feat: add CloudFront

.github/workflows/deploy.yml

@@ -8,6 +8,9 @@ on:
 
 env:
   AWS_REGION: eu-west-3
+  ORIGIN_BUCKET_NAME: twitch-live-17102024-my-web-site-origin
+  ROLE_ARN: arn:aws:iam::448878779811:role/twitch-live-17102024-my-web-site
+  ROLE_SESSON_NAME: github-ipppontech-my-web-site-to-aws-via-oidc
 
 # Permission can be added at job level or workflow level
 permissions:
@@ -24,8 +27,31 @@ jobs:
       - uses: actions/checkout@v4
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::448878779811:role/twitch-live-1710204-my-web-site
-          role-session-name: github-ipppontech-my-web-site-to-aws-via-oidc
+          role-to-assume: ${{ env.ROLE_ARN }}
+          role-session-name: ${{ env.ROLE_SESSION_NAME }}
+          aws-region: ${{ env.AWS_REGION }}
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "1.9.7"
+          terraform_wrapper: false
+      - run: terraform fmt -check -recursive
+      - run: terraform init -backend=false
+      - run: terraform validate
+      - run: terraform init
+      - run: terraform plan -out=tfplan.out
+      - run: terraform apply -input=false tfplan.out
+
+  terraform-20-cloudfront:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: infrastructure/20_cloudfront
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ env.ROLE_ARN }}
+          role-session-name: ${{ env.ROLE_SESSION_NAME }}
           aws-region: ${{ env.AWS_REGION }}
       - uses: hashicorp/setup-terraform@v3
         with:
@@ -41,16 +67,41 @@ jobs:
   build:
     needs:
       - terraform-10-boostrap
+      - terraform-20-cloudfront
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ env.ROLE_ARN }}
+          role-session-name: ${{ env.ROLE_SESSION_NAME }}
+          aws-region: ${{ env.AWS_REGION }}
       - name: Use Node.js LTS
         uses: actions/setup-node@v4
         with:
           cache: 'npm'
           node-version: 'lts/*'
           registry-url: 'https://registry.npmjs.org'
+      - uses: unfor19/install-aws-cli-action@v1
+        with:
+          version: 2
+          verbose: false
       - name: build
         run: |
           npm ci
           npm run build
+      - name: clean S3 origin bucket
+        run: |
+          objects_number=$(aws s3 ls s3://twitch-live-17102024-my-web-site-origin/ --recursive | wc -l)
+          if [ "$objects_number" -gt "0" ]; then
+            aws s3api delete-objects \
+              --bucket ${{ env.ORIGIN_BUCKET_NAME }} \
+              --delete "$(aws s3api list-object-versions \
+              --bucket ${{ env.ORIGIN_BUCKET_NAME }} \
+              --output=json \
+              --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}')";
+          fi
+
+      - name: copy dist folder to S3
+        run: |
+          aws s3 cp --recursive dist s3://${{ env.ORIGIN_BUCKET_NAME }}/

.gitignore

@@ -12,3 +12,27 @@
 !.vscode/launch.json
 !.vscode/extensions.json
 *.code-workspace
+
+######################
+# Terraform
+######################
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# tf plan files
+**.tfplan
+**.plan.json
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+~
+# ignore temp doc file
+doc.md
+
+# ignore zip files generated with data_archive
+*.zip

infrastructure/10_bootstrap/github_oidc.tf

@@ -1,10 +1,5 @@
 locals {
-  role_name = "twitch-live-1710204-my-web-site"
-}
-
-import {
-  to = aws_iam_openid_connect_provider.github
-  id = "arn:aws:iam::448878779811:oidc-provider/token.actions.githubusercontent.com"
+  role_name = "twitch-live-17102024-my-web-site"
 }
 
 resource "aws_iam_openid_connect_provider" "github" {
@@ -17,11 +12,6 @@ resource "aws_iam_openid_connect_provider" "github" {
   thumbprint_list = ["d89e3bd43d5d909b47a18977aa9d5ce36cee184c"]
 }
 
-import {
-  to = aws_iam_role.twitch_live
-  id = local.role_name
-}
-
 resource "aws_iam_role" "twitch_live" {
   name               = local.role_name
   description        = "Role dedicated to deploy infrastructure during the Twitch Live on October 17th 2024 with Arnaud and Timothee"
@@ -62,6 +52,11 @@ resource "aws_iam_role_policy_attachment" "cloudfront" {
   policy_arn = "arn:aws:iam::aws:policy/CloudFrontFullAccess"
 }
 
+resource "aws_iam_role_policy_attachment" "acm" {
+  role       = aws_iam_role.twitch_live.name
+  policy_arn = "arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess"
+}
+
 resource "aws_iam_role_policy" "twitch_live_runner" {
   name   = "${local.role_name}-runner"
   role   = aws_iam_role.twitch_live.id
@@ -102,7 +97,28 @@ data "aws_iam_policy_document" "twitch_live_runner" {
       "iam:*"
     ]
     resources = [
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/twitch-live-1710204-my-web-site"
+      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/twitch-live-17102024-my-web-site"
+    ]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "route53:ListHostedZones",
+    ]
+    resources = [
+      "*"
+    ]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "route53:GetHostedZone",
+      "route53:ChangeResourceRecordSets",
+      "route53:ListResourceRecordSets",
+      "route53:ListTagsForResource",
+    ]
+    resources = [
+      "arn:aws:route53:::hostedzone/Z0612444205RFX4C90XIM"
     ]
   }
 }

infrastructure/20_cloudfront/backend.tf

@@ -0,0 +1,10 @@
+# Note: at the moment, it's not possible to use variables in Terraform backend
+terraform {
+  backend "s3" {
+    bucket         = "twitch-live-17102024-tf-states"
+    key            = "20_cloudfront/terraform.tfstate"
+    region         = "eu-west-3"
+    dynamodb_table = "twitch-live-17102024-tf-states-lock"
+    encrypt        = true
+  }
+}

infrastructure/20_cloudfront/certificate.tf

@@ -0,0 +1,38 @@
+resource "aws_acm_certificate" "cert" {
+  domain_name       = local.my_domain
+  validation_method = "DNS"
+
+  tags = {
+    Environment = "my-web-site"
+  }
+
+  lifecycle {
+    create_before_destroy = true
+    prevent_destroy       = true
+  }
+
+  provider = aws.us
+}
+
+resource "aws_acm_certificate_validation" "cert" {
+  certificate_arn         = aws_acm_certificate.cert.arn
+  validation_record_fqdns = [for record in aws_route53_record.record_validation : record.fqdn]
+  provider                = aws.us
+}
+
+resource "aws_route53_record" "record_validation" {
+  for_each = {
+    for dvo in aws_acm_certificate.cert.domain_validation_options : dvo.domain_name => {
+      name   = dvo.resource_record_name
+      record = dvo.resource_record_value
+      type   = dvo.resource_record_type
+    }
+  }
+
+  allow_overwrite = true
+  name            = each.value.name
+  records         = [each.value.record]
+  ttl             = 60
+  type            = each.value.type
+  zone_id         = data.aws_route53_zone.ippon.zone_id
+}

infrastructure/20_cloudfront/cloudfront.tf

@@ -0,0 +1,76 @@
+locals {
+  origin_id = "s3_oac"
+  my_domain = "my-web-site.${data.aws_route53_zone.ippon.name}"
+}
+
+module "cdn" {
+  source  = "terraform-aws-modules/cloudfront/aws"
+  version = "3.4.1"
+
+  comment             = "My awesome CloudFront"
+  enabled             = true
+  is_ipv6_enabled     = true
+  price_class         = "PriceClass_All"
+  retain_on_delete    = false
+  wait_for_deployment = true
+  default_root_object = "index.html"
+
+  create_origin_access_identity = true
+
+  create_origin_access_control = true
+  origin_access_control = {
+    (local.origin_id) = {
+      description      = "CloudFront access to S3"
+      origin_type      = "s3"
+      signing_behavior = "always"
+      signing_protocol = "sigv4"
+    }
+  }
+
+  origin = {
+    (local.origin_id) = {
+      domain_name           = module.s3_bucket.s3_bucket_bucket_domain_name
+      origin_access_control = local.origin_id # key in `origin_access_control`
+    }
+  }
+
+  default_cache_behavior = {
+    target_origin_id       = local.origin_id
+    viewer_protocol_policy = "redirect-to-https"
+  }
+
+  aliases = [
+    local.my_domain
+  ]
+
+  viewer_certificate = {
+    cloudfront_default_certificate = false
+    acm_certificate_arn            = aws_acm_certificate.cert.arn
+    ssl_support_method             = "sni-only"
+    minimum_protocol_version       = "TLSv1.2_2021"
+  }
+
+  logging_config = {
+    bucket = module.cloudfront_log_bucket.s3_bucket_bucket_domain_name
+  }
+
+  providers = {
+    aws = aws.us
+  }
+}
+
+data "aws_route53_zone" "ippon" {
+  name = "sbx.aws.ippon.fr"
+}
+
+resource "aws_route53_record" "cloudfront" {
+  zone_id = data.aws_route53_zone.ippon.zone_id
+  name    = local.my_domain
+  type    = "A"
+
+  alias {
+    name                   = module.cdn.cloudfront_distribution_domain_name
+    zone_id                = module.cdn.cloudfront_distribution_hosted_zone_id
+    evaluate_target_health = true
+  }
+}

infrastructure/20_cloudfront/cloudfront_logs.tf

@@ -0,0 +1,28 @@
+data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}
+data "aws_canonical_user_id" "current" {}
+
+module "cloudfront_log_bucket" {
+  source  = "terraform-aws-modules/s3-bucket/aws"
+  version = "4.2.1"
+
+  bucket                   = "${local.origin_bucket_name}-cloudfront-logs"
+  control_object_ownership = true
+  object_ownership         = "ObjectWriter"
+
+  grant = [{
+    type       = "CanonicalUser"
+    permission = "FULL_CONTROL"
+    id         = data.aws_canonical_user_id.current.id
+    }, {
+    type       = "CanonicalUser"
+    permission = "FULL_CONTROL"
+    id         = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
+    }
+  ]
+
+  owner = {
+    id = data.aws_canonical_user_id.current.id
+  }
+
+  force_destroy = true
+}

infrastructure/20_cloudfront/data.tf

@@ -0,0 +1 @@
+data "aws_caller_identity" "current" {}