aws-cloudfront-s3
| Reference Documentation: | https://docs.aws.amazon.com/solutions/latest/constructs/ |
| Language | Package |
|---|---|
|
|
|
|
|
|
|
|
|
Overview
This AWS Solutions Construct provisions an Amazon CloudFront Distribution that serves objects from an AWS S3 Bucket via an Origin Access Control (OAC).
Here is a minimal deployable pattern definition:
Example
Pattern Construct Props
| Name | Type | Description |
|---|---|---|
|
cloudFrontDistributionProps? |
Optional user provided props to override the default props for CloudFront Distribution |
|
|
insertHttpSecurityHeaders? |
|
Optional user provided props to turn on/off the automatic injection of best practice HTTP security headers in all responses from CloudFront |
|
responseHeadersPolicyProps? |
Optional user provided configuration that cloudfront applies to all http responses. |
|
|
originPath? |
|
Optional user provided props to provide
anhttps://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront_origins.S3OriginProps.html#originpath[originPath]
that CloudFront appends to the origin domain name when CloudFront
requests content from the origin. The string should start with a |
|
existingBucketObj? |
Optional - existing instance of S3 Bucket. If this is provided, then also providing bucketProps will cause an error. |
|
|
bucketProps? |
Optional user provided props to override the default props for the S3 Content Bucket, providing both this and |
|
|
logS3AccessLogs? |
boolean |
Whether to turn on Access Logging for the S3 bucket. Creates an S3 bucket with associated storage costs for the logs. Enabling Access Logging is a best practice. default - true |
|
loggingBucketProps? |
Optional user provided props to override the default props for the S3 Logging Bucket. |
|
|
cloudFrontLoggingBucketProps? |
Optional user provided props to override the default props for the CloudFront Logging Bucket. Note: to use an existing bucketto hold CloudFront logs, pass the existing log bucket in |
|
|
logCloudFrontAccessLog |
|
Optional - Whether to maintain access logs for the CloudFront Logging bucket. Specifying false for this while providing info about the log bucket will cause an error. Default = true |
|
cloudFrontLoggingBucketAccessLogBucketProps |
Optional user provided props to override the default props for the
CloudFront Log Bucket Access Log bucket. Providing both this and
|
Pattern Properties
| Name | Type | Description |
|---|---|---|
|
cloudFrontWebDistribution |
Returns an instance of cloudfront.Distribution created by the construct. |
|
|
cloudFrontFunction? |
Returns an instance of the Cloudfront function created by the construct. |
|
|
originAccessControl? |
Returns an instance of cloudfront.CfnOriginAccessControl created by the construct. |
|
|
s3BucketInterface |
Returns an instance of s3.IBucket created by the construct. |
|
|
s3Bucket? |
Returns an instance of s3.Bucket created by the construct. IMPORTANT:
If |
|
|
s3LoggingBucket? |
Returns an instance of s3.Bucket created by the construct as the logging bucket for the primary bucket. |
|
|
cloudFrontLoggingBucket? |
The S3 bucket created by the construct to hold CloudFront logs. Only populated if the construct creates the bucket (not if an existing bucket is passed in via DistributionProps) |
|
|
cloudFrontLoggingBucketAccessLogBucket? |
The S3 bucket containing the S3 access logs for the CloudFront log
bucket. Only populated if the construct creates the bucket (not if the
bucket is passed in via
|
Default settings
Out of the box implementation of the Construct without any override will set the following defaults:
Amazon CloudFront
-
Configure Access logging for CloudFront Distribution
-
Enable automatic injection of best practice HTTP security headers in all responses from CloudFront Distribution
-
CloudFront originPath set to
'/' -
Create an Origin Access Control to access S3 bucket
-
The construct will assign the origin created by the construct to any
DistributionProps.additionalBehaviorsprovided that do not have an origin specified.
Amazon S3 Bucket
-
Configure Access logging for S3 Bucket
-
Enable server-side encryption for S3 Bucket using AWS managed KMS Key
-
Enforce encryption of data in transit
-
Turn on the versioning for S3 Bucket
-
Don’t allow public access for S3 Bucket
-
Retain the S3 Bucket when deleting the CloudFormation stack
-
Applies Lifecycle rule to move noncurrent object versions to Glacier storage after 90 days
Architecture
Github
Go to the Github repo