@aws/nx-plugin 1.0.0-rc.40 → 1.0.0-rc.42

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -23,6 +23,18 @@ variable "website_file_path" {
   type        = string
 }
 
+variable "custom_domain_names" {
+  description = "Custom domain names (aliases) for the CloudFront distribution. Requires acm_certificate_arn."
+  type        = list(string)
+  default     = []
+}
+
+variable "acm_certificate_arn" {
+  description = "ARN of an ACM certificate (in us-east-1) for the custom domain names. When set, viewers are required to use TLS 1.2 or later."
+  type        = string
+  default     = null
+}
+
 # Content-Security-Policy enforced on all responses. Restricts scripts and
 # framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
 # (connect-src) to AWS service endpoints such as API Gateway, Cognito and
@@ -30,6 +42,10 @@ variable "website_file_path" {
 # connect-src to your specific origins once they are known.
 locals {
   content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+
+  # Delivery source/destination names have a 60 character maximum. Truncate the
+  # website name so the longest delivery name stays within the limit.
+  access_logs_name_prefix = substr(lower(var.website_name), 0, 16)
 }
 
 
@@ -68,6 +84,26 @@ resource "aws_kms_key" "website_key" {
         ]
         Resource = "*"
       },
+      {
+        Sid    = "AllowCloudWatchLogs"
+        Effect = "Allow"
+        Principal = {
+          Service = "logs.${data.aws_region.current.region}.amazonaws.com"
+        }
+        Action = [
+          "kms:Encrypt",
+          "kms:Decrypt",
+          "kms:ReEncrypt*",
+          "kms:GenerateDataKey*",
+          "kms:DescribeKey"
+        ]
+        Resource = "*"
+        Condition = {
+          ArnLike = {
+            "kms:EncryptionContext:aws:logs:arn" = "arn:aws:logs:${data.aws_region.current.region}:${data.aws_caller_identity.current.account_id}:log-group:*"
+          }
+        }
+      },
       {
         Sid    = "AllowCloudFrontServicePrincipalSSE-KMS"
         Effect = "Allow"
@@ -99,18 +135,12 @@ resource "aws_kms_alias" "website_key_alias" {
   target_key_id = aws_kms_key.website_key.key_id
 }
 
-# Access Logs Bucket
-resource "aws_s3_bucket" "access_logs" {
-  #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for access logs bucket
-  #checkov:skip=CKV_AWS_144:Cross-region replication not required for access logs
-  #checkov:skip=CKV2_AWS_62:Event notifications not required for access logs bucket
-  #checkov:skip=CKV_AWS_21:Versioning disabled for access logs to reduce storage costs
-  bucket        = "${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
-  force_destroy = true
-
-  tags = {
-    Name = "${lower(var.website_name)}-access-logs"
-  }
+# CloudWatch log group receiving S3 server access logs for the website and
+# distribution log buckets.
+resource "aws_cloudwatch_log_group" "access_logs" {
+  name              = "/aws/s3/${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
+  retention_in_days = 365
+  kms_key_id        = aws_kms_key.website_key.arn
 }
 
 resource "random_id" "unique_suffix" {
@@ -121,63 +151,12 @@ resource "random_id" "bucket_suffix" {
   byte_length = 8
 }
 
-resource "aws_s3_bucket_versioning" "access_logs_versioning" {
-  bucket = aws_s3_bucket.access_logs.id
-  versioning_configuration {
-    status = "Disabled"
-  }
-}
-
-resource "aws_s3_bucket_server_side_encryption_configuration" "access_logs_encryption" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
-    }
-  }
-}
-
-resource "aws_s3_bucket_public_access_block" "access_logs_pab" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
-}
-
-resource "aws_s3_bucket_policy" "access_logs_ssl_policy" {
-  bucket = aws_s3_bucket.access_logs.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid       = "DenyInsecureConnections"
-        Effect    = "Deny"
-        Principal = "*"
-        Action    = "s3:*"
-        Resource = [
-          aws_s3_bucket.access_logs.arn,
-          "${aws_s3_bucket.access_logs.arn}/*"
-        ]
-        Condition = {
-          Bool = {
-            "aws:SecureTransport" = "false"
-          }
-        }
-      }
-    ]
-  })
-}
-
 # Website Bucket
 resource "aws_s3_bucket" "website" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for static website content
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for static website
   #checkov:skip=CKV2_AWS_62:Event notifications not required for static website bucket
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.website)
   bucket        = "${lower(var.website_name)}-website-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -221,20 +200,35 @@ resource "aws_s3_bucket_ownership_controls" "website_ownership" {
   }
 }
 
-resource "aws_s3_bucket_logging" "website_logging" {
-  bucket = aws_s3_bucket.website.id
+# Deliver the website bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "website" {
+  name         = "${local.access_logs_name_prefix}-website-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.website.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "website-access-logs/"
+resource "aws_cloudwatch_log_delivery_destination" "access_logs" {
+  name = "${local.access_logs_name_prefix}-access-logs-${random_id.bucket_suffix.hex}"
+
+  delivery_destination_configuration {
+    destination_resource_arn = aws_cloudwatch_log_group.access_logs.arn
+  }
+}
+
+resource "aws_cloudwatch_log_delivery" "website" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.website.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 
-# Distribution Log Bucket
+# Distribution Log Bucket — holds CloudFront standard access logs (CloudFront
+# delivers only to S3). Its own S3 server access logs go to CloudWatch Logs.
 resource "aws_s3_bucket" "distribution_logs" {
   #checkov:skip=CKV2_AWS_61:Lifecycle configuration not required for CloudFront logs
   #checkov:skip=CKV_AWS_144:Cross-region replication not required for CloudFront logs
   #checkov:skip=CKV2_AWS_62:Event notifications not required for CloudFront logs bucket
   #checkov:skip=CKV_AWS_21:Versioning not required for CloudFront access logs
+  #checkov:skip=CKV_AWS_18:Server access logs are delivered to CloudWatch Logs (see aws_cloudwatch_log_delivery.distribution_logs)
   bucket        = "${lower(var.website_name)}-distribution-logs-${random_id.bucket_suffix.hex}"
   force_destroy = true
 
@@ -280,11 +274,16 @@ resource "aws_s3_bucket_acl" "distribution_logs_acl" {
   depends_on = [aws_s3_bucket_ownership_controls.distribution_logs_ownership]
 }
 
-resource "aws_s3_bucket_logging" "distribution_logs_logging" {
-  bucket = aws_s3_bucket.distribution_logs.id
+# Deliver the distribution log bucket's server access logs to CloudWatch Logs.
+resource "aws_cloudwatch_log_delivery_source" "distribution_logs" {
+  name         = "${local.access_logs_name_prefix}-distribution-logs-${random_id.bucket_suffix.hex}"
+  log_type     = "S3_SERVER_ACCESS_LOGS"
+  resource_arn = aws_s3_bucket.distribution_logs.arn
+}
 
-  target_bucket = aws_s3_bucket.access_logs.id
-  target_prefix = "distribution-access-logs/"
+resource "aws_cloudwatch_log_delivery" "distribution_logs" {
+  delivery_source_name     = aws_cloudwatch_log_delivery_source.distribution_logs.name
+  delivery_destination_arn = aws_cloudwatch_log_delivery_destination.access_logs.arn
 }
 
 resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
@@ -439,6 +438,7 @@ resource "aws_cloudfront_distribution" "website" {
   is_ipv6_enabled     = true
   default_root_object = "index.html"
   web_acl_id          = aws_wafv2_web_acl.cloudfront_waf.arn
+  aliases             = var.custom_domain_names
 
   logging_config {
     include_cookies = false
@@ -485,7 +485,10 @@ resource "aws_cloudfront_distribution" "website" {
   }
 
   viewer_certificate {
-    cloudfront_default_certificate = true
+    cloudfront_default_certificate = var.acm_certificate_arn == null
+    acm_certificate_arn            = var.acm_certificate_arn
+    ssl_support_method             = var.acm_certificate_arn == null ? null : "sni-only"
+    minimum_protocol_version       = var.acm_certificate_arn == null ? "TLSv1" : "TLSv1.2_2021"
   }
 
   tags = {