quidproquo-deploy-awscdk 0.0.82 → 0.0.84

package/lib/constructs/feature/webserver/webEntry/QpqWebserverWebEntryConstruct.js

@@ -31,6 +31,7 @@ const path_1 = __importDefault(require("path"));
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const cdk = __importStar(require("aws-cdk-lib"));
 const quidproquo_webserver_1 = require("quidproquo-webserver");
+const securityHeaders_1 = require("./utils/securityHeaders");
 const quidproquo_actionprocessor_awslambda_1 = require("quidproquo-actionprocessor-awslambda");
 const QpqConstructBlock_1 = require("../../../base/QpqConstructBlock");
 const qpqDeployAwsCdkUtils = __importStar(require("../../../../utils"));
@@ -105,7 +106,6 @@ class QpqWebserverWebEntryConstruct extends QpqConstructBlock_1.QpqConstructBloc
             enableAcceptEncodingGzip: true,
             enableAcceptEncodingBrotli: true,
         });
-        const mustRevalidate = false;
         const responseHeaderPolicy = new aws_cdk_lib_1.aws_cloudfront.ResponseHeadersPolicy(this, `dist-rhp`, {
             responseHeadersPolicyName: this.resourceName(props.webEntryConfig.name),
             customHeadersBehavior: {
@@ -117,6 +117,7 @@ class QpqWebserverWebEntryConstruct extends QpqConstructBlock_1.QpqConstructBloc
                     },
                 ],
             },
+            securityHeadersBehavior: (0, securityHeaders_1.convertSecurityHeadersFromQpqSecurityHeaders)(quidproquo_webserver_1.qpqWebServerUtils.getBaseDomainName(props.qpqConfig), props.webEntryConfig.securityHeaders),
         });
         // Create a CloudFront distribution using the S3 bucket as the origin
         const distributionOrigin = new aws_cdk_lib_1.aws_cloudfront_origins.S3Origin(originBucket);
@@ -159,15 +160,15 @@ class QpqWebserverWebEntryConstruct extends QpqConstructBlock_1.QpqConstructBloc
         // if we have some ~ Build the edge lambdas and deploy
         if (seos.length > 0) {
             const seoEntryBuildPath = quidproquo_webserver_1.qpqWebServerUtils.getWebEntrySeoFullPath(props.qpqConfig, props.webEntryConfig);
-            const edgeFunctionVR = new aws_cdk_lib_1.aws_cloudfront.experimental.EdgeFunction(this, `SEO-${props.webEntryConfig.name}-VR`, {
-                functionName: this.resourceName(`SEO-VR-${props.webEntryConfig.name}`),
+            const edgeFunctionVR = new aws_cdk_lib_1.aws_cloudfront.experimental.EdgeFunction(this, `SEO-VR`, {
+                functionName: this.qpqResourceName(props.webEntryConfig.name, 'SEO-VR'),
                 timeout: cdk.Duration.seconds(5),
                 runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_18_X,
                 code: aws_cdk_lib_1.aws_lambda.Code.fromAsset(path_1.default.join(seoEntryBuildPath, 'lambdaEventViewerRequest')),
                 handler: 'index.executeEventViewerRequest',
             });
-            const edgeFunctionOR = new aws_cdk_lib_1.aws_cloudfront.experimental.EdgeFunction(this, `SEO-${props.webEntryConfig.name}-OR`, {
-                functionName: this.resourceName(`SEO-OR-${props.webEntryConfig.name}`),
+            const edgeFunctionOR = new aws_cdk_lib_1.aws_cloudfront.experimental.EdgeFunction(this, `SEO-OR`, {
+                functionName: this.qpqResourceName(props.webEntryConfig.name, 'SEO-OR'),
                 timeout: cdk.Duration.seconds(30),
                 runtime: aws_cdk_lib_1.aws_lambda.Runtime.NODEJS_18_X,
                 memorySize: 1024,
@@ -223,6 +224,7 @@ class QpqWebserverWebEntryConstruct extends QpqConstructBlock_1.QpqConstructBloc
                     },
                 ],
             },
+            securityHeadersBehavior: (0, securityHeaders_1.convertSecurityHeadersFromQpqSecurityHeaders)(quidproquo_webserver_1.qpqWebServerUtils.getBaseDomainName(props.qpqConfig), props.webEntryConfig.securityHeaders),
         });
         props.webEntryConfig.ignoreCache.forEach((pathPattern) => {
             distribution.addBehavior(pathPattern, distributionOrigin, {

package/lib/constructs/feature/webserver/webEntry/utils/securityHeaders.d.ts

@@ -0,0 +1,10 @@
+import { aws_cloudfront } from 'aws-cdk-lib';
+import { ResponseSecurityHeaders, ResponseHeadersStrictTransportSecurity, ResponseHeadersContentSecurityPolicy, ResponseHeadersContentTypeOptions, ResponseHeadersFrameOptions, ResponseHeadersReferrerPolicy, ResponseHeadersXSSProtection, ContentSecurityPolicyEntry } from 'quidproquo-webserver';
+export declare const convertStrictTransportSecurity: (strictTransportSecurity?: ResponseHeadersStrictTransportSecurity) => aws_cloudfront.ResponseHeadersStrictTransportSecurity | undefined;
+export declare const convertContentSecurityPolicyEntryToString: (baseDomain: string, contentSecurityPolicyEntry: ContentSecurityPolicyEntry) => string;
+export declare const convertContentSecurityPolicy: (baseDomain: string, contentSecurityPolicy?: ResponseHeadersContentSecurityPolicy) => aws_cloudfront.ResponseHeadersContentSecurityPolicy | undefined;
+export declare const convertContentTypeOptions: (contentTypeOptions?: ResponseHeadersContentTypeOptions) => aws_cloudfront.ResponseHeadersContentTypeOptions | undefined;
+export declare const convertFrameOptions: (frameOptions?: ResponseHeadersFrameOptions) => aws_cloudfront.ResponseHeadersFrameOptions | undefined;
+export declare const convertReferrerPolicy: (referrerPolicy?: ResponseHeadersReferrerPolicy) => aws_cloudfront.ResponseHeadersReferrerPolicy | undefined;
+export declare const convertXssProtection: (xssProtection?: ResponseHeadersXSSProtection) => aws_cloudfront.ResponseHeadersXSSProtection | undefined;
+export declare const convertSecurityHeadersFromQpqSecurityHeaders: (baseDomain: string, securityHeaders?: ResponseSecurityHeaders) => aws_cloudfront.ResponseSecurityHeadersBehavior;

package/lib/constructs/feature/webserver/webEntry/utils/securityHeaders.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertSecurityHeadersFromQpqSecurityHeaders = exports.convertXssProtection = exports.convertReferrerPolicy = exports.convertFrameOptions = exports.convertContentTypeOptions = exports.convertContentSecurityPolicy = exports.convertContentSecurityPolicyEntryToString = exports.convertStrictTransportSecurity = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const cdk = __importStar(require("aws-cdk-lib"));
+const quidproquo_webserver_1 = require("quidproquo-webserver");
+const convertStrictTransportSecurity = (strictTransportSecurity) => {
+    if (!strictTransportSecurity) {
+        return {
+            override: true,
+            accessControlMaxAge: cdk.Duration.hours(1),
+            includeSubdomains: true,
+            preload: true,
+        };
+    }
+    return {
+        accessControlMaxAge: cdk.Duration.seconds(strictTransportSecurity.accessControlMaxAgeInSeconds),
+        override: strictTransportSecurity.override,
+        includeSubdomains: strictTransportSecurity.includeSubdomains,
+        preload: strictTransportSecurity.preload,
+    };
+};
+exports.convertStrictTransportSecurity = convertStrictTransportSecurity;
+const convertContentSecurityPolicyEntryToString = (baseDomain, contentSecurityPolicyEntry) => {
+    if (typeof contentSecurityPolicyEntry === 'string') {
+        return contentSecurityPolicyEntry;
+    }
+    // Otherwise its a QpqServiceContentSecurityPolicy
+    const scsp = contentSecurityPolicyEntry;
+    const domain = scsp.domain || baseDomain;
+    if (scsp.service) {
+        return `${scsp.api}.${scsp.service}.${domain}`;
+    }
+    return `${scsp.api}.${domain}`;
+};
+exports.convertContentSecurityPolicyEntryToString = convertContentSecurityPolicyEntryToString;
+const convertContentSecurityPolicy = (baseDomain, contentSecurityPolicy) => {
+    if (!contentSecurityPolicy) {
+        return {
+            contentSecurityPolicy: "default-src 'self'; object-src 'none'",
+            override: true,
+        };
+    }
+    return {
+        contentSecurityPolicy: Object.keys(contentSecurityPolicy.contentSecurityPolicy)
+            .map((directive) => [
+            directive,
+            ...contentSecurityPolicy.contentSecurityPolicy[directive].map((cspe) => (0, exports.convertContentSecurityPolicyEntryToString)(baseDomain, cspe)),
+        ].join(' '))
+            .join('; '),
+        override: contentSecurityPolicy.override,
+    };
+};
+exports.convertContentSecurityPolicy = convertContentSecurityPolicy;
+const convertContentTypeOptions = (contentTypeOptions) => {
+    if (!contentTypeOptions) {
+        return {
+            override: true,
+        };
+    }
+    return {
+        override: contentTypeOptions.override,
+    };
+};
+exports.convertContentTypeOptions = convertContentTypeOptions;
+const convertFrameOptions = (frameOptions) => {
+    if (!frameOptions) {
+        return {
+            frameOption: aws_cdk_lib_1.aws_cloudfront.HeadersFrameOption.DENY,
+            override: true,
+        };
+    }
+    const frameOptionMap = {
+        [quidproquo_webserver_1.HeadersFrameOption.DENY]: aws_cdk_lib_1.aws_cloudfront.HeadersFrameOption.DENY,
+        [quidproquo_webserver_1.HeadersFrameOption.SAMEORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersFrameOption.SAMEORIGIN,
+    };
+    return {
+        frameOption: frameOptionMap[frameOptions.frameOption],
+        override: frameOptions.override,
+    };
+};
+exports.convertFrameOptions = convertFrameOptions;
+const convertReferrerPolicy = (referrerPolicy) => {
+    if (!referrerPolicy) {
+        return {
+            referrerPolicy: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+        };
+    }
+    const referrerPolicyMap = {
+        [quidproquo_webserver_1.HeadersReferrerPolicy.NO_REFERRER]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.NO_REFERRER,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.NO_REFERRER_WHEN_DOWNGRADE]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.NO_REFERRER_WHEN_DOWNGRADE,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.ORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.ORIGIN,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.ORIGIN_WHEN_CROSS_ORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.ORIGIN_WHEN_CROSS_ORIGIN,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.SAME_ORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.SAME_ORIGIN,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.STRICT_ORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+        [quidproquo_webserver_1.HeadersReferrerPolicy.UNSAFE_URL]: aws_cdk_lib_1.aws_cloudfront.HeadersReferrerPolicy.UNSAFE_URL,
+    };
+    return {
+        referrerPolicy: referrerPolicyMap[referrerPolicy.referrerPolicy],
+        override: referrerPolicy.override,
+    };
+};
+exports.convertReferrerPolicy = convertReferrerPolicy;
+const convertXssProtection = (xssProtection) => {
+    if (!xssProtection) {
+        return {
+            protection: true,
+            modeBlock: true,
+            override: true,
+        };
+    }
+    return {
+        protection: xssProtection.protection,
+        modeBlock: xssProtection.modeBlock,
+        override: xssProtection.override,
+    };
+};
+exports.convertXssProtection = convertXssProtection;
+const convertSecurityHeadersFromQpqSecurityHeaders = (baseDomain, securityHeaders) => {
+    return {
+        contentSecurityPolicy: (0, exports.convertContentSecurityPolicy)(baseDomain, securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.contentSecurityPolicy),
+        contentTypeOptions: (0, exports.convertContentTypeOptions)(securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.contentTypeOptions),
+        frameOptions: (0, exports.convertFrameOptions)(securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.frameOptions),
+        referrerPolicy: (0, exports.convertReferrerPolicy)(securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.referrerPolicy),
+        xssProtection: (0, exports.convertXssProtection)(securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.xssProtection),
+        strictTransportSecurity: (0, exports.convertStrictTransportSecurity)(securityHeaders === null || securityHeaders === void 0 ? void 0 : securityHeaders.strictTransportSecurity),
+    };
+};
+exports.convertSecurityHeadersFromQpqSecurityHeaders = convertSecurityHeadersFromQpqSecurityHeaders;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quidproquo-deploy-awscdk",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "description": "",
   "main": "./lib/index.js",
   "types": "./lib/index.d.js",

package/src/constructs/feature/webserver/webEntry/QpqWebserverWebEntryConstruct.ts

@@ -19,6 +19,8 @@ import {
   qpqHeaderIsBot,
 } from 'quidproquo-webserver';
 
+import { convertSecurityHeadersFromQpqSecurityHeaders } from './utils/securityHeaders';
+
 import { awsNamingUtils } from 'quidproquo-actionprocessor-awslambda';
 
 import { QpqConstructBlock, QpqConstructBlockProps } from '../../../base/QpqConstructBlock';
@@ -128,8 +130,6 @@ export class QpqWebserverWebEntryConstruct extends QpqConstructBlock {
       enableAcceptEncodingBrotli: true,
     });
 
-    const mustRevalidate = false;
-
     const responseHeaderPolicy = new aws_cloudfront.ResponseHeadersPolicy(this, `dist-rhp`, {
       responseHeadersPolicyName: this.resourceName(props.webEntryConfig.name),
       customHeadersBehavior: {
@@ -143,6 +143,10 @@ export class QpqWebserverWebEntryConstruct extends QpqConstructBlock {
           },
         ],
       },
+      securityHeadersBehavior: convertSecurityHeadersFromQpqSecurityHeaders(
+        qpqWebServerUtils.getBaseDomainName(props.qpqConfig),
+        props.webEntryConfig.securityHeaders,
+      ),
     });
 
     // Create a CloudFront distribution using the S3 bucket as the origin
@@ -214,33 +218,25 @@ export class QpqWebserverWebEntryConstruct extends QpqConstructBlock {
         props.webEntryConfig,
       );
 
-      const edgeFunctionVR = new aws_cloudfront.experimental.EdgeFunction(
-        this,
-        `SEO-${props.webEntryConfig.name}-VR`,
-        {
-          functionName: this.resourceName(`SEO-VR-${props.webEntryConfig.name}`),
-          timeout: cdk.Duration.seconds(5),
-          runtime: aws_lambda.Runtime.NODEJS_18_X,
-
-          code: aws_lambda.Code.fromAsset(path.join(seoEntryBuildPath, 'lambdaEventViewerRequest')),
-          handler: 'index.executeEventViewerRequest',
-        },
-      );
+      const edgeFunctionVR = new aws_cloudfront.experimental.EdgeFunction(this, `SEO-VR`, {
+        functionName: this.qpqResourceName(props.webEntryConfig.name, 'SEO-VR'),
+        timeout: cdk.Duration.seconds(5),
+        runtime: aws_lambda.Runtime.NODEJS_18_X,
 
-      const edgeFunctionOR = new aws_cloudfront.experimental.EdgeFunction(
-        this,
-        `SEO-${props.webEntryConfig.name}-OR`,
-        {
-          functionName: this.resourceName(`SEO-OR-${props.webEntryConfig.name}`),
-          timeout: cdk.Duration.seconds(30),
-          runtime: aws_lambda.Runtime.NODEJS_18_X,
+        code: aws_lambda.Code.fromAsset(path.join(seoEntryBuildPath, 'lambdaEventViewerRequest')),
+        handler: 'index.executeEventViewerRequest',
+      });
 
-          memorySize: 1024,
+      const edgeFunctionOR = new aws_cloudfront.experimental.EdgeFunction(this, `SEO-OR`, {
+        functionName: this.qpqResourceName(props.webEntryConfig.name, 'SEO-OR'),
+        timeout: cdk.Duration.seconds(30),
+        runtime: aws_lambda.Runtime.NODEJS_18_X,
 
-          code: aws_lambda.Code.fromAsset(path.join(seoEntryBuildPath, 'lambdaEventOriginRequest')),
-          handler: 'index.executeEventOriginRequest',
-        },
-      );
+        memorySize: 1024,
+
+        code: aws_lambda.Code.fromAsset(path.join(seoEntryBuildPath, 'lambdaEventOriginRequest')),
+        handler: 'index.executeEventOriginRequest',
+      });
 
       const grantables = qpqDeployAwsCdkUtils.getQqpGrantableResources(
         this,
@@ -307,6 +303,10 @@ export class QpqWebserverWebEntryConstruct extends QpqConstructBlock {
             },
           ],
         },
+        securityHeadersBehavior: convertSecurityHeadersFromQpqSecurityHeaders(
+          qpqWebServerUtils.getBaseDomainName(props.qpqConfig),
+          props.webEntryConfig.securityHeaders,
+        ),
       },
     );
 

package/src/constructs/feature/webserver/webEntry/utils/securityHeaders.ts

@@ -0,0 +1,183 @@
+import { aws_cloudfront } from 'aws-cdk-lib';
+import * as cdk from 'aws-cdk-lib';
+
+import {
+  ResponseSecurityHeaders,
+  ResponseHeadersStrictTransportSecurity,
+  ResponseHeadersContentSecurityPolicy,
+  ResponseHeadersContentTypeOptions,
+  ResponseHeadersFrameOptions,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersReferrerPolicy,
+  ResponseHeadersXSSProtection,
+  ContentSecurityPolicyEntry,
+  QpqServiceContentSecurityPolicy,
+} from 'quidproquo-webserver';
+
+export const convertStrictTransportSecurity = (
+  strictTransportSecurity?: ResponseHeadersStrictTransportSecurity,
+): aws_cloudfront.ResponseHeadersStrictTransportSecurity | undefined => {
+  if (!strictTransportSecurity) {
+    return {
+      override: true,
+      accessControlMaxAge: cdk.Duration.hours(1),
+      includeSubdomains: true,
+      preload: true,
+    };
+  }
+
+  return {
+    accessControlMaxAge: cdk.Duration.seconds(strictTransportSecurity.accessControlMaxAgeInSeconds),
+    override: strictTransportSecurity.override,
+    includeSubdomains: strictTransportSecurity.includeSubdomains,
+    preload: strictTransportSecurity.preload,
+  };
+};
+
+export const convertContentSecurityPolicyEntryToString = (
+  baseDomain: string,
+  contentSecurityPolicyEntry: ContentSecurityPolicyEntry,
+): string => {
+  if (typeof contentSecurityPolicyEntry === 'string') {
+    return contentSecurityPolicyEntry;
+  }
+
+  // Otherwise its a QpqServiceContentSecurityPolicy
+  const scsp: QpqServiceContentSecurityPolicy = contentSecurityPolicyEntry;
+  const domain = scsp.domain || baseDomain;
+
+  if (scsp.service) {
+    return `${scsp.api}.${scsp.service}.${domain}`;
+  }
+
+  return `${scsp.api}.${domain}`;
+};
+
+export const convertContentSecurityPolicy = (
+  baseDomain: string,
+  contentSecurityPolicy?: ResponseHeadersContentSecurityPolicy,
+): aws_cloudfront.ResponseHeadersContentSecurityPolicy | undefined => {
+  if (!contentSecurityPolicy) {
+    return {
+      contentSecurityPolicy: "default-src 'self'; object-src 'none'",
+      override: true,
+    };
+  }
+
+  return {
+    contentSecurityPolicy: Object.keys(contentSecurityPolicy.contentSecurityPolicy)
+      .map((directive) =>
+        [
+          directive,
+          ...contentSecurityPolicy.contentSecurityPolicy[directive].map((cspe) =>
+            convertContentSecurityPolicyEntryToString(baseDomain, cspe),
+          ),
+        ].join(' '),
+      )
+      .join('; '),
+    override: contentSecurityPolicy.override,
+  };
+};
+
+export const convertContentTypeOptions = (
+  contentTypeOptions?: ResponseHeadersContentTypeOptions,
+): aws_cloudfront.ResponseHeadersContentTypeOptions | undefined => {
+  if (!contentTypeOptions) {
+    return {
+      override: true,
+    };
+  }
+
+  return {
+    override: contentTypeOptions.override,
+  };
+};
+
+export const convertFrameOptions = (
+  frameOptions?: ResponseHeadersFrameOptions,
+): aws_cloudfront.ResponseHeadersFrameOptions | undefined => {
+  if (!frameOptions) {
+    return {
+      frameOption: aws_cloudfront.HeadersFrameOption.DENY,
+      override: true,
+    };
+  }
+
+  const frameOptionMap = {
+    [HeadersFrameOption.DENY]: aws_cloudfront.HeadersFrameOption.DENY,
+    [HeadersFrameOption.SAMEORIGIN]: aws_cloudfront.HeadersFrameOption.SAMEORIGIN,
+  };
+
+  return {
+    frameOption: frameOptionMap[frameOptions.frameOption],
+    override: frameOptions.override,
+  };
+};
+
+export const convertReferrerPolicy = (
+  referrerPolicy?: ResponseHeadersReferrerPolicy,
+): aws_cloudfront.ResponseHeadersReferrerPolicy | undefined => {
+  if (!referrerPolicy) {
+    return {
+      referrerPolicy: aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+      override: true,
+    };
+  }
+
+  const referrerPolicyMap = {
+    [HeadersReferrerPolicy.NO_REFERRER]: aws_cloudfront.HeadersReferrerPolicy.NO_REFERRER,
+    [HeadersReferrerPolicy.NO_REFERRER_WHEN_DOWNGRADE]:
+      aws_cloudfront.HeadersReferrerPolicy.NO_REFERRER_WHEN_DOWNGRADE,
+    [HeadersReferrerPolicy.ORIGIN]: aws_cloudfront.HeadersReferrerPolicy.ORIGIN,
+    [HeadersReferrerPolicy.ORIGIN_WHEN_CROSS_ORIGIN]:
+      aws_cloudfront.HeadersReferrerPolicy.ORIGIN_WHEN_CROSS_ORIGIN,
+    [HeadersReferrerPolicy.SAME_ORIGIN]: aws_cloudfront.HeadersReferrerPolicy.SAME_ORIGIN,
+    [HeadersReferrerPolicy.STRICT_ORIGIN]: aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN,
+    [HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN]:
+      aws_cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+    [HeadersReferrerPolicy.UNSAFE_URL]: aws_cloudfront.HeadersReferrerPolicy.UNSAFE_URL,
+  };
+
+  return {
+    referrerPolicy: referrerPolicyMap[referrerPolicy.referrerPolicy],
+    override: referrerPolicy.override,
+  };
+};
+
+export const convertXssProtection = (
+  xssProtection?: ResponseHeadersXSSProtection,
+): aws_cloudfront.ResponseHeadersXSSProtection | undefined => {
+  if (!xssProtection) {
+    return {
+      protection: true,
+      modeBlock: true,
+      override: true,
+    };
+  }
+
+  return {
+    protection: xssProtection.protection,
+    modeBlock: xssProtection.modeBlock,
+    override: xssProtection.override,
+  };
+};
+
+export const convertSecurityHeadersFromQpqSecurityHeaders = (
+  baseDomain: string,
+  securityHeaders?: ResponseSecurityHeaders,
+): aws_cloudfront.ResponseSecurityHeadersBehavior => {
+  return {
+    contentSecurityPolicy: convertContentSecurityPolicy(
+      baseDomain,
+      securityHeaders?.contentSecurityPolicy,
+    ),
+    contentTypeOptions: convertContentTypeOptions(securityHeaders?.contentTypeOptions),
+    frameOptions: convertFrameOptions(securityHeaders?.frameOptions),
+    referrerPolicy: convertReferrerPolicy(securityHeaders?.referrerPolicy),
+    xssProtection: convertXssProtection(securityHeaders?.xssProtection),
+    strictTransportSecurity: convertStrictTransportSecurity(
+      securityHeaders?.strictTransportSecurity,
+    ),
+  };
+};