diff --git a/cloudfront.tf b/cloudfront.tf index 93236a8..7e4948e 100755 --- a/cloudfront.tf +++ b/cloudfront.tf @@ -1,42 +1,29 @@ -resource "random_string" "header_value" { - length = 20 - special = true - upper = true - lower = true - number = true +resource "aws_cloudfront_origin_access_identity" "website_OAI" { + comment = "The OAI used to access our website buckets." +} + +locals { + primary_s3_origin = "${var.root_domain_name}" + backup_s3_origin = "backup-${var.root_domain_name}" } resource "aws_cloudfront_distribution" "website_distribution" { origin { - custom_origin_config { - http_port = "80" - https_port = "443" - origin_protocol_policy = "http-only" - origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] - } + domain_name = aws_s3_bucket.website.bucket_regional_domain_name + origin_id = local.primary_s3_origin - domain_name = "${aws_s3_bucket_website_configuration.website-bucket-config.website_endpoint}" - origin_id = "${var.root_domain_name}" - custom_header { - name = "${var.custom_header}" - value = random_string.header_value.result - } + s3_origin_config { + origin_access_identity = aws_cloudfront_origin_access_identity.website_OAI.cloudfront_access_identity_path + } } origin { - custom_origin_config { - http_port = "80" - https_port = "443" - origin_protocol_policy = "http-only" - origin_ssl_protocols = ["TLSv1", "TLSv1.1", "TLSv1.2"] - } + domain_name = aws_s3_bucket.backup-website.bucket_regional_domain_name + origin_id = local.backup_s3_origin - domain_name = "${aws_s3_bucket_website_configuration.backup-website-bucket-config.website_endpoint}" - origin_id = "backup-${var.root_domain_name}" - custom_header { - name = "${var.custom_header}" - value = random_string.header_value.result - } + s3_origin_config { + origin_access_identity = aws_cloudfront_origin_access_identity.website_OAI.cloudfront_access_identity_path + } } origin_group { @@ -47,11 +34,12 @@ resource "aws_cloudfront_distribution" "website_distribution" { } member { - origin_id = "${var.root_domain_name}" + origin_id = local.primary_s3_origin } member { - origin_id = "backup-${var.root_domain_name}" + origin_id = local.backup_s3_origin + } } @@ -64,9 +52,20 @@ resource "aws_cloudfront_distribution" "website_distribution" { tags = { Name = "website_distribution" } + default_root_object = "index.html" + custom_error_response { + error_code = "404" + response_code = "404" + response_page_path = "/error.html" + } + custom_error_response { + error_code = "403" + response_code = "403" + response_page_path = "/error.html" + } default_cache_behavior { - viewer_protocol_policy = "redirect-to-https" + viewer_protocol_policy = "https-only" compress = true allowed_methods = ["GET", "HEAD"] cached_methods = ["GET", "HEAD"] diff --git a/custom_header_lambda.zip b/custom_header_lambda.zip deleted file mode 100755 index 19a844d..0000000 Binary files a/custom_header_lambda.zip and /dev/null differ diff --git a/custom_header_lambda/rotate_custom_headers.py b/custom_header_lambda/rotate_custom_headers.py deleted file mode 100755 index ed5d683..0000000 --- a/custom_header_lambda/rotate_custom_headers.py +++ /dev/null @@ -1,53 +0,0 @@ -import boto3 -import json -import random -import string -import os - -def get_bucket_policy(client, bucket_name): - result = client.get_bucket_policy(Bucket=f"{bucket_name}") - result = json.loads(result['Policy']) - return result - -def update_bucket_policy(client, bucket_name, bucket_policy, value): - bucket_policy['Statement'][1]['Condition']['StringNotLike'] = {'aws:Referer': f'{value}'} - bucket_policy = json.dumps(bucket_policy) - client.put_bucket_policy(Bucket=bucket_name, Policy=bucket_policy) - print(bucket_policy) - -def random_pass(): - length = 20 - chars = string.ascii_letters + string.digits + '!@#$%^&*' - - rnd = random.SystemRandom() - password = ''.join(rnd.choice(chars) for i in range(length)) - return password - -def get_cloudfront_headers(client, value): - distro = client.get_distribution_config(Id=f'{os.environ['cf_dist_id']}') - distro['DistributionConfig']['Origins']['Items'][0]['CustomHeaders']['Items'] = [{'HeaderName': 'Referer', 'HeaderValue': f'{value}'}] - distro['DistributionConfig']['Origins']['Items'][1]['CustomHeaders']['Items'] = [{'HeaderName': 'Referer', 'HeaderValue': f'{value}'}] - return distro['DistributionConfig'], distro['ETag'] - - - - - -def lambda_handler(event, context): - s3 = boto3.client('s3') - bucket = os.environ['primary_bucket'] - backup_bucket = os.environ['backup_bucket'] - value = random_pass() - policy = get_bucket_policy(s3, bucket) - backup_policy = get_bucket_policy(s3, backup_bucket) - update_bucket_policy(s3, bucket, policy, value) - update_bucket_policy(s3, backup_bucket, backup_policy, value) - - cloudfront = boto3.client('cloudfront') - updated_distro = get_cloudfront_headers(cloudfront, value) - update_distro_request = updated_distro[0] - etag = updated_distro[1] - dist_id = cloudfront.list_distributions() - dist_id = dist_id['DistributionList']['Items'][0]['Id'] - print(update_distro_request) - cloudfront.update_distribution(DistributionConfig=update_distro_request, Id=dist_id, IfMatch=etag) \ No newline at end of file diff --git a/lambda_rotate_header.tf b/lambda_rotate_header.tf deleted file mode 100755 index 127aced..0000000 --- a/lambda_rotate_header.tf +++ /dev/null @@ -1,105 +0,0 @@ -data "archive_file" "custom_header_lambda_zip" { - type = "zip" - source_dir = "./custom_header_lambda" - output_path = "custom_header_lambda.zip" -} - -resource "aws_iam_role" "iam_for_custom_header_lambda" { - name = "rotate_custom_headers-assume-role-s3-static-website" - path = "/service-role/" - - assume_role_policy = <