Skip to content

Commit 2fc93dd

Browse files
Script47Script47
committed
fix(static-site): fix bugs and refactor
- Fix instance key issues - Ensure the certificate is created before being destroyed - Perform certificate validation only if the domains match those in Route 53 - Standardise and clean up naming conventions for consistency
1 parent 6104da8 commit 2fc93dd

6 files changed

Lines changed: 67 additions & 26 deletions

File tree

‎static-site/acm.tf‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,17 @@ resource "aws_acm_certificate" "cloudfront_cert" {
44
validation_method = "DNS"
55
tags = var.tags
66
provider = aws.acm
7+
8+
lifecycle {
9+
create_before_destroy = true
10+
}
711
}
812

913
resource "aws_acm_certificate_validation" "cloudfront_cert_validation" {
10-
certificate_arn = aws_acm_certificate.cloudfront_cert.arn
11-
validation_record_fqdns = [for record in aws_route53_record.acm_records : record.fqdn]
12-
provider = aws.acm
13-
}
14+
certificate_arn = aws_acm_certificate.cloudfront_cert.arn
15+
validation_record_fqdns = [
16+
for record in aws_route53_record.acm_records : record.fqdn
17+
if contains(local.internal_domains, record.fqdn)
18+
]
19+
provider = aws.acm
20+
}

‎static-site/cloudfront.tf‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
locals {
2-
origin_id = "S3-${aws_s3_bucket.static_site.bucket}"
2+
origin_id = "S3-${local.bucket_name}"
3+
origin_path = var.origin_path == "" ? "" : var.origin_path
4+
bucket_regional_domain_name = var.create_bucket ? aws_s3_bucket.static_site[0].bucket_regional_domain_name : data.aws_s3_bucket.user_created[0].bucket_regional_domain_name
5+
oac_name = replace("${local.bucket_name}-${replace(local.origin_path, "/", "-")}", "/[^a-zA-Z0-9-]/", "")
6+
rhp_name = local.primary_domain_normalised
37
}
48

59
resource "aws_cloudfront_distribution" "static_site" {
@@ -26,8 +30,8 @@ resource "aws_cloudfront_distribution" "static_site" {
2630
origin {
2731
origin_id = local.origin_id
2832
origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
29-
domain_name = aws_s3_bucket.static_site.bucket_regional_domain_name
30-
origin_path = var.origin_path != "" ? "/${var.origin_path}" : ""
33+
domain_name = local.bucket_regional_domain_name
34+
origin_path = local.origin_path
3135
}
3236

3337
default_cache_behavior {
@@ -68,16 +72,16 @@ resource "aws_cloudfront_distribution" "static_site" {
6872
}
6973

7074
resource "aws_cloudfront_origin_access_control" "oac" {
71-
name = "oac-for-${aws_s3_bucket.static_site.bucket}"
72-
description = "OAC for ${aws_s3_bucket.static_site.bucket}"
75+
name = local.oac_name
76+
description = "OAC for ${local.bucket_name}"
7377
origin_access_control_origin_type = "s3"
7478
signing_behavior = "always"
7579
signing_protocol = "sigv4"
7680
provider = aws.default
7781
}
7882

7983
resource "aws_cloudfront_response_headers_policy" "cloudfront" {
80-
name = "cf-resp-hdrs-${local.primary_domain_normalised}"
84+
name = local.rhp_name
8185
comment = "Response headers policy for ${local.primary_domain}"
8286

8387
cors_config {

‎static-site/data.tf‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
locals {
2+
custom_prefix = startswith(local.origin_path, "/") ? substr(local.origin_path, 1, length(local.origin_path)) : local.origin_path
3+
bucket_prefix = local.origin_path == "" ? "*" : "${local.custom_prefix}/*"
4+
}
15
data "aws_caller_identity" "current" {}
26

37
data "aws_route53_zone" "hosted_zone" {
@@ -6,11 +10,16 @@ data "aws_route53_zone" "hosted_zone" {
610
private_zone = false
711
}
812

13+
data "aws_s3_bucket" "user_created" {
14+
count = !var.create_bucket ? 1 : 0
15+
bucket = var.bucket_name
16+
}
17+
918
data "aws_iam_policy_document" "cloudfront_to_s3" {
1019
statement {
1120
sid = "AllowCloudFrontToAccessBucket"
1221
actions = ["s3:GetObject"]
13-
resources = ["${aws_s3_bucket.static_site.arn}/*"]
22+
resources = ["${local.bucket_arn}/${local.bucket_prefix}"]
1423

1524
principals {
1625
type = "Service"
@@ -29,4 +38,4 @@ data "aws_iam_policy_document" "cloudfront_to_s3" {
2938
values = [data.aws_caller_identity.current.account_id]
3039
}
3140
}
32-
}
41+
}

‎static-site/locals.tf‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,14 @@
11
locals {
2+
create_hosted_zone = var.hosted_zone == ""
3+
hosted_zone_domain = local.create_hosted_zone ? local.primary_domain : data.aws_route53_zone.hosted_zone[0].name
24
domains = distinct(var.domains)
35
primary_domain = local.domains[0]
4-
5-
primary_domain_normalised = replace(local.primary_domain, ".", "-")
6-
7-
create_hosted_zone = var.hosted_zone == ""
6+
primary_domain_normalised = replace(replace(local.primary_domain, ".", "-"), "/[^a-zA-Z0-9-]/", "")
7+
internal_domains = [
8+
for d in local.domains : d
9+
if endswith(d, local.hosted_zone_domain)
10+
]
811

912
bucket_name = var.bucket_name == "" ? local.primary_domain : var.bucket_name
13+
bucket_arn = var.create_bucket ? aws_s3_bucket.static_site[0].arn : data.aws_s3_bucket.user_created[0].arn
1014
}

‎static-site/outputs.tf‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
output "bucket" {
22
value = {
3-
arn = aws_s3_bucket.static_site.arn
4-
id = aws_s3_bucket.static_site.id
3+
arn = var.create_bucket ? aws_s3_bucket.static_site[0].arn : data.aws_s3_bucket.user_created[0].arn
4+
id = local.bucket_name
55
}
66
}
77

@@ -13,3 +13,15 @@ output "cloudfront" {
1313
aliases = aws_cloudfront_distribution.static_site.aliases
1414
}
1515
}
16+
17+
output "external_validation_records" {
18+
value = {
19+
for dvo in aws_acm_certificate.cloudfront_cert.domain_validation_options :
20+
dvo.domain_name => {
21+
name = dvo.resource_record_name
22+
value = dvo.resource_record_value
23+
type = dvo.resource_record_type
24+
}
25+
if !contains(local.internal_domains, dvo.domain_name)
26+
}
27+
}

‎static-site/route53.tf‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,20 +9,23 @@ resource "aws_route53_zone" "hosted_zone" {
99
#############################################
1010
resource "aws_route53_record" "acm_records" {
1111
for_each = {
12-
for dvo in aws_acm_certificate.cloudfront_cert.domain_validation_options : dvo.domain_name => {
12+
for dvo in aws_acm_certificate.cloudfront_cert.domain_validation_options :
13+
dvo.domain_name => {
1314
name = dvo.resource_record_name
1415
record = dvo.resource_record_value
1516
type = dvo.resource_record_type
1617
}
1718
}
1819

19-
zone_id = local.create_hosted_zone ? aws_route53_zone.hosted_zone[0].zone_id : data.aws_route53_zone.hosted_zone[0].zone_id
20-
type = each.value.type
21-
name = each.value.name
22-
records = [each.value.record]
23-
ttl = 60
20+
zone_id = try(aws_route53_zone.hosted_zone[0].zone_id, data.aws_route53_zone.hosted_zone[0].zone_id)
21+
type = each.value.type
22+
name = each.value.name
23+
records = [each.value.record]
24+
ttl = 60
25+
2426
allow_overwrite = true
25-
provider = aws.default
27+
28+
provider = aws.default
2629
}
2730

2831
#############################################
@@ -31,7 +34,7 @@ resource "aws_route53_record" "acm_records" {
3134
resource "aws_route53_record" "static_site_a_record" {
3235
count = length(local.domains)
3336

34-
zone_id = local.create_hosted_zone ? aws_route53_zone.hosted_zone[0].zone_id : data.aws_route53_zone.hosted_zone[0].zone_id
37+
zone_id = try(aws_route53_zone.hosted_zone[0].zone_id, data.aws_route53_zone.hosted_zone[0].zone_id)
3538
type = "A"
3639
name = local.domains[count.index]
3740

@@ -41,5 +44,7 @@ resource "aws_route53_record" "static_site_a_record" {
4144
evaluate_target_health = false
4245
}
4346

47+
allow_overwrite = true
48+
4449
provider = aws.default
4550
}

0 commit comments

Comments
 (0)