@stacksjs/cloud 0.58.48 → 0.58.50

package/src/cloud/security.ts

@@ -0,0 +1,259 @@
+// waf and encryption
+import { config } from '@stacksjs/config'
+import type { aws_route53 as route53 } from 'aws-cdk-lib'
+import { Duration, RemovalPolicy, Tags, aws_certificatemanager as acm, aws_kms as kms, aws_wafv2 as wafv2 } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface StorageStackProps extends NestedCloudProps {
+  zone: route53.IHostedZone
+}
+
+export class SecurityStack {
+  firewall: wafv2.CfnWebACL
+  kmsKey: kms.Key
+  certificate: acm.Certificate
+
+  constructor(scope: Construct, props: StorageStackProps) {
+    const firewallOptions = config.cloud.firewall
+
+    if (!firewallOptions)
+      throw new Error('No firewall options found in config')
+
+    const options = {
+      defaultAction: { allow: {} },
+      scope: 'CLOUDFRONT',
+      visibilityConfig: {
+        sampledRequestsEnabled: true,
+        cloudWatchMetricsEnabled: true,
+        metricName: 'firewallMetric',
+      },
+      rules: this.getFirewallRules(),
+    }
+
+    this.firewall = new wafv2.CfnWebACL(scope, 'WebFirewall', options)
+    Tags.of(this.firewall).add('Name', 'waf-cloudfront', { priority: 300 })
+    Tags.of(this.firewall).add('Purpose', 'CloudFront', { priority: 300 })
+    Tags.of(this.firewall).add('CreatedBy', 'CloudFormation', { priority: 300 })
+
+    this.kmsKey = new kms.Key(scope, 'EncryptionKey', {
+      alias: 'stacks-encryption-key',
+      description: 'KMS key for Stacks Cloud',
+      enableKeyRotation: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      pendingWindow: Duration.days(30),
+    })
+
+    this.certificate = new acm.Certificate(scope, 'Certificate', {
+      domainName: props.domain,
+      validation: acm.CertificateValidation.fromDns(props.zone),
+      subjectAlternativeNames: [`www.${props.domain}`, `api.${props.domain}`],
+    })
+  }
+
+  getFirewallRules() {
+    const rules: wafv2.CfnWebACL.RuleProperty[] = []
+    const priorities = []
+
+    if (config.security.firewall?.countryCodes?.length) {
+      priorities.push(1)
+      rules.push({
+        name: 'CountryRule',
+        priority: priorities.length,
+        statement: {
+          geoMatchStatement: {
+            countryCodes: config.security.firewall.countryCodes,
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'CountryRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.ipAddresses?.length) {
+      const ipSet = new wafv2.CfnIPSet(this, 'IpSet', {
+        name: 'IpSet',
+        description: 'IP Set',
+        scope: 'CLOUDFRONT',
+        addresses: config.security.firewall.ipAddresses,
+        ipAddressVersion: 'IPV4',
+      })
+
+      priorities.push(1)
+      rules.push({
+        name: 'IpAddressRule',
+        priority: priorities.length,
+        statement: {
+          ipSetReferenceStatement: {
+            arn: ipSet.attrArn,
+          },
+        },
+        action: {
+          block: {},
+        },
+        visibilityConfig: {
+          sampledRequestsEnabled: true,
+          cloudWatchMetricsEnabled: true,
+          metricName: 'IpAddressRule',
+        },
+      })
+    }
+
+    if (config.security.firewall?.httpHeaders?.length) {
+      config.security.firewall.httpHeaders.forEach((header, index) => {
+        priorities.push(1)
+        rules.push({
+          name: `HttpHeaderRule${index}`,
+          priority: priorities.length,
+          statement: {
+            byteMatchStatement: {
+              fieldToMatch: {
+                singleHeader: {
+                  name: header,
+                },
+              },
+              positionalConstraint: 'EXACTLY',
+              searchString: 'true',
+              textTransformations: [
+                {
+                  priority: index,
+                  type: 'NONE',
+                },
+              ],
+            },
+          },
+          action: {
+            block: {},
+          },
+          visibilityConfig: {
+            sampledRequestsEnabled: true,
+            cloudWatchMetricsEnabled: true,
+            metricName: `HttpHeaderRule${index}`,
+          },
+        })
+      })
+    }
+
+    // if (config.security.firewall?.queryString?.length) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'QueryStringRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       byteMatchStatement: {
+    //         fieldToMatch: {
+    //           queryString: {},
+    //         },
+    //         positionalConstraint: 'EXACTLY',
+    //         searchString: config.security.firewall.queryString.join(', '),
+    //         textTransformations: [
+    //           {
+    //             priority: 0,
+    //             type: 'NONE',
+    //           },
+    //         ],
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'QueryStringRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.rateLimitPerMinute) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'RateLimitRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       rateBasedStatement: {
+    //         limit: config.security.firewall.rateLimitPerMinute,
+    //         aggregateKeyType: 'IP',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'RateLimitRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.useIpReputationLists) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'IpReputationRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       managedRuleGroupStatement: {
+    //         vendorName: 'AWS',
+    //         name: 'AWSManagedRulesAmazonIpReputationList',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'IpReputationRule',
+    //     },
+    //   })
+    // }
+
+    // if (config.security.firewall?.useKnownBadInputsRuleSet) {
+    //   priorities.push(1)
+    //   rules.push({
+    //     name: 'KnownBadInputsRule',
+    //     priority: priorities.length,
+    //     statement: {
+    //       managedRuleGroupStatement: {
+    //         vendorName: 'AWS',
+    //         name: 'AWSManagedRulesKnownBadInputsRuleSet',
+    //       },
+    //     },
+    //     action: {
+    //       block: {},
+    //     },
+    //     visibilityConfig: {
+    //       sampledRequestsEnabled: true,
+    //       cloudWatchMetricsEnabled: true,
+    //       metricName: 'KnownBadInputsRule',
+    //     },
+    //   })
+    // }
+    // also add
+    //     }, {
+    //   "name": "AWSManagedRulesAnonymousIpList",
+    //   "priority": 40,
+    //   "overrideAction": "none",
+    //   "excludedRules": []
+    // }, {
+    //   "name": "AWSManagedRulesLinuxRuleSet",
+    //   "priority": 50,
+    //   "overrideAction": "none",
+    //   "excludedRules": []
+    // }, {
+    //   "name": "AWSManagedRulesUnixRuleSet",
+    //   "priority": 60,
+    //   "overrideAction": "none",
+    //   "excludedRules": [],
+    // }];
+
+    return rules
+  }
+}

package/src/cloud/storage.ts

@@ -0,0 +1,168 @@
+import type { aws_kms as kms } from 'aws-cdk-lib'
+import { RemovalPolicy, Tags, aws_backup as backup, aws_iam as iam, aws_s3 as s3 } from 'aws-cdk-lib'
+import type { Construct } from 'constructs'
+import type { NestedCloudProps } from '../types'
+
+export interface StorageStackProps extends NestedCloudProps {
+  kmsKey: kms.Key
+}
+
+export class StorageStack {
+  publicBucket: s3.Bucket
+  privateBucket: s3.Bucket
+  logBucket: s3.Bucket
+  bucketPrefix: string
+  vault: backup.BackupVault
+  backupPlan: backup.BackupPlan
+  backupRole: iam.Role
+
+  constructor(scope: Construct, props: StorageStackProps) {
+    this.bucketPrefix = `${props.slug}-${props.appEnv}`
+
+    this.publicBucket = new s3.Bucket(scope, 'PublicBucket', {
+      bucketName: `${this.bucketPrefix}-public-${props.timestamp}`,
+      versioned: true,
+      autoDeleteObjects: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+    })
+
+    Tags.of(this.publicBucket).add('daily-backup', 'true')
+
+    this.privateBucket = new s3.Bucket(scope, 'PrivateBucket', {
+      bucketName: `${this.bucketPrefix}-private-${props.timestamp}`,
+      versioned: true,
+      removalPolicy: RemovalPolicy.DESTROY,
+      autoDeleteObjects: true,
+      encryption: s3.BucketEncryption.S3_MANAGED,
+      enforceSSL: true,
+      publicReadAccess: false,
+      blockPublicAccess: {
+        blockPublicAcls: true,
+        blockPublicPolicy: true,
+        ignorePublicAcls: true,
+        restrictPublicBuckets: true,
+      },
+    })
+
+    Tags.of(this.privateBucket).add('daily-backup', 'true')
+
+    this.logBucket = new s3.Bucket(scope, 'LogsBucket', {
+      bucketName: `${this.bucketPrefix}-logs-${props.timestamp}`,
+      removalPolicy: RemovalPolicy.RETAIN, // somehow, if we try to auto-delete logs, it fails bc the bucket is not empty (even though objects should be deleted) -> that's why we let buddy cloud:cleanup handle this which is auto triggered when buddy undeploy is ran
+      // autoDeleteObjects: true,
+      blockPublicAccess: new s3.BlockPublicAccess({
+        blockPublicAcls: false,
+        ignorePublicAcls: true,
+        blockPublicPolicy: true,
+        restrictPublicBuckets: true,
+      }),
+      objectOwnership: s3.ObjectOwnership.BUCKET_OWNER_PREFERRED,
+    })
+
+    Tags.of(this.logBucket).add('daily-backup', 'true')
+
+    this.backupRole = this.createBackupRole(scope)
+
+    // Daily 35 day retention
+    this.vault = new backup.BackupVault(scope, 'BackupVault', {
+      backupVaultName: `${props.slug}-${props.appEnv}-daily-backup-vault`,
+      encryptionKey: props.kmsKey,
+      removalPolicy: RemovalPolicy.DESTROY,
+    })
+
+    this.backupPlan = backup.BackupPlan.daily35DayRetention(scope, 'BackupPlan', this.vault)
+
+    this.backupPlan.addSelection('Selection', {
+      role: this.backupRole,
+      resources: [backup.BackupResource.fromTag('daily-backup', 'true')],
+    })
+  }
+
+  createBackupRole(scope: Construct) {
+    const backupRole = new iam.Role(scope, 'BackupRole', {
+      assumedBy: new iam.ServicePrincipal('backup.amazonaws.com'),
+    })
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          's3:GetInventoryConfiguration',
+          's3:PutInventoryConfiguration',
+          's3:ListBucketVersions',
+          's3:ListBucket',
+          's3:GetBucketVersioning',
+          's3:GetBucketNotification',
+          's3:PutBucketNotification',
+          's3:GetBucketLocation',
+          's3:GetBucketTagging',
+        ],
+        resources: ['arn:aws:s3:::*'],
+        sid: 'S3BucketBackupPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          's3:GetObjectAcl',
+          's3:GetObject',
+          's3:GetObjectVersionTagging',
+          's3:GetObjectVersionAcl',
+          's3:GetObjectTagging',
+          's3:GetObjectVersion',
+        ],
+        resources: ['arn:aws:s3:::*/*'],
+        sid: 'S3ObjectBackupPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['s3:ListAllMyBuckets'],
+        resources: ['*'],
+        sid: 'S3GlobalPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['kms:Decrypt', 'kms:DescribeKey'],
+        resources: ['*'],
+        sid: 'KMSBackupPermissions',
+        conditions: {
+          StringLike: {
+            'kms:ViaService': 's3.*.amazonaws.com',
+          },
+        },
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: [
+          'events:DescribeRule',
+          'events:EnableRule',
+          'events:PutRule',
+          'events:DeleteRule',
+          'events:PutTargets',
+          'events:RemoveTargets',
+          'events:ListTargetsByRule',
+          'events:DisableRule',
+        ],
+        resources: ['arn:aws:events:*:*:rule/AwsBackupManagedRule*'],
+        sid: 'EventsPermissions',
+      }),
+    )
+
+    backupRole.addToPolicy(
+      new iam.PolicyStatement({
+        actions: ['cloudwatch:GetMetricData', 'events:ListRules'],
+        resources: ['*'],
+        sid: 'EventsMetricsGlobalPermissions',
+      }),
+    )
+
+    return backupRole
+  }
+}

package/src/edge/origin-request.ts

@@ -0,0 +1,49 @@
+const config = {
+  suffix: '.html',
+  appendToDirs: 'index.html',
+  removeTrailingSlash: false,
+}
+
+const regexSuffixless = /\/[^/.]+$/ // e.g. "/some/page" but not "/", "/some/" or "/some.jpg"
+const regexTrailingSlash = /.+\/$/ // e.g. "/some/" or "/some/page/" but not root "/"
+
+export function handler(event, context, callback) {
+  const { request } = event.Records[0].cf
+  const { uri } = request
+  const { suffix, appendToDirs } = config
+
+  // Append ".html" to origin request
+  if (suffix && uri.match(regexSuffixless)) {
+    request.uri = uri + suffix
+    callback(null, request)
+    return
+  }
+
+  // Append "index.html" to origin request
+  if (appendToDirs && uri.match(regexTrailingSlash)) {
+    request.uri = uri + appendToDirs
+    callback(null, request)
+    return
+  }
+
+  // Redirect (301) non-root requests ending in "/" to URI without trailing slash
+  // if (removeTrailingSlash && uri.match(/.+\/$/)) {
+  //   const response = {
+  //     // body: '',
+  //     // bodyEncoding: 'text',
+  //     headers: {
+  //       location: [{
+  //         key: 'Location',
+  //         value: uri.slice(0, -1),
+  //       }],
+  //     },
+  //     status: '301',
+  //     statusDescription: 'Moved Permanently',
+  //   }
+  //   callback(null, response)
+  //   return
+  // }
+
+  // If nothing matches, return request unchanged
+  callback(null, request)
+}