@composurecdk/cloudfront 0.4.8 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +46 -12
- package/dist/defaults.d.ts.map +1 -1
- package/dist/defaults.js +5 -4
- package/dist/defaults.js.map +1 -1
- package/dist/distribution-builder.d.ts +28 -20
- package/dist/distribution-builder.d.ts.map +1 -1
- package/dist/distribution-builder.js +46 -19
- package/dist/distribution-builder.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js.map +1 -1
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -37,15 +37,15 @@ compose({ site: createBucketBuilder(), cdn }, { site: [], cdn: ["site"] }).build
|
|
|
37
37
|
|
|
38
38
|
`createDistributionBuilder` applies the following defaults. Each can be overridden via the builder's fluent API.
|
|
39
39
|
|
|
40
|
-
| Property | Default
|
|
41
|
-
| --------------------------------------- |
|
|
42
|
-
| `
|
|
43
|
-
| `priceClass` | `PRICE_CLASS_100`
|
|
44
|
-
| `httpVersion` | `HTTP2_AND_3`
|
|
45
|
-
| `defaultRootObject` | `"index.html"`
|
|
46
|
-
| `minimumProtocolVersion` | `TLS_V1_2_2021`
|
|
47
|
-
| `defaultBehavior.viewerProtocolPolicy` | `REDIRECT_TO_HTTPS`
|
|
48
|
-
| `defaultBehavior.responseHeadersPolicy` | `SECURITY_HEADERS`
|
|
40
|
+
| Property | Default | Rationale |
|
|
41
|
+
| --------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------ |
|
|
42
|
+
| `accessLogs` | `{ prefix: "logs/" }` | Auto-creates an S3 logging bucket for the access log audit trail under the `logs/` prefix. |
|
|
43
|
+
| `priceClass` | `PRICE_CLASS_100` | North America and Europe edge locations — sufficient and cost-effective. |
|
|
44
|
+
| `httpVersion` | `HTTP2_AND_3` | Enables HTTP/2 and HTTP/3 (QUIC) for improved performance. |
|
|
45
|
+
| `defaultRootObject` | `"index.html"` | Standard for static website hosting. |
|
|
46
|
+
| `minimumProtocolVersion` | `TLS_V1_2_2021` | Requires TLS 1.2+ to prevent older, less secure protocol negotiation. |
|
|
47
|
+
| `defaultBehavior.viewerProtocolPolicy` | `REDIRECT_TO_HTTPS` | Ensures all viewer traffic is encrypted in transit. |
|
|
48
|
+
| `defaultBehavior.responseHeadersPolicy` | `SECURITY_HEADERS` | Applies managed security headers (HSTS, X-Content-Type-Options, etc.). |
|
|
49
49
|
|
|
50
50
|
These defaults are guided by the [AWS Well-Architected Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/protecting-data-in-transit.html).
|
|
51
51
|
|
|
@@ -63,14 +63,14 @@ import { PriceClass, ViewerProtocolPolicy } from "aws-cdk-lib/aws-cloudfront";
|
|
|
63
63
|
const cdn = createDistributionBuilder()
|
|
64
64
|
.origin(myOrigin)
|
|
65
65
|
.priceClass(PriceClass.PRICE_CLASS_ALL)
|
|
66
|
-
.
|
|
66
|
+
.accessLogs(false)
|
|
67
67
|
.defaultBehavior({ viewerProtocolPolicy: ViewerProtocolPolicy.ALLOW_ALL })
|
|
68
68
|
.build(stack, "CDN");
|
|
69
69
|
```
|
|
70
70
|
|
|
71
71
|
### Access logging
|
|
72
72
|
|
|
73
|
-
By default, the builder creates
|
|
73
|
+
CloudFront standard access logging is configured through a single `.accessLogs(config)` setting. By default, the builder creates a dedicated logging bucket (using `@composurecdk/s3` with its secure defaults, plus `BUCKET_OWNER_PREFERRED` object ownership which CloudFront standard logging requires) and writes logs under `logs/`. The created bucket is returned in the build result:
|
|
74
74
|
|
|
75
75
|
```ts
|
|
76
76
|
const result = createDistributionBuilder().origin(myOrigin).build(stack, "CDN");
|
|
@@ -79,7 +79,41 @@ result.distribution; // Distribution
|
|
|
79
79
|
result.accessLogsBucket; // Bucket | undefined
|
|
80
80
|
```
|
|
81
81
|
|
|
82
|
-
|
|
82
|
+
`.accessLogs(config)` accepts either `false` to disable access logging, or an object describing how to handle logs:
|
|
83
|
+
|
|
84
|
+
```ts
|
|
85
|
+
import { Duration } from "aws-cdk-lib";
|
|
86
|
+
|
|
87
|
+
// Disable access logging entirely
|
|
88
|
+
createDistributionBuilder().origin(myOrigin).accessLogs(false);
|
|
89
|
+
|
|
90
|
+
// Auto-create a logging bucket with a custom prefix
|
|
91
|
+
createDistributionBuilder().origin(myOrigin).accessLogs({ prefix: "cdn/" });
|
|
92
|
+
|
|
93
|
+
// Include cookies in the logs
|
|
94
|
+
createDistributionBuilder().origin(myOrigin).accessLogs({ includeCookies: true });
|
|
95
|
+
|
|
96
|
+
// Auto-create and customize the logging sub-builder
|
|
97
|
+
createDistributionBuilder()
|
|
98
|
+
.origin(myOrigin)
|
|
99
|
+
.accessLogs({
|
|
100
|
+
configure: (sub) => sub.lifecycleRules([{ id: "ShortLogs", expiration: Duration.days(180) }]),
|
|
101
|
+
});
|
|
102
|
+
|
|
103
|
+
// Bring your own destination bucket
|
|
104
|
+
createDistributionBuilder().origin(myOrigin).accessLogs({ destination: myBucket });
|
|
105
|
+
|
|
106
|
+
// Bring your own destination with a prefix and cookies
|
|
107
|
+
createDistributionBuilder()
|
|
108
|
+
.origin(myOrigin)
|
|
109
|
+
.accessLogs({ destination: myBucket, prefix: "cdn/", includeCookies: true });
|
|
110
|
+
```
|
|
111
|
+
|
|
112
|
+
`destination` and `configure` cannot be combined — the destination bucket is user-managed and is not built by this builder.
|
|
113
|
+
|
|
114
|
+
The config object replaces the default wholesale rather than merging with it. For example, `.accessLogs({ includeCookies: true })` does **not** preserve the default `prefix: "logs/"` — restate any default you want to keep.
|
|
115
|
+
|
|
116
|
+
The auto-created logging bucket uses `DEFAULT_ACCESS_LOG_BUCKET_LIFECYCLE_RULES` from `@composurecdk/s3`: incomplete multipart uploads are aborted after 7 days and access log objects expire after 2 years (matching the default `LogGroup` retention so the audit window is consistent across log destinations). CloudFront never deletes its own logs, so this lifecycle is the only thing that bounds the bucket's growth.
|
|
83
117
|
|
|
84
118
|
## Recommended Alarms
|
|
85
119
|
|
package/dist/defaults.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEpG;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,wBAAwB,
|
|
1
|
+
{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEpG;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,wBAAwB,CAmDnE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,CAOtE,CAAC"}
|
package/dist/defaults.js
CHANGED
|
@@ -10,12 +10,13 @@ import { FunctionRuntime, HttpVersion, PriceClass, ResponseHeadersPolicy, Securi
|
|
|
10
10
|
*/
|
|
11
11
|
export const DISTRIBUTION_DEFAULTS = {
|
|
12
12
|
/**
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
* monitoring and
|
|
13
|
+
* Auto-create a dedicated logging bucket and write CloudFront standard
|
|
14
|
+
* access logs to it under the `logs/` prefix. Access logging provides an
|
|
15
|
+
* audit trail of all viewer requests for security monitoring and
|
|
16
|
+
* troubleshooting.
|
|
16
17
|
* @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html
|
|
17
18
|
*/
|
|
18
|
-
|
|
19
|
+
accessLogs: { prefix: "logs/" },
|
|
19
20
|
/**
|
|
20
21
|
* Use the cheapest price class — edge locations in North America and Europe.
|
|
21
22
|
* Sufficient for most small websites and avoids costs from global edge locations.
|
package/dist/defaults.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE
|
|
1
|
+
{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../src/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsC;IACtE;;;;;;OAMG;IACH,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;IAE/B;;;;OAIG;IACH,UAAU,EAAE,UAAU,CAAC,eAAe;IAEtC;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC,WAAW;IAEpC;;;OAGG;IACH,iBAAiB,EAAE,YAAY;IAE/B;;;;OAIG;IACH,sBAAsB,EAAE,sBAAsB,CAAC,aAAa;IAE5D,eAAe,EAAE;QACf;;;WAGG;QACH,oBAAoB,EAAE,oBAAoB,CAAC,iBAAiB;QAE5D;;;;WAIG;QACH,qBAAqB,EAAE,qBAAqB,CAAC,gBAAgB;KAC9D;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsC;IACzE;;;;OAIG;IACH,OAAO,EAAE,eAAe,CAAC,MAAM;CAChC,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
import { Distribution, type DistributionProps, type IOrigin, type AddBehaviorOptions, type BehaviorOptions, type Function as CfFunction, type FunctionCode, type FunctionEventType, type FunctionRuntime, type IKeyValueStore } from "aws-cdk-lib/aws-cloudfront";
|
|
2
2
|
import { type ICertificate } from "aws-cdk-lib/aws-certificatemanager";
|
|
3
3
|
import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
|
|
4
|
-
import { type Bucket } from "aws-cdk-lib/aws-s3";
|
|
4
|
+
import { type Bucket, type IBucket } from "aws-cdk-lib/aws-s3";
|
|
5
5
|
import { type IConstruct } from "constructs";
|
|
6
6
|
import { type IBuilder, type Lifecycle, type Resolvable } from "@composurecdk/core";
|
|
7
7
|
import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
|
|
8
|
+
import { type IBucketBuilder } from "@composurecdk/s3";
|
|
8
9
|
import type { DistributionAlarmConfig, FunctionAlarmConfig } from "./alarm-config.js";
|
|
9
10
|
/**
|
|
10
11
|
* Per-function metadata exposed on {@link DistributionBuilderResult.functions}.
|
|
@@ -115,6 +116,26 @@ export interface AdditionalBehaviorConfig extends Omit<BehaviorOptions, "origin"
|
|
|
115
116
|
*/
|
|
116
117
|
functions?: InlineFunctionDefinition[];
|
|
117
118
|
}
|
|
119
|
+
/**
|
|
120
|
+
* Configures how CloudFront standard access logs are handled. Pass `false`
|
|
121
|
+
* to disable logging; pass an object to wire a destination, prefix,
|
|
122
|
+
* include cookies, or customize the auto-created sub-builder.
|
|
123
|
+
*
|
|
124
|
+
* `configure` cannot be combined with `destination` — a user-managed
|
|
125
|
+
* destination is not built by this builder.
|
|
126
|
+
*/
|
|
127
|
+
export type AccessLogsConfig = false | {
|
|
128
|
+
destination?: IBucket;
|
|
129
|
+
prefix?: string;
|
|
130
|
+
includeCookies?: boolean;
|
|
131
|
+
/**
|
|
132
|
+
* Customize the auto-created logging sub-builder. Receives a builder
|
|
133
|
+
* pre-seeded with `versioned: false`, `objectOwnership:
|
|
134
|
+
* BUCKET_OWNER_PREFERRED`, `removalPolicy: RETAIN`, and recursive
|
|
135
|
+
* S3 server access logging disabled.
|
|
136
|
+
*/
|
|
137
|
+
configure?: (b: IBucketBuilder) => IBucketBuilder;
|
|
138
|
+
};
|
|
118
139
|
/**
|
|
119
140
|
* Configuration properties for the CloudFront distribution builder.
|
|
120
141
|
*
|
|
@@ -124,26 +145,13 @@ export interface AdditionalBehaviorConfig extends Omit<BehaviorOptions, "origin"
|
|
|
124
145
|
* {@link IDistributionBuilder.behavior} method rather than the raw
|
|
125
146
|
* `additionalBehaviors` record.
|
|
126
147
|
*
|
|
127
|
-
* The `enableLogging`
|
|
128
|
-
*
|
|
148
|
+
* The CDK `enableLogging`, `logBucket`, `logFilePrefix`, and
|
|
149
|
+
* `logIncludesCookies` props are replaced by {@link accessLogs}, which
|
|
150
|
+
* auto-creates a logging bucket with secure defaults by default.
|
|
129
151
|
*/
|
|
130
|
-
export interface DistributionBuilderProps extends Omit<DistributionProps, "defaultBehavior" | "additionalBehaviors" | "enableLogging" | "certificate"> {
|
|
131
|
-
/**
|
|
132
|
-
|
|
133
|
-
* access logging.
|
|
134
|
-
*
|
|
135
|
-
* When `true`, the builder creates a logging bucket using
|
|
136
|
-
* {@link createBucketBuilder} (with its secure defaults) and configures it
|
|
137
|
-
* as the distribution's log destination. The created bucket is returned in
|
|
138
|
-
* the build result as `accessLogsBucket`.
|
|
139
|
-
*
|
|
140
|
-
* When `false`, no logging bucket is created. You can still provide your
|
|
141
|
-
* own bucket via `logBucket`.
|
|
142
|
-
*
|
|
143
|
-
* This setting is ignored when `logBucket` is provided — the user-supplied
|
|
144
|
-
* bucket takes precedence.
|
|
145
|
-
*/
|
|
146
|
-
accessLogging?: boolean;
|
|
152
|
+
export interface DistributionBuilderProps extends Omit<DistributionProps, "defaultBehavior" | "additionalBehaviors" | "enableLogging" | "logBucket" | "logFilePrefix" | "logIncludesCookies" | "certificate"> {
|
|
153
|
+
/** See {@link AccessLogsConfig}. Defaults to `{ prefix: "logs/" }`. */
|
|
154
|
+
accessLogs?: AccessLogsConfig;
|
|
147
155
|
/**
|
|
148
156
|
* The ACM certificate to associate with the distribution for HTTPS.
|
|
149
157
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"distribution-builder.d.ts","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,QAAQ,IAAI,UAAU,EAC3B,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAmB,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"distribution-builder.d.ts","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,QAAQ,IAAI,UAAU,EAC3B,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,SAAS,EAEd,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAMtF;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,EAAE,UAAU,CAAC;IAErB;;;OAGG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,6CAA6C;IAC7C,SAAS,EAAE,iBAAiB,CAAC;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;CACjD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,wDAAwD;IACxD,SAAS,EAAE,iBAAiB,CAAC;IAE7B,kFAAkF;IAClF,IAAI,EAAE,YAAY,CAAC;IAEnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,OAAO,CAAC,EAAE,eAAe,CAAC;IAE1B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;CACjD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAC7F;;;OAGG;IACH,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,eAAe,EACf,QAAQ,GAAG,sBAAsB,CAClC;IACC,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL;IACE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,KAAK,cAAc,CAAC;CACnD,CAAC;AAEN;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,iBAAiB,EACf,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,aAAa,CAChB;IACC,uEAAuE;IACvE,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6CG;IACH,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,KAAK,CAAC;CACrD;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,oEAAoE;IACpE,YAAY,EAAE,YAAY,CAAC;IAE3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAEzC;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AAE3F,cAAM,mBAAoB,YAAW,SAAS,CAAC,yBAAyB,CAAC;;IACvE,KAAK,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAM;IAM9C,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,KACxC,sBAAsB,CAAC,YAAY,CAAC,GACxC,IAAI;IAKP;;;;;;;;OAQG;IACH,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI;IAKzC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,IAAI;IAuBrE,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,yBAAyB;CAsE7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,yBAAyB,IAAI,oBAAoB,CAEhE"}
|
|
@@ -3,7 +3,7 @@ import { ObjectOwnership } from "aws-cdk-lib/aws-s3";
|
|
|
3
3
|
import { RemovalPolicy } from "aws-cdk-lib";
|
|
4
4
|
import { Builder, resolve, } from "@composurecdk/core";
|
|
5
5
|
import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
|
|
6
|
-
import { createBucketBuilder } from "@composurecdk/s3";
|
|
6
|
+
import { DEFAULT_ACCESS_LOG_BUCKET_LIFECYCLE_RULES, createBucketBuilder, } from "@composurecdk/s3";
|
|
7
7
|
import { DISTRIBUTION_DEFAULTS } from "./defaults.js";
|
|
8
8
|
import { resolveBehaviors } from "./resolve-behaviors.js";
|
|
9
9
|
import { pathPatternSlug } from "./behavior-function-alarms.js";
|
|
@@ -63,25 +63,11 @@ class DistributionBuilder {
|
|
|
63
63
|
throw new Error(`DistributionBuilder "${id}" requires an origin. ` +
|
|
64
64
|
`Call .origin() with an IOrigin or a Ref to one.`);
|
|
65
65
|
}
|
|
66
|
-
const {
|
|
66
|
+
const { accessLogs, certificate, defaultBehavior: userBehavior, recommendedAlarms: alarmConfig, ...distProps } = this.props;
|
|
67
67
|
const resolvedCertificate = certificate ? resolve(certificate, context ?? {}) : undefined;
|
|
68
|
-
const {
|
|
69
|
-
const
|
|
70
|
-
|
|
71
|
-
let accessLogProps = {};
|
|
72
|
-
if (autoAccessLog) {
|
|
73
|
-
accessLogsBucket = createBucketBuilder()
|
|
74
|
-
.accessLogging(false)
|
|
75
|
-
.versioned(false)
|
|
76
|
-
// CloudFront standard logging writes via ACLs, which requires BucketOwnerPreferred.
|
|
77
|
-
.objectOwnership(ObjectOwnership.BUCKET_OWNER_PREFERRED)
|
|
78
|
-
.removalPolicy(RemovalPolicy.RETAIN)
|
|
79
|
-
.build(scope, `${id}AccessLogs`).bucket;
|
|
80
|
-
accessLogProps = {
|
|
81
|
-
enableLogging: true,
|
|
82
|
-
logBucket: accessLogsBucket,
|
|
83
|
-
};
|
|
84
|
-
}
|
|
68
|
+
const { accessLogs: defaultAccessLogs, defaultBehavior: defaultBehaviorDefaults, ...cdkDefaults } = DISTRIBUTION_DEFAULTS;
|
|
69
|
+
const cfg = accessLogs ?? defaultAccessLogs;
|
|
70
|
+
const { accessLogsBucket, accessLogProps } = resolveAccessLogs(scope, id, cfg);
|
|
85
71
|
const behaviors = resolveBehaviors({
|
|
86
72
|
scope,
|
|
87
73
|
id,
|
|
@@ -148,4 +134,45 @@ class DistributionBuilder {
|
|
|
148
134
|
export function createDistributionBuilder() {
|
|
149
135
|
return Builder(DistributionBuilder);
|
|
150
136
|
}
|
|
137
|
+
function resolveAccessLogs(scope, id, cfg) {
|
|
138
|
+
if (cfg === false || cfg === undefined) {
|
|
139
|
+
return { accessLogProps: {} };
|
|
140
|
+
}
|
|
141
|
+
const extras = {
|
|
142
|
+
...(cfg.prefix !== undefined ? { logFilePrefix: cfg.prefix } : {}),
|
|
143
|
+
...(cfg.includeCookies !== undefined ? { logIncludesCookies: cfg.includeCookies } : {}),
|
|
144
|
+
};
|
|
145
|
+
if (cfg.destination !== undefined) {
|
|
146
|
+
if (cfg.configure !== undefined) {
|
|
147
|
+
throw new Error("accessLogs: 'configure' cannot be combined with 'destination' — " +
|
|
148
|
+
"the destination bucket is user-managed and not built by this builder.");
|
|
149
|
+
}
|
|
150
|
+
return {
|
|
151
|
+
accessLogProps: {
|
|
152
|
+
enableLogging: true,
|
|
153
|
+
logBucket: cfg.destination,
|
|
154
|
+
...extras,
|
|
155
|
+
},
|
|
156
|
+
};
|
|
157
|
+
}
|
|
158
|
+
let subBuilder = createBucketBuilder()
|
|
159
|
+
.serverAccessLogs(false)
|
|
160
|
+
.versioned(false)
|
|
161
|
+
// CloudFront standard logging writes via ACLs, which requires BucketOwnerPreferred.
|
|
162
|
+
.objectOwnership(ObjectOwnership.BUCKET_OWNER_PREFERRED)
|
|
163
|
+
.removalPolicy(RemovalPolicy.RETAIN)
|
|
164
|
+
.lifecycleRules(DEFAULT_ACCESS_LOG_BUCKET_LIFECYCLE_RULES);
|
|
165
|
+
if (cfg.configure) {
|
|
166
|
+
subBuilder = cfg.configure(subBuilder);
|
|
167
|
+
}
|
|
168
|
+
const accessLogsBucket = subBuilder.build(scope, `${id}AccessLogs`).bucket;
|
|
169
|
+
return {
|
|
170
|
+
accessLogsBucket,
|
|
171
|
+
accessLogProps: {
|
|
172
|
+
enableLogging: true,
|
|
173
|
+
logBucket: accessLogsBucket,
|
|
174
|
+
...extras,
|
|
175
|
+
},
|
|
176
|
+
};
|
|
177
|
+
}
|
|
151
178
|
//# sourceMappingURL=distribution-builder.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"distribution-builder.js","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAUb,MAAM,4BAA4B,CAAC;AAGpC,OAAO,
|
|
1
|
+
{"version":3,"file":"distribution-builder.js","sourceRoot":"","sources":["../src/distribution-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAUb,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAA6B,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EACL,OAAO,EAGP,OAAO,GAER,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,yCAAyC,EACzC,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AA4TtE,MAAM,mBAAmB;IACvB,KAAK,GAAsC,EAAE,CAAC;IAC9C,OAAO,CAAuB;IACrB,oBAAoB,GAAG,IAAI,GAAG,EAAoC,CAAC;IACnE,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,aAAa,GAA2C,EAAE,CAAC;IAEpE,QAAQ,CACN,GAAW,EACX,SAEyC;QAEzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAe,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,MAA2B;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAmB,EAAE,MAAgC;QAC5D,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,mDAAmD,WAAW,uBAAuB,CACtF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,4EAA4E;QAC5E,sDAAsD;QACtD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,sCAAsC,WAAW,sCAAsC;gBACrF,UAAU,IAAI,UAAU,eAAe,4BAA4B,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,wBAAwB;gBAChD,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,EACJ,UAAU,EACV,WAAW,EACX,eAAe,EAAE,YAAY,EAC7B,iBAAiB,EAAE,WAAW,EAC9B,GAAG,SAAS,EACb,GAAG,IAAI,CAAC,KAAK,CAAC;QACf,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,EACJ,UAAU,EAAE,iBAAiB,EAC7B,eAAe,EAAE,uBAAuB,EACxC,GAAG,WAAW,EACf,GAAG,qBAAqB,CAAC;QAC1B,MAAM,GAAG,GAAG,UAAU,IAAI,iBAAiB,CAAC;QAE5C,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAE/E,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,KAAK;YACL,EAAE;YACF,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,aAAa,EAAE,cAAc;YAC7B,eAAe,EAAE,YAAY;YAC7B,uBAAuB,EAAE,uBAAuB,IAAI,EAAE;YACtD,mBAAmB,EAAE,IAAI,CAAC,oBAAoB;SAC/C,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG;YAClB,GAAG,WAAW;YACd,GAAG,cAAc;YACjB,GAAG,SAAS;YACZ,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;gBACvD,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;SACa,CAAC;QAEvB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;QAE9D,oFAAoF;QACpF,gGAAgG;QAChG,IAAI,gBAAgB,EAAE,CAAC;YACrB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAClC,KAAK,EACL,EAAE,EACF,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,EAChD,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CACrE,CAAC;QAEF,OAAO;YACL,YAAY;YACZ,gBAAgB;YAChB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM;SACP,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,OAAO,CAAgD,mBAAmB,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAiB,EACjB,EAAU,EACV,GAAiC;IAOjC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC;IAEF,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAChE,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,cAAc,EAAE;gBACd,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,GAAG,CAAC,WAAW;gBAC1B,GAAG,MAAM;aACV;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,mBAAmB,EAAE;SACnC,gBAAgB,CAAC,KAAK,CAAC;SACvB,SAAS,CAAC,KAAK,CAAC;QACjB,oFAAoF;SACnF,eAAe,CAAC,eAAe,CAAC,sBAAsB,CAAC;SACvD,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC;SACnC,cAAc,CAAC,yCAAyC,CAAC,CAAC;IAC7D,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,gBAAgB,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC;IAE3E,OAAO;QACL,gBAAgB;QAChB,cAAc,EAAE;YACd,aAAa,EAAE,IAAI;YACnB,SAAS,EAAE,gBAAgB;YAC3B,GAAG,MAAM;SACV;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export { createDistributionBuilder, type DistributionBuilderProps, type DistributionBuilderResult, type IDistributionBuilder, type DefaultBehaviorConfig, type AdditionalBehaviorConfig, type InlineFunctionDefinition, } from "./distribution-builder.js";
|
|
1
|
+
export { createDistributionBuilder, type AccessLogsConfig, type DistributionBuilderProps, type DistributionBuilderResult, type IDistributionBuilder, type DefaultBehaviorConfig, type AdditionalBehaviorConfig, type InlineFunctionDefinition, } from "./distribution-builder.js";
|
|
2
2
|
export { createCloudFrontAlarmBuilder, type CloudFrontAlarmBuilderProps, type CloudFrontAlarmBuilderResult, type ICloudFrontAlarmBuilder, } from "./cloudfront-alarm-builder.js";
|
|
3
3
|
export { DISTRIBUTION_DEFAULTS, INLINE_FUNCTION_DEFAULTS } from "./defaults.js";
|
|
4
4
|
export { type DistributionAlarmConfig, type FunctionAlarmConfig } from "./alarm-config.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAQ1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,GAI7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEhF,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@composurecdk/cloudfront",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"description": "Composable CloudFront distribution builder with well-architected defaults",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -35,9 +35,9 @@
|
|
|
35
35
|
},
|
|
36
36
|
"type": "module",
|
|
37
37
|
"peerDependencies": {
|
|
38
|
-
"@composurecdk/cloudwatch": "^0.
|
|
39
|
-
"@composurecdk/core": "^0.
|
|
40
|
-
"@composurecdk/s3": "^0.
|
|
38
|
+
"@composurecdk/cloudwatch": "^0.5.0",
|
|
39
|
+
"@composurecdk/core": "^0.5.0",
|
|
40
|
+
"@composurecdk/s3": "^0.5.0",
|
|
41
41
|
"aws-cdk-lib": "^2.0.0",
|
|
42
42
|
"constructs": "^10.0.0"
|
|
43
43
|
},
|