
62+
| Name | Description |
63+
|----------------------|------------------------------------------------------|
64+
| usernames | List of usernames created |
65+
| roles | The roles created for each user |
66+
| user_secrets | The secret manager keys created for each user |
67+
| bucket_id | The bucket where AWS Transfer is connected to |
68+
| bucket_kms_key | KMS key used to encrypt S3 bucket |
69+
| secret_kms_key | KMS key used to encrypt Secret Manager secretts |
70+
| transfer_endpoint | The endpoint of the AWS Transfer service |
71+
| route53_endpoint | Subdomains created as an alias to transfer_endpoint |
72+

‎bucket.tf‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
data "aws_s3_bucket" "logging" {
2+
bucket = var.logging_bucket
3+
}
4+
5+
# enable logging to logging_bucket
6+
data "aws_iam_policy_document" "allow_logging_to_logging_bucket" {
7+
statement {
8+
sid = "S3PolicyLoggingAccessStmt"
9+
principals {
10+
type = "Service"
11+
identifiers = ["logging.s3.amazonaws.com"]
12+
}
13+
actions = ["s3:PutObject"]
14+
resources = ["${data.aws_s3_bucket.logging.arn}/*"]
15+
}
16+
}
17+
18+
# attach logging policy to logging_bucket
19+
resource "aws_s3_bucket_policy" "allow_logging_to_logging_bucket" {
20+
bucket = data.aws_s3_bucket.logging.id
21+
policy = data.aws_iam_policy_document.allow_logging_to_logging_bucket.json
22+
}
23+
24+
# rotating KMS key for S3
25+
resource "aws_kms_key" "s3_key" {
26+
description = "This key is used to encrypt bucket objects"
27+
deletion_window_in_days = 10
28+
enable_key_rotation = true
29+
}
30+
31+
# Data bucket for SFTP server, tfsec warnings supressed as aws provider > 4 has not been supported yet
32+
# tfsec:ignore:aws-s3-enable-bucket-logging
33+
# tfsec:ignore:aws-s3-enable-versioning
34+
# tfsec:ignore:aws-s3-enable-bucket-encryption
35+
# tfsec:ignore:aws-s3-encryption-customer-key
36+
# tfsec:ignore:aws-s3-enable-default-server-side-encryption
37+
resource "aws_s3_bucket" "sftp" {
38+
bucket_prefix = "${local.prefix_kebab}sftpbucket"
39+
}
40+
41+
resource "aws_s3_bucket_acl" "this" {
42+
bucket = aws_s3_bucket.sftp.id
43+
acl = "private"
44+
}
45+
46+
resource "aws_s3_bucket_versioning" "this" {
47+
bucket = aws_s3_bucket.sftp.id
48+
versioning_configuration {
49+
status = "Enabled"
50+
}
51+
}
52+
53+
resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
54+
bucket = aws_s3_bucket.sftp.id
55+
56+
rule {
57+
apply_server_side_encryption_by_default {
58+
kms_master_key_id = aws_kms_key.s3_key.arn
59+
sse_algorithm = "aws:kms"
60+
}
61+
}
62+
}
63+
64+
resource "aws_s3_bucket_logging" "this" {
65+
bucket = aws_s3_bucket.sftp.id
66+
target_bucket = data.aws_s3_bucket.logging.id
67+
target_prefix = var.prefix
68+
}
69+
70+
# block all public access to data bucket
71+
resource "aws_s3_bucket_public_access_block" "sftp" {
72+
bucket = aws_s3_bucket.sftp.id
73+
block_public_acls = true
74+
block_public_policy = true
75+
ignore_public_acls = true
76+
restrict_public_buckets = true
77+
}

‎example/main.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
module "sftp_server" {
2+
source = "../"
3+
usernames = ["sftp_user_1", "sftp_user_2"]
4+
prefix = "acme"
5+
subdomains = ["sftp"]
6+
r53_zone = "acme.com"
7+
logging_bucket = "acme-sftp-access-logs"
8+
}

‎example/output.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
output "usernames" {
2+
value = module.sftp_server.usernames
3+
}
4+
5+
output "roles" {
6+
value = module.sftp_server.roles
7+
}
8+
9+
output "user_secrets" {
10+
value = module.sftp_server.user_secrets
11+
}
12+
13+
output "bucket_id" {
14+
value = module.sftp_server.bucket_id
15+
}
16+
17+
output "bucket_kms_key" {
18+
value = module.sftp_server.bucket_kms_key
19+
}
20+
21+
output "secret_kms_key" {
22+
value = module.sftp_server.secret_kms_key
23+
}
24+
25+
output "transfer_endpoint" {
26+
value = module.sftp_server.transfer_endpoint
27+
}
28+
29+
output "route53_endpoint" {
30+
value = module.sftp_server.route53_endpoint
31+
}
32+

‎iam.tf‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
resource "aws_iam_role" "transfer" {
2+
for_each = toset(var.usernames)
3+
name = "${local.prefix_kebab}transfer-user-iam-role-${each.key}"
4+
5+
assume_role_policy = <<EOF
6+
{
7+
"Version": "2012-10-17",
8+
"Statement": [
9+
{
10+
"Effect": "Allow",
11+
"Principal": {
12+
"Service": "transfer.amazonaws.com"
13+
},
14+
"Action": "sts:AssumeRole"
15+
}
16+
]
17+
}
18+
EOF
19+
}
20+
21+
resource "aws_iam_role_policy" "transfer" {
22+
for_each = toset(var.usernames)
23+
24+
name = "${local.prefix_kebab}transfer-user-iam-policy-${each.key}"
25+
role = aws_iam_role.transfer[each.key].id
26+
27+
policy = <<-POLICY
28+
{
29+
"Version": "2012-10-17",
30+
"Statement": [
31+
{
32+
"Sid": "AllowListingOfUserFolder",
33+
"Action": [
34+
"s3:ListBucket",
35+
"s3:GetBucketLocation"
36+
],
37+
"Effect": "Allow",
38+
"Resource": [
39+
"${aws_s3_bucket.sftp.arn}"
40+
],
41+
"Condition": {
42+
"StringLike": {
43+
"s3:prefix": [
44+
"${each.key}/*",
45+
"${each.key}"
46+
]
47+
}
48+
}
49+
},
50+
{
51+
"Sid": "HomeDirObjectAccess",
52+
"Effect": "Allow",
53+
"Action": [
54+
"s3:PutObject",
55+
"s3:GetObject",
56+
"s3:DeleteObjectVersion",
57+
"s3:DeleteObject",
58+
"s3:GetObjectVersion"
59+
],
60+
"Resource": [
61+
"${aws_s3_bucket.sftp.arn}/${each.key}",
62+
"${aws_s3_bucket.sftp.arn}/${each.key}/*"
63+
]
64+
},
65+
{
66+
"Sid": "EncryptionKeyAccess",
67+
"Action": [
68+
"kms:Decrypt",
69+
"kms:Encrypt",
70+
"kms:GenerateDataKey",
71+
"kms:DescribeKey",
72+
"kms:ReEncrypt"
73+
],
74+
"Effect": "Allow",
75+
"Resource": "${aws_kms_key.s3_key.arn}"
76+
}
77+
]
78+
}
79+
POLICY
80+
}

‎locals.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
locals {
2+
prefix_kebab = var.prefix == "" ? var.prefix : "${var.prefix}-" # for kebab case resource names
3+
prefix_snake = var.prefix == "" ? var.prefix : "${var.prefix}_" # for snake case resource names
4+
}

‎output.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
output "usernames" {
2+
value = var.usernames
3+
}
4+
5+
output "roles" {
6+
value = {
7+
for k, v in aws_iam_role.transfer : k => v.name
8+
}
9+
}
10+
11+
output "user_secrets" {
12+
value = {
13+
for k, v in aws_secretsmanager_secret.user : k => v.name
14+
}
15+
}
16+
17+
output "bucket_id" {
18+
value = aws_s3_bucket.sftp.id
19+
}
20+
21+
output "bucket_kms_key" {
22+
value = aws_kms_key.s3_key.arn
23+
}
24+
25+
output "secret_kms_key" {
26+
value = aws_kms_key.secret_key.arn
27+
}
28+
29+
output "transfer_endpoint" {
30+
value = aws_transfer_server.sftp.endpoint
31+
}
32+
33+
output "route53_endpoint" {
34+
value = [
35+
for k, v in aws_route53_record.this : "${v.name}.${data.aws_route53_zone.this.name}"
36+
]
37+
}
38+

‎route53.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
data "aws_route53_zone" "this" {
2+
name = var.r53_zone
3+
private_zone = false
4+
}
5+
6+
# if more than one subdomain names specified, create a new record set for each
7+
resource "aws_route53_record" "this" {
8+
for_each = toset(var.subdomains)
9+
type = "CNAME"
10+
name = each.key
11+
ttl = 600
12+
records = [aws_transfer_server.sftp.endpoint]
13+
zone_id = data.aws_route53_zone.this.zone_id
14+
}
15+
16+
# associate the first subdomain with the sftp server endpoint
17+
resource "null_resource" "associate_custom_hostname" {
18+
provisioner "local-exec" {
19+
command = <<EOF
20+
aws transfer tag-resource \
21+
--arn '${aws_transfer_server.sftp.arn}' \
22+
--tags \
23+
'Key=aws:transfer:customHostname,Value=${var.subdomains[0]}.${data.aws_route53_zone.this.name}' \
24+
'Key=aws:transfer:route53HostedZoneId,Value=/hostedzone/${data.aws_route53_zone.this.zone_id}'
25+
EOF
26+
}
27+
depends_on = [aws_transfer_server.sftp, data.aws_route53_zone.this, aws_route53_record.this]
28+
}

0 commit comments

Comments
 (0)