Enable List access to the S3 bucket via CloudFront OAI

This also blocks direct public access to the S3 bucket, which avoids exposing
the bucket publicly (meaning we can change the bucket structure so long as the
public access via CloudFront is preserved).

Author: Mark-Simulacrum

terraform/crates-io/impl/cloudfront-index.tf

@@ -1,5 +1,9 @@
 // This file configures index.crates.io
 
+resource "aws_cloudfront_origin_access_identity" "index" {
+  comment = "index.crates.io access"
+}
+
 resource "aws_cloudfront_distribution" "index" {
   comment = var.index_domain_name
 
@@ -44,6 +48,9 @@ resource "aws_cloudfront_distribution" "index" {
   origin {
     origin_id   = "main"
     domain_name = aws_s3_bucket.index.bucket_regional_domain_name
+    s3_origin_config {
+      origin_access_identity = aws_cloudfront_origin_access_identity.index.cloudfront_access_identity_path
+    }
   }
 
   restrictions {

terraform/crates-io/impl/s3-index.tf

@@ -13,18 +13,35 @@ resource "aws_s3_bucket_policy" "index" {
     Version = "2012-10-17"
     Statement = [
       {
-        Sid    = "PublicReadGetObject",
+        Sid    = "CloudFrontAccess",
         Effect = "Allow"
         Principal = {
-          AWS = "*"
+          AWS = "${aws_cloudfront_origin_access_identity.index.iam_arn}"
         }
-        Action   = "s3:GetObject"
-        Resource = "${aws_s3_bucket.index.arn}/*"
+        Action = [
+          "s3:GetObject",
+          "s3:ListBucket"
+        ]
+        Resource = [
+          "${aws_s3_bucket.index.arn}",
+          "${aws_s3_bucket.index.arn}/*"
+        ]
       }
     ]
   })
 }
 
+// We provide public access only through CloudFront, which is enabled with a
+// CloudFront origin access identity.
+resource "aws_s3_bucket_public_access_block" "index" {
+  bucket = aws_s3_bucket.index.id
+
+  restrict_public_buckets = true
+  ignore_public_acls      = true
+  block_public_acls       = true
+  block_public_policy     = true
+}
+
 resource "aws_s3_bucket_inventory" "index" {
   name    = "all-objects-csv"
   bucket  = aws_s3_bucket.index.id