@gradientedge/cdk-utils 8.97.0 → 8.98.0

package/dist/src/lib/construct/site-with-ecs-backend/constants.d.ts

@@ -0,0 +1,4 @@
+export declare enum SiteResponseHeaderPolicyType {
+    ORIGIN = "origin",
+    STATIC = "static"
+}

package/dist/src/lib/construct/site-with-ecs-backend/constants.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SiteResponseHeaderPolicyType = void 0;
+var SiteResponseHeaderPolicyType;
+(function (SiteResponseHeaderPolicyType) {
+    SiteResponseHeaderPolicyType["ORIGIN"] = "origin";
+    SiteResponseHeaderPolicyType["STATIC"] = "static";
+})(SiteResponseHeaderPolicyType || (exports.SiteResponseHeaderPolicyType = SiteResponseHeaderPolicyType = {}));

package/dist/src/lib/construct/site-with-ecs-backend/index.d.ts

@@ -1,2 +1,3 @@
+export * from './constants';
 export * from './main';
 export * from './types';

package/dist/src/lib/construct/site-with-ecs-backend/index.js

@@ -14,5 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./constants"), exports);
 __exportStar(require("./main"), exports);
 __exportStar(require("./types"), exports);

package/dist/src/lib/construct/site-with-ecs-backend/main.d.ts

@@ -1,3 +1,4 @@
+import * as cdk from 'aws-cdk-lib';
 import * as certificateManager from 'aws-cdk-lib/aws-certificatemanager';
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
@@ -11,7 +12,7 @@ import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as efs from 'aws-cdk-lib/aws-efs';
 import { Construct } from 'constructs';
 import { CommonConstruct } from '../../common';
-import { SiteWithEcsBackendProps } from './types';
+import { SiteWithEcsBackendProps, SiteResponseHeadersPolicyProps } from './types';
 /**
  * @classdesc Provides a construct to create and deploy a site hosted with an clustered ECS/ELB backend
  * @example
@@ -58,6 +59,8 @@ export declare class SiteWithEcsBackend extends CommonConstruct {
     siteDomainNames: string[];
     siteCloudfrontFunction: cloudfront.Function;
     siteFunctionAssociations: cloudfront.FunctionAssociation[];
+    siteOriginRequestPolicy: cloudfront.OriginRequestPolicy;
+    siteOriginResponseHeadersPolicy?: cloudfront.ResponseHeadersPolicy;
     constructor(parent: Construct, id: string, props: SiteWithEcsBackendProps);
     /**
      * @summary Initialise and provision resources
@@ -122,6 +125,9 @@ export declare class SiteWithEcsBackend extends CommonConstruct {
      * Method to create log bucket for site distribution
      */
     protected createSiteLogBucket(): void;
+    protected createSiteOriginRequestPolicy(): void;
+    protected createResponseHeaderPolicy(props: SiteResponseHeadersPolicyProps): cdk.aws_cloudfront.ResponseHeadersPolicy | undefined;
+    protected createSiteOriginResponseHeadersPolicy(): void;
     protected createSiteOrigin(): void;
     /**
      * @summary Method to create a site cloudfront function

package/dist/src/lib/construct/site-with-ecs-backend/main.js

@@ -24,6 +24,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SiteWithEcsBackend = void 0;
+const _ = __importStar(require("lodash"));
 const cdk = __importStar(require("aws-cdk-lib"));
 const cloudfront = __importStar(require("aws-cdk-lib/aws-cloudfront"));
 const origins = __importStar(require("aws-cdk-lib/aws-cloudfront-origins"));
@@ -77,6 +78,8 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
     siteDomainNames;
     siteCloudfrontFunction;
     siteFunctionAssociations;
+    siteOriginRequestPolicy;
+    siteOriginResponseHeadersPolicy;
     constructor(parent, id, props) {
         super(parent, id, props);
         this.props = props;
@@ -100,6 +103,8 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
         this.createEcsBuildArgs();
         this.createEcsContainerImage();
         this.createEcsService();
+        this.createSiteOriginRequestPolicy();
+        this.createSiteOriginResponseHeadersPolicy();
         this.createSiteOrigin();
         this.createSiteCloudfrontFunction();
         this.resolveSiteFunctionAssociations();
@@ -340,9 +345,47 @@ class SiteWithEcsBackend extends common_1.CommonConstruct {
     createSiteLogBucket() {
         this.siteLogBucket = this.s3Manager.createS3Bucket(`${this.id}-site-logs`, this, this.props.siteLogBucket);
     }
+    createSiteOriginRequestPolicy() {
+        if (!this.props.siteOriginRequestPolicy)
+            return;
+        this.siteOriginRequestPolicy = new cloudfront.OriginRequestPolicy(this, `${this.id}-sorp`, {
+            comment: `Request Policy for ${this.id}-distribution - ${this.props.stage} stage`,
+            cookieBehavior: this.props.siteOriginRequestPolicy.cookieBehavior,
+            headerBehavior: this.props.siteOriginRequestPolicy.headerBehavior,
+            originRequestPolicyName: `${this.id}-origin-request`,
+            queryStringBehavior: this.props.siteOriginRequestPolicy.queryStringBehavior,
+        });
+        _.assign(this.props.siteDistribution.defaultBehavior, {
+            originRequestPolicy: this.siteOriginRequestPolicy,
+        });
+    }
+    createResponseHeaderPolicy(props) {
+        if (!props)
+            return undefined;
+        return new cloudfront.ResponseHeadersPolicy(this, `${this.id}-${props.type}-srhp`, {
+            ...props,
+            comment: `Response Header Policy for ${props.type} for ${this.id}-distribution - ${this.props.stage} stage`,
+            responseHeadersPolicyName: `${this.id}-${props.type}-response`,
+            securityHeadersBehavior: {
+                strictTransportSecurity: {
+                    ...props.securityHeadersBehavior?.strictTransportSecurity,
+                    accessControlMaxAge: cdk.Duration.seconds(props.securityHeadersBehavior?.strictTransportSecurity?.accessControlMaxAgeInSeconds),
+                },
+            },
+        });
+    }
+    createSiteOriginResponseHeadersPolicy() {
+        if (!this.props.siteOriginResponseHeadersPolicy)
+            return;
+        this.siteOriginResponseHeadersPolicy = this.createResponseHeaderPolicy(this.props.siteOriginResponseHeadersPolicy);
+        _.assign(this.props.siteDistribution.defaultBehavior, {
+            responseHeadersPolicy: this.siteOriginResponseHeadersPolicy,
+        });
+    }
     createSiteOrigin() {
         this.siteOrigin = new origins.HttpOrigin(this.siteInternalDomainName, {
             httpPort: this.props.siteTask.listenerPort,
+            originId: `${this.id}-server`,
             protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
         });
     }

package/dist/src/lib/construct/site-with-ecs-backend/types.d.ts

@@ -1,6 +1,8 @@
 import { CommonStackProps } from '../../common';
 import { AcmProps, CloudfrontFunctionProps, DistributionProps, EcsApplicationLoadBalancedFargateServiceProps, EcsClusterProps, EfsAccessPointOptions, EfsFileSystemProps, HealthCheck, LogProps, S3BucketProps } from '../../services';
 import { VpcProps } from 'aws-cdk-lib/aws-ec2';
+import { OriginRequestPolicyProps, ResponseHeadersStrictTransportSecurity, ResponseSecurityHeadersBehavior, ResponseHeadersPolicyProps } from 'aws-cdk-lib/aws-cloudfront';
+import { SiteResponseHeaderPolicyType } from './constants';
 /**
  */
 export interface SiteWithEcsBackendProps extends CommonStackProps {
@@ -18,6 +20,8 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
     siteHealthCheck: HealthCheck;
     siteLog: LogProps;
     siteLogBucket: S3BucketProps;
+    siteOriginRequestPolicy: OriginRequestPolicyProps;
+    siteOriginResponseHeadersPolicy: SiteResponseHeadersPolicyProps;
     siteRecordName?: string;
     siteRegionalCertificate: AcmProps;
     siteSubDomain: string;
@@ -27,3 +31,13 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
     useExistingHostedZone: boolean;
     useExistingVpc: boolean;
 }
+export interface SiteResponseHeadersStrictTransportSecurity extends ResponseHeadersStrictTransportSecurity {
+    accessControlMaxAgeInSeconds: number;
+}
+export interface SiteSecurityHeadersBehavior extends ResponseSecurityHeadersBehavior {
+    strictTransportSecurity: SiteResponseHeadersStrictTransportSecurity;
+}
+export interface SiteResponseHeadersPolicyProps extends ResponseHeadersPolicyProps {
+    securityHeadersBehavior: SiteSecurityHeadersBehavior;
+    type: SiteResponseHeaderPolicyType;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradientedge/cdk-utils",
-  "version": "8.97.0",
+  "version": "8.98.0",
   "description": "Utilities for AWS CDK provisioning",
   "main": "dist/index.js",
   "engines": {

package/src/lib/construct/site-with-ecs-backend/constants.ts

@@ -0,0 +1,4 @@
+export enum SiteResponseHeaderPolicyType {
+  ORIGIN = 'origin',
+  STATIC = 'static',
+}

package/src/lib/construct/site-with-ecs-backend/index.ts

@@ -1,2 +1,3 @@
+export * from './constants'
 export * from './main'
 export * from './types'

package/src/lib/construct/site-with-ecs-backend/main.ts

@@ -1,3 +1,4 @@
+import * as _ from 'lodash'
 import * as cdk from 'aws-cdk-lib'
 import * as certificateManager from 'aws-cdk-lib/aws-certificatemanager'
 import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'
@@ -13,7 +14,7 @@ import * as s3 from 'aws-cdk-lib/aws-s3'
 import * as efs from 'aws-cdk-lib/aws-efs'
 import { Construct } from 'constructs'
 import { CommonConstruct } from '../../common'
-import { SiteWithEcsBackendProps } from './types'
+import { SiteWithEcsBackendProps, SiteResponseHeadersPolicyProps } from './types'
 
 /**
  * @classdesc Provides a construct to create and deploy a site hosted with an clustered ECS/ELB backend
@@ -62,6 +63,8 @@ export class SiteWithEcsBackend extends CommonConstruct {
   siteDomainNames: string[]
   siteCloudfrontFunction: cloudfront.Function
   siteFunctionAssociations: cloudfront.FunctionAssociation[]
+  siteOriginRequestPolicy: cloudfront.OriginRequestPolicy
+  siteOriginResponseHeadersPolicy?: cloudfront.ResponseHeadersPolicy
 
   constructor(parent: Construct, id: string, props: SiteWithEcsBackendProps) {
     super(parent, id, props)
@@ -88,6 +91,8 @@ export class SiteWithEcsBackend extends CommonConstruct {
     this.createEcsBuildArgs()
     this.createEcsContainerImage()
     this.createEcsService()
+    this.createSiteOriginRequestPolicy()
+    this.createSiteOriginResponseHeadersPolicy()
     this.createSiteOrigin()
     this.createSiteCloudfrontFunction()
     this.resolveSiteFunctionAssociations()
@@ -402,9 +407,50 @@ export class SiteWithEcsBackend extends CommonConstruct {
     this.siteLogBucket = this.s3Manager.createS3Bucket(`${this.id}-site-logs`, this, this.props.siteLogBucket)
   }
 
+  protected createSiteOriginRequestPolicy() {
+    if (!this.props.siteOriginRequestPolicy) return
+    this.siteOriginRequestPolicy = new cloudfront.OriginRequestPolicy(this, `${this.id}-sorp`, {
+      comment: `Request Policy for ${this.id}-distribution - ${this.props.stage} stage`,
+      cookieBehavior: this.props.siteOriginRequestPolicy.cookieBehavior,
+      headerBehavior: this.props.siteOriginRequestPolicy.headerBehavior,
+      originRequestPolicyName: `${this.id}-origin-request`,
+      queryStringBehavior: this.props.siteOriginRequestPolicy.queryStringBehavior,
+    })
+
+    _.assign(this.props.siteDistribution.defaultBehavior, {
+      originRequestPolicy: this.siteOriginRequestPolicy,
+    })
+  }
+
+  protected createResponseHeaderPolicy(props: SiteResponseHeadersPolicyProps) {
+    if (!props) return undefined
+    return new cloudfront.ResponseHeadersPolicy(this, `${this.id}-${props.type}-srhp`, {
+      ...props,
+      comment: `Response Header Policy for ${props.type} for ${this.id}-distribution - ${this.props.stage} stage`,
+      responseHeadersPolicyName: `${this.id}-${props.type}-response`,
+      securityHeadersBehavior: {
+        strictTransportSecurity: {
+          ...props.securityHeadersBehavior?.strictTransportSecurity,
+          accessControlMaxAge: cdk.Duration.seconds(
+            props.securityHeadersBehavior?.strictTransportSecurity?.accessControlMaxAgeInSeconds
+          ),
+        },
+      },
+    })
+  }
+
+  protected createSiteOriginResponseHeadersPolicy() {
+    if (!this.props.siteOriginResponseHeadersPolicy) return
+    this.siteOriginResponseHeadersPolicy = this.createResponseHeaderPolicy(this.props.siteOriginResponseHeadersPolicy)
+    _.assign(this.props.siteDistribution.defaultBehavior, {
+      responseHeadersPolicy: this.siteOriginResponseHeadersPolicy,
+    })
+  }
+
   protected createSiteOrigin() {
     this.siteOrigin = new origins.HttpOrigin(this.siteInternalDomainName, {
       httpPort: this.props.siteTask.listenerPort,
+      originId: `${this.id}-server`,
       protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
     })
   }

package/src/lib/construct/site-with-ecs-backend/types.ts

@@ -12,6 +12,13 @@ import {
   S3BucketProps,
 } from '../../services'
 import { VpcProps } from 'aws-cdk-lib/aws-ec2'
+import {
+  OriginRequestPolicyProps,
+  ResponseHeadersStrictTransportSecurity,
+  ResponseSecurityHeadersBehavior,
+  ResponseHeadersPolicyProps,
+} from 'aws-cdk-lib/aws-cloudfront'
+import { SiteResponseHeaderPolicyType } from './constants'
 
 /**
  */
@@ -30,6 +37,8 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
   siteHealthCheck: HealthCheck
   siteLog: LogProps
   siteLogBucket: S3BucketProps
+  siteOriginRequestPolicy: OriginRequestPolicyProps
+  siteOriginResponseHeadersPolicy: SiteResponseHeadersPolicyProps
   siteRecordName?: string
   siteRegionalCertificate: AcmProps
   siteSubDomain: string
@@ -39,3 +48,16 @@ export interface SiteWithEcsBackendProps extends CommonStackProps {
   useExistingHostedZone: boolean
   useExistingVpc: boolean
 }
+
+export interface SiteResponseHeadersStrictTransportSecurity extends ResponseHeadersStrictTransportSecurity {
+  accessControlMaxAgeInSeconds: number
+}
+
+export interface SiteSecurityHeadersBehavior extends ResponseSecurityHeadersBehavior {
+  strictTransportSecurity: SiteResponseHeadersStrictTransportSecurity
+}
+
+export interface SiteResponseHeadersPolicyProps extends ResponseHeadersPolicyProps {
+  securityHeadersBehavior: SiteSecurityHeadersBehavior
+  type: SiteResponseHeaderPolicyType
+}