@aws/nx-plugin 1.0.0-rc.76 → 1.0.0-rc.78

package/src/utils/website-constructs/files/terraform/core/static-website/static-website.tf.template

@@ -35,6 +35,41 @@ variable "acm_certificate_arn" {
   default     = null
 }
 
+variable "enable_waf" {
+  description = "Whether to protect the CloudFront distribution with an AWS WAF Web ACL."
+  type        = bool
+  default     = true
+}
+
+variable "encryption" {
+  description = "Server-side encryption for the website and distribution log buckets. One of KMS or S3_MANAGED."
+  type        = string
+  default     = "KMS"
+
+  validation {
+    condition     = contains(["KMS", "S3_MANAGED"], var.encryption)
+    error_message = "encryption must be one of KMS or S3_MANAGED."
+  }
+}
+
+variable "kms_key_arn" {
+  description = "ARN of an existing KMS key used to encrypt the website and distribution log buckets when encryption is KMS. When not provided and create_kms_key is true, a new key is created. Note that a customer-supplied key must already grant the CloudWatch Logs, S3 and CloudFront service principals the necessary permissions in its own key policy."
+  type        = string
+  default     = null
+}
+
+variable "create_kms_key" {
+  description = "Whether to create a KMS key for the website. Only applies when encryption is KMS. Set to false when supplying kms_key_arn."
+  type        = bool
+  default     = true
+}
+
+variable "enable_key_rotation" {
+  description = "Whether the automatically created KMS key has rotation enabled. Only applies when encryption is KMS and create_kms_key is true."
+  type        = bool
+  default     = true
+}
+
 # Content-Security-Policy enforced on all responses. Restricts scripts and
 # framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
 # (connect-src) to AWS service endpoints such as API Gateway, Cognito and
@@ -46,6 +81,13 @@ locals {
   # Delivery source/destination names have a 60 character maximum. Truncate the
   # website name so the longest delivery name stays within the limit.
   access_logs_name_prefix = substr(lower(var.website_name), 0, 16)
+
+  create_website_key = var.encryption == "KMS" && var.create_kms_key
+  website_kms_key_arn = (
+    var.encryption != "KMS" ? null :
+    local.create_website_key ? aws_kms_key.website_key[0].arn :
+    var.kms_key_arn
+  )
 }
 
 
@@ -56,9 +98,11 @@ data "aws_region" "current" {}
 
 # KMS Key for encryption
 resource "aws_kms_key" "website_key" {
+  count = local.create_website_key ? 1 : 0
+
   description             = "KMS key for ${var.website_name} website encryption"
   deletion_window_in_days = 7
-  enable_key_rotation     = true
+  enable_key_rotation     = var.enable_key_rotation
 
   policy = jsonencode({
     Version = "2012-10-17"
@@ -131,8 +175,10 @@ resource "aws_kms_key" "website_key" {
 }
 
 resource "aws_kms_alias" "website_key_alias" {
+  count = local.create_website_key ? 1 : 0
+
   name          = "alias/${lower(var.website_name)}-website-key-${random_id.unique_suffix.hex}"
-  target_key_id = aws_kms_key.website_key.key_id
+  target_key_id = aws_kms_key.website_key[0].key_id
 }
 
 # CloudWatch log group receiving S3 server access logs for the website and
@@ -140,7 +186,7 @@ resource "aws_kms_alias" "website_key_alias" {
 resource "aws_cloudwatch_log_group" "access_logs" {
   name              = "/aws/s3/${lower(var.website_name)}-access-logs-${random_id.bucket_suffix.hex}"
   retention_in_days = 365
-  kms_key_id        = aws_kms_key.website_key.arn
+  kms_key_id        = local.website_kms_key_arn
 }
 
 resource "random_id" "unique_suffix" {
@@ -177,8 +223,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "website_encryptio
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -242,8 +288,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "distribution_logs
 
   rule {
     apply_server_side_encryption_by_default {
-      kms_master_key_id = aws_kms_key.website_key.arn
-      sse_algorithm     = "aws:kms"
+      kms_master_key_id = var.encryption == "KMS" ? local.website_kms_key_arn : null
+      sse_algorithm     = var.encryption == "KMS" ? "aws:kms" : "AES256"
     }
   }
 }
@@ -313,6 +359,8 @@ resource "aws_s3_bucket_policy" "distribution_logs_ssl_policy" {
 
 # WAF Web ACL (must be in us-east-1 for CloudFront)
 resource "aws_wafv2_web_acl" "cloudfront_waf" {
+  count = var.enable_waf ? 1 : 0
+
   #checkov:skip=CKV2_AWS_31:WAF logging disabled
   provider = aws.us_east_1
   name     = "${lower(var.website_name)}-cloudfront-waf-${random_id.unique_suffix.hex}"
@@ -437,7 +485,7 @@ resource "aws_cloudfront_distribution" "website" {
   enabled             = true
   is_ipv6_enabled     = true
   default_root_object = "index.html"
-  web_acl_id          = aws_wafv2_web_acl.cloudfront_waf.arn
+  web_acl_id          = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
   aliases             = var.custom_domain_names
 
   logging_config {
@@ -495,12 +543,6 @@ resource "aws_cloudfront_distribution" "website" {
     Name = "${lower(var.website_name)}-distribution-${random_id.unique_suffix.hex}"
   }
 
-  lifecycle {
-    replace_triggered_by = [
-      aws_wafv2_web_acl.cloudfront_waf
-    ]
-  }
-
   # CloudFront validates access to the distribution logs bucket when it
   # creates the distribution.
   depends_on = [
@@ -773,5 +815,5 @@ output "cloudfront_domain_name" {
 
 output "waf_web_acl_arn" {
   description = "ARN of the WAF Web ACL"
-  value       = aws_wafv2_web_acl.cloudfront_waf.arn
+  value       = var.enable_waf ? aws_wafv2_web_acl.cloudfront_waf[0].arn : null
 }