@staticforge/aws 0.0.0-stage → 0.1.0

package/terraform/modules/site/router.tf

@@ -0,0 +1,33 @@
+# Routing at the edge: a viewer-request function maps clean URLs to objects and
+# prefixes them with the active version, which lives in a KeyValueStore. A
+# deploy or rollback is one KVS key update: no distribution change, and since
+# the rewritten URI is the cache key, no invalidation either.
+
+resource "aws_cloudfront_key_value_store" "site" {
+  name    = substr("sforge-${local.id}", 0, 64)
+  comment = "staticforge ${local.id}: active version, previews and routes"
+}
+
+# Seeded once; deploys and rollbacks change the value with the SDK, so the
+# value is ignored here and never shows up as drift.
+resource "aws_cloudfrontkeyvaluestore_key" "active" {
+  key_value_store_arn = aws_cloudfront_key_value_store.site.arn
+  key                 = "active"
+  value               = "none"
+
+  lifecycle {
+    ignore_changes = [value]
+  }
+}
+
+resource "aws_cloudfront_function" "router" {
+  name    = substr("sforge-${local.id}-router", 0, 64)
+  comment = "staticforge URL routing and versions"
+  runtime = "cloudfront-js-2.0"
+  publish = true
+  code = replace(file("${path.module}/router.js"), "__SFORGE_CONFIG__", jsonencode({
+    trailingSlash = var.trailing_slash
+    previewSuffix = var.preview_domain == null ? "" : ".${var.preview_domain}"
+  }))
+  key_value_store_associations = [aws_cloudfront_key_value_store.site.arn]
+}

package/terraform/modules/site/storage.tf

@@ -0,0 +1,107 @@
+locals {
+  id = "${var.name}-${var.target}"
+  # bucket_prefix may be at most 37 characters; a random suffix makes the name unique.
+  bucket_prefix = "${trimsuffix(substr("sforge-${local.id}", 0, 36), "-")}-"
+  tags          = merge(var.tags, { "sforge:site" = var.name, "sforge:target" = var.target })
+}
+
+# Private content bucket. Deploys write v/<versionId>/...; there is no website
+# endpoint and no public access: only this distribution can read it (OAC).
+resource "aws_s3_bucket" "site" {
+  bucket_prefix = local.bucket_prefix
+  force_destroy = var.force_destroy
+  tags          = local.tags
+}
+
+resource "aws_s3_bucket_public_access_block" "site" {
+  bucket                  = aws_s3_bucket.site.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_ownership_controls" "site" {
+  bucket = aws_s3_bucket.site.id
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_versioning" "site" {
+  bucket = aws_s3_bucket.site.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "site" {
+  bucket = aws_s3_bucket.site.id
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "AES256"
+    }
+  }
+}
+
+# Deploy prefixes beyond retainVersions are deleted by sforge; this only
+# cleans up overwritten object versions and failed uploads.
+resource "aws_s3_bucket_lifecycle_configuration" "site" {
+  bucket = aws_s3_bucket.site.id
+
+  rule {
+    id     = "expire-noncurrent-versions"
+    status = "Enabled"
+    filter {}
+    noncurrent_version_expiration {
+      noncurrent_days = 30
+    }
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 1
+    }
+  }
+
+  depends_on = [aws_s3_bucket_versioning.site]
+}
+
+locals {
+  cloudfront_only = {
+    StringEquals = { "AWS:SourceArn" = aws_cloudfront_distribution.site.arn }
+  }
+}
+
+resource "aws_s3_bucket_policy" "site" {
+  bucket = aws_s3_bucket.site.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "CloudFrontRead"
+        Effect    = "Allow"
+        Principal = { Service = "cloudfront.amazonaws.com" }
+        Action    = "s3:GetObject"
+        Resource  = "${aws_s3_bucket.site.arn}/*"
+        Condition = local.cloudfront_only
+      },
+      {
+        # Lets S3 answer 404 (not 403) for missing objects.
+        Sid       = "CloudFrontList"
+        Effect    = "Allow"
+        Principal = { Service = "cloudfront.amazonaws.com" }
+        Action    = "s3:ListBucket"
+        Resource  = aws_s3_bucket.site.arn
+        Condition = local.cloudfront_only
+      },
+      {
+        Sid       = "DenyInsecureTransport"
+        Effect    = "Deny"
+        Principal = "*"
+        Action    = "s3:*"
+        Resource  = [aws_s3_bucket.site.arn, "${aws_s3_bucket.site.arn}/*"]
+        Condition = { Bool = { "aws:SecureTransport" = "false" } }
+      },
+    ]
+  })
+
+  depends_on = [aws_s3_bucket_public_access_block.site]
+}

package/terraform/modules/site/variables.tf

@@ -0,0 +1,106 @@
+variable "name" {
+  description = "Project name (iac.name), used in resource names and tags."
+  type        = string
+}
+
+variable "target" {
+  description = "Target name, e.g. staging."
+  type        = string
+}
+
+variable "trailing_slash" {
+  description = "build.trailingSlash: how the router maps extensionless URLs."
+  type        = string
+  default     = "always"
+  validation {
+    condition     = contains(["always", "never"], var.trailing_slash)
+    error_message = "trailing_slash must be \"always\" or \"never\"."
+  }
+}
+
+variable "domain" {
+  description = "Custom domain. Null serves the site from the *.cloudfront.net domain."
+  type        = string
+  default     = null
+}
+
+variable "hosted_zone" {
+  description = "Route 53 hosted zone for DNS validation and alias records. Null prints the records instead."
+  type        = string
+  default     = null
+}
+
+variable "preview_domain" {
+  description = "Parent domain of PR previews (pr-<n>.<preview_domain>). Needs domain."
+  type        = string
+  default     = null
+}
+
+variable "wait_for_validation" {
+  description = "Wait for the ACM certificate to be validated (false only creates the certificate)."
+  type        = bool
+  default     = true
+}
+
+variable "price_class" {
+  type    = string
+  default = "PriceClass_100"
+}
+
+variable "logging" {
+  description = "Write CloudFront standard access logs to a separate bucket."
+  type        = bool
+  default     = false
+}
+
+variable "waf_web_acl_arn" {
+  type    = string
+  default = null
+}
+
+variable "force_destroy" {
+  description = "Allow the content bucket to be deleted while it holds objects (set by sforge destroy)."
+  type        = bool
+  default     = false
+}
+
+variable "security_headers" {
+  description = "Security headers sent with every response."
+  type = object({
+    content_security_policy        = optional(string)
+    search_content_security_policy = optional(string)
+    hsts_max_age                   = optional(number)
+    hsts_include_subdomains        = optional(bool, false)
+    hsts_preload                   = optional(bool, false)
+    referrer_policy                = optional(string, "strict-origin-when-cross-origin")
+    frame_options                  = optional(string, "SAMEORIGIN")
+    permissions_policy             = optional(string)
+  })
+  default = {}
+}
+
+variable "search_paths" {
+  description = "Path patterns of the search page, which gets search_content_security_policy (Pagefind needs WebAssembly)."
+  type        = list(string)
+  default     = []
+}
+
+variable "ci" {
+  description = "GitHub Actions OIDC deploy role. Null creates none."
+  type = object({
+    repo                 = string
+    branches             = list(string)
+    environments         = list(string)
+    pull_requests        = bool
+    create_oidc_provider = bool
+    oidc_provider_arn    = optional(string)
+    state_bucket         = optional(string)
+    state_key            = optional(string)
+  })
+  default = null
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}

package/terraform/modules/site/versions.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    aws = {
+      source                = "hashicorp/aws"
+      version               = ">= 6.0, < 7.0"
+      configuration_aliases = [aws.us_east_1]
+    }
+  }
+}

package/terraform/state-bootstrap/main.tf

@@ -0,0 +1,104 @@
+# Remote state for every staticforge site in one AWS account and region.
+# State files are stored at <site>/<target>.tfstate and locked with S3 native
+# locking (<key>.tflock objects, no DynamoDB table).
+
+resource "aws_s3_bucket" "state" {
+  bucket = var.bucket_name
+  tags   = merge(var.tags, { "sforge:role" = "state" })
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "state" {
+  bucket                  = aws_s3_bucket.state.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_ownership_controls" "state" {
+  bucket = aws_s3_bucket.state.id
+  rule {
+    object_ownership = "BucketOwnerEnforced"
+  }
+}
+
+resource "aws_s3_bucket_versioning" "state" {
+  bucket = aws_s3_bucket.state.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "state" {
+  bucket = aws_s3_bucket.state.id
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = var.kms_key_arn == null ? "AES256" : "aws:kms"
+      kms_master_key_id = var.kms_key_arn
+    }
+    bucket_key_enabled = var.kms_key_arn != null
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "state" {
+  bucket = aws_s3_bucket.state.id
+
+  rule {
+    id     = "expire-old-state-versions"
+    status = "Enabled"
+    filter {}
+    noncurrent_version_expiration {
+      noncurrent_days = var.noncurrent_version_days
+    }
+    abort_incomplete_multipart_upload {
+      days_after_initiation = 7
+    }
+  }
+
+  depends_on = [aws_s3_bucket_versioning.state]
+}
+
+data "aws_iam_policy_document" "state" {
+  statement {
+    sid       = "DenyInsecureTransport"
+    effect    = "Deny"
+    actions   = ["s3:*"]
+    resources = [aws_s3_bucket.state.arn, "${aws_s3_bucket.state.arn}/*"]
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "Bool"
+      variable = "aws:SecureTransport"
+      values   = ["false"]
+    }
+  }
+
+  statement {
+    sid       = "DenyOutdatedTLS"
+    effect    = "Deny"
+    actions   = ["s3:*"]
+    resources = [aws_s3_bucket.state.arn, "${aws_s3_bucket.state.arn}/*"]
+    principals {
+      type        = "*"
+      identifiers = ["*"]
+    }
+    condition {
+      test     = "NumericLessThan"
+      variable = "s3:TlsVersion"
+      values   = ["1.2"]
+    }
+  }
+}
+
+resource "aws_s3_bucket_policy" "state" {
+  bucket = aws_s3_bucket.state.id
+  policy = data.aws_iam_policy_document.state.json
+
+  depends_on = [aws_s3_bucket_public_access_block.state]
+}

package/terraform/state-bootstrap/outputs.tf

@@ -0,0 +1,11 @@
+output "bucket" {
+  value = aws_s3_bucket.state.id
+}
+
+output "bucket_arn" {
+  value = aws_s3_bucket.state.arn
+}
+
+output "region" {
+  value = aws_s3_bucket.state.region
+}

package/terraform/state-bootstrap/variables.tf

@@ -0,0 +1,21 @@
+variable "bucket_name" {
+  description = "Name of the state bucket, e.g. sforge-state-<accountId>-<region>."
+  type        = string
+}
+
+variable "kms_key_arn" {
+  description = "KMS key for SSE-KMS. Null uses SSE-S3."
+  type        = string
+  default     = null
+}
+
+variable "noncurrent_version_days" {
+  description = "Days to keep previous versions of state files."
+  type        = number
+  default     = 90
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}

package/terraform/state-bootstrap/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.10.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.0, < 7.0"
+    }
+  }
+}