Cloud: Media and Remote Storage

apiVersion: batch/v1
kind: Job
metadata:
  name: pocketcoffee-image-resize
  namespace: pocketcoffee
spec:
  backoffLimit: 0
  ttlSecondsAfterFinished: 86400
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pocketcoffee-image-resize
    spec:
      restartPolicy: Never
      serviceAccountName: {{ include "pc.serviceAccountName" . }}
      containers:
        - name: resize
          image: {{ include "pc.image" . }}
          command: ["bin/magento", "catalog:images:resize"]
          envFrom:
            {{- include "pc.envFrom" . | nindent 12 }}
          env:
            {{- include "pc.mediaEnv" . | nindent 12 }}
          resources:
            requests:
              cpu: "1"
              memory: 1Gi
            limits:
              memory: 2Gi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            {{- include "pc.mediaVolumeMounts" . | nindent 12 }}
            - name: env-php
              mountPath: /var/www/html/app/etc/env.php
              subPath: env.php
              readOnly: true
      volumes:
        {{- include "pc.mediaVolumes" . | nindent 8 }}
        - name: env-php
          configMap:
            name: pocketcoffee-env-php

#!/usr/bin/env bash
# Remove the resized product images outside Magento, tell Magento, then build them again.
set -euo pipefail

aws s3 rm s3://pocketcoffee-prod-media/media/catalog/product/cache/ --recursive --region eu-west-1 --only-show-errors
bin/magento cache:flush
bin/magento catalog:images:resize

terraform {
  required_version = ">= 1.8"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.70"
    }
  }
}

provider "aws" {
  region = "eu-west-1"
}

# media-s3.tf: bucket, CloudFront distribution for media.pocketcoffee.example and the pod role.
variable "media_certificate_arn" {
  description = "ACM certificate for media.pocketcoffee.example, issued in us-east-1."
  type        = string
}

variable "route53_zone_id" {
  description = "Hosted zone of pocketcoffee.example."
  type        = string
}

variable "cluster_name" {
  type    = string
  default = "pocketcoffee-prod"
}

resource "aws_s3_bucket" "media" {
  bucket = "pocketcoffee-prod-media"
}

resource "aws_s3_bucket_public_access_block" "media" {
  bucket                  = aws_s3_bucket.media.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "media" {
  bucket = aws_s3_bucket.media.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_versioning" "media" {
  bucket = aws_s3_bucket.media.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "media" {
  bucket = aws_s3_bucket.media.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "media" {
  bucket = aws_s3_bucket.media.id

  rule {
    id     = "expire-noncurrent-versions"
    status = "Enabled"

    filter {}

    noncurrent_version_expiration {
      noncurrent_days = 30
    }

    abort_incomplete_multipart_upload {
      days_after_initiation = 7
    }
  }

  # The resized images are a cache that Magento rebuilds; do not keep their old versions at all.
  rule {
    id     = "expire-resized-image-versions"
    status = "Enabled"

    filter {
      prefix = "media/catalog/product/cache/"
    }

    noncurrent_version_expiration {
      noncurrent_days = 1
    }
  }
}

resource "aws_cloudfront_origin_access_control" "media" {
  name                              = "pocketcoffee-prod-media"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

# Viewer-request function: the paths that the nginx sample of Magento denies are never served from the bucket.
resource "aws_cloudfront_function" "media_deny" {
  name    = "pocketcoffee-media-deny"
  runtime = "cloudfront-js-2.0"
  comment = "Deny the private subfolders of pub/media"
  publish = true
  code    = <<-EOT
    var denied = [
      '/media/customer/',
      '/media/customer_address/',
      '/media/downloadable/',
      '/media/import/',
      '/media/custom_options/'
    ];

    function handler(event) {
      var uri = event.request.uri;
      var isDenied = denied.some(function (prefix) { return uri.indexOf(prefix) === 0; });
      if (isDenied || /^\/media\/theme_customization\/.*\.xml$/.test(uri)) {
        return { statusCode: 403, statusDescription: 'Forbidden' };
      }
      return event.request;
    }
  EOT
}

data "aws_cloudfront_cache_policy" "optimized" {
  name = "Managed-CachingOptimized"
}

resource "aws_cloudfront_response_headers_policy" "media" {
  name = "pocketcoffee-media"

  custom_headers_config {
    items {
      header   = "Cache-Control"
      value    = "public, max-age=31536000"
      override = false
    }
  }
}

resource "aws_cloudfront_distribution" "media" {
  enabled         = true
  is_ipv6_enabled = true
  http_version    = "http2and3"
  aliases         = ["media.pocketcoffee.example"]
  comment         = "Pocket Coffee: pub/media from S3"

  origin {
    origin_id                = "media"
    domain_name              = aws_s3_bucket.media.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.media.id
  }

  default_cache_behavior {
    target_origin_id           = "media"
    viewer_protocol_policy     = "redirect-to-https"
    allowed_methods            = ["GET", "HEAD"]
    cached_methods             = ["GET", "HEAD"]
    cache_policy_id            = data.aws_cloudfront_cache_policy.optimized.id
    response_headers_policy_id = aws_cloudfront_response_headers_policy.media.id
    compress                   = true

    function_association {
      event_type   = "viewer-request"
      function_arn = aws_cloudfront_function.media_deny.arn
    }
  }

  # Without s3:ListBucket for CloudFront, S3 answers 403 for a missing key; show it as 404 and do not keep it for long.
  custom_error_response {
    error_code            = 403
    response_code         = 404
    error_caching_min_ttl = 10
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = var.media_certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

data "aws_iam_policy_document" "media_bucket" {
  statement {
    sid       = "AllowCloudFrontReadMedia"
    actions   = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.media.arn}/media/*"]

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = [aws_cloudfront_distribution.media.arn]
    }
  }

  statement {
    sid       = "DenyInsecureTransport"
    effect    = "Deny"
    actions   = ["s3:*"]
    resources = [aws_s3_bucket.media.arn, "${aws_s3_bucket.media.arn}/*"]

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["false"]
    }
  }
}

resource "aws_s3_bucket_policy" "media" {
  bucket = aws_s3_bucket.media.id
  policy = data.aws_iam_policy_document.media_bucket.json

  depends_on = [aws_s3_bucket_public_access_block.media]
}

resource "aws_route53_record" "media" {
  zone_id = var.route53_zone_id
  name    = "media.pocketcoffee.example"
  type    = "A"

  alias {
    name                   = aws_cloudfront_distribution.media.domain_name
    zone_id                = aws_cloudfront_distribution.media.hosted_zone_id
    evaluate_target_health = false
  }
}

# pod-role.tf: the role of the Magento pods, bound to the service account with EKS Pod Identity.
data "aws_iam_policy_document" "pod_trust" {
  statement {
    actions = ["sts:AssumeRole", "sts:TagSession"]

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }
  }
}

data "aws_iam_policy_document" "magento_media" {
  statement {
    sid       = "ListBucket"
    actions   = ["s3:ListBucket", "s3:GetBucketLocation"]
    resources = [aws_s3_bucket.media.arn]
  }

  statement {
    sid = "ReadWriteObjects"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:AbortMultipartUpload",
      "s3:ListMultipartUploadParts",
    ]
    resources = ["${aws_s3_bucket.media.arn}/*"]
  }
}

resource "aws_iam_role" "magento" {
  name               = "pocketcoffee-prod-magento"
  assume_role_policy = data.aws_iam_policy_document.pod_trust.json
}

resource "aws_iam_role_policy" "magento_media" {
  name   = "media-bucket"
  role   = aws_iam_role.magento.id
  policy = data.aws_iam_policy_document.magento_media.json
}

resource "aws_eks_pod_identity_association" "magento" {
  cluster_name    = var.cluster_name
  namespace       = "pocketcoffee"
  service_account = "pocketcoffee-magento"
  role_arn        = aws_iam_role.magento.arn
}

output "media_bucket" {
  value = aws_s3_bucket.media.bucket
}

output "media_distribution_id" {
  value = aws_cloudfront_distribution.media.id
}

output "magento_role_arn" {
  value = aws_iam_role.magento.arn
}

# media-efs.tf: only for media.mode=efs. The file system and its mount targets belong to the infrastructure module.
variable "efs_file_system_id" {
  description = "ID of the EFS file system pocketcoffee-prod-media."
  type        = string
  default     = ""
}

resource "aws_efs_access_point" "media" {
  count          = var.efs_file_system_id == "" ? 0 : 1
  file_system_id = var.efs_file_system_id

  posix_user {
    uid = 33
    gid = 33
  }

  root_directory {
    path = "/pocketcoffee/media"

    creation_info {
      owner_uid   = 33
      owner_gid   = 33
      permissions = "0775"
    }
  }

  tags = {
    Name = "pocketcoffee-media"
  }
}

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pocketcoffee-media
spec:
  capacity:
    storage: 200Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ""
  mountOptions:
    - tls
  csi:
    driver: efs.csi.aws.com
    volumeHandle: fs-0123456789abcdef0::fsap-0123456789abcdef0
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pocketcoffee-media
  namespace: pocketcoffee
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: ""
  volumeName: pocketcoffee-media
  resources:
    requests:
      storage: 200Gi

# media.mode=efs: pub/media is the shared volume; the private subfolders are denied as in the Magento sample.
location /media/ {
    expires 1y;
    add_header Cache-Control "public";
    try_files $uri =404;
}

location ~ ^/media/(customer|customer_address|downloadable|import|custom_options)/ {
    deny all;
}

location ~ ^/media/theme_customization/.*\.xml$ {
    deny all;
}

{{- /* Fragment: the media variables that the env.php template reads (listing 1). */ -}}
{{- define "pc.mediaEnv" -}}
- name: MAGENTO_MEDIA_MODE
  value: {{ .Values.media.mode | quote }}
- name: MAGENTO_MEDIA_BASE_URL
  value: {{ .Values.media.baseUrl | quote }}
{{- if eq .Values.media.mode "s3" }}
- name: MAGENTO_S3_BUCKET
  value: {{ .Values.media.bucket | quote }}
- name: MAGENTO_S3_REGION
  value: eu-west-1
{{- end }}
{{- end -}}

{{- define "pc.mediaVolumeMounts" -}}
- name: var
  mountPath: /var/www/html/var
- name: tmp
  mountPath: /tmp
{{- if eq .Values.media.mode "efs" }}
- name: media
  mountPath: /var/www/html/pub/media
{{- end }}
{{- end -}}

{{- define "pc.mediaVolumes" -}}
- name: var
  emptyDir:
    sizeLimit: 2Gi
- name: tmp
  emptyDir:
    sizeLimit: 1Gi
{{- if eq .Values.media.mode "efs" }}
- name: media
  persistentVolumeClaim:
    claimName: {{ .Values.media.claimName }}
{{- end }}
{{- end -}}

#!/usr/bin/env bash
# On the old server: copy pub/media to the bucket under the key prefix media/, without the generated image cache.
set -euo pipefail

cd /var/www/pocketcoffee
aws s3 sync pub/media s3://pocketcoffee-prod-media/media/ \
  --region eu-west-1 \
  --exclude "catalog/product/cache/*" \
  --exclude "tmp/*"

#!/usr/bin/env bash
# Check the bucket, the URL of an image and the headers that CloudFront returns.
set -euo pipefail

aws s3 ls s3://pocketcoffee-prod-media/media/catalog/product/ --region eu-west-1 | head
aws s3 ls s3://pocketcoffee-prod-media/ --region eu-west-1

# Replace the key with one that the first listing shows.
curl -sI https://media.pocketcoffee.example/media/catalog/product/a/b/example.jpg | head -n 12
curl -s -o /dev/null -w '%{http_code}\n' https://media.pocketcoffee.example/media/customer/anything.txt
curl -s -o /dev/null -w '%{http_code}\n' https://media.pocketcoffee.example/.maintenance.flag