Skip to content

Commit 318a1ed

Browse files
eyulfeyulf
committed
Refactor and update module
1 parent ec63bf1 commit 318a1ed

15 files changed

+757
-591
lines changed

Diff for: ‎.gitignore

+16-4
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,20 @@
22
**/.terraform/*
33

44
# .tfstate files
5-
*.tfstate
6-
*.tfstate.*
5+
**.tfstate
6+
**.tfstate.*
77

8-
# .tfvars files
9-
*.tfvars
8+
# .plan files
9+
**.plan
10+
**.plan.*
11+
12+
# .swp files
13+
**.swp
14+
15+
# .hcl files
16+
**.hcl
17+
!.tflint.hcl
18+
19+
# Checkov
20+
.external_modules/
21+
.external_modules/**

Diff for: ‎.pre-commit-config.yaml

+9-4
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
1+
---
12
repos:
2-
- repo: git://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.48.0
3+
- repo: https://github.com/antonbabenko/pre-commit-terraform
4+
rev: v1.77.1
45
hooks:
56
- id: terraform_fmt
6-
- id: terraform_tflint
7-
- id: terraform_validate
87
- id: terraform_docs
8+
- id: terraform_tflint
9+
- id: terraform_checkov
10+
args:
11+
- --args=--quiet
12+
- --args=--compact
13+
- --args=--download-external-modules=True

Diff for: ‎README.md

+175-70
Large diffs are not rendered by default.

Diff for: ‎cloudfront.tf

+95
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
### Cloudfront
2+
3+
data "aws_cloudfront_cache_policy" "this" {
4+
name = "Managed-CachingOptimized"
5+
}
6+
7+
data "aws_cloudfront_origin_request_policy" "this" {
8+
name = "Managed-CORS-S3Origin"
9+
}
10+
11+
data "aws_cloudfront_response_headers_policy" "this" {
12+
name = var.cloudfront_response_headers_policy_name
13+
}
14+
15+
resource "aws_cloudfront_distribution" "this" {
16+
aliases = local.cloudfront_alias
17+
comment = "Static Website for ${var.website_domain}"
18+
price_class = var.cloudfront_price_class
19+
enabled = true
20+
is_ipv6_enabled = true
21+
default_root_object = "index.html"
22+
http_version = "http2and3"
23+
web_acl_id = local.cloudfront_web_acl_arn
24+
25+
origin {
26+
domain_name = aws_s3_bucket.this.bucket_regional_domain_name
27+
origin_access_control_id = aws_cloudfront_origin_access_control.this.id
28+
origin_id = "S3-${var.website_domain}"
29+
}
30+
31+
default_cache_behavior {
32+
allowed_methods = var.cloudfront_default_cache_allowed_methods
33+
cached_methods = var.cloudfront_default_cache_cached_methods
34+
target_origin_id = "S3-${var.website_domain}"
35+
36+
viewer_protocol_policy = "redirect-to-https"
37+
cache_policy_id = data.aws_cloudfront_cache_policy.this.id
38+
origin_request_policy_id = data.aws_cloudfront_origin_request_policy.this.id
39+
response_headers_policy_id = data.aws_cloudfront_response_headers_policy.this.id
40+
compress = true
41+
42+
function_association {
43+
event_type = "viewer-request"
44+
function_arn = aws_cloudfront_function.this.arn
45+
}
46+
}
47+
48+
viewer_certificate {
49+
acm_certificate_arn = local.cloudfront_certificate_arn
50+
cloudfront_default_certificate = local.cloudfront_default_certificate
51+
ssl_support_method = "sni-only"
52+
minimum_protocol_version = var.cloudfront_ssl_minimum_protocol
53+
}
54+
55+
restrictions {
56+
geo_restriction {
57+
restriction_type = "none"
58+
}
59+
}
60+
61+
tags = local.tags
62+
63+
depends_on = [aws_acm_certificate.this]
64+
65+
#checkov:skip=CKV_AWS_68:WAF is enabled if ARN supplied via var.cloudfront_web_acl_arn
66+
#checkov:skip=CKV_AWS_86:FIXME Add logging support
67+
#checkov:skip=CKV2_AWS_32:Response header policy used is set via var.cloudfront_response_headers_policy_name
68+
#checkov:skip=CKV2_AWS_47:WAF is enabled if ARN supplied via var.cloudfront_web_acl_arn
69+
}
70+
71+
### Cloudfront Access
72+
73+
resource "aws_cloudfront_origin_access_control" "this" {
74+
name = var.website_domain
75+
description = "Static Website for ${var.website_domain}"
76+
origin_access_control_origin_type = "s3"
77+
signing_behavior = "always"
78+
signing_protocol = "sigv4"
79+
}
80+
81+
### Cloudfront Function
82+
83+
resource "aws_cloudfront_function" "this" {
84+
name = replace(var.website_domain, ".", "-")
85+
runtime = "cloudfront-js-1.0"
86+
comment = "Viewer Request function for ${var.website_domain}"
87+
publish = true
88+
code = templatefile(
89+
"${path.module}/functions/main.tftpl",
90+
{
91+
domain = var.website_domain,
92+
redirect_www = var.website_redirect_www,
93+
}
94+
)
95+
}

Diff for: ‎functions/main.tftpl

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
function handler(event) {
2+
var request = event.request;
3+
var headers = request.headers;
4+
var host = request.headers.host.value;
5+
6+
var uri = request.uri;
7+
8+
// Check whether the URI is missing a file name.
9+
if (uri.endsWith('/')) {
10+
request.uri += 'index.html';
11+
}
12+
// Check whether the URI is missing a file extension.
13+
else if (!uri.includes('.')) {
14+
request.uri += '/index.html';
15+
}
16+
17+
%{~ if redirect_www ~}
18+
// Redirect www to non-www
19+
if (host === 'www.${domain}') {
20+
var response = {
21+
statusCode: 302,
22+
statusDescription: 'Found',
23+
headers:
24+
{ "location": { "value": "https://${domain}".concat(request.uri) } }
25+
}
26+
return response;
27+
}
28+
%{~ endif ~}
29+
30+
return request;
31+
}

Diff for: ‎iam-bitbucket.tf

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
### OpenID
2+
3+
resource "aws_iam_openid_connect_provider" "bitbucket" {
4+
count = var.openid_provider_create && var.bitbucket_repo_uuid != "" ? 1 : 0
5+
6+
url = "https://api.bitbucket.org/2.0/workspaces/${var.bitbucket_workspace_name}/pipelines-config/identity/oidc"
7+
client_id_list = ["ari:cloud:bitbucket::workspace/${var.bitbucket_workspace_uuid}"]
8+
9+
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
10+
thumbprint_list = [
11+
"a031c46782e6e6c662c2c87c76da9aa62ccabd8e", # api.bitbucket.org (04/02/2023)
12+
]
13+
}
14+
15+
### IAM Role
16+
17+
resource "aws_iam_role" "bitbucket" {
18+
count = var.bitbucket_repo_uuid != "" ? 1 : 0
19+
20+
name = "OpenIdBitBucket-${replace(var.website_domain, ".", "-")}"
21+
assume_role_policy = data.aws_iam_policy_document.bitbucket_assume.json
22+
}
23+
24+
data "aws_iam_policy_document" "bitbucket_assume" {
25+
statement {
26+
sid = "AllowRoleAssumptionWithWebIdentity"
27+
effect = "Allow"
28+
actions = ["sts:AssumeRoleWithWebIdentity"]
29+
30+
principals {
31+
type = "Federated"
32+
identifiers = [var.openid_provider_create && var.bitbucket_openid_arn == "" ? aws_iam_openid_connect_provider.bitbucket[0].arn : var.bitbucket_openid_arn]
33+
}
34+
35+
condition {
36+
test = "StringLike"
37+
variable = "api.bitbucket.org/2.0/workspaces/${var.bitbucket_workspace_name}/pipelines-config/identity/oidc:sub"
38+
values = ["${var.bitbucket_repo_uuid}:*"]
39+
}
40+
}
41+
}
42+
43+
### IAM Policy
44+
45+
resource "aws_iam_role_policy" "bitbucket" {
46+
count = var.bitbucket_repo_uuid != "" ? 1 : 0
47+
48+
name = "OpenIdBitBucket"
49+
role = aws_iam_role.bitbucket[0].id
50+
policy = data.aws_iam_policy_document.pipeline.json
51+
}

Diff for: ‎iam-github.tf

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
### OpenID
2+
3+
resource "aws_iam_openid_connect_provider" "github" {
4+
count = var.openid_provider_create && var.github_repo != "" ? 1 : 0
5+
6+
url = "https://token.actions.githubusercontent.com"
7+
client_id_list = ["sts.amazonaws.com"]
8+
9+
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html
10+
thumbprint_list = [
11+
"f879abce0008e4eb126e0097e46620f5aaae26ad", # token.actions.githubusercontent.com (04/02/2023)
12+
]
13+
}
14+
15+
### IAM Role
16+
17+
resource "aws_iam_role" "github" {
18+
count = var.github_repo != "" ? 1 : 0
19+
20+
name = "OpenIdGitHub-${replace(var.website_domain, ".", "-")}"
21+
assume_role_policy = data.aws_iam_policy_document.github_assume.json
22+
}
23+
24+
data "aws_iam_policy_document" "github_assume" {
25+
statement {
26+
sid = "AllowRoleAssumptionWithWebIdentity"
27+
effect = "Allow"
28+
actions = ["sts:AssumeRoleWithWebIdentity"]
29+
30+
principals {
31+
type = "Federated"
32+
identifiers = [var.openid_provider_create && var.github_openid_arn == "" ? aws_iam_openid_connect_provider.github[0].arn : var.github_openid_arn]
33+
}
34+
35+
condition {
36+
test = "StringLike"
37+
variable = "token.actions.githubusercontent.com:sub"
38+
values = ["repo:${var.github_repo}:*"]
39+
}
40+
}
41+
}
42+
43+
### IAM Policy
44+
45+
resource "aws_iam_role_policy" "github" {
46+
count = var.github_repo != "" ? 1 : 0
47+
48+
name = "OpenIdGitHub"
49+
role = aws_iam_role.github[0].id
50+
policy = data.aws_iam_policy_document.pipeline.json
51+
}

Diff for: ‎iam.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
data "aws_iam_policy_document" "pipeline" {
2+
statement {
3+
sid = "AllowUploadToS3${local.domain_titled}"
4+
effect = "Allow"
5+
actions = [
6+
"s3:ListBucket",
7+
"s3:GetBucketLocation",
8+
"s3:GetObject",
9+
"s3:GetObjectAcl",
10+
"s3:PutObject",
11+
"s3:PutObjectAcl",
12+
"s3:DeleteObject",
13+
]
14+
resources = [
15+
aws_s3_bucket.this.arn,
16+
"${aws_s3_bucket.this.arn}/*",
17+
]
18+
}
19+
20+
statement {
21+
sid = "AllowCloudFrontInvalidate${local.domain_titled}"
22+
effect = "Allow"
23+
actions = ["cloudfront:CreateInvalidation"]
24+
resources = [aws_cloudfront_distribution.this.arn]
25+
}
26+
}

Diff for: ‎locals.tf

+18-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,25 @@
11
locals {
2-
origin_id = "S3-${var.website_domain}"
3-
42
tags = {
53
role = "website"
64
domain = var.website_domain
75
managed = "terraform"
86
}
7+
8+
domain_redirect = var.website_redirect_www ? ["www.${var.website_domain}"] : []
9+
domains_all = concat(
10+
[var.website_domain],
11+
local.domain_redirect,
12+
var.website_aliases,
13+
)
14+
domains_alias = concat(
15+
local.domain_redirect,
16+
var.website_aliases,
17+
)
18+
19+
domain_titled = replace(replace(title(var.website_domain), ".", ""), "-", "")
20+
21+
cloudfront_certificate_arn = data.aws_acm_certificate.this.status == "ISSUED" ? aws_acm_certificate.this.arn : null
22+
cloudfront_default_certificate = data.aws_acm_certificate.this.status != "ISSUED" ? true : null
23+
cloudfront_alias = data.aws_acm_certificate.this.status == "ISSUED" ? local.domains_all : []
24+
cloudfront_web_acl_arn = var.cloudfront_web_acl_arn != "" ? var.cloudfront_web_acl_arn : null
925
}

0 commit comments

Comments
 (0)