🎉 initial commit

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.terraform/

Dockerfile

@@ -0,0 +1,25 @@
+FROM node:8.10
+
+###
+# Set up the working directory
+#
+ENV CODES_DIR /codes
+RUN mkdir -p "${CODES_DIR}"
+WORKDIR "${CODES_DIR}"
+
+###
+# Install dependencies
+#
+COPY package.json .
+COPY yarn.lock .
+RUN yarn
+
+###
+# Install codes
+#
+COPY . .
+
+###
+# What we need is.. bash!
+#
+CMD [ "bash" ]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Naoto Yokoyama
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,13 @@
+# aws-lambda-edge-basic-auth-terraform
+
+This is a [Terraform](https://www.terraform.io/) module that creates [AWS Lambda@Edge](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html) resources to protect [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) distributions with [BASIC Authentication](https://en.wikipedia.org/wiki/Basic_access_authentication).
+
+The purpose of this module is to make it no-brainer to set up AWS resources required to perform BASIC Authentication with AWS Lambda@Edge. If you don't want to take care of tedious jobs such as IAM role setup, this is a right module to go with.
+
+The actual code to perform BASIC Authentication is derived from [lmakarov/lambda-basic-auth.js](https://gist.github.com/lmakarov/e5984ec16a76548ff2b278c06027f1a4#file-lambda-basic-auth-js).
+
+## License
+
+Copyright © 2019 Naoto Yokoyama
+
+Distributed under the MIT license. See the [LICENSE](./LICENSE) file for full details.

build.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+#
+# Builds codes and creates a zip file for the lambda@edge function.
+#
+# Usage:
+#   ./build.sh
+#
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o xtrace
+
+__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+docker-compose run --rm dev npm run build

clean.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+#
+# Deletes the generated zip file for the lambda@edge function.
+#
+# Usage:
+#   ./clean.sh
+#
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o xtrace
+
+__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+docker-compose run --rm dev npm run clean

docker-compose.yml

@@ -0,0 +1,7 @@
+version: '3'
+services:
+  dev:
+    build: .
+    volumes:
+      - .:/codes/
+      - /codes/node_modules

gulpfile.js

@@ -0,0 +1,31 @@
+const { src, dest } = require('gulp')
+const babel = require('gulp-babel')
+const concat = require('gulp-concat')
+const uglify = require('gulp-uglify')
+const zip = require('gulp-zip')
+const rimraf = require('rimraf')
+
+const ZIP_FILENAME = 'lambda-edge-basic-auth-function.zip'
+const ZIP_DIR = 'module/functions'
+
+function build() {
+  return src('src/**/*.js')
+    .pipe(babel({
+      presets: [ '@babel/env' ]
+    }))
+    .pipe(concat('basic-auth.js'))
+    .pipe(uglify())
+    .pipe(zip(ZIP_FILENAME))
+    .pipe(dest(ZIP_DIR))
+}
+
+function clean(cb) {
+  return rimraf(`${ZIP_DIR}/${ZIP_FILENAME}`, cb)
+}
+
+function defaultTask() {
+  return build()
+}
+
+exports.clean = clean
+exports.default = defaultTask

module/main.tf

@@ -0,0 +1,79 @@
+###
+# IAM Roles
+#
+
+# We have to create and use an IAM role that can be assumed by the two service principals -
+# lambda.amazonaws.com and edgelambda.amazonaws.com.
+# See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html
+resource "aws_iam_role" "lambda" {
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": [
+          "lambda.amazonaws.com",
+          "edgelambda.amazonaws.com"
+        ]
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}
+EOF
+}
+
+###
+# IAM Role Policies
+#
+
+resource "aws_iam_role_policy" "lambda" {
+  role = "${aws_iam_role.lambda}"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "arn:aws:logs:*:*:*"
+    }
+  ]
+}
+EOF
+}
+
+###
+# Lambda functions
+#
+
+resource "aws_lambda_function" "basic_auth" {
+  filename = "${path.module}/functions/lambda-edge-basic-auth-function.zip"
+  function_name = "${var.function_name}"
+  role = "${aws_iam_role.lambda}"
+  handler = "basic-auth.handler"
+  source_code_hash = "${base64sha256(file("${path.module}/functions/lambda-edge-basic-auth-function.zip"))}"
+  runtime = "nodejs8.10"
+  description = "Protect CloudFront distributions with Basic Authentication"
+}
+
+###
+# Secrets
+#
+
+resource "aws_secretsmanager_secret" "basic_auth_credentials" {
+  name_prefix = "lambda-edge-basic-auth-"
+  description = "Secrets for Basic Authentication used by Lambda@Edge"
+}
+
+resource "aws_secretsmanager_secret_version" "basic_auth_credentials" {
+  secret_id = "${aws_secretsmanager_secret.basic_auth_credentials.id}"
+  secret_string = "${jsonencode(var.basic_auth_credentials)}"
+}

module/variables.tf

@@ -0,0 +1,10 @@
+variable "function_name" {
+  type = "string"
+  default = "basicAuth"
+  description = "Lambda function name"
+}
+
+variable "basic_auth_credentials" {
+  type = "map"
+  description = "Credentials for Basic Authentication. Pass a map composed of 'user' and 'password'."
+}

package.json

@@ -0,0 +1,31 @@
+{
+  "name": "aws-lambda-edge-basic-auth-terraform",
+  "version": "0.0.0",
+  "description": "A Terraform module that creates AWS Lambda@Edge resources to perform BASIC Authentication",
+  "scripts": {
+    "build": "npx gulp",
+    "clean": "npx gulp clean",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/builtinnya/aws-lambda-edge-basic-auth-terraform.git"
+  },
+  "author": "Naoto Yokoyama <builtinnya@gmail.com>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/builtinnya/aws-lambda-edge-basic-auth-terraform/issues"
+  },
+  "homepage": "https://github.com/builtinnya/aws-lambda-edge-basic-auth-terraform#readme",
+  "devDependencies": {
+    "@babel/core": "^7.2.2",
+    "@babel/preset-env": "^7.3.1",
+    "gulp": "^4.0.0",
+    "gulp-babel": "^8.0.0",
+    "gulp-cli": "^2.0.1",
+    "gulp-concat": "^2.6.1",
+    "gulp-uglify": "^3.0.1",
+    "gulp-zip": "^4.2.0",
+    "rimraf": "^2.6.3"
+  }
+}

src/basic-auth.js

@@ -0,0 +1,36 @@
+'use strict'
+
+exports.handler = (event, context, callback) => {
+  const request = event.Records[0].cf.request
+  const headers = request.headers
+
+  const authUser = 'user'
+  const authPass = 'pass'
+
+  const encodedCredentials = new Buffer(`${authUser}:${authPass}`).toString('base64')
+  const authString = `Basic ${encodedCredentials}`
+
+  if (
+    typeof headers.authorization == 'undefined' ||
+    headers.authorization[0].value != authString
+  ) {
+    const response = {
+      status: '401',
+      statusDescription: 'Unauthorized',
+      body: 'Unauthorized',
+      headers: {
+        'www-authenticate': [
+          {
+            key: 'WWW-Authenticate',
+            value:'Basic',
+          }
+        ]
+      },
+    }
+
+    callback(null, response)
+  }
+
+  // Continue request processing if authentication passed
+  callback(null, request)
+}