Skip to content

InterweaveCloud/terraform-aws-s3-cloudfront-static-website

Repository files navigation

AWS S3 CloudFront Static Website Terraform Module

This module provisions the infrasructure required for a static website hosted on AWS S3 and CloudFront and optionally allows syncronisation of the website content with a local directory.

Key Features

  • S3 Bucket to store website content.
  • CloudFront Distribution to serve the website at edge locations at a low cost and high performance.
  • Route 53 A records to utilise custom domain on website.
  • Security First - S3 Bucket is private with IAM policies to provide permissions to CloudFront.
  • Utilises aws S3 sync command to upload website content to S3 Bucket.

image

Pre-quisites

For syncronisation of the website content with a local directory, the following is required:

Usage

Example available here

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "4.10.0"
    }
  }
}

# Default provider for resource creation
provider "aws" {
  region  = ""
  profile = ""
}

# Provider required in useast1 for cloudfront, SSLM Certificate
provider "aws" {
  alias   = "useast1"
  region  = "us-east-1"
  profile = ""
}

module "website" {
  
  source = "XXX"

  resource_uid   = "DevOpsNavy"
  domain_name    = "XXX"
  hosted_zone_id = "XXX"
  profile        = "XXX"

  sync_directories = [{
    local_source_directory = "./website_content"
    s3_target_directory    = ""
  }]

  providers = {
    aws.useast1 = aws.useast1
  }
}

Requirements

Name Version
aws 4.10.0

Providers

Name Version
aws 4.10.0
aws.useast1 4.10.0

Modules

No modules.

Resources

Name Type
aws_acm_certificate.ssl_certificate resource
aws_acm_certificate_validation.ssl_certificate_validation resource
aws_cloudfront_distribution.s3_distribution resource
aws_cloudfront_origin_access_identity.cloudfront_oai resource
aws_route53_record.cert_validation resource
aws_route53_record.root-a resource
aws_route53_record.www-a resource
aws_s3_bucket.website_files resource
aws_s3_bucket_acl.website_files resource
aws_s3_bucket_policy.website_files resource
aws_s3_bucket_versioning.website_files resource
null_resource.sync_remote_website_content resource
archive_file.website_content_zip data source
aws_caller_identity.current data source

Inputs

Name Description Type Default Required
Application Environment to tag all resources created by this module string "S3 Static Website" no
Environment Environment to tag all resources created by this module string "Automation" no
bucket_versioning Enable bucket versioning bool false no
cloudfront_geo_restriction_locations The ISO 3166-1-alpha-2 codes for which you want CloudFront either to distribute your content (whitelist) or not distribute your content (blacklist). list(string) [] no
cloudfront_geo_restriction_type The method that you want to use to restrict distribution of your content by country: none, whitelist, or blacklist. string "none" no
cloudfront_minimum_protocol_version The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. string "TLSv1.1_2016" no
cloudfront_price_class The price class for this distribution. One of PriceClass_All, PriceClass_200, PriceClass_100 string "PriceClass_200" no
cloudfront_ssl_support_method Specifies how you want CloudFront to serve HTTPS requests. One of vip or sni-only. string "sni-only" no
default_cache_allowed_methods Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin. list(string)
[
"GET",
"HEAD",
"OPTIONS",
"PUT",
"POST",
"PATCH",
"DELETE"
]
no
default_cache_default_ttl The default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an Cache-Control max-age or Expires header. number 3600 no
default_cache_forward_query_string Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior. bool false no
default_cache_max_ttl The maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of Cache-Control max-age, Cache-Control s-maxage, and Expires headers number 86400 no
default_cache_methods Controls whether CloudFront caches the response to requests using the specified HTTP methods. list(string)
[
"GET",
"HEAD",
"OPTIONS"
]
no
default_cache_min_ttl The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. number 0 no
default_cache_viewer_protocol_policy Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of allow-all, https-only, or redirect-to-https. string "redirect-to-https" no
default_root_object The object that you want CloudFront to return (for example, index.html) when an end user requests the root URL. string "index.html" no
domain_name The domain name for the website. string n/a yes
enable_cloudfront_distribution Whether the distribution is enabled to accept end user requests for content. bool true no
hosted_zone_id The Hosted Zone ID. This is automatically generated and can be referenced by zone records. string n/a yes
profile Credentials profile to use for aws s3 sync command string n/a yes
resource_uid UID which will be prepended to resources created by this module string n/a yes
sync_directories Directories to sync with S3
list(object({
local_source_directory = string
s3_target_directory = string
}))
[] no

Outputs

Name Description
acm_certificate_arn The ARN of the certificate
acm_certificate_domain_name The domain name for which the certificate is issued
acm_certificate_status Status of the certificate.
acm_certificate_validation_id The time at which the certificate was issued
cloudfront_distribution_arn The ARN (Amazon Resource Name) for the distribution. For example: arn:aws:cloudfront::123456789012:distribution/EDFDVBD632BHDS5, where 123456789012 is your AWS account ID.
cloudfront_distribution_caller_reference Internal value used by CloudFront to allow future updates to the distribution configuration.
cloudfront_distribution_domain_name The domain name corresponding to the distribution. For example: d604721fxaaqy9.cloudfront.net.
cloudfront_distribution_etag The current version of the distribution's information. For example: E2QWRUHAPOMQZL.
cloudfront_distribution_hosted_zone_id The CloudFront Route 53 zone ID that can be used to route an Alias Resource Record Set to. This attribute is simply an alias for the zone ID Z2FDTNDATAQYW2.
cloudfront_distribution_id The identifier for the distribution. For example: EDFDVBD632BHDS5.
cloudfront_distribution_in_progress_validation_batches The number of invalidation batches currently in progress.
cloudfront_distribution_last_modified_time The date and time the distribution was last modified.
cloudfront_distribution_status The current status of the distribution. Deployed if the distribution's information is fully propagated throughout the Amazon CloudFront system.
cloudfront_distribution_tags_all A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
cloudfront_distribution_trusted_key_groups List of nested attributes for active trusted key groups, if the distribution is set up to serve private content with signed URLs
cloudfront_distribution_trusted_signers List of nested attributes for active trusted signers, if the distribution is set up to serve private content with signed URLs
cloudfront_origin_access_identity_caller_reference Internal value used by CloudFront to allow future updates to the origin access identity.
cloudfront_origin_access_identity_cloudfront_access_identity_path A shortcut to the full path for the origin access identity to use in CloudFront, see below.
cloudfront_origin_access_identity_etag The current version of the origin access identity's information. For example: E2QWRUHAPOMQZL.
cloudfront_origin_access_identity_iam_arn A pre-generated ARN for use in S3 bucket policies (see below). Example: arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity E2QWRUHAPOMQZL.
cloudfront_origin_access_identity_id The identifier for the distribution. For example: EDFDVBD632BHDS5.
cloudfront_origin_access_identity_s3_canonical_user_id The Amazon S3 canonical user ID for the origin access identity, which you use when giving the origin access identity read permission to an object in Amazon S3.
route53_acm_certificate_validation_records Route 53 validation records for the ACM certificate.
route53_root_a_record_name The name of the root A record.
route53_root_www_record_name The name of the www A record.
s3_bucket_access_policy Bucket policy to allow CloudFront to access the S3 bucket.
s3_bucket_access_policy_json JSON bucket policy to allow CloudFront to access the S3 bucket.
s3_bucket_acl The ACL of the bucket.
s3_bucket_arn The ARN of the bucket. Will be of format arn:aws:s3:::bucketname.
s3_bucket_id The name of the bucket.
s3_bucket_region The AWS region this bucket resides in.
s3_bucket_versioning The bucket versioning status.

Bug Reports & Feature Requests Please use the issue tracker to report any bugs or file feature requests.

Developing If you are interested in being a contributor and want to get involved in developing this project or help out with our other projects, we would love to hear from you! Shoot us an email.

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

Fork the repo on GitHub Clone the project to your own machine Commit changes to your own branch Push your work back up to your fork Submit a Pull Request so that we can review your changes NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

To Do

To dos are documented in the project associated with this repo.

Contributing

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Developing

If you are interested in being a contributor and want to get involved in developing this project or with our other projects, we would love to hear from you! Shoot us an [email][Admin@devopsnavy.co.uk].

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

  1. Fork the repo on GitHub
  2. Clone the project to your own machine
  3. Commit changes to your own branch
  4. Push your work back up to your fork
  5. Submit a Pull Request so that we can review your changes

NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

Contributors

Name Role
Faizan Raza Lead Developer
Vic Hassan Developer

Resources Used

Terraform Docs used for generating documentation.