aws-cdk-constructs 2.26.0__tar.gz → 2.26.2__tar.gz

{aws_cdk_constructs-2.26.0 → aws_cdk_constructs-2.26.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws_cdk_constructs
-Version: 2.26.0
+Version: 2.26.2
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author

{aws_cdk_constructs-2.26.0 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs/__init__.py

@@ -14,4 +14,4 @@ from .load_balancer import Alb, Nlb
 from .security_group import SecurityGroup
 from .windows_server import WindowsServer
 
-__version__ = '2.26.0'
+__version__ = '2.26.2'

{aws_cdk_constructs-2.26.0 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs/bucket/bucket.py

@@ -103,6 +103,7 @@ class Bucket(Construct):
 
         cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
 
+        bucket_policy_statements: List[_iam.PolicyStatement]: List of policy statements to be added to the Bucket policy. Default: []
     """
 
     @property
@@ -160,8 +161,9 @@ class Bucket(Construct):
         encryption_allowed_principals_arns: Union[str, List[str]] = None,
         enforce_ssl: bool = False,
         will_implement_cdn: str = 'false',
-        cdn_domain_names: [str] = [],
+        cdn_domain_names: List[str] = [],
         cdn_ssl_certificate_arn: str = None,
+        bucket_policy_statements: List[_iam.PolicyStatement] = [],
         **kwargs,
     ) -> aws_cdk.aws_s3.Bucket:
         """Create an S3 bucket
@@ -198,6 +200,8 @@ class Bucket(Construct):
 
             cdn_ssl_certificate_arn (str): If "will_implement_cdn" is "True" and you want to enable HTTPS for your CloudFront distribution, specify the SSL certificate ARN to use. NB: this certificate must be in North Virginia
 
+            bucket_policy_statements: List[_iam.PolicyStatement]: List of policy statements to be added to the Bucket policy. Default: []
+
         Returns:
             aws_s3.Bucket: the S3 bucket
         """
@@ -299,30 +303,131 @@ class Bucket(Construct):
         )
         # Create CloudFront distribution
         if create_cloudfront_distribution:
+            distribution_id = f'distribution_{bucket_name}'
             self._cloudfront_distribution = _cloudfront.Distribution(
                 self,
-                f'distribution_{bucket_name}',
+                distribution_id,
                 default_behavior=_cloudfront.BehaviorOptions(
                     origin=_cloudfront_origins.S3Origin(s3_bucket),
                     compress=True,
                     viewer_protocol_policy=_cloudfront.ViewerProtocolPolicy.HTTPS_ONLY,
                     allowed_methods=_cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
                     cache_policy=_cloudfront.CachePolicy.CACHING_DISABLED,
-                    origin_request_policy=_cloudfront.OriginRequestPolicy.ALL_VIEWER,
+                    origin_request_policy=_cloudfront.OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
                 ),
                 certificate=_certificate.Certificate.from_certificate_arn(
                     self,
                     'https_certificate_cdn',
-                    certificate_arn=cdn_ssl_certificate_arn
-                    if cdn_ssl_certificate_arn
-                    else self.aws_account[
-                        'ssl_certificate_star_fao_org_arn_north_virginia'
-                    ],
+                    certificate_arn=(
+                        cdn_ssl_certificate_arn
+                        if cdn_ssl_certificate_arn
+                        else self.aws_account[
+                            'ssl_certificate_star_fao_org_arn_north_virginia'
+                        ]
+                    ),
                 ),
                 price_class=_cloudfront.PriceClass.PRICE_CLASS_100,
                 domain_names=cdn_domain_names,
             )
 
+            self._origin_access_control = _cloudfront.CfnOriginAccessControl(
+                self,
+                f'oac_{bucket_name}',
+                origin_access_control_config=_cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
+                    name=f'oac_{bucket_name}',
+                    origin_access_control_origin_type='s3',
+                    signing_behavior='always',
+                    signing_protocol='sigv4',
+                ),
+            )
+
+            cloudfront_distribution_arn = (
+                f'arn:aws:cloudfront::'
+                + self.aws_account['id']
+                + f':distribution/{self._cloudfront_distribution.distribution_id}'
+            )
+            bucket_statement = _iam.PolicyStatement(
+                principals=[_iam.ServicePrincipal('cloudfront.amazonaws.com')],
+                actions=['s3:GetObject'],
+                resources=[f'{s3_bucket.bucket_arn}/*'],
+                conditions={
+                    'StringEquals': {
+                        'aws:sourceArn': cloudfront_distribution_arn
+                    }
+                },
+            )
+
+            s3_bucket.add_to_resource_policy(bucket_statement)
+
+            # Add custom policy statements to bucket policy
+            for statement in bucket_policy_statements:
+                s3_bucket.add_to_resource_policy(statement)
+
+            ## clean-up the OAI reference and associate the OAC with the cloudfront distribution
+            # query the site bucket policy as a document
+            bucket_policy = s3_bucket.policy
+            bucket_policy_document = bucket_policy.document
+
+            # remove the CloudFront Origin Access Identity permission from the bucket policy
+            if isinstance(bucket_policy_document, _iam.PolicyDocument):
+                bucket_policy_document_json = bucket_policy_document.to_json()
+                # create an updated policy without the OAI reference
+                bucket_policy_updated_json = {
+                    'Version': '2012-10-17',
+                    'Statement': [],
+                }
+                for statement in bucket_policy_document_json['Statement']:
+                    if 'CanonicalUser' not in statement['Principal']:
+                        bucket_policy_updated_json['Statement'].append(
+                            statement
+                        )
+
+            # apply the updated bucket policy to the bucket
+            bucket_policy_override = s3_bucket.node.find_child(
+                'Policy'
+            ).node.default_child
+            bucket_policy_override.add_override(
+                'Properties.PolicyDocument', bucket_policy_updated_json
+            )
+
+            # remove the created OAI reference (S3 Origin property) for the distribution
+            all_distribution_props = (
+                self._cloudfront_distribution.node.find_all()
+            )
+            for child in all_distribution_props:
+                if child.node.id == 'S3Origin':
+                    child.node.try_remove_child('Resource')
+
+            # associate the created OAC with the distribution
+            distribution_props = (
+                self._cloudfront_distribution.node.default_child
+            )
+            distribution_props.add_override(
+                'Properties.DistributionConfig.Origins.0.S3OriginConfig.OriginAccessIdentity',
+                '',
+            )
+            distribution_props.add_property_override(
+                'DistributionConfig.Origins.0.OriginAccessControlId',
+                self._origin_access_control.ref,
+            )
+
+            # Assign Origin Access Control
+            # indexes = ["0"]
+            # for index in indexes:
+            #     self._cloudfront_distribution.node.find_child(
+            #         "Resource"
+            #     ).add_property_override(
+            #         f"DistributionConfig.Origins.{index}.OriginAccessControlId",
+            #         self._origin_access_control.get_att("Id"),
+            #     )
+
+            #     self._cloudfront_distribution.node.find_child(
+            #         "Resource"
+            #     ).add_property_override(
+            #         f"DistributionConfig.Origins.{index}.S3OriginConfig.OriginAccessIdentity",
+            #         {},
+            #     )
+
         return s3_bucket
 
     def __init__(
@@ -349,6 +454,7 @@ class Bucket(Construct):
         will_implement_cdn: str = 'false',
         cdn_domain_names: [str] = [],
         cdn_ssl_certificate_arn: str = None,
+        bucket_policy_statements: List[_iam.PolicyStatement] = [],
         **kwargs,
     ) -> None:
         super().__init__(scope, id, **kwargs)
@@ -459,17 +565,21 @@ class Bucket(Construct):
             website_index_document=bucket_website_index_document,
             website_error_document=bucket_website_error_document,
             removal_policy=removal_policy,
-            access_control=_s3.BucketAccessControl.PRIVATE
-            if not public_read_access
-            else None,
+            access_control=(
+                _s3.BucketAccessControl.PRIVATE
+                if not public_read_access
+                else None
+            ),
             # https://docs.aws.amazon.com/AmazonS3/latest/dev/access-control-block-public-access.html,
-            block_public_access=_s3.BlockPublicAccess.BLOCK_ALL
-            if not public_read_access
-            else _s3.BlockPublicAccess(
-                block_public_acls=False,
-                block_public_policy=False,
-                ignore_public_acls=False,
-                restrict_public_buckets=False,
+            block_public_access=(
+                _s3.BlockPublicAccess.BLOCK_ALL
+                if not public_read_access
+                else _s3.BlockPublicAccess(
+                    block_public_acls=False,
+                    block_public_policy=False,
+                    ignore_public_acls=False,
+                    restrict_public_buckets=False,
+                )
             ),
             versioned=versioned,
             is_encrypted=is_encrypted,
@@ -478,6 +588,7 @@ class Bucket(Construct):
             will_implement_cdn=will_implement_cdn,
             cdn_domain_names=cdn_domain_names,
             cdn_ssl_certificate_arn=cdn_ssl_certificate_arn,
+            bucket_policy_statements=bucket_policy_statements,
         )
 
         if bucket_is_privately_accessed_from_vpc_over_http:

{aws_cdk_constructs-2.26.0 → aws_cdk_constructs-2.26.2}/aws_cdk_constructs.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: aws-cdk-constructs
-Version: 2.26.0
+Version: 2.26.2
 Summary: AWS CDK constructs
 Home-page: https://bitbucket.org/cioapps/aws-cdk-constructs
 Author: author