terruvim-core-test 0.0.1

package/dist/src/factories/s3Factory.js

@@ -0,0 +1,262 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3Factory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const resourceFactory_1 = require("./resourceFactory");
+const validateS3Config_1 = require("./validateS3Config");
+class S3Factory extends resourceFactory_1.ResourceFactory {
+    async createResource(config, provider) {
+        (0, validateS3Config_1.validateS3Config)(config);
+        const opts = provider ? { provider } : undefined;
+        const bucketName = config.configuration.bucket ||
+            `${config.meta.environment}-${config.meta.variables.project}-${config.id}`;
+        const bucket = new aws.s3.BucketV2(`${config.id}-bucket`, {
+            bucket: bucketName,
+            forceDestroy: true,
+            tags: config.configuration.tags,
+        }, opts);
+        if (config.configuration.versioning?.enabled) {
+            new aws.s3.BucketVersioningV2(`${config.id}-versioning`, {
+                bucket: bucket.id,
+                versioningConfiguration: {
+                    status: "Enabled"
+                }
+            }, opts);
+        }
+        let ownershipControls;
+        if (config.configuration.objectOwnership || config.configuration.enableAcl) {
+            ownershipControls = new aws.s3.BucketOwnershipControls(`${config.id}-ownership`, {
+                bucket: bucket.id,
+                rule: {
+                    objectOwnership: config.configuration.objectOwnership || "BucketOwnerPreferred"
+                }
+            }, opts);
+        }
+        if (config.configuration.acl && config.configuration.enableAcl) {
+            const aclConfig = {
+                bucket: bucket.id,
+                acl: config.configuration.acl
+            };
+            const aclOpts = { ...opts };
+            if (ownershipControls) {
+                aclOpts.dependsOn = [ownershipControls];
+            }
+            new aws.s3.BucketAclV2(`${config.id}-acl`, aclConfig, aclOpts);
+        }
+        if (config.configuration.encryption?.enabled) {
+            const encryptionConfig = {
+                bucket: bucket.id,
+                rules: [{
+                        applyServerSideEncryptionByDefault: {
+                            sseAlgorithm: config.configuration.encryption.algorithm || "AES256"
+                        },
+                        bucketKeyEnabled: true
+                    }]
+            };
+            if (config.configuration.encryption.kmsMasterKeyId) {
+                encryptionConfig.rules[0].applyServerSideEncryptionByDefault.kmsMasterKeyId =
+                    config.configuration.encryption.kmsMasterKeyId;
+            }
+            new aws.s3.BucketServerSideEncryptionConfigurationV2(`${config.id}-encryption`, encryptionConfig, opts);
+        }
+        if (config.configuration.lifecycle?.enabled && config.configuration.lifecycle.rules) {
+            new aws.s3.BucketLifecycleConfigurationV2(`${config.id}-lifecycle`, {
+                bucket: bucket.id,
+                rules: config.configuration.lifecycle.rules.map((rule, index) => ({
+                    id: rule.id || `rule-${index}`,
+                    status: rule.enabled ? "Enabled" : "Disabled",
+                    filter: rule.filter || {},
+                    transitions: rule.transitions || [],
+                    expiration: rule.expiration ? {
+                        days: rule.expiration.days
+                    } : undefined
+                }))
+            }, opts);
+        }
+        if (config.configuration.publicAccessBlock) {
+            new aws.s3.BucketPublicAccessBlock(`${config.id}-public-access-block`, {
+                bucket: bucket.id,
+                blockPublicAcls: config.configuration.publicAccessBlock.blockPublicAcls,
+                blockPublicPolicy: config.configuration.publicAccessBlock.blockPublicPolicy,
+                ignorePublicAcls: config.configuration.publicAccessBlock.ignorePublicAcls,
+                restrictPublicBuckets: config.configuration.publicAccessBlock.restrictPublicBuckets
+            }, opts);
+        }
+        if (config.configuration.serverAccessLogging?.enabled) {
+            new aws.s3.BucketLoggingV2(`${config.id}-logging`, {
+                bucket: bucket.id,
+                targetBucket: config.configuration.serverAccessLogging.targetBucket || bucket.id,
+                targetPrefix: config.configuration.serverAccessLogging.targetPrefix || "access-logs/",
+                ...(config.configuration.serverAccessLogging.targetGrants && {
+                    targetGrants: config.configuration.serverAccessLogging.targetGrants
+                })
+            }, opts);
+        }
+        if (config.configuration.policy?.enabled && config.configuration.policy.statements) {
+            const policyDocument = {
+                Version: "2012-10-17",
+                Statement: config.configuration.policy.statements.map((stmt) => {
+                    let principal = {};
+                    if (stmt.principals) {
+                        if (stmt.principals.service) {
+                            principal.Service = stmt.principals.service;
+                        }
+                        if (stmt.principals.aws) {
+                            principal.AWS = stmt.principals.aws;
+                        }
+                        if (stmt.principals.federated) {
+                            principal.Federated = stmt.principals.federated;
+                        }
+                        if (stmt.principals.Service || stmt.principals.AWS || stmt.principals.Federated) {
+                            principal = stmt.principals;
+                        }
+                    }
+                    return {
+                        Sid: stmt.sid,
+                        Effect: stmt.effect,
+                        Principal: principal,
+                        Action: stmt.actions,
+                        Resource: stmt.resources,
+                        ...(stmt.conditions && { Condition: stmt.conditions })
+                    };
+                })
+            };
+            new aws.s3.BucketPolicy(`${config.id}-policy`, {
+                bucket: bucket.id,
+                policy: JSON.stringify(policyDocument)
+            }, opts);
+        }
+        if (config.configuration.replication?.enabled) {
+            await this.setupReplication(config, bucket, provider);
+        }
+        return bucket;
+    }
+    getOutputs(resource) {
+        return {
+            id: resource.id,
+            arn: resource.arn,
+            bucket: resource.bucket,
+            bucketName: resource.bucket,
+            kmsKeyArn: undefined,
+            kmsKeyId: undefined,
+        };
+    }
+    validateConfig(config) {
+        (0, validateS3Config_1.validateS3Config)(config);
+    }
+    async setupReplication(config, sourceBucket, provider) {
+        const replicationConfig = config.configuration.replication;
+        if (!replicationConfig?.enabled)
+            return;
+        const destinationRegion = replicationConfig.destinationRegion;
+        const destinationBucketName = replicationConfig.destinationBucket ||
+            `${config.meta.environment}-${config.configuration.bucket}-backup`;
+        const destinationBucketArn = `arn:aws:s3:::${destinationBucketName}`;
+        const replicationRole = this.createReplicationRole(config, sourceBucket, destinationBucketArn);
+        new aws.s3.BucketReplicationConfig(`${config.id}-replication`, {
+            bucket: sourceBucket.id,
+            role: replicationRole.arn,
+            rules: [{
+                    id: "ReplicateEverything",
+                    status: "Enabled",
+                    priority: 1,
+                    filter: {},
+                    deleteMarkerReplication: {
+                        status: "Enabled"
+                    },
+                    destination: {
+                        bucket: destinationBucketArn,
+                        storageClass: replicationConfig.storageClass || "STANDARD_IA"
+                    }
+                }]
+        }, {
+            provider: provider,
+            dependsOn: [replicationRole]
+        });
+        return { replicationRole };
+    }
+    createReplicationRole(config, sourceBucket, destinationBucketArn) {
+        const replicationRole = new aws.iam.Role(`${config.id}-replication-role`, {
+            assumeRolePolicy: JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [{
+                        Action: "sts:AssumeRole",
+                        Effect: "Allow",
+                        Principal: {
+                            Service: "s3.amazonaws.com"
+                        }
+                    }]
+            }),
+            tags: config.configuration.tags
+        });
+        const replicationPolicy = new aws.iam.Policy(`${config.id}-replication-policy`, {
+            policy: sourceBucket.arn.apply(sourceArn => JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "s3:GetObjectVersionForReplication",
+                            "s3:GetObjectVersionAcl",
+                            "s3:GetObjectVersionTagging"
+                        ],
+                        Resource: [`${sourceArn}/*`]
+                    },
+                    {
+                        Effect: "Allow",
+                        Action: ["s3:ListBucket"],
+                        Resource: [sourceArn]
+                    },
+                    {
+                        Effect: "Allow",
+                        Action: [
+                            "s3:ReplicateObject",
+                            "s3:ReplicateDelete",
+                            "s3:ReplicateTags"
+                        ],
+                        Resource: [`${destinationBucketArn}/*`]
+                    }
+                ]
+            }))
+        });
+        new aws.iam.RolePolicyAttachment(`${config.id}-replication-policy-attachment`, {
+            role: replicationRole.name,
+            policyArn: replicationPolicy.arn
+        });
+        return replicationRole;
+    }
+}
+exports.S3Factory = S3Factory;

package/dist/src/factories/s3StaticHostingFactory.backup.js

@@ -0,0 +1,424 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3StaticHostingFactory = void 0;
+const aws = __importStar(require("@pulumi/aws"));
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const resourceFactory_1 = require("./resourceFactory");
+const buildAwsCloudWatchAlarmsHelper_1 = require("./buildAwsCloudWatchAlarmsHelper");
+const buildS3StaticHostingCloudWatchDashboardHelper_1 = require("./buildS3StaticHostingCloudWatchDashboardHelper");
+const buildS3StaticHostingCicdHelper_1 = require("./buildS3StaticHostingCicdHelper");
+const wafFactory_1 = require("./wafFactory");
+class S3StaticHostingFactory extends resourceFactory_1.ResourceFactory {
+    static supportsProviderRegistry = true;
+    async createResource(config, provider, providerRegistry = {}) {
+        this.validateConfig(config);
+        this.validateHostedZoneRequirement(config);
+        const route53Provider = this.resolveRoute53Provider(config, providerRegistry);
+        const s3Client = this.createS3Client(config);
+        const bucket = this.createMainBucket(config, provider);
+        const artifactBucket = this.createArtifactBucketIfDefined(config, provider);
+        this.blockPublicAccessIfRequired(config, bucket, provider);
+        const cloudfrontDomain = await this.setupCloudFront(config, bucket, s3Client, provider, route53Provider);
+        bucket.cloudfrontDomain = cloudfrontDomain;
+        this.createEventNotifications(config, bucket, provider);
+        this.setupMonitoring(config, bucket, provider);
+        this.setupCicd(config, bucket, artifactBucket, provider);
+        return bucket;
+    }
+    getOutputs(resource) {
+        const getOutputName = (output) => output?.apply ? output.apply((x) => x.name) : output?.name;
+        return {
+            bucket: resource.bucket,
+            websiteUrl: resource.websiteUrl || resource.websiteEndpoint,
+            cloudfrontDomain: resource.cloudfrontDomain,
+            monitoringAlarmArns: resource.monitoringResources?.map((a) => a.arn),
+            dashboardName: resource.dashboardResource?.dashboardName,
+            codebuildProjectName: getOutputName(resource.cicdResources?.codebuild),
+            codepipelineName: getOutputName(resource.cicdResources?.pipeline),
+        };
+    }
+    validateConfig(config) {
+        if (!config.configuration?.bucket) {
+            throw new Error("S3StaticHosting config must include configuration with bucket");
+        }
+    }
+    validateHostedZoneRequirement(config) {
+        const cf = config.configuration.cloudfront;
+        if (cf?.enabled && cf.enableCertProvisioning && cf.aliases?.length && !config.meta?.hostedZoneId) {
+            throw new Error("[ERROR] meta.hostedZoneId is required for ACM automation.");
+        }
+    }
+    resolveRoute53Provider(config, registry) {
+        const ref = config.inputs?.route53Provider;
+        if (typeof ref === "object")
+            return ref;
+        if (typeof ref === "string") {
+            return registry[ref] || config.inputs.providers?.[ref] || (() => {
+                throw new Error(`[ERROR] route53Provider '${ref}' not found in registry`);
+            })();
+        }
+        return undefined;
+    }
+    createS3Client(config) {
+        const awsSdk = require("aws-sdk");
+        const bucket = config.configuration.cloudfront?.logging?.bucket;
+        const region = bucket === "cf-logs-bucket" ? "eu-central-1" : undefined;
+        return new awsSdk.S3(region ? { region } : {});
+    }
+    createMainBucket(config, provider) {
+        return new aws.s3.Bucket(`${config.meta.environment}-${config.configuration.bucket}`, {
+            bucket: config.configuration.bucket,
+            acl: config.configuration.acl || "private",
+            website: config.configuration.website,
+            tags: config.configuration.tags,
+            versioning: config.configuration.versioning ? { enabled: true } : undefined,
+            serverSideEncryptionConfiguration: config.configuration.encryption?.enabled
+                ? {
+                    rule: {
+                        applyServerSideEncryptionByDefault: {
+                            sseAlgorithm: config.configuration.encryption.type || "AES256",
+                            kmsMasterKeyId: config.configuration.encryption.kmsKeyId,
+                        },
+                    },
+                }
+                : undefined,
+            corsRules: config.configuration.cors ? [config.configuration.cors] : undefined,
+            lifecycleRules: config.configuration.lifecycleRules,
+            replicationConfiguration: config.configuration.replication,
+            forceDestroy: true,
+        }, provider ? { provider } : undefined);
+    }
+    createArtifactBucketIfDefined(config, provider) {
+        if (!config.configuration.cicd?.artifactBucket)
+            return undefined;
+        return new aws.s3.Bucket(`${config.meta.environment}-${config.configuration.cicd.artifactBucket}`, {
+            bucket: config.configuration.cicd.artifactBucket,
+            acl: "private",
+            versioning: { enabled: true },
+            tags: config.configuration.tags,
+            forceDestroy: true,
+        }, provider ? { provider } : undefined);
+    }
+    blockPublicAccessIfRequired(config, bucket, provider) {
+        if (config.configuration.blockPublicAccess === false)
+            return;
+        new aws.s3.BucketPublicAccessBlock(`${config.meta.environment}-${config.configuration.bucket}-block-public`, {
+            bucket: bucket.id,
+            blockPublicAcls: true,
+            blockPublicPolicy: true,
+            ignorePublicAcls: true,
+            restrictPublicBuckets: true,
+        }, provider ? { provider } : undefined);
+    }
+    async setupCloudFront(config, bucket, s3, provider, route53Provider) {
+        const cfConfig = config.configuration.cloudfront;
+        if (!cfConfig?.enabled)
+            return;
+        const envPrefix = `${config.meta.environment}-${config.id}`;
+        const oai = new aws.cloudfront.OriginAccessIdentity(`${envPrefix}-oai`, {}, provider ? { provider } : undefined);
+        new aws.s3.BucketPolicy(`${envPrefix}-policy`, {
+            bucket: bucket.id,
+            policy: pulumi.all([bucket.id, oai.iamArn]).apply(([id, iamArn]) => JSON.stringify({
+                Version: "2012-10-17",
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: { AWS: iamArn },
+                        Action: ["s3:GetObject"],
+                        Resource: `arn:aws:s3:::${config.configuration.bucket}/*`,
+                    },
+                ],
+            })),
+        }, provider ? { provider } : undefined);
+        const usEast1Provider = config.inputs?.providers?.["dev-us-east-1"] || undefined;
+        let effectiveCertArn = cfConfig.acmCertificateArn;
+        const aliases = (cfConfig.aliases || [])
+            .map((a) => a.trim())
+            .filter((a) => !!a && !a.includes("*") && !a.includes("${"));
+        if ((!effectiveCertArn || effectiveCertArn === "") && aliases.length && cfConfig.enableCertProvisioning && config.meta.hostedZoneId) {
+            if (!usEast1Provider)
+                throw new Error("usEast1Provider required for ACM with CloudFront");
+            const cert = new aws.acm.Certificate(`${envPrefix}-cf-cert`, {
+                domainName: aliases[0],
+                subjectAlternativeNames: aliases.slice(1),
+                validationMethod: "DNS",
+                tags: cfConfig.tags || config.configuration.tags,
+            }, { provider: usEast1Provider });
+            const validationRecord = pulumi.all([cert.domainValidationOptions]).apply(([options]) => {
+                const opt = options[0];
+                return new aws.route53.Record(`${envPrefix}-cf-cert-validation`, {
+                    name: opt.resourceRecordName,
+                    zoneId: config.meta.hostedZoneId,
+                    type: opt.resourceRecordType,
+                    records: [opt.resourceRecordValue],
+                    ttl: 300,
+                }, route53Provider ? { provider: route53Provider } : provider ? { provider } : undefined);
+            });
+            const certValidation = pulumi.all([cert.arn, cert.domainValidationOptions]).apply(([arn, options]) => {
+                const fqdns = options.map((o) => o.resourceRecordName);
+                return new aws.acm.CertificateValidation(`${envPrefix}-cf-cert-validate`, {
+                    certificateArn: arn,
+                    validationRecordFqdns: fqdns,
+                }, { provider: usEast1Provider });
+            });
+            effectiveCertArn = certValidation.apply((v) => v.certificateArn);
+        }
+        let effectiveWafArn = cfConfig.wafArn;
+        if ((!effectiveWafArn || effectiveWafArn === "") && (cfConfig.enableWaf || cfConfig.wafConfig?.enabled)) {
+            const wafName = `${envPrefix}-cf-waf`;
+            let wafConfig;
+            if (cfConfig.wafConfig?.customConfig) {
+                wafConfig = {
+                    name: wafName,
+                    scope: "CLOUDFRONT",
+                    defaultAction: "allow",
+                    ...cfConfig.wafConfig.customConfig,
+                };
+            }
+            else if (cfConfig.wafConfig?.useSecureDefaults !== false) {
+                wafConfig = wafFactory_1.WafFactory.createSecureWafConfig(wafName, "CLOUDFRONT");
+                if (cfConfig.wafConfig?.rateLimiting) {
+                    wafConfig.rateLimiting = cfConfig.wafConfig.rateLimiting;
+                }
+                if (cfConfig.wafConfig?.ipRestrictions) {
+                    wafConfig.ipRestrictions = cfConfig.wafConfig.ipRestrictions;
+                }
+                if (cfConfig.wafConfig?.geoRestrictions) {
+                    wafConfig.geoRestrictions = cfConfig.wafConfig.geoRestrictions;
+                }
+                if (cfConfig.wafConfig?.managedRuleGroups) {
+                    const managedRules = cfConfig.wafConfig.managedRuleGroups;
+                    wafConfig.managedRuleGroups = [];
+                    if (managedRules.enableCommonRules !== false) {
+                        wafConfig.managedRuleGroups.push({
+                            name: "AWSManagedRulesCommonRuleSet",
+                            vendorName: "AWS",
+                            priority: 10,
+                            overrideAction: "count",
+                        });
+                    }
+                    if (managedRules.enableKnownBadInputs !== false) {
+                        wafConfig.managedRuleGroups.push({
+                            name: "AWSManagedRulesKnownBadInputsRuleSet",
+                            vendorName: "AWS",
+                            priority: 20,
+                            overrideAction: "count",
+                        });
+                    }
+                    if (managedRules.enableSQLInjection !== false) {
+                        wafConfig.managedRuleGroups.push({
+                            name: "AWSManagedRulesSQLiRuleSet",
+                            vendorName: "AWS",
+                            priority: 30,
+                            overrideAction: "count",
+                        });
+                    }
+                    if (managedRules.enableIpReputation !== false) {
+                        wafConfig.managedRuleGroups.push({
+                            name: "AWSManagedRulesAmazonIpReputationList",
+                            vendorName: "AWS",
+                            priority: 50,
+                            overrideAction: "count",
+                        });
+                    }
+                    if (managedRules.enableAnonymousIp !== false) {
+                        wafConfig.managedRuleGroups.push({
+                            name: "AWSManagedRulesAnonymousIpList",
+                            vendorName: "AWS",
+                            priority: 60,
+                            overrideAction: "count",
+                        });
+                    }
+                }
+                if (cfConfig.wafConfig?.customRules?.length) {
+                    wafConfig.customRegexRules = cfConfig.wafConfig.customRules.map(rule => ({
+                        name: rule.name,
+                        priority: rule.priority,
+                        regex: rule.regex || "/.*",
+                        action: rule.action,
+                        fieldToMatch: { type: "uri" },
+                    }));
+                }
+                if (cfConfig.wafConfig?.logging) {
+                    wafConfig.logging = cfConfig.wafConfig.logging;
+                }
+            }
+            else {
+                wafConfig = {
+                    name: wafName,
+                    scope: "CLOUDFRONT",
+                    description: `WAF for CloudFront distribution ${envPrefix}`,
+                    defaultAction: "allow",
+                    rateLimiting: {
+                        enabled: true,
+                        limit: 2000,
+                        action: "block",
+                    },
+                    visibilityConfig: {
+                        cloudwatchMetricsEnabled: true,
+                        sampledRequestsEnabled: true,
+                    },
+                    tags: cfConfig.tags || config.configuration.tags,
+                };
+            }
+            const waf = wafFactory_1.WafFactory.createWaf(wafConfig, usEast1Provider);
+            effectiveWafArn = waf.arn;
+        }
+        let loggingConfig;
+        const logBucket = cfConfig.logging?.bucket;
+        if (logBucket && !logBucket.includes("${")) {
+            try {
+                await s3.headBucket({ Bucket: logBucket }).promise();
+                loggingConfig = {
+                    bucket: logBucket,
+                    prefix: cfConfig.logging?.prefix,
+                    includeCookies: cfConfig.logging?.includeCookies,
+                };
+            }
+            catch {
+                console.warn(`[WARNING] CloudFront logging bucket "${logBucket}" not accessible. Skipping logging.`);
+            }
+        }
+        const distribution = new aws.cloudfront.Distribution(`${envPrefix}-cf`, {
+            enabled: true,
+            origins: [
+                {
+                    domainName: bucket.bucketRegionalDomainName,
+                    originId: bucket.arn,
+                    s3OriginConfig: {
+                        originAccessIdentity: oai.cloudfrontAccessIdentityPath,
+                    },
+                },
+            ],
+            defaultRootObject: cfConfig.defaultRootObject || config.configuration.website?.indexDocument || "index.html",
+            defaultCacheBehavior: {
+                targetOriginId: bucket.arn,
+                viewerProtocolPolicy: "redirect-to-https",
+                allowedMethods: ["GET", "HEAD"],
+                cachedMethods: ["GET", "HEAD"],
+                forwardedValues: {
+                    queryString: false,
+                    cookies: { forward: "none" },
+                },
+            },
+            aliases,
+            restrictions: {
+                geoRestriction: cfConfig.geoRestriction || { restrictionType: "none" },
+            },
+            viewerCertificate: effectiveCertArn
+                ? {
+                    acmCertificateArn: effectiveCertArn,
+                    sslSupportMethod: "sni-only",
+                }
+                : { cloudfrontDefaultCertificate: true },
+            priceClass: cfConfig.priceClass || "PriceClass_100",
+            customErrorResponses: cfConfig.customErrorResponses,
+            orderedCacheBehaviors: cfConfig.cacheBehaviors,
+            loggingConfig,
+            webAclId: effectiveWafArn,
+            tags: cfConfig.tags || config.configuration.tags,
+        }, provider ? { provider } : undefined);
+        bucket.cloudfrontDistribution = distribution;
+        return distribution.domainName;
+    }
+    createEventNotifications(config, bucket, provider) {
+        for (const notif of config.configuration.eventNotifications || []) {
+            new aws.s3.BucketNotification(`${config.meta.environment}-${config.configuration.bucket}-notif`, {
+                bucket: bucket.id,
+                ...notif,
+            }, provider ? { provider } : undefined);
+        }
+    }
+    setupMonitoring(config, bucket, provider) {
+        if (!config.configuration.monitoring?.enabled)
+            return;
+        const cfId = bucket.cloudfrontDistribution?.id;
+        bucket.monitoringResources = (0, buildAwsCloudWatchAlarmsHelper_1.buildAwsCloudWatchAlarmsHelper)(`${config.meta.environment}-${config.id}`, {
+            resourceType: "cloudfront",
+            resourceId: cfId,
+            alarms: config.configuration.monitoring.alarms || [],
+            alarmActions: config.configuration.monitoring.alarms?.map(a => a.alarmActionArn).filter((v) => typeof v === "string"),
+            okActions: config.configuration.monitoring.alarms?.map(a => a.okActionArn).filter((v) => typeof v === "string"),
+            tags: config.configuration.tags,
+            provider,
+        });
+        if (config.configuration.monitoring.dashboard) {
+            bucket.dashboardResource = (0, buildS3StaticHostingCloudWatchDashboardHelper_1.buildS3StaticHostingCloudWatchDashboardHelper)(`${config.meta.environment}-${config.id}`, {
+                bucketName: config.configuration.bucket,
+                cloudfrontDistributionId: cfId,
+                tags: config.configuration.tags,
+            }, provider);
+        }
+    }
+    setupCicd(config, bucket, artifactBucket, provider) {
+        const cicd = config.configuration.cicd;
+        if (!cicd?.enabled || !cicd.buildspecPath || !cicd.serviceRoleArn || !cicd.pipelineRoleArn)
+            return;
+        const cicdAny = cicd;
+        let repoOwner = cicdAny.repoOwner;
+        let repoName = cicdAny.repoName;
+        if ((!repoOwner || !repoName) && cicd.repo) {
+            const parts = cicd.repo.split("/");
+            if (parts.length === 2) {
+                repoOwner = repoOwner || parts[0];
+                repoName = repoName || parts[1];
+            }
+            else {
+                repoName = repoName || cicd.repo;
+            }
+        }
+        const cicdResources = (0, buildS3StaticHostingCicdHelper_1.buildS3StaticHostingCicdHelper)({
+            name: `${config.meta.environment}-${config.id}`,
+            artifactBucket: artifactBucket ? artifactBucket.bucket : cicd.artifactBucket,
+            buildspecPath: cicd.buildspecPath,
+            buildEnvironmentVariables: cicd.environmentVariables,
+            cloudfrontDistributionId: bucket.cloudfrontDistribution?.id,
+            bucketName: config.configuration.bucket,
+            provider,
+            serviceRoleArn: cicd.serviceRoleArn,
+            pipelineRoleArn: cicd.pipelineRoleArn,
+            repoOwner: repoOwner || "",
+            repoName: repoName || "",
+            branch: cicd.branch || "main",
+            codestarConnectionArn: cicd.codestarConnectionArn || "",
+            buildImage: cicd.buildImage,
+            buildTimeout: cicd.buildTimeout,
+            tags: cicd.tags,
+        });
+        bucket.cicdResources = cicdResources;
+    }
+}
+exports.S3StaticHostingFactory = S3StaticHostingFactory;