terraform-aws-cloudfront-s3-hosting/main.tf at main · hisapy/terraform-aws-cloudfront-s3-hosting · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
# AWS infra for a static website stored in a S3 bucket and served from CloudFront

## S3 ##

resource "aws_s3_bucket" "origin" {
  # TODO: maybe make this configurable adding it to variables.tf
  bucket = "${var.project}-static-web-origin-${var.env}"
}

resource "aws_s3_bucket_policy" "origin" {
  bucket = aws_s3_bucket.origin.bucket
  policy = data.aws_iam_policy_document.origin.json
}

# See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
data "aws_iam_policy_document" "origin" {
  statement {
    sid    = "AllowCloudFrontServicePrincipalRead"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }

    actions = [
      "s3:GetObject"
    ]

    resources = [
      "${aws_s3_bucket.origin.arn}/*",
      "${aws_s3_bucket.origin.arn}/en/*",
    ]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      values   = [aws_cloudfront_distribution.cdn.arn]
    }
  }
}

## CloudFront ##

locals {
  s3_origin_id = "${var.project}-static-web-s3"
}

resource "aws_cloudfront_origin_access_control" "oac" {
  name                              = "${var.project}-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

data "aws_cloudfront_cache_policy" "optimize" {
  name = "Managed-CachingOptimized"
}

resource "aws_cloudfront_distribution" "cdn" {
  origin {
    origin_id                = local.s3_origin_id
    domain_name              = aws_s3_bucket.origin.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }

  enabled             = true
  is_ipv6_enabled     = true
  comment             = "${var.project} static website ${var.env}"
  default_root_object = "index.html"
  price_class         = "PriceClass_All"
  aliases             = var.cdn_aliases

  viewer_certificate {
    acm_certificate_arn            = var.acm_cert_arn
    cloudfront_default_certificate = var.acm_cert_arn == null
    ssl_support_method             = var.acm_cert_arn == null ? null : "sni-only"
  }

  default_cache_behavior {
    target_origin_id       = local.s3_origin_id
    cache_policy_id        = data.aws_cloudfront_cache_policy.optimize.id
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD", "OPTIONS"]
    cached_methods         = ["GET", "HEAD"]

    dynamic "function_association" {
      for_each = coalesce(var.function_association, [])

      content {
        event_type   = function_association.value.event_type
        function_arn = function_association.value.function_arn
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
      locations        = []
    }
  }
}

## Route53 (required to point the CDN aliases to it) ##

resource "aws_route53_record" "this" {
  for_each = toset(var.cdn_aliases)
  zone_id  = var.route53_zone_id
  name     = each.value
  type     = "A"

  alias {
    name                   = aws_cloudfront_distribution.cdn.domain_name
    zone_id                = aws_cloudfront_distribution.cdn.hosted_zone_id
    evaluate_target_health = false
  }
}


## CloudWatch (logging) ##

locals {
  log_group_name = "${var.project}-${var.env}-static-web-logs"
}

resource "aws_cloudwatch_log_group" "this" {
  name = local.log_group_name
}

resource "aws_cloudwatch_log_delivery_source" "this" {
  name         = local.log_group_name
  resource_arn = aws_cloudfront_distribution.cdn.arn
  log_type     = "ACCESS_LOGS"
}

resource "aws_cloudwatch_log_delivery_destination" "this" {
  name = local.log_group_name

  delivery_destination_configuration {
    destination_resource_arn = aws_cloudwatch_log_group.this.arn
  }
}

resource "aws_cloudwatch_log_delivery" "this" {
  delivery_source_name     = aws_cloudwatch_log_delivery_source.this.name
  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.this.arn
}