@staticforge/aws 0.0.0-stage → 0.1.0

package/terraform/modules/site/cdn.tf

@@ -0,0 +1,191 @@
+locals {
+  custom_domain = var.domain != null
+  aliases = local.custom_domain ? concat(
+    [var.domain],
+    var.preview_domain == null ? [] : ["*.${var.preview_domain}"],
+  ) : []
+  # Served by CloudFront's error responses; sforge copies the active version's
+  # 404.html here on every deploy and rollback.
+  error_page = "/_sforge/errors/404.html"
+  headers    = var.security_headers
+  header_policies = merge(
+    { default = local.headers.content_security_policy },
+    length(var.search_paths) > 0 ? { search = local.headers.search_content_security_policy } : {},
+  )
+}
+
+resource "aws_cloudfront_origin_access_control" "site" {
+  name                              = substr("sforge-${local.id}", 0, 64)
+  description                       = "staticforge ${local.id}"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}
+
+# Honors the Cache-Control set on each object: immutable for fingerprinted
+# assets, max-age=0 + must-revalidate (ETag revalidation) for everything else.
+resource "aws_cloudfront_cache_policy" "site" {
+  name        = "sforge-${local.id}"
+  comment     = "staticforge: origin Cache-Control, no cookies or query strings"
+  min_ttl     = 0
+  default_ttl = 86400
+  max_ttl     = 31536000
+
+  parameters_in_cache_key_and_forwarded_to_origin {
+    enable_accept_encoding_brotli = true
+    enable_accept_encoding_gzip   = true
+    cookies_config {
+      cookie_behavior = "none"
+    }
+    headers_config {
+      header_behavior = "none"
+    }
+    query_strings_config {
+      query_string_behavior = "none"
+    }
+  }
+}
+
+resource "aws_cloudfront_response_headers_policy" "site" {
+  for_each = local.header_policies
+  name     = "sforge-${local.id}-${each.key}"
+  comment  = "staticforge security headers (${each.key})"
+
+  security_headers_config {
+    content_type_options {
+      override = true
+    }
+
+    dynamic "frame_options" {
+      for_each = local.headers.frame_options == null ? [] : [local.headers.frame_options]
+      content {
+        frame_option = frame_options.value
+        override     = true
+      }
+    }
+
+    dynamic "referrer_policy" {
+      for_each = local.headers.referrer_policy == null ? [] : [local.headers.referrer_policy]
+      content {
+        referrer_policy = referrer_policy.value
+        override        = true
+      }
+    }
+
+    dynamic "strict_transport_security" {
+      for_each = local.headers.hsts_max_age == null ? [] : [local.headers.hsts_max_age]
+      content {
+        access_control_max_age_sec = strict_transport_security.value
+        include_subdomains         = local.headers.hsts_include_subdomains
+        preload                    = local.headers.hsts_preload
+        override                   = true
+      }
+    }
+
+    dynamic "content_security_policy" {
+      for_each = each.value == null ? [] : [each.value]
+      content {
+        content_security_policy = content_security_policy.value
+        override                = true
+      }
+    }
+  }
+
+  dynamic "custom_headers_config" {
+    for_each = local.headers.permissions_policy == null ? [] : [local.headers.permissions_policy]
+    content {
+      items {
+        header   = "Permissions-Policy"
+        value    = custom_headers_config.value
+        override = true
+      }
+    }
+  }
+}
+
+resource "aws_cloudfront_distribution" "site" {
+  enabled         = true
+  comment         = "staticforge ${local.id}"
+  is_ipv6_enabled = true
+  http_version    = "http2and3"
+  price_class     = var.price_class
+  aliases         = local.aliases
+  web_acl_id      = var.waf_web_acl_arn
+  tags            = local.tags
+
+  origin {
+    origin_id                = "site"
+    domain_name              = aws_s3_bucket.site.bucket_regional_domain_name
+    origin_access_control_id = aws_cloudfront_origin_access_control.site.id
+  }
+
+  default_cache_behavior {
+    target_origin_id           = "site"
+    viewer_protocol_policy     = "redirect-to-https"
+    allowed_methods            = ["GET", "HEAD"]
+    cached_methods             = ["GET", "HEAD"]
+    compress                   = true
+    cache_policy_id            = aws_cloudfront_cache_policy.site.id
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.site["default"].id
+
+    function_association {
+      event_type   = "viewer-request"
+      function_arn = aws_cloudfront_function.router.arn
+    }
+  }
+
+  dynamic "ordered_cache_behavior" {
+    for_each = var.search_paths
+    content {
+      path_pattern               = ordered_cache_behavior.value
+      target_origin_id           = "site"
+      viewer_protocol_policy     = "redirect-to-https"
+      allowed_methods            = ["GET", "HEAD"]
+      cached_methods             = ["GET", "HEAD"]
+      compress                   = true
+      cache_policy_id            = aws_cloudfront_cache_policy.site.id
+      response_headers_policy_id = aws_cloudfront_response_headers_policy.site["search"].id
+
+      function_association {
+        event_type   = "viewer-request"
+        function_arn = aws_cloudfront_function.router.arn
+      }
+    }
+  }
+
+  # S3 answers 404 for missing objects (403 if listing were not allowed).
+  dynamic "custom_error_response" {
+    for_each = [403, 404]
+    content {
+      error_code            = custom_error_response.value
+      response_code         = 404
+      response_page_path    = local.error_page
+      error_caching_min_ttl = 10
+    }
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = !local.custom_domain
+    acm_certificate_arn            = local.custom_domain ? aws_acm_certificate_validation.site[0].certificate_arn : null
+    ssl_support_method             = local.custom_domain ? "sni-only" : null
+    # The default *.cloudfront.net certificate does not allow choosing the policy.
+    minimum_protocol_version = local.custom_domain ? "TLSv1.2_2021" : "TLSv1"
+  }
+
+  dynamic "logging_config" {
+    for_each = var.logging ? [1] : []
+    content {
+      bucket          = aws_s3_bucket.logs[0].bucket_domain_name
+      include_cookies = false
+      prefix          = "cloudfront/"
+    }
+  }
+
+  depends_on = [aws_s3_bucket_acl.logs]
+}

package/terraform/modules/site/ci.tf

@@ -0,0 +1,117 @@
+# GitHub Actions deploy role, assumed through OIDC (no long-lived keys). The
+# trust policy accepts only the configured branches, environments and, if
+# enabled, pull_request workflows of one repository.
+
+locals {
+  ci        = var.ci
+  ci_create = local.ci != null && try(local.ci.create_oidc_provider, false)
+  ci_subjects = local.ci == null ? [] : concat(
+    [for branch in local.ci.branches : "repo:${local.ci.repo}:ref:refs/heads/${branch}"],
+    [for environment in local.ci.environments : "repo:${local.ci.repo}:environment:${environment}"],
+    local.ci.pull_requests ? ["repo:${local.ci.repo}:pull_request"] : [],
+  )
+  oidc_provider_arn = local.ci == null ? null : (
+    local.ci_create ? aws_iam_openid_connect_provider.github[0].arn : local.ci.oidc_provider_arn
+  )
+  state_bucket = local.ci == null ? "" : (local.ci.state_bucket == null ? "" : local.ci.state_bucket)
+  state_key    = local.ci == null ? "" : (local.ci.state_key == null ? "" : local.ci.state_key)
+  state_object = "arn:aws:s3:::${local.state_bucket}/${local.state_key}"
+  # This target's state (and its lock file) only, for `sforge status` and plans in CI.
+  state_statements = [for statement in [
+    {
+      Sid       = "ListState"
+      Effect    = "Allow"
+      Action    = "s3:ListBucket"
+      Resource  = "arn:aws:s3:::${local.state_bucket}"
+      Condition = { StringLike = { "s3:prefix" = [local.state_key, "${local.state_key}.tflock"] } }
+    },
+    {
+      Sid      = "ReadWriteState"
+      Effect   = "Allow"
+      Action   = ["s3:GetObject", "s3:PutObject"]
+      Resource = [local.state_object, "${local.state_object}.tflock"]
+    },
+    {
+      Sid      = "UnlockState"
+      Effect   = "Allow"
+      Action   = "s3:DeleteObject"
+      Resource = "${local.state_object}.tflock"
+    },
+  ] : statement if local.state_bucket != ""]
+}
+
+# One per account. sforge reuses an existing provider and creates one (tagged
+# with this site and target) only when the account has none.
+resource "aws_iam_openid_connect_provider" "github" {
+  count          = local.ci_create ? 1 : 0
+  url            = "https://token.actions.githubusercontent.com"
+  client_id_list = ["sts.amazonaws.com"]
+  tags           = merge(local.tags, { "sforge:owner" = local.id })
+}
+
+resource "aws_iam_role" "ci" {
+  count                = local.ci == null ? 0 : 1
+  name                 = substr("sforge-${local.id}-deploy", 0, 64)
+  description          = "staticforge: GitHub Actions deploys of ${local.id} (${local.ci.repo})"
+  max_session_duration = 3600
+  tags                 = local.tags
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Federated = local.oidc_provider_arn }
+      Action    = "sts:AssumeRoleWithWebIdentity"
+      Condition = {
+        StringEquals = { "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" }
+        StringLike   = { "token.actions.githubusercontent.com:sub" = local.ci_subjects }
+      }
+    }]
+  })
+}
+
+resource "aws_iam_role_policy" "ci" {
+  count = local.ci == null ? 0 : 1
+  name  = "deploy"
+  role  = aws_iam_role.ci[0].id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = concat(
+      [
+        {
+          Sid      = "ListContent"
+          Effect   = "Allow"
+          Action   = "s3:ListBucket"
+          Resource = aws_s3_bucket.site.arn
+        },
+        {
+          Sid      = "WriteContent"
+          Effect   = "Allow"
+          Action   = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
+          Resource = "${aws_s3_bucket.site.arn}/*"
+        },
+        {
+          Sid    = "SwitchVersions"
+          Effect = "Allow"
+          Action = [
+            "cloudfront-keyvaluestore:DescribeKeyValueStore",
+            "cloudfront-keyvaluestore:GetKey",
+            "cloudfront-keyvaluestore:ListKeys",
+            "cloudfront-keyvaluestore:PutKey",
+            "cloudfront-keyvaluestore:DeleteKey",
+            "cloudfront-keyvaluestore:UpdateKeys",
+          ]
+          Resource = aws_cloudfront_key_value_store.site.arn
+        },
+        {
+          Sid      = "Invalidate"
+          Effect   = "Allow"
+          Action   = ["cloudfront:CreateInvalidation", "cloudfront:GetInvalidation", "cloudfront:GetDistribution"]
+          Resource = aws_cloudfront_distribution.site.arn
+        },
+      ],
+      local.state_statements,
+    )
+  })
+}

package/terraform/modules/site/domain.tf

@@ -0,0 +1,77 @@
+# Optional custom domain: an ACM certificate in us-east-1 (required by
+# CloudFront), validated through Route 53 when hosted_zone is set. Without a
+# hosted zone, sforge creates the certificate first, prints the validation
+# records and waits until they resolve.
+
+resource "aws_acm_certificate" "site" {
+  count                     = local.custom_domain ? 1 : 0
+  provider                  = aws.us_east_1
+  domain_name               = var.domain
+  subject_alternative_names = var.preview_domain == null ? [] : ["*.${var.preview_domain}"]
+  validation_method         = "DNS"
+  tags                      = local.tags
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+data "aws_route53_zone" "site" {
+  count        = local.custom_domain && var.hosted_zone != null ? 1 : 0
+  name         = var.hosted_zone
+  private_zone = false
+}
+
+locals {
+  # Keyed by the configured names, so the keys are known when planning.
+  certificate_names = local.custom_domain ? toset(concat(
+    [var.domain],
+    var.preview_domain == null ? [] : ["*.${var.preview_domain}"],
+  )) : toset([])
+  validation_options = local.custom_domain ? {
+    for name in local.certificate_names : name => one([
+      for option in aws_acm_certificate.site[0].domain_validation_options : option if option.domain_name == name
+    ])
+  } : {}
+}
+
+resource "aws_route53_record" "validation" {
+  for_each = var.hosted_zone == null ? toset([]) : local.certificate_names
+
+  zone_id         = data.aws_route53_zone.site[0].zone_id
+  name            = local.validation_options[each.key].resource_record_name
+  type            = local.validation_options[each.key].resource_record_type
+  records         = [local.validation_options[each.key].resource_record_value]
+  ttl             = 300
+  allow_overwrite = true
+}
+
+resource "aws_acm_certificate_validation" "site" {
+  count                   = local.custom_domain ? 1 : 0
+  provider                = aws.us_east_1
+  certificate_arn         = aws_acm_certificate.site[0].arn
+  validation_record_fqdns = var.hosted_zone == null ? null : [for record in aws_route53_record.validation : record.fqdn]
+
+  timeouts {
+    create = "2h"
+  }
+}
+
+resource "aws_route53_record" "alias" {
+  for_each = var.hosted_zone == null ? {} : {
+    for pair in setproduct(local.aliases, ["A", "AAAA"]) : "${pair[0]} ${pair[1]}" => {
+      name = pair[0]
+      type = pair[1]
+    }
+  }
+
+  zone_id = data.aws_route53_zone.site[0].zone_id
+  name    = each.value.name
+  type    = each.value.type
+
+  alias {
+    name                   = aws_cloudfront_distribution.site.domain_name
+    zone_id                = aws_cloudfront_distribution.site.hosted_zone_id
+    evaluate_target_health = false
+  }
+}

package/terraform/modules/site/logging.tf

@@ -0,0 +1,82 @@
+# Optional CloudFront standard (legacy) access logs. They are delivered with
+# ACLs, so this bucket, unlike the content bucket, keeps ACLs enabled.
+
+data "aws_canonical_user_id" "current" {
+  count = var.logging ? 1 : 0
+}
+
+resource "aws_s3_bucket" "logs" {
+  count         = var.logging ? 1 : 0
+  bucket_prefix = "${trimsuffix(substr("sforge-${local.id}", 0, 31), "-")}-logs-"
+  force_destroy = var.force_destroy
+  tags          = local.tags
+}
+
+resource "aws_s3_bucket_public_access_block" "logs" {
+  count                   = var.logging ? 1 : 0
+  bucket                  = aws_s3_bucket.logs[0].id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_ownership_controls" "logs" {
+  count  = var.logging ? 1 : 0
+  bucket = aws_s3_bucket.logs[0].id
+  rule {
+    object_ownership = "BucketOwnerPreferred"
+  }
+}
+
+resource "aws_s3_bucket_acl" "logs" {
+  count  = var.logging ? 1 : 0
+  bucket = aws_s3_bucket.logs[0].id
+
+  access_control_policy {
+    owner {
+      id = data.aws_canonical_user_id.current[0].id
+    }
+    grant {
+      permission = "FULL_CONTROL"
+      grantee {
+        type = "CanonicalUser"
+        id   = data.aws_canonical_user_id.current[0].id
+      }
+    }
+    grant {
+      # The awslogsdelivery account, which writes CloudFront logs.
+      permission = "FULL_CONTROL"
+      grantee {
+        type = "CanonicalUser"
+        id   = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0"
+      }
+    }
+  }
+
+  depends_on = [aws_s3_bucket_ownership_controls.logs]
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "logs" {
+  count  = var.logging ? 1 : 0
+  bucket = aws_s3_bucket.logs[0].id
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "logs" {
+  count  = var.logging ? 1 : 0
+  bucket = aws_s3_bucket.logs[0].id
+
+  rule {
+    id     = "expire-logs"
+    status = "Enabled"
+    filter {}
+    expiration {
+      days = 90
+    }
+  }
+}

package/terraform/modules/site/outputs.tf

@@ -0,0 +1,69 @@
+output "bucket" {
+  description = "Content bucket (private)."
+  value       = aws_s3_bucket.site.id
+}
+
+output "bucket_region" {
+  value = aws_s3_bucket.site.region
+}
+
+output "distribution_id" {
+  value = aws_cloudfront_distribution.site.id
+}
+
+output "distribution_arn" {
+  value = aws_cloudfront_distribution.site.arn
+}
+
+output "distribution_domain" {
+  value = aws_cloudfront_distribution.site.domain_name
+}
+
+output "kvs_arn" {
+  description = "KeyValueStore with the active version, preview hosts and route exceptions."
+  value       = aws_cloudfront_key_value_store.site.arn
+}
+
+output "url" {
+  value = "https://${local.custom_domain ? var.domain : aws_cloudfront_distribution.site.domain_name}"
+}
+
+output "preview_domain" {
+  value = var.preview_domain
+}
+
+output "trailing_slash" {
+  value = var.trailing_slash
+}
+
+output "certificate_arn" {
+  value = local.custom_domain ? aws_acm_certificate.site[0].arn : null
+}
+
+output "validation_records" {
+  description = "DNS records that validate the certificate (create them when there is no hosted_zone)."
+  value = local.custom_domain ? [
+    for option in aws_acm_certificate.site[0].domain_validation_options : {
+      name  = option.resource_record_name
+      type  = option.resource_record_type
+      value = option.resource_record_value
+    }
+  ] : []
+}
+
+output "dns_records" {
+  description = "Records pointing the custom domain at CloudFront (created when hosted_zone is set)."
+  value = [for name in local.aliases : {
+    name  = name
+    type  = "CNAME"
+    value = aws_cloudfront_distribution.site.domain_name
+  }]
+}
+
+output "ci_role_arn" {
+  value = local.ci == null ? null : aws_iam_role.ci[0].arn
+}
+
+output "oidc_provider_arn" {
+  value = local.oidc_provider_arn
+}

package/terraform/modules/site/router.js

@@ -0,0 +1,136 @@
+// staticforge viewer-request router (CloudFront Functions, cloudfront-js-2.0).
+//
+// 1. Picks the version to serve from the KeyValueStore: "active", or for a PR
+//    preview host (pr-42.<previewDomain>) the key "host:pr-42".
+// 2. Maps the URL to an object the way `sforge dev`/`preview` do
+//    (resolveRequest in @staticforge/server), by rule:
+//      trailingSlash "always": /a/ → a/index.html, /a → 301 /a/
+//      trailingSlash "never":  /a → a.html,        /a/ → 301 /a
+//      /file.ext → file.ext; dot-segments and malformed paths → 404
+//    Files that break the rule (a section index with "never", an
+//    extensionless file, ...) are listed per version in the KVS as
+//    "r:<version>:<path>" exceptions by `sforge deploy`.
+// 3. Prefixes the object with v/<version>/. The rewritten URI is the cache
+//    key, so a new version never serves stale cached objects.
+
+import cf from 'cloudfront';
+
+// Replaced at provision time, e.g. {"trailingSlash":"always","previewSuffix":".preview.example.com"}.
+const CONFIG = __SFORGE_CONFIG__;
+const kvs = cf.kvs();
+
+async function lookup(key) {
+  try {
+    return await kvs.get(key);
+  } catch (e) {
+    return null;
+  }
+}
+
+function route(uri) {
+  if (uri.charAt(0) !== '/') return { missing: true };
+  const raw = uri.slice(1).split('/');
+  const trailing = raw[raw.length - 1] === '';
+  if (trailing) raw.pop();
+  const canonical = [];
+  for (let i = 0; i < raw.length; i++) {
+    let segment;
+    try {
+      segment = decodeURIComponent(raw[i]);
+    } catch (e) {
+      return { missing: true };
+    }
+    if (
+      segment === '' ||
+      segment.charAt(0) === '.' ||
+      segment.indexOf('\\') !== -1 ||
+      segment.indexOf('\0') !== -1
+    ) {
+      return { missing: true };
+    }
+    canonical.push(encodeURIComponent(segment));
+  }
+  if (raw.length === 0) return { file: 'index.html' };
+
+  const path = raw.join('/');
+  const key = '/' + canonical.join('/') + (trailing ? '/' : '');
+  if (trailing) {
+    if (CONFIG.trailingSlash === 'always') return { file: path + '/index.html', key: key };
+    // "/style.css/" is not a page; only pages lose their slash.
+    return raw[raw.length - 1].indexOf('.') !== -1
+      ? { missing: true, key: key }
+      : { redirect: '/' + path, key: key };
+  }
+  if (raw[raw.length - 1].indexOf('.') !== -1) return { file: path };
+  return CONFIG.trailingSlash === 'always'
+    ? { redirect: '/' + path + '/', key: key }
+    : { file: path + '.html', key: key };
+}
+
+function exception(value) {
+  if (value === '404') return { missing: true };
+  if (value.slice(0, 2) === 'f:') return { file: value.slice(2) };
+  if (value.slice(0, 2) === 'r:') return { redirect: value.slice(2) };
+  return null;
+}
+
+function queryString(querystring) {
+  const parts = [];
+  for (const name in querystring) {
+    const entry = querystring[name];
+    const values = entry.multiValue ? entry.multiValue : [entry];
+    for (let i = 0; i < values.length; i++) {
+      parts.push(values[i].value === '' ? name : name + '=' + values[i].value);
+    }
+  }
+  return parts.length > 0 ? '?' + parts.join('&') : '';
+}
+
+function textResponse(statusCode, statusDescription, text) {
+  return {
+    statusCode: statusCode,
+    statusDescription: statusDescription,
+    headers: {
+      'content-type': { value: 'text/plain; charset=utf-8' },
+      'cache-control': { value: 'no-store' },
+    },
+    body: { encoding: 'text', data: text },
+  };
+}
+
+async function handler(event) {
+  const request = event.request;
+  // The error page fetched by CloudFront's custom error responses; nothing
+  // else outside v/<version>/ (such as _sforge/versions.json) is reachable.
+  if (request.uri === '/_sforge/errors/404.html') return request;
+
+  const host = request.headers.host ? request.headers.host.value.toLowerCase() : '';
+  const suffix = CONFIG.previewSuffix;
+  let key = 'active';
+  if (suffix !== '' && host.length > suffix.length && host.slice(-suffix.length) === suffix) {
+    key = 'host:' + host.slice(0, host.length - suffix.length);
+  }
+  const version = await lookup(key);
+  if (!version || version === 'none') {
+    return key === 'active'
+      ? textResponse(503, 'Service Unavailable', 'This site has not been deployed yet.')
+      : textResponse(404, 'Not Found', 'No preview is deployed at this address.');
+  }
+
+  let target = route(request.uri);
+  if (target.key !== undefined) {
+    const value = await lookup('r:' + version + ':' + target.key);
+    const override = value ? exception(value) : null;
+    if (override !== null) target = override;
+  }
+  if (target.redirect !== undefined) {
+    return {
+      statusCode: 301,
+      statusDescription: 'Moved Permanently',
+      headers: { location: { value: target.redirect + queryString(request.querystring) } },
+    };
+  }
+  // A key that never exists, so S3 answers 404 and CloudFront serves the 404 page.
+  request.uri = '/v/' + version + '/' + (target.missing ? '_sforge/missing' : target.file);
+  return request;
+}