@gradientedge/cdk-utils 8.65.0 → 8.66.0

package/dist/src/lib/construct/site-with-ecs-backend/main.d.ts

@@ -37,6 +37,7 @@ export declare class SiteWithEcsBackend extends CommonConstruct {
     id: string;
     siteHostedZone: route53.IHostedZone;
     siteCertificate: certificateManager.ICertificate;
+    siteRegionalCertificate: certificateManager.ICertificate;
     siteEcsPolicy: iam.PolicyDocument;
     siteEcsRole: iam.Role;
     siteEcsEnvironment: {

package/dist/src/lib/construct/site-with-ecs-backend/main.js

@@ -58,6 +58,7 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
     /* site resources */
     siteHostedZone;
     siteCertificate;
+    siteRegionalCertificate;
     siteEcsPolicy;
     siteEcsRole;
     siteEcsEnvironment;
@@ -131,6 +132,7 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
             this.props.siteCertificate.certificateArn = this.ssmManager.readStringParameterFromRegion(`${this.id}-certificate-parameter`, this, this.props.siteCertificate.certificateSsmName, this.props.siteCertificate.certificateRegion);
         }
         this.siteCertificate = this.acmManager.resolveCertificate(`${this.id}-certificate`, this, this.props.siteCertificate);
+        this.siteRegionalCertificate = this.acmManager.resolveCertificate(`${this.id}-regional-certificate`, this, this.props.siteRegionalCertificate, this.siteHostedZone);
     }
     /**
      * @summary Method to resolve secrets from SecretsManager
@@ -230,6 +232,7 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
             serviceName: `${this.id}-${this.props.stage}`,
             cpu: this.props.siteTask.cpu,
             loadBalancerName: `${this.id}-${this.props.stage}`,
+            certificate: this.siteRegionalCertificate,
             domainName: this.siteInternalDomainName,
             domainZone: this.siteHostedZone,
             listenerPort: this.props.siteTask.listenerPort,
@@ -340,7 +343,7 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
     createSiteOrigin() {
         this.siteOrigin = new origins.HttpOrigin(this.siteEcsLoadBalancer.loadBalancerDnsName, {
             httpPort: this.props.siteTask.listenerPort,
-            protocolPolicy: cloudfront.OriginProtocolPolicy.HTTP_ONLY,
+            protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
         });
     }
     /**

package/dist/src/lib/types/aws/index.d.ts

@@ -69,6 +69,7 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
     siteCacheInvalidationDockerFilePath?: string;
     siteHealthCheck: HealthCheck;
     siteCertificate: AcmProps;
+    siteRegionalCertificate: AcmProps;
     siteCluster: EcsClusterProps;
     siteDistribution: DistributionProps;
     siteCloudfrontFunctionProps?: CloudfrontFunctionProps;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils",
-  "version": "8.65.0",
+  "version": "8.66.0",
   "description": "Utilities for AWS CDK provisioning",
   "main": "dist/index.js",
   "engines": {

package/src/lib/construct/site-with-ecs-backend/main.ts

@@ -43,6 +43,7 @@ export class SiteWithEcsBackend extends CommonConstruct {
   /* site resources */
   siteHostedZone: route53.IHostedZone
   siteCertificate: certificateManager.ICertificate
+  siteRegionalCertificate: certificateManager.ICertificate
   siteEcsPolicy: iam.PolicyDocument
   siteEcsRole: iam.Role
   siteEcsEnvironment: { [key: string]: string }
@@ -136,6 +137,13 @@ export class SiteWithEcsBackend extends CommonConstruct {
       this,
       this.props.siteCertificate
     )
+
+    this.siteRegionalCertificate = this.acmManager.resolveCertificate(
+      `${this.id}-regional-certificate`,
+      this,
+      this.props.siteRegionalCertificate,
+      this.siteHostedZone
+    )
   }
 
   /**
@@ -253,6 +261,7 @@ export class SiteWithEcsBackend extends CommonConstruct {
       serviceName: `${this.id}-${this.props.stage}`,
       cpu: this.props.siteTask.cpu,
       loadBalancerName: `${this.id}-${this.props.stage}`,
+      certificate: this.siteRegionalCertificate,
       domainName: this.siteInternalDomainName,
       domainZone: this.siteHostedZone,
       listenerPort: this.props.siteTask.listenerPort,
@@ -386,7 +395,7 @@ export class SiteWithEcsBackend extends CommonConstruct {
   protected createSiteOrigin() {
     this.siteOrigin = new origins.HttpOrigin(this.siteEcsLoadBalancer.loadBalancerDnsName, {
       httpPort: this.props.siteTask.listenerPort,
-      protocolPolicy: cloudfront.OriginProtocolPolicy.HTTP_ONLY,
+      protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
     })
   }
 

package/src/lib/types/aws/index.ts

@@ -72,6 +72,7 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
   siteCacheInvalidationDockerFilePath?: string
   siteHealthCheck: HealthCheck
   siteCertificate: AcmProps
+  siteRegionalCertificate: AcmProps
   siteCluster: EcsClusterProps
   siteDistribution: DistributionProps
   siteCloudfrontFunctionProps?: CloudfrontFunctionProps