@jaypie/constructs 1.2.51 → 1.2.52

package/dist/esm/JaypieStaticWebBucket.d.ts

@@ -1,11 +1,13 @@
 import { Construct } from "constructs";
+import { HostConfig } from "./helpers";
 import { JaypieWebDeploymentBucket, JaypieWebDeploymentBucketProps } from "./JaypieWebDeploymentBucket";
 export interface JaypieStaticWebBucketProps extends Omit<JaypieWebDeploymentBucketProps, "host" | "name" | "roleTag"> {
     /**
-     * The domain name for the website
+     * The domain name for the website. Accepts a string or a HostConfig
+     * object resolved via envHostname().
      * @default envHostname({ subdomain: "static" })
      */
-    host?: string;
+    host?: string | HostConfig;
     /**
      * Optional bucket name
      * @default constructEnvName("static")

package/dist/esm/JaypieWebDeploymentBucket.d.ts

@@ -4,9 +4,21 @@ import * as cloudfront from "aws-cdk-lib/aws-cloudfront";
 import { AddToResourcePolicyResult, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import * as route53 from "aws-cdk-lib/aws-route53";
 import * as s3 from "aws-cdk-lib/aws-s3";
+import { LambdaDestination } from "aws-cdk-lib/aws-s3-notifications";
 import * as kms from "aws-cdk-lib/aws-kms";
+import * as wafv2 from "aws-cdk-lib/aws-wafv2";
 import { Construct } from "constructs";
+import { HostConfig } from "./helpers";
+import { JaypieWafConfig, SecurityHeadersOverrides } from "./JaypieDistribution";
 import { JaypieHostedZone } from "./JaypieHostedZone";
+/**
+ * WAF configuration for JaypieWebDeploymentBucket. Same shape as
+ * JaypieDistribution's JaypieWafConfig, but `name` is optional — when omitted,
+ * the construct id is used to namespace the WebACL and WAF log bucket.
+ */
+export type JaypieWebDeploymentBucketWafConfig = Omit<JaypieWafConfig, "name"> & {
+    name?: string;
+};
 export interface JaypieWebDeploymentBucketProps extends s3.BucketProps {
     /**
      * SSL certificate for the CloudFront distribution
@@ -14,19 +26,75 @@ export interface JaypieWebDeploymentBucketProps extends s3.BucketProps {
      */
     certificate?: boolean | acm.ICertificate;
     /**
-     * The domain name for the website
+     * Log destination configuration for CloudFront access logs.
+     * - LambdaDestination: Use a specific Lambda destination for S3 notifications
+     * - true: Use Datadog forwarder for S3 notifications (default)
+     * - false: Disable S3 notifications (logging still occurs if logBucket is set)
+     * @default true
+     */
+    destination?: LambdaDestination | boolean;
+    /**
+     * The domain name for the website.
+     *
+     * Supports both string and config object:
+     * - String: used directly as the domain name (e.g., "app.example.com")
+     * - Object: passed to envHostname() to construct the domain name
+     *   - { subdomain, domain, env, component }
+     *
      * @default mergeDomain(CDK_ENV_WEB_SUBDOMAIN, CDK_ENV_WEB_HOSTED_ZONE || CDK_ENV_HOSTED_ZONE)
+     *
+     * @example
+     * // Direct string
+     * host: "app.example.com"
+     *
+     * @example
+     * // Config object - resolves using envHostname()
+     * host: { subdomain: "app" }
      */
-    host?: string;
+    host?: string | HostConfig;
+    /**
+     * External log bucket for CloudFront access logs.
+     * - IBucket: Use existing bucket directly
+     * - string: Bucket name to import
+     * - { exportName: string }: CloudFormation export name to import
+     * - true: Use account logging bucket (CDK.IMPORT.LOG_BUCKET)
+     * @default undefined (creates new bucket if destination !== false)
+     */
+    logBucket?: s3.IBucket | string | {
+        exportName: string;
+    } | true;
     /**
      * Optional bucket name
      */
     name?: string;
+    /**
+     * Full override for the response headers policy.
+     * When provided, bypasses all default security header logic.
+     */
+    responseHeadersPolicy?: cloudfront.IResponseHeadersPolicy;
     /**
      * Role tag for tagging resources
      * @default CDK.ROLE.HOSTING
      */
     roleTag?: string;
+    /**
+     * Security headers configuration.
+     * - true/undefined: apply sensible defaults (HSTS, X-Frame-Options, CSP, etc.)
+     * - false: disable security headers entirely
+     * - SecurityHeadersOverrides object: merge overrides with defaults
+     * @default true
+     */
+    securityHeaders?: boolean | SecurityHeadersOverrides;
+    /**
+     * WAF WebACL configuration for the CloudFront distribution.
+     * - true/undefined: create and attach a WebACL with sensible defaults; the
+     *   construct id is used to namespace the WebACL and WAF log bucket
+     * - false: disable WAF
+     * - JaypieWebDeploymentBucketWafConfig: customize WAF behavior; if `name`
+     *   is omitted the construct id is used
+     * @default true
+     */
+    waf?: boolean | JaypieWebDeploymentBucketWafConfig;
     /**
      * The hosted zone for DNS records
      * @default CDK_ENV_WEB_HOSTED_ZONE || CDK_ENV_HOSTED_ZONE
@@ -50,7 +118,14 @@ export declare class JaypieWebDeploymentBucket extends Construct implements s3.I
     readonly distributionDomainName?: string;
     readonly certificate?: acm.ICertificate;
     readonly distribution?: cloudfront.Distribution;
+    readonly logBucket?: s3.IBucket;
+    readonly responseHeadersPolicy?: cloudfront.IResponseHeadersPolicy;
+    readonly wafLogBucket?: s3.IBucket;
+    readonly webAcl?: wafv2.CfnWebACL;
     constructor(scope: Construct, id: string, props?: JaypieWebDeploymentBucketProps);
+    private resolveWafConfig;
+    private isExportNameObject;
+    private resolveLogBucket;
     addEventNotification(event: s3.EventType, dest: s3.IBucketNotificationDestination, ...filters: s3.NotificationKeyFilter[]): void;
     addObjectCreatedNotification(dest: s3.IBucketNotificationDestination, ...filters: s3.NotificationKeyFilter[]): void;
     addObjectRemovedNotification(dest: s3.IBucketNotificationDestination, ...filters: s3.NotificationKeyFilter[]): void;

package/dist/esm/__tests__/JaypieWebDeploymentBucket.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/index.js

@@ -2395,8 +2395,8 @@ class JaypieDatadogSecret extends JaypieEnvSecret {
     }
 }
 
-const DEFAULT_RATE_LIMIT = 2000;
-const DEFAULT_MANAGED_RULES = [
+const DEFAULT_RATE_LIMIT$1 = 2000;
+const DEFAULT_MANAGED_RULES$1 = [
     "AWSManagedRulesCommonRuleSet",
     "AWSManagedRulesKnownBadInputsRuleSet",
 ];
@@ -2657,7 +2657,7 @@ class JaypieDistribution extends Construct {
             }
             else {
                 // Create new WebACL
-                const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES$1, rateLimitPerIp = DEFAULT_RATE_LIMIT$1, } = wafConfig;
                 let priority = 0;
                 const rules = [];
                 // Add managed rule groups
@@ -4200,10 +4200,16 @@ class JaypieSsoSyncApplication extends Construct {
     }
 }
 
+const DEFAULT_RATE_LIMIT = 2000;
+const DEFAULT_MANAGED_RULES = [
+    "AWSManagedRulesCommonRuleSet",
+    "AWSManagedRulesKnownBadInputsRuleSet",
+];
 class JaypieWebDeploymentBucket extends Construct {
     constructor(scope, id, props = {}) {
         super(scope, id);
-        const roleTag = props.roleTag || CDK$2.ROLE.HOSTING;
+        const { certificate: certificateProp, destination: destinationProp = true, host: propsHost, logBucket: logBucketProp, name: nameProp, responseHeadersPolicy: responseHeadersPolicyProp, roleTag: roleTagProp, securityHeaders: securityHeadersProp, waf: wafProp = true, zone: propsZone, ...bucketProps } = props;
+        const roleTag = roleTagProp || CDK$2.ROLE.HOSTING;
         // Environment variable validation
         if (process.env.CDK_ENV_WEB_SUBDOMAIN &&
             !isValidSubdomain(process.env.CDK_ENV_WEB_SUBDOMAIN)) {
@@ -4218,8 +4224,19 @@ class JaypieWebDeploymentBucket extends Construct {
             throw new ConfigurationError("CDK_ENV_HOSTED_ZONE is not a valid hostname");
         }
         // Determine host from props or environment
-        let host = props.host;
-        if (!host) {
+        let host;
+        if (typeof propsHost === "string") {
+            host = propsHost;
+        }
+        else if (typeof propsHost === "object") {
+            try {
+                host = envHostname(propsHost);
+            }
+            catch {
+                host = undefined;
+            }
+        }
+        else {
             try {
                 host =
                     process.env.CDK_ENV_WEB_HOST ||
@@ -4235,7 +4252,7 @@ class JaypieWebDeploymentBucket extends Construct {
             throw new ConfigurationError("Host is not a valid hostname");
         }
         // Determine zone from props or environment
-        const zone = props.zone ||
+        const zone = propsZone ||
             process.env.CDK_ENV_WEB_HOSTED_ZONE ||
             process.env.CDK_ENV_HOSTED_ZONE;
         // Create the S3 bucket
@@ -4243,13 +4260,13 @@ class JaypieWebDeploymentBucket extends Construct {
             accessControl: s3.BucketAccessControl.BUCKET_OWNER_FULL_CONTROL,
             autoDeleteObjects: true,
             blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS_ONLY,
-            bucketName: props.name || constructEnvName("web"),
+            bucketName: nameProp || constructEnvName("web"),
             publicReadAccess: true,
             removalPolicy: RemovalPolicy.DESTROY,
             versioned: false,
             websiteErrorDocument: "index.html",
             websiteIndexDocument: "index.html",
-            ...props,
+            ...bucketProps,
         });
         // Delegate IBucket properties to the bucket
         this.bucketArn = this.bucket.bucketArn;
@@ -4331,7 +4348,7 @@ class JaypieWebDeploymentBucket extends Construct {
             }
             // Use resolveCertificate to create certificate at stack level (enables reuse when swapping constructs)
             this.certificate = resolveCertificate(this, {
-                certificate: props.certificate,
+                certificate: certificateProp,
                 domainName: host,
                 roleTag,
                 zone: hostedZone,
@@ -4341,15 +4358,126 @@ class JaypieWebDeploymentBucket extends Construct {
                     value: this.certificate.certificateArn,
                 });
             }
+            // Resolve response headers policy for security headers
+            let resolvedResponseHeadersPolicy;
+            if (responseHeadersPolicyProp) {
+                resolvedResponseHeadersPolicy = responseHeadersPolicyProp;
+            }
+            else if (securityHeadersProp !== false) {
+                const overrides = typeof securityHeadersProp === "object" ? securityHeadersProp : {};
+                resolvedResponseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, "SecurityHeaders", {
+                    customHeadersBehavior: {
+                        customHeaders: [
+                            {
+                                header: "Cache-Control",
+                                override: true,
+                                value: "no-store, no-cache, must-revalidate, proxy-revalidate",
+                            },
+                            {
+                                header: "Cross-Origin-Embedder-Policy",
+                                override: true,
+                                value: "unsafe-none",
+                            },
+                            {
+                                header: "Cross-Origin-Opener-Policy",
+                                override: true,
+                                value: "same-origin",
+                            },
+                            {
+                                header: "Cross-Origin-Resource-Policy",
+                                override: true,
+                                value: "same-origin",
+                            },
+                            {
+                                header: "Permissions-Policy",
+                                override: true,
+                                value: overrides.permissionsPolicy ??
+                                    CDK$2.SECURITY_HEADERS.PERMISSIONS_POLICY,
+                            },
+                        ],
+                    },
+                    removeHeaders: ["Server"],
+                    securityHeadersBehavior: {
+                        contentSecurityPolicy: {
+                            contentSecurityPolicy: overrides.contentSecurityPolicy ??
+                                CDK$2.SECURITY_HEADERS.CONTENT_SECURITY_POLICY,
+                            override: true,
+                        },
+                        contentTypeOptions: { override: true },
+                        frameOptions: {
+                            frameOption: overrides.frameOption ?? cloudfront.HeadersFrameOption.DENY,
+                            override: true,
+                        },
+                        referrerPolicy: {
+                            referrerPolicy: overrides.referrerPolicy ??
+                                cloudfront.HeadersReferrerPolicy
+                                    .STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+                            override: true,
+                        },
+                        strictTransportSecurity: {
+                            accessControlMaxAge: Duration.seconds(overrides.hstsMaxAge ?? CDK$2.SECURITY_HEADERS.HSTS_MAX_AGE),
+                            includeSubdomains: overrides.hstsIncludeSubdomains ?? true,
+                            override: true,
+                            preload: true,
+                        },
+                    },
+                });
+            }
+            this.responseHeadersPolicy = resolvedResponseHeadersPolicy;
+            // Resolve or create access log bucket
+            let accessLogBucket;
+            const isExternalLogBucket = logBucketProp !== undefined;
+            if (logBucketProp !== undefined) {
+                accessLogBucket = this.resolveLogBucket(logBucketProp);
+            }
+            else if (destinationProp !== false) {
+                const createdBucket = new s3.Bucket(this, constructEnvName("LogBucket"), {
+                    autoDeleteObjects: true,
+                    lifecycleRules: [
+                        {
+                            expiration: Duration.days(90),
+                            transitions: [
+                                {
+                                    storageClass: s3.StorageClass.INFREQUENT_ACCESS,
+                                    transitionAfter: Duration.days(30),
+                                },
+                            ],
+                        },
+                    ],
+                    objectOwnership: s3.ObjectOwnership.OBJECT_WRITER,
+                    removalPolicy: RemovalPolicy.DESTROY,
+                });
+                Tags.of(createdBucket).add(CDK$2.TAG.ROLE, CDK$2.ROLE.STORAGE);
+                accessLogBucket = createdBucket;
+            }
+            if (accessLogBucket &&
+                destinationProp !== false &&
+                !isExternalLogBucket) {
+                const lambdaDestination = destinationProp === true
+                    ? new LambdaDestination(resolveDatadogForwarderFunction(this))
+                    : destinationProp;
+                accessLogBucket.addEventNotification(s3.EventType.OBJECT_CREATED, lambdaDestination);
+            }
+            this.logBucket = accessLogBucket;
             // Create CloudFront distribution
             this.distribution = new cloudfront.Distribution(this, "Distribution", {
                 defaultBehavior: {
                     cachePolicy: cloudfront.CachePolicy.CACHING_DISABLED,
                     origin: new origins.S3StaticWebsiteOrigin(this.bucket),
+                    ...(resolvedResponseHeadersPolicy
+                        ? { responseHeadersPolicy: resolvedResponseHeadersPolicy }
+                        : {}),
                     viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                 },
                 certificate: this.certificate,
                 domainNames: [host],
+                ...(accessLogBucket
+                    ? {
+                        enableLogging: true,
+                        logBucket: accessLogBucket,
+                        logFilePrefix: "cloudfront-logs/",
+                    }
+                    : {}),
             });
             Tags.of(this.distribution).add(CDK$2.TAG.ROLE, roleTag);
             // If this is production, enable caching on everything but index.html
@@ -4357,6 +4485,9 @@ class JaypieWebDeploymentBucket extends Construct {
                 this.distribution.addBehavior("/*", new origins.S3StaticWebsiteOrigin(this.bucket), {
                     viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
                     cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
+                    ...(resolvedResponseHeadersPolicy
+                        ? { responseHeadersPolicy: resolvedResponseHeadersPolicy }
+                        : {}),
                 });
             }
             // Create DNS record
@@ -4381,8 +4512,148 @@ class JaypieWebDeploymentBucket extends Construct {
                     ],
                 }));
             }
+            // Create and attach WAF WebACL
+            let resolvedWebAclArn;
+            const wafConfig = this.resolveWafConfig(wafProp, id);
+            if (wafConfig) {
+                if (wafConfig.webAclArn) {
+                    resolvedWebAclArn = wafConfig.webAclArn;
+                    this.distribution.attachWebAclId(wafConfig.webAclArn);
+                }
+                else {
+                    const { managedRuleOverrides, managedRuleScopeDowns, managedRules = DEFAULT_MANAGED_RULES, rateLimitPerIp = DEFAULT_RATE_LIMIT, } = wafConfig;
+                    let priority = 0;
+                    const rules = [];
+                    for (const ruleName of managedRules) {
+                        const ruleActionOverrides = managedRuleOverrides?.[ruleName];
+                        const scopeDownStatement = managedRuleScopeDowns?.[ruleName];
+                        rules.push({
+                            name: ruleName,
+                            priority: priority++,
+                            overrideAction: { none: {} },
+                            statement: {
+                                managedRuleGroupStatement: {
+                                    name: ruleName,
+                                    vendorName: "AWS",
+                                    ...(ruleActionOverrides && { ruleActionOverrides }),
+                                    ...(scopeDownStatement && { scopeDownStatement }),
+                                },
+                            },
+                            visibilityConfig: {
+                                cloudWatchMetricsEnabled: true,
+                                metricName: ruleName,
+                                sampledRequestsEnabled: true,
+                            },
+                        });
+                    }
+                    rules.push({
+                        name: "RateLimitPerIp",
+                        priority,
+                        action: { block: {} },
+                        statement: {
+                            rateBasedStatement: {
+                                aggregateKeyType: "IP",
+                                limit: rateLimitPerIp,
+                            },
+                        },
+                        visibilityConfig: {
+                            cloudWatchMetricsEnabled: true,
+                            metricName: "RateLimitPerIp",
+                            sampledRequestsEnabled: true,
+                        },
+                    });
+                    const webAclName = constructEnvName(`${wafConfig.name}-WebAcl`);
+                    const webAcl = new wafv2.CfnWebACL(this, "WebAcl", {
+                        defaultAction: { allow: {} },
+                        name: webAclName,
+                        rules,
+                        scope: "CLOUDFRONT",
+                        visibilityConfig: {
+                            cloudWatchMetricsEnabled: true,
+                            metricName: webAclName,
+                            sampledRequestsEnabled: true,
+                        },
+                    });
+                    this.webAcl = webAcl;
+                    resolvedWebAclArn = webAcl.attrArn;
+                    this.distribution.attachWebAclId(webAcl.attrArn);
+                    Tags.of(webAcl).add(CDK$2.TAG.ROLE, roleTag);
+                }
+            }
+            // Create WAF logging
+            if (resolvedWebAclArn && wafConfig) {
+                const { logBucket: wafLogBucketProp = true } = wafConfig;
+                let wafLogBucket;
+                if (wafLogBucketProp === true) {
+                    const wafLogBucketId = constructEnvName(`${wafConfig.name}-WafLogBucket`);
+                    const wafLogBucketName = `aws-waf-logs-${constructEnvName(`${wafConfig.name}-waf`).toLowerCase()}`;
+                    const createdBucket = new s3.Bucket(this, wafLogBucketId, {
+                        bucketName: wafLogBucketName,
+                        lifecycleRules: [
+                            {
+                                expiration: Duration.days(90),
+                                transitions: [
+                                    {
+                                        storageClass: s3.StorageClass.INFREQUENT_ACCESS,
+                                        transitionAfter: Duration.days(30),
+                                    },
+                                ],
+                            },
+                        ],
+                        objectOwnership: s3.ObjectOwnership.OBJECT_WRITER,
+                        removalPolicy: RemovalPolicy.RETAIN,
+                    });
+                    Tags.of(createdBucket).add(CDK$2.TAG.ROLE, CDK$2.ROLE.MONITORING);
+                    if (destinationProp !== false) {
+                        const lambdaDestination = destinationProp === true
+                            ? new LambdaDestination(resolveDatadogForwarderFunction(this))
+                            : destinationProp;
+                        createdBucket.addEventNotification(s3.EventType.OBJECT_CREATED, lambdaDestination);
+                    }
+                    wafLogBucket = createdBucket;
+                }
+                else if (typeof wafLogBucketProp === "object") {
+                    wafLogBucket = wafLogBucketProp;
+                }
+                if (wafLogBucket) {
+                    this.wafLogBucket = wafLogBucket;
+                    new wafv2.CfnLoggingConfiguration(this, "WafLoggingConfig", {
+                        logDestinationConfigs: [wafLogBucket.bucketArn],
+                        resourceArn: resolvedWebAclArn,
+                    });
+                }
+            }
         }
     }
+    resolveWafConfig(wafProp, defaultName) {
+        if (wafProp === false)
+            return undefined;
+        if (wafProp === true)
+            return { name: defaultName };
+        if (wafProp.enabled === false)
+            return undefined;
+        return { ...wafProp, name: wafProp.name || defaultName };
+    }
+    isExportNameObject(value) {
+        return (typeof value === "object" &&
+            value !== null &&
+            "exportName" in value &&
+            typeof value.exportName === "string");
+    }
+    resolveLogBucket(logBucketProp) {
+        if (logBucketProp === true) {
+            const bucketName = Fn.importValue(CDK$2.IMPORT.LOG_BUCKET);
+            return s3.Bucket.fromBucketName(this, "ImportedLogBucket", bucketName);
+        }
+        if (this.isExportNameObject(logBucketProp)) {
+            const bucketName = Fn.importValue(logBucketProp.exportName);
+            return s3.Bucket.fromBucketName(this, "ImportedLogBucket", bucketName);
+        }
+        if (typeof logBucketProp === "string") {
+            return s3.Bucket.fromBucketName(this, "ImportedLogBucket", logBucketProp);
+        }
+        return logBucketProp;
+    }
     // Implement remaining IBucket methods by delegating to the bucket
     addEventNotification(event, dest, ...filters) {
         this.bucket.addEventNotification(event, dest, ...filters);