Parking a domain on S3

You might want to "park" a domain to notify people that they're no longer in use or whatever. Since we're using Terraform you can update a ton of parked domains at the same time. Which is nice when business decides to rebrand everything. Like they do.

Notice that we're using a bucket policy and not ACLs to make the contents of the bucket public. This gives us more fine grained control over access to the bucket, and while it doesn't really matter in this case, it's a good habit to get into.

resource "aws_s3_bucket" "this" {
  # The bucket name must be the fqdn it responds to
  bucket = "parked.netwerk.io"
  acl    = "private"

  # We set both index and error document so that all requests are routed to
  # index.html
  website {
    index_document = "index.html"
    error_document = "index.html"
  }
}

# Create index.html with the domain name used to access this bucket
resource "aws_s3_bucket_object" "this" {
  key          = "${aws_s3_bucket.this.website.index_document}"
  bucket       = "${aws_s3_bucket.this.id}"
  content      = "<h1>${aws_route53_record.this.fqdn} is parked.</h1>"
  content_type = "text/html"
}

# Policy to grant access to object previously created inside the bucket
data "aws_iam_policy_document" "this" {
  statement {
    actions   = ["s3:GetObject"]
    # This is a very restricted policy that will only allow access to object
    resources = ["${aws_s3_bucket.this.arn}/${aws_s3_bucket_object.this.id}"]

    principals = {
      type        = "AWS"
      identifiers = ["*"]
    }
  }
}

resource "aws_s3_bucket_policy" "this" {
  bucket = "${aws_s3_bucket.this.id}"
  policy = "${data.aws_iam_policy_document.this.json}"
}

resource "aws_route53_record" "this" {
  zone_id = "${aws_route53_zone.this.zone_id}"
  name    = "parked"
  type    = "A"

  alias {
    name                   = "${aws_s3_bucket.this.website_domain}"
    zone_id                = "${aws_s3_bucket.this.hosted_zone_id}"
    evaluate_target_health = true
  }
}