@takumi-stack/core 1.0.0 → 1.0.1

package/prefab/cdn/cdn-api/index.ts

@@ -0,0 +1,169 @@
+import * as awsCloudfront from 'aws-cdk-lib/aws-cloudfront';
+import { CfnOutput, Fn } from 'aws-cdk-lib';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
+import { HttpOrigin, HttpOriginProps, LoadBalancerV2Origin, RestApiOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { ApplicationLoadBalancer } from 'aws-cdk-lib/aws-elasticloadbalancingv2';
+import { ARecord, HostedZone, RecordTarget } from 'aws-cdk-lib/aws-route53';
+import { CloudFrontTarget } from 'aws-cdk-lib/aws-route53-targets';
+import { Construct } from 'constructs';
+
+import { ServiceStack, SynthError, getCloudFrontName, getDomain, getLogicalName, getResourceName } from '../../../common';
+import { PublicAlbPrefab, ApiRestPrefab } from '../../gateway';
+import { WafPrefab } from '../../networking';
+import { PrivateBucketPrefab } from '../../storage';
+
+export type CdnApiPrefabParams = {
+  subDomain: string;
+  certificate: ICertificate;
+  albDefaultBehavior?: PublicAlbPrefab;
+  restApiDefaultBehavior?: ApiRestPrefab;
+  headersWhitelist?: string[];
+  waf?: WafPrefab;
+  skipRecord?: true;
+  explicitDomains?: string[];
+  cachePolicyProps?: Omit<awsCloudfront.CachePolicyProps, 'cachePolicyName' | 'headerBehavior' | 'queryStringBehavior'>;
+};
+
+export class CdnApiPrefab extends Construct {
+  public readonly domain: string;
+  public readonly baseUrl: string;
+  private readonly service: ServiceStack;
+  private readonly distribution: awsCloudfront.Distribution;
+  private readonly apiGatewayRequestPolicy: awsCloudfront.OriginRequestPolicy;
+  private readonly apiGatewayCachePolicy: awsCloudfront.CachePolicy;
+  private readonly apiGatewayBehaviorOptions: Omit<awsCloudfront.BehaviorOptions, 'origin'>;
+  private readonly unrestrictedBehaviorOptions: Omit<awsCloudfront.BehaviorOptions, 'origin'>;
+
+  constructor(service: ServiceStack, params: CdnApiPrefabParams) {
+    super(service, getLogicalName(CdnApiPrefab.name, params.subDomain));
+
+    this.service = service;
+    this.domain = getDomain(params.subDomain, service.props);
+    this.baseUrl = `https://${this.domain}/`;
+
+    if (params.albDefaultBehavior && params.restApiDefaultBehavior) throw new SynthError('Only alb or api can be default behavior', service.props);
+
+    // Api Gateway Policies
+    this.apiGatewayCachePolicy = new awsCloudfront.CachePolicy(this, 'CachePolicy', {
+      cachePolicyName: getCloudFrontName('ApiGateway', 'CachePolicy', this.service.props),
+      queryStringBehavior: awsCloudfront.CacheQueryStringBehavior.all(),
+      headerBehavior: {
+        behavior: 'whitelist',
+        headers: [...(params.headersWhitelist || []), 'Authorization'],
+      },
+      ...params.cachePolicyProps,
+    });
+
+    this.apiGatewayRequestPolicy = new awsCloudfront.OriginRequestPolicy(this, 'OriginRequestPolicy', {
+      originRequestPolicyName: getCloudFrontName('ApiGateway', 'RequestPolicy', this.service.props),
+      headerBehavior: {
+        behavior: 'whitelist',
+        headers: [
+          ...(params.headersWhitelist || []),
+          'Access-Control-Allow-Origin',
+          'Access-Control-Request-Method',
+          'Access-Control-Allow-Headers',
+          'Access-Control-Request-Headers',
+          'Origin',
+        ],
+      },
+      queryStringBehavior: awsCloudfront.OriginRequestQueryStringBehavior.all(),
+    });
+
+    this.apiGatewayBehaviorOptions = {
+      compress: true,
+      cachePolicy: this.apiGatewayCachePolicy,
+      originRequestPolicy: this.apiGatewayRequestPolicy,
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_ALL,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+    };
+
+    // Integrations Policies
+    this.unrestrictedBehaviorOptions = {
+      compress: true,
+      cachePolicy: awsCloudfront.CachePolicy.CACHING_DISABLED,
+      originRequestPolicy: awsCloudfront.OriginRequestPolicy.ALL_VIEWER,
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_ALL,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+    };
+
+    // Default Behavior
+    let defaultBehavior: awsCloudfront.BehaviorOptions = {
+      origin: new HttpOrigin(new PrivateBucketPrefab(service, { bucketName: 'default-origin' }).bucket.bucketDomainName, {
+        originId: getCloudFrontName('Origin', 'Default', this.service.props),
+      }),
+      ...this.apiGatewayBehaviorOptions,
+    };
+
+    if (params.albDefaultBehavior) {
+      defaultBehavior = {
+        origin: new LoadBalancerV2Origin(params.albDefaultBehavior.alb, {
+          originId: getCloudFrontName('Origin', 'Default', this.service.props),
+        }),
+        ...this.unrestrictedBehaviorOptions,
+      };
+    }
+
+    if (params.restApiDefaultBehavior) {
+      defaultBehavior = {
+        origin: new RestApiOrigin(params.restApiDefaultBehavior.api, {
+          originId: getCloudFrontName('Origin', 'Default', this.service.props),
+        }),
+        ...this.unrestrictedBehaviorOptions,
+        originRequestPolicy: awsCloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
+      };
+    }
+
+    // Distribution
+    this.distribution = new awsCloudfront.Distribution(this, 'Distribution', {
+      enabled: true,
+      comment: getResourceName('cdn', service.props),
+      certificate: params.certificate,
+      domainNames: params.explicitDomains ?? [this.domain],
+      defaultBehavior,
+      ...(service.props.envName !== 'prod' ? { priceClass: awsCloudfront.PriceClass.PRICE_CLASS_100 } : {}),
+      webAclId: params.waf?.webACL?.attrArn,
+    });
+
+    // Route53
+    if (!params.explicitDomains && !params.skipRecord) {
+      const hostedZone = HostedZone.fromLookup(this, 'HostedZoneEnvDns', { domainName: getDomain('', service.props) });
+      new ARecord(service, 'Record', {
+        zone: hostedZone,
+        target: RecordTarget.fromAlias(new CloudFrontTarget(this.distribution)),
+        recordName: this.domain,
+      });
+    }
+    new CfnOutput(this, 'Domain', { value: params.explicitDomains ? params.explicitDomains[0]! : this.domain });
+    new CfnOutput(this, 'BaseUrl', {
+      value: params.explicitDomains ? `https://${params.explicitDomains[0]}/` : this.baseUrl,
+    });
+  }
+
+  public addApiGateway(basePath: string, apiUrl: string, originOptions?: HttpOriginProps): void {
+    this.distribution.addBehavior(
+      `/${basePath}*`,
+      new HttpOrigin(apiUrl, { originId: getCloudFrontName('Origin', basePath, this.service.props), ...originOptions }),
+      this.apiGatewayBehaviorOptions
+    );
+  }
+
+  public addAppSync(apiUrl: string, originOptions?: HttpOriginProps): void {
+    this.distribution.addBehavior(
+      '/graphql*',
+      new HttpOrigin(Fn.select(2, Fn.split('/', apiUrl)), {
+        originId: getCloudFrontName('Origin', 'graphql', this.service.props),
+        ...originOptions,
+      }),
+      this.apiGatewayBehaviorOptions
+    );
+  }
+
+  public addAlb(basePath: string, alb: ApplicationLoadBalancer): void {
+    this.distribution.addBehavior(
+      `/${basePath}/*`,
+      new LoadBalancerV2Origin(alb, { originId: getCloudFrontName('Origin', basePath, this.service.props) }),
+      this.unrestrictedBehaviorOptions
+    );
+  }
+}

package/prefab/cdn/cdn-asset/index.ts

@@ -0,0 +1,89 @@
+import * as awsCloudfront from 'aws-cdk-lib/aws-cloudfront';
+import { CfnOutput } from 'aws-cdk-lib';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
+import { S3Origin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { ARecord, HostedZone, RecordTarget } from 'aws-cdk-lib/aws-route53';
+import { CloudFrontTarget } from 'aws-cdk-lib/aws-route53-targets';
+import { HttpMethods } from 'aws-cdk-lib/aws-s3';
+import { Construct } from 'constructs';
+
+import { ServiceStack, getCloudFrontName, getDomain, getLogicalName, getResourceName } from '../../../common';
+import { WafPrefab } from '../../networking';
+import { AssetBucketParams, AssetBucketPrefab } from '../../storage';
+
+export type CdnAssetConstructProps = {
+  subDomain: string;
+  certificate: ICertificate;
+  assetBucketProps: AssetBucketParams;
+  waf?: WafPrefab;
+  skipRecord?: true;
+  explicitDomains?: string[];
+  distributionProps?: Partial<awsCloudfront.DistributionProps>;
+};
+
+export class CdnAssetPrefab extends Construct {
+  public readonly bucketPrefab: AssetBucketPrefab;
+  public readonly domain: string;
+  public readonly baseUrl: string;
+  public readonly distribution: awsCloudfront.Distribution;
+  public readonly behaviorOptions: Omit<awsCloudfront.BehaviorOptions, 'origin'>;
+
+  constructor(service: ServiceStack, params: CdnAssetConstructProps) {
+    super(service, getLogicalName(CdnAssetPrefab.name, params.subDomain));
+
+    this.domain = getDomain(params.subDomain, service.props);
+    this.baseUrl = `https://${this.domain}/`;
+
+    this.bucketPrefab = new AssetBucketPrefab(service, {
+      ...params.assetBucketProps,
+      bucketProps: {
+        cors: [{ allowedMethods: [HttpMethods.GET, HttpMethods.POST], allowedOrigins: ['*'], allowedHeaders: ['*'] }],
+        ...params.assetBucketProps?.bucketProps,
+      },
+    });
+
+    this.behaviorOptions = {
+      compress: true,
+      originRequestPolicy: new awsCloudfront.OriginRequestPolicy(this, 'OriginRequestPolicy', {
+        originRequestPolicyName: getCloudFrontName('Bucket', 'RequestPolicy', service.props),
+        headerBehavior: {
+          behavior: 'whitelist',
+          headers: ['Access-Control-Allow-Origin', 'Access-Control-Allow-Headers', 'Origin'],
+        },
+      }),
+      cachePolicy: awsCloudfront.CachePolicy.CACHING_OPTIMIZED,
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_ALL,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+    };
+
+    this.distribution = new awsCloudfront.Distribution(this, 'Distribution', {
+      enabled: true,
+      comment: getResourceName('cdn', service.props),
+      certificate: params.certificate,
+      domainNames: params.explicitDomains ?? [this.domain],
+      defaultBehavior: {
+        origin: new S3Origin(this.bucketPrefab.bucket, {
+          originId: getCloudFrontName('Origin', 'Default', service.props),
+        }),
+        ...this.behaviorOptions,
+      },
+      ...(service.props.envName !== 'prod' ? { priceClass: awsCloudfront.PriceClass.PRICE_CLASS_100 } : {}),
+      webAclId: params.waf?.webACL?.attrArn,
+      ...params.distributionProps,
+    });
+
+    if (!params.explicitDomains || !params.skipRecord) {
+      const hostedZone = HostedZone.fromLookup(this, 'HostedZoneEnvDns', { domainName: getDomain('', service.props) });
+      new ARecord(service, 'Record', {
+        zone: hostedZone,
+        target: RecordTarget.fromAlias(new CloudFrontTarget(this.distribution)),
+        recordName: this.domain,
+      });
+    }
+
+    new CfnOutput(this, 'Domain', { value: params.explicitDomains ? params.explicitDomains[0]! : this.domain });
+    new CfnOutput(this, 'BaseUrl', {
+      value: params.explicitDomains ? `https://${params.explicitDomains[0]}/` : this.baseUrl,
+    });
+  }
+}

package/prefab/cdn/cdn-spa/index.ts

@@ -0,0 +1,136 @@
+import * as awsCloudfront from 'aws-cdk-lib/aws-cloudfront';
+import { CfnOutput, Duration, RemovalPolicy } from 'aws-cdk-lib';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
+import { S3Origin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { ARecord, HostedZone, RecordTarget } from 'aws-cdk-lib/aws-route53';
+import { CloudFrontTarget } from 'aws-cdk-lib/aws-route53-targets';
+import { HttpMethods } from 'aws-cdk-lib/aws-s3';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+
+import { ServiceStack, SynthError, getCloudFrontName, getDomain, getLogicalName, getResourceName } from '../../../common';
+import { WafPrefab } from '../../networking';
+import { PrivateBucketPrefab } from '../../storage';
+import { FrontendEnvBuilder } from '../../utils';
+
+export type SpaPrefabParams = {
+  subDomain: string;
+  certificate: ICertificate;
+  assetMaxAge?: string;
+  indexMaxAge?: string;
+  baseDir?: string;
+  distDir?: string;
+  calculatedSecrets?: Record<string, string>;
+  waf?: WafPrefab;
+  skipRecord?: true;
+  wwwRedirectEnabled?: true;
+  explicitDomains?: string[];
+};
+
+export class SpaPrefab extends Construct {
+  private readonly domain: string;
+  private readonly baseUrl: string;
+  private readonly distribution: awsCloudfront.Distribution;
+
+  constructor(service: ServiceStack, params: SpaPrefabParams) {
+    super(service, getLogicalName(SpaPrefab.name, params.subDomain));
+
+    this.domain = getDomain(params.subDomain, service.props);
+    this.baseUrl = `https://${this.domain}/`;
+
+    const privateBucketPrefab = new PrivateBucketPrefab(service, {
+      bucketName: 'spawebapp',
+      bucketProps: {
+        autoDeleteObjects: true,
+        removalPolicy: RemovalPolicy.DESTROY,
+        cors: [
+          {
+            allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
+            allowedOrigins: ['*'],
+            allowedHeaders: ['*'],
+          },
+        ],
+      },
+    });
+
+    const behaviorOptions = {
+      compress: true,
+      origin: new S3Origin(privateBucketPrefab.bucket, {
+        originId: getCloudFrontName('Origin', 'Default', service.props),
+      }),
+      originRequestPolicy: new awsCloudfront.OriginRequestPolicy(this, 'OriginRequestPolicy', {
+        originRequestPolicyName: getCloudFrontName('Bucket', 'RequestPolicy', service.props),
+        headerBehavior: {
+          behavior: 'whitelist',
+          headers: ['Access-Control-Allow-Origin', 'Access-Control-Allow-Headers', 'Origin'],
+        },
+      }),
+      cachePolicy: awsCloudfront.CachePolicy.CACHING_OPTIMIZED,
+      cachedMethods: awsCloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+    };
+
+    const domains = [this.domain];
+    if (params.wwwRedirectEnabled) {
+      if (params.subDomain) throw new SynthError('wwwRedirectEnabled is only allowed in the root domain', service.props);
+      domains.push(`www.${this.domain}`);
+    }
+
+    this.distribution = new awsCloudfront.Distribution(this, 'Distribution', {
+      enabled: true,
+      comment: getResourceName('cdn', service.props),
+      certificate: params.certificate,
+      domainNames: params.explicitDomains ?? domains,
+      defaultRootObject: 'index.html',
+      errorResponses: [
+        {
+          httpStatus: 403,
+          responseHttpStatus: 200,
+          ttl: Duration.seconds(86400),
+          responsePagePath: '/index.html',
+        },
+        {
+          httpStatus: 404,
+          responseHttpStatus: 200,
+          responsePagePath: '/index.html',
+          ttl: Duration.seconds(86400),
+        },
+      ],
+      defaultBehavior: behaviorOptions,
+      ...(service.props.envName !== 'prod' ? { priceClass: awsCloudfront.PriceClass.PRICE_CLASS_100 } : {}),
+      webAclId: params.waf?.webACL?.attrArn,
+    });
+
+    if (!params.explicitDomains && !params.skipRecord) {
+      const hostedZone = HostedZone.fromLookup(this, 'HostedZoneEnvDns', { domainName: getDomain('', service.props) });
+      domains.map((d) => {
+        new ARecord(service, d.split('.')[0]!, {
+          zone: hostedZone,
+          target: RecordTarget.fromAlias(new CloudFrontTarget(this.distribution)),
+          recordName: d,
+        });
+      });
+    }
+    new FrontendEnvBuilder(service, { ...params, name: params.subDomain });
+
+    new StringParameter(this, 'Config', {
+      simpleName: true,
+      parameterName: getResourceName('config', service.props),
+      stringValue: JSON.stringify({
+        domain: params.explicitDomains ? params.explicitDomains[0] : this.domain,
+        bucketName: privateBucketPrefab.bucket.bucketName,
+        distributionId: this.distribution.distributionId,
+        assetMaxAge: params.assetMaxAge || '604800',
+        indexMaxAge: params.indexMaxAge || '1800',
+        baseDir: params.baseDir || `frontend/${service.props.serviceName}`,
+        distDir: params.distDir || 'build',
+      }),
+    });
+
+    new CfnOutput(this, 'Domain', { value: params.explicitDomains ? params.explicitDomains[0]! : this.domain });
+    new CfnOutput(this, 'BaseUrl', {
+      value: params.explicitDomains ? `https://${params.explicitDomains[0]}/` : this.baseUrl,
+    });
+  }
+}

package/prefab/cdn/cdn-ssr/index.ts

@@ -0,0 +1,288 @@
+import * as awsCloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+import { CfnOutput, Duration, Fn, RemovalPolicy } from 'aws-cdk-lib';
+import { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
+import { HttpOrigin, OriginGroup, S3Origin } from 'aws-cdk-lib/aws-cloudfront-origins';
+import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
+import { RetentionDays } from 'aws-cdk-lib/aws-logs';
+import { ARecord, HostedZone, RecordTarget } from 'aws-cdk-lib/aws-route53';
+import { CloudFrontTarget } from 'aws-cdk-lib/aws-route53-targets';
+import { HttpMethods } from 'aws-cdk-lib/aws-s3';
+import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+
+import { execSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+
+import { ServiceStack, SynthError, getDomain, getLogicalName, getResourceName, getShortResourceName } from '../../../common';
+import { WafPrefab } from '../../networking';
+import { PrivateBucketPrefab } from '../../storage';
+import { FrontendEnvBuilder } from '../../utils';
+
+export type SsrPrefabParams = {
+  subDomain: string;
+  certificate: ICertificate;
+  assetMaxAge?: string;
+  indexMaxAge?: string;
+  baseDir?: string;
+  distDir?: string;
+  calculatedSecrets?: Record<string, string>;
+  waf?: WafPrefab;
+  skipRecord?: true;
+  wwwRedirectEnabled?: true;
+  filesPathAssets: string;
+  filesPathNextFunction: string;
+  filesPathImageFunction: string;
+};
+
+export class SsrPrefab extends Construct {
+  public readonly domain: string;
+  public readonly baseUrl: string;
+  public readonly distribution: awsCloudfront.Distribution;
+  public readonly bucket: PrivateBucketPrefab;
+  public readonly serverFunction: lambda.Function;
+  public readonly imageFunction: lambda.Function;
+
+  constructor(service: ServiceStack, params: SsrPrefabParams) {
+    super(service, getLogicalName(SsrPrefab.name, params.subDomain));
+
+    const command = `npx dotenv -e .env.${service.props.envName} open-next build`;
+    execSync(command, { stdio: 'inherit', cwd: `${process.cwd()}/${params.baseDir}` });
+
+    this.domain = getDomain(params.subDomain, service.props);
+    this.baseUrl = `https://${this.domain}/`;
+
+    this.bucket = new PrivateBucketPrefab(service, {
+      bucketName: 'ssr',
+      bucketProps: {
+        removalPolicy: RemovalPolicy.DESTROY,
+        autoDeleteObjects: true,
+        cors: [
+          {
+            allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
+            allowedOrigins: ['*'],
+            allowedHeaders: ['*'],
+          },
+        ],
+      },
+    });
+
+    new BucketDeployment(this, 'DeployAssetsBucket', {
+      sources: [Source.asset(params.filesPathAssets)],
+      destinationBucket: this.bucket.bucket,
+      destinationKeyPrefix: '',
+      prune: true,
+      retainOnDelete: false,
+    });
+
+    // NextJS Server Function
+    this.serverFunction = new lambda.Function(this, 'SSRServerFunction', {
+      functionName: getShortResourceName('server-function', service.props),
+      handler: 'index.handler',
+      currentVersionOptions: {
+        removalPolicy: RemovalPolicy.DESTROY,
+      },
+      logRetention: RetentionDays.FIVE_DAYS,
+      runtime: lambda.Runtime.NODEJS_18_X,
+      memorySize: 2048,
+      timeout: Duration.seconds(5),
+      code: lambda.Code.fromAsset(params.filesPathNextFunction),
+      environment: {
+        ...params.calculatedSecrets,
+      },
+    });
+
+    // Image Optimization Function
+    this.imageFunction = new lambda.Function(this, 'SSRImageFunction', {
+      functionName: getShortResourceName('image-function', service.props),
+      handler: 'index.handler',
+      currentVersionOptions: {
+        removalPolicy: RemovalPolicy.DESTROY,
+      },
+      logRetention: RetentionDays.FIVE_DAYS,
+      runtime: lambda.Runtime.NODEJS_18_X,
+      memorySize: 1536,
+      code: lambda.Code.fromAsset(params.filesPathImageFunction),
+      architecture: lambda.Architecture.ARM_64,
+      timeout: Duration.seconds(25),
+      environment: {
+        BUCKET_NAME: this.bucket.bucket.bucketName,
+        // TODO: Add allowed domains here. These are on the nextjs config file.
+        NEXT_IMAGE_ALLOWED_DOMAINS: '',
+        ...params.calculatedSecrets,
+      },
+      initialPolicy: [
+        new PolicyStatement({
+          actions: ['s3:GetObject'],
+          resources: [this.bucket.bucket.arnForObjects('*')],
+        }),
+      ],
+    });
+
+    // Middleware Function (for redirects)
+    const oai: awsCloudfront.IOriginAccessIdentity = new awsCloudfront.OriginAccessIdentity(this, getResourceName('oai', service.props));
+    this.bucket.bucket.grantRead(oai);
+
+    // Create origin group with the bucket and server function
+    const origin = new S3Origin(this.bucket.bucket, {
+      originId: getResourceName('OriginId', service.props),
+      originAccessIdentity: oai,
+    });
+
+    // Create server behavior for the origin group with the server function and middleware function (for redirects)
+    const serverFnUrl = this.serverFunction.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    // Create server behavior for the origin group with the server function
+    const serverBehavior = {
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      origin: new HttpOrigin(Fn.parseDomainName(serverFnUrl.url)),
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_ALL,
+      cachedMethods: awsCloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+      compress: true,
+      cachePolicy: this.createCloudFrontServerCachePolicy(),
+    };
+
+    // Create image optimization behavior for the origin group with the image function
+    const imageFnUrl = this.imageFunction.addFunctionUrl({
+      authType: lambda.FunctionUrlAuthType.NONE,
+    });
+
+    // Create image optimization behavior for the origin group with the image function
+    const imageBehavior = {
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      origin: new HttpOrigin(Fn.parseDomainName(imageFnUrl.url)),
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_ALL,
+      cachedMethods: awsCloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+      compress: true,
+      cachePolicy: serverBehavior.cachePolicy,
+    };
+
+    const domains = [this.domain];
+    if (params.wwwRedirectEnabled) {
+      if (params.subDomain) throw new SynthError('wwwRedirectEnabled is only allowed in the root domain', service.props);
+      domains.push(`www.${this.domain}`);
+    }
+
+    // Create default behavior
+    // default handler for requests that don't match any other path:
+    //   - try lambda handler first first
+    //   - if failed, fall back to S3
+    const fallbackOriginGroup = new OriginGroup({
+      primaryOrigin: serverBehavior.origin,
+      fallbackOrigin: origin,
+      fallbackStatusCodes: [404],
+    });
+
+    const defaultBehavior = {
+      origin: fallbackOriginGroup,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      compress: true,
+      cachePolicy: serverBehavior.cachePolicy,
+      // TODO: Add edge lambdas here
+      // edgeLambdas: serverBehavior.edgeLambdas,
+    };
+
+    // Create statics behavior for the origin group with the bucket
+    const staticFileBehavior: awsCloudfront.BehaviorOptions = {
+      origin,
+      viewerProtocolPolicy: awsCloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+      allowedMethods: awsCloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
+      cachedMethods: awsCloudfront.CachedMethods.CACHE_GET_HEAD_OPTIONS,
+      compress: true,
+      cachePolicy: awsCloudfront.CachePolicy.CACHING_OPTIMIZED,
+    };
+
+    const staticsBehaviorsStatic: Record<string, awsCloudfront.BehaviorOptions> = {};
+    const publicDir = path.join(params.filesPathAssets);
+    // Get all files and folders in the public directory
+    // and create a behavior for each one
+    for (const item of fs.readdirSync(publicDir)) {
+      if (fs.statSync(path.join(publicDir, item)).isDirectory()) {
+        staticsBehaviorsStatic[`${item}/*`] = staticFileBehavior;
+      } else {
+        staticsBehaviorsStatic[item] = staticFileBehavior;
+      }
+    }
+
+    this.distribution = new awsCloudfront.Distribution(this, 'Distribution', {
+      defaultRootObject: '',
+      domainNames: domains,
+      certificate: params.certificate,
+      comment: getResourceName('cdn', service.props),
+      enableIpv6: false,
+      enabled: true,
+      httpVersion: awsCloudfront.HttpVersion.HTTP2,
+      priceClass: awsCloudfront.PriceClass.PRICE_CLASS_100,
+      minimumProtocolVersion: awsCloudfront.SecurityPolicyProtocol.TLS_V1_2_2021,
+      sslSupportMethod: awsCloudfront.SSLMethod.SNI,
+      defaultBehavior: defaultBehavior,
+      additionalBehaviors: {
+        'api/*': serverBehavior,
+        '_next/data/*': serverBehavior,
+        '_next/image*': imageBehavior,
+        '_next/*': staticFileBehavior,
+        // all other static files
+        ...staticsBehaviorsStatic,
+      },
+    });
+
+    if (!params.skipRecord) {
+      const hostedZone = HostedZone.fromLookup(this, 'HostedZoneEnvDns', { domainName: getDomain('', service.props) });
+      domains.map((d) => {
+        new ARecord(service, d.split('.')[0]!, {
+          zone: hostedZone,
+          target: RecordTarget.fromAlias(new CloudFrontTarget(this.distribution)),
+          recordName: d,
+        });
+      });
+    }
+
+    new FrontendEnvBuilder(service, { ...params, name: params.subDomain });
+
+    new StringParameter(this, 'Config', {
+      simpleName: true,
+      parameterName: getResourceName('config', service.props),
+      stringValue: JSON.stringify({
+        domain: this.domain,
+        distributionBucket: this.bucket.bucket.bucketName,
+        distributionId: this.distribution.distributionId,
+        assetMaxAge: params.assetMaxAge || '300',
+        indexMaxAge: params.indexMaxAge || '1800',
+        baseDir: params.baseDir || `frontend/${service.props.serviceName}`,
+        distDir: params.distDir || 'build',
+      }),
+    });
+    new CfnOutput(this, 'Domain', { value: this.domain });
+    new CfnOutput(this, 'BaseUrl', { value: this.baseUrl });
+  }
+
+  protected createCloudFrontServerCachePolicy(): awsCloudfront.CachePolicy {
+    return new awsCloudfront.CachePolicy(this, 'ServerCache', {
+      queryStringBehavior: awsCloudfront.CacheQueryStringBehavior.all(),
+      headerBehavior: awsCloudfront.CacheHeaderBehavior.allowList(
+        // required by image optimization request
+        'Accept',
+        // required by server request
+        'x-op-middleware-request-headers',
+        'x-op-middleware-response-headers',
+        'x-nextjs-data',
+        'x-middleware-prefetch',
+        // required by server request (in-place routing)
+        'rsc',
+        'next-router-prefetch',
+        'next-router-state-tree'
+      ),
+      cookieBehavior: awsCloudfront.CacheCookieBehavior.all(),
+      defaultTtl: Duration.days(0),
+      maxTtl: Duration.days(365),
+      minTtl: Duration.days(0),
+      enableAcceptEncodingBrotli: true,
+      enableAcceptEncodingGzip: true,
+      comment: 'Server response cache policy',
+    });
+  }
+}

package/prefab/cdn/index.ts

@@ -0,0 +1,4 @@
+export * from './cdn-api';
+export * from './cdn-asset';
+export * from './cdn-spa';
+export * from './cdn-ssr';