Skip to content

Commit 189a05e

Browse files
biffgautbiffgaut
authored
Merge branch 'main' into conflict-290
2 parents ae14e40 + fd753f1 commit 189a05e

File tree

35 files changed

+387
-1779
lines changed

35 files changed

+387
-1779
lines changed

‎source/patterns/@aws-solutions-constructs/aws-cloudfront-apigateway-lambda/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ _Parameters_
6666
| **Name** | **Type** | **Description** |
6767
|:-------------|:----------------|-----------------|
6868
|cloudFrontWebDistribution|[`cloudfront.CloudFrontWebDistribution`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.CloudFrontWebDistribution.html)|Returns an instance of cloudfront.CloudFrontWebDistribution created by the construct|
69-
|edgeLambdaFunctionVersion|[`lambda.Version`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-lambda.Version.html)|Returns an instance of the edge Lambda function version created by the pattern.|
69+
|cloudFrontFunction?|[`cloudfront.Function`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.Function.html)|Returns an instance of the Cloudfront function created by the pattern.|
7070
|cloudFrontLoggingBucket|[`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-s3-readme.html)|Returns an instance of the logging bucket for CloudFront WebDistribution.|
7171
|apiGateway|[`api.RestApi`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-apigateway.RestApi.html)|Returns an instance of the API Gateway REST API created by the pattern.|
7272
|apiGatewayCloudWatchRole|[`iam.Role`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.Role.html)|Returns an instance of the iam.Role created by the construct for API Gateway for CloudWatch access.|

‎source/patterns/@aws-solutions-constructs/aws-cloudfront-apigateway-lambda/lib/index.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ export interface CloudFrontToApiGatewayToLambdaProps {
6666

6767
export class CloudFrontToApiGatewayToLambda extends Construct {
6868
public readonly cloudFrontWebDistribution: cloudfront.Distribution;
69-
public readonly edgeLambdaFunctionVersion?: lambda.Version;
69+
public readonly cloudFrontFunction?: cloudfront.Function;
7070
public readonly cloudFrontLoggingBucket?: s3.Bucket;
7171
public readonly apiGateway: api.RestApi;
7272
public readonly apiGatewayCloudWatchRole: iam.Role;
@@ -116,7 +116,7 @@ export class CloudFrontToApiGatewayToLambda extends Construct {
116116
});
117117

118118
this.cloudFrontWebDistribution = apiCloudfront.cloudFrontWebDistribution;
119-
this.edgeLambdaFunctionVersion = apiCloudfront.edgeLambdaFunctionVersion;
119+
this.cloudFrontFunction = apiCloudfront.cloudFrontFunction;
120120
this.cloudFrontLoggingBucket = apiCloudfront.cloudFrontLoggingBucket;
121121
}
122122
}

‎source/patterns/@aws-solutions-constructs/aws-cloudfront-apigateway-lambda/test/__snapshots__/test.cloudfront-apigateway-lambda.test.js.snap

+14-144
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,14 @@ Object {
8080
"DefaultCacheBehavior": Object {
8181
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
8282
"Compress": true,
83-
"LambdaFunctionAssociations": Array [
83+
"FunctionAssociations": Array [
8484
Object {
85-
"EventType": "origin-response",
86-
"LambdaFunctionARN": Object {
87-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersVersion1946ABC2",
85+
"EventType": "viewer-response",
86+
"FunctionARN": Object {
87+
"Fn::GetAtt": Array [
88+
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A",
89+
"FunctionARN",
90+
],
8891
},
8992
},
9093
],
@@ -257,149 +260,16 @@ Object {
257260
"Type": "AWS::S3::BucketPolicy",
258261
},
259262
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A": Object {
260-
"DependsOn": Array [
261-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196",
262-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF",
263-
],
264-
"Metadata": Object {
265-
"cfn_nag": Object {
266-
"rules_to_suppress": Array [
267-
Object {
268-
"id": "W58",
269-
"reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions.",
270-
},
271-
Object {
272-
"id": "W89",
273-
"reason": "This is not a rule for the general case, just for specific use cases/industries",
274-
},
275-
Object {
276-
"id": "W92",
277-
"reason": "Impossible for us to define the correct concurrency for clients",
278-
},
279-
],
280-
},
281-
},
282263
"Properties": Object {
283-
"Code": Object {
284-
"ZipFile": "exports.handler = (event, context, callback) => { const response = event.Records[0].cf.response; const headers = response.headers; headers['x-xss-protection'] = [ { key: 'X-XSS-Protection', value: '1; mode=block' } ]; headers['x-frame-options'] = [ { key: 'X-Frame-Options', value: 'DENY' } ]; headers['x-content-type-options'] = [ { key: 'X-Content-Type-Options', value: 'nosniff' } ]; headers['strict-transport-security'] = [ { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubdomains; preload' } ]; headers['referrer-policy'] = [ { key: 'Referrer-Policy', value: 'same-origin' } ]; headers['content-security-policy'] = [ { key: 'Content-Security-Policy', value: \\"default-src 'none'; base-uri 'self'; img-src 'self'; script-src 'self'; style-src 'self' https:; object-src 'none'; frame-ancestors 'none'; font-src 'self' https:; form-action 'self'; manifest-src 'self'; connect-src 'self'\\" } ]; callback(null, response); };",
285-
},
286-
"Handler": "index.handler",
287-
"Role": Object {
288-
"Fn::GetAtt": Array [
289-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF",
290-
"Arn",
291-
],
292-
},
293-
"Runtime": "nodejs12.x",
294-
"TracingConfig": Object {
295-
"Mode": "Active",
296-
},
297-
},
298-
"Type": "AWS::Lambda::Function",
299-
},
300-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF": Object {
301-
"Properties": Object {
302-
"AssumeRolePolicyDocument": Object {
303-
"Statement": Array [
304-
Object {
305-
"Action": "sts:AssumeRole",
306-
"Effect": "Allow",
307-
"Principal": Object {
308-
"Service": "lambda.amazonaws.com",
309-
},
310-
},
311-
Object {
312-
"Action": "sts:AssumeRole",
313-
"Effect": "Allow",
314-
"Principal": Object {
315-
"Service": "edgelambda.amazonaws.com",
316-
},
317-
},
318-
],
319-
"Version": "2012-10-17",
320-
},
321-
"Policies": Array [
322-
Object {
323-
"PolicyDocument": Object {
324-
"Statement": Array [
325-
Object {
326-
"Action": Array [
327-
"logs:CreateLogGroup",
328-
"logs:CreateLogStream",
329-
"logs:PutLogEvents",
330-
],
331-
"Effect": "Allow",
332-
"Resource": Object {
333-
"Fn::Join": Array [
334-
"",
335-
Array [
336-
"arn:",
337-
Object {
338-
"Ref": "AWS::Partition",
339-
},
340-
":logs:",
341-
Object {
342-
"Ref": "AWS::Region",
343-
},
344-
":",
345-
Object {
346-
"Ref": "AWS::AccountId",
347-
},
348-
":log-group:/aws/lambda/*",
349-
],
350-
],
351-
},
352-
},
353-
],
354-
"Version": "2012-10-17",
355-
},
356-
"PolicyName": "LambdaFunctionServiceRolePolicy",
357-
},
358-
],
359-
},
360-
"Type": "AWS::IAM::Role",
361-
},
362-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196": Object {
363-
"Metadata": Object {
364-
"cfn_nag": Object {
365-
"rules_to_suppress": Array [
366-
Object {
367-
"id": "W12",
368-
"reason": "Lambda needs the following minimum required permissions to send trace data to X-Ray and access ENIs in a VPC.",
369-
},
370-
],
371-
},
372-
},
373-
"Properties": Object {
374-
"PolicyDocument": Object {
375-
"Statement": Array [
376-
Object {
377-
"Action": Array [
378-
"xray:PutTraceSegments",
379-
"xray:PutTelemetryRecords",
380-
],
381-
"Effect": "Allow",
382-
"Resource": "*",
383-
},
384-
],
385-
"Version": "2012-10-17",
386-
},
387-
"PolicyName": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196",
388-
"Roles": Array [
389-
Object {
390-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF",
391-
},
392-
],
393-
},
394-
"Type": "AWS::IAM::Policy",
395-
},
396-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersVersion1946ABC2": Object {
397-
"Properties": Object {
398-
"FunctionName": Object {
399-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A",
264+
"AutoPublish": true,
265+
"FunctionCode": "function handler(event) { var response = event.response; var headers = response.headers; headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubdomains; preload'}; headers['content-security-policy'] = { value: \\"default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'\\"}; headers['x-content-type-options'] = { value: 'nosniff'}; headers['x-frame-options'] = {value: 'DENY'}; headers['x-xss-protection'] = {value: '1; mode=block'}; return response; }",
266+
"FunctionConfig": Object {
267+
"Comment": "SetHttpSecurityHeadersc8921a01111335c3cb09d76a1618677328b11c1cb8",
268+
"Runtime": "cloudfront-js-1.0",
400269
},
270+
"Name": "SetHttpSecurityHeadersc8921a01111335c3cb09d76a1618677328b11c1cb8",
401271
},
402-
"Type": "AWS::Lambda::Version",
272+
"Type": "AWS::CloudFront::Function",
403273
},
404274
"testcloudfrontapigatewaylambdaLambdaFunction17A55E65": Object {
405275
"DependsOn": Array [

‎source/patterns/@aws-solutions-constructs/aws-cloudfront-apigateway-lambda/test/integ.no-arguments.expected.json

+14-144
Original file line numberDiff line numberDiff line change
@@ -618,148 +618,15 @@
618618
"testcloudfrontapigatewaylambdaLambdaRestApi6A4CBD44"
619619
]
620620
},
621-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF": {
622-
"Type": "AWS::IAM::Role",
623-
"Properties": {
624-
"AssumeRolePolicyDocument": {
625-
"Statement": [
626-
{
627-
"Action": "sts:AssumeRole",
628-
"Effect": "Allow",
629-
"Principal": {
630-
"Service": "lambda.amazonaws.com"
631-
}
632-
},
633-
{
634-
"Action": "sts:AssumeRole",
635-
"Effect": "Allow",
636-
"Principal": {
637-
"Service": "edgelambda.amazonaws.com"
638-
}
639-
}
640-
],
641-
"Version": "2012-10-17"
642-
},
643-
"Policies": [
644-
{
645-
"PolicyDocument": {
646-
"Statement": [
647-
{
648-
"Action": [
649-
"logs:CreateLogGroup",
650-
"logs:CreateLogStream",
651-
"logs:PutLogEvents"
652-
],
653-
"Effect": "Allow",
654-
"Resource": {
655-
"Fn::Join": [
656-
"",
657-
[
658-
"arn:",
659-
{
660-
"Ref": "AWS::Partition"
661-
},
662-
":logs:",
663-
{
664-
"Ref": "AWS::Region"
665-
},
666-
":",
667-
{
668-
"Ref": "AWS::AccountId"
669-
},
670-
":log-group:/aws/lambda/*"
671-
]
672-
]
673-
}
674-
}
675-
],
676-
"Version": "2012-10-17"
677-
},
678-
"PolicyName": "LambdaFunctionServiceRolePolicy"
679-
}
680-
]
681-
}
682-
},
683-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196": {
684-
"Type": "AWS::IAM::Policy",
685-
"Properties": {
686-
"PolicyDocument": {
687-
"Statement": [
688-
{
689-
"Action": [
690-
"xray:PutTraceSegments",
691-
"xray:PutTelemetryRecords"
692-
],
693-
"Effect": "Allow",
694-
"Resource": "*"
695-
}
696-
],
697-
"Version": "2012-10-17"
698-
},
699-
"PolicyName": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196",
700-
"Roles": [
701-
{
702-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF"
703-
}
704-
]
705-
},
706-
"Metadata": {
707-
"cfn_nag": {
708-
"rules_to_suppress": [
709-
{
710-
"id": "W12",
711-
"reason": "Lambda needs the following minimum required permissions to send trace data to X-Ray and access ENIs in a VPC."
712-
}
713-
]
714-
}
715-
}
716-
},
717621
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A": {
718-
"Type": "AWS::Lambda::Function",
719-
"Properties": {
720-
"Code": {
721-
"ZipFile": "exports.handler = (event, context, callback) => { const response = event.Records[0].cf.response; const headers = response.headers; headers['x-xss-protection'] = [ { key: 'X-XSS-Protection', value: '1; mode=block' } ]; headers['x-frame-options'] = [ { key: 'X-Frame-Options', value: 'DENY' } ]; headers['x-content-type-options'] = [ { key: 'X-Content-Type-Options', value: 'nosniff' } ]; headers['strict-transport-security'] = [ { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubdomains; preload' } ]; headers['referrer-policy'] = [ { key: 'Referrer-Policy', value: 'same-origin' } ]; headers['content-security-policy'] = [ { key: 'Content-Security-Policy', value: \"default-src 'none'; base-uri 'self'; img-src 'self'; script-src 'self'; style-src 'self' https:; object-src 'none'; frame-ancestors 'none'; font-src 'self' https:; form-action 'self'; manifest-src 'self'; connect-src 'self'\" } ]; callback(null, response); };"
722-
},
723-
"Role": {
724-
"Fn::GetAtt": [
725-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF",
726-
"Arn"
727-
]
728-
},
729-
"Handler": "index.handler",
730-
"Runtime": "nodejs12.x",
731-
"TracingConfig": {
732-
"Mode": "Active"
733-
}
734-
},
735-
"DependsOn": [
736-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleDefaultPolicy2016F196",
737-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersServiceRoleCA39BFFF"
738-
],
739-
"Metadata": {
740-
"cfn_nag": {
741-
"rules_to_suppress": [
742-
{
743-
"id": "W58",
744-
"reason": "Lambda functions has the required permission to write CloudWatch Logs. It uses custom policy instead of arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole with tighter permissions."
745-
},
746-
{
747-
"id": "W89",
748-
"reason": "This is not a rule for the general case, just for specific use cases/industries"
749-
},
750-
{
751-
"id": "W92",
752-
"reason": "Impossible for us to define the correct concurrency for clients"
753-
}
754-
]
755-
}
756-
}
757-
},
758-
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersVersion1946ABC2": {
759-
"Type": "AWS::Lambda::Version",
622+
"Type": "AWS::CloudFront::Function",
760623
"Properties": {
761-
"FunctionName": {
762-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A"
624+
"Name": "SetHttpSecurityHeadersc8118ca6b46a588ddfb2f1826effa6addb3adda75e",
625+
"AutoPublish": true,
626+
"FunctionCode": "function handler(event) { var response = event.response; var headers = response.headers; headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubdomains; preload'}; headers['content-security-policy'] = { value: \"default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'\"}; headers['x-content-type-options'] = { value: 'nosniff'}; headers['x-frame-options'] = {value: 'DENY'}; headers['x-xss-protection'] = {value: '1; mode=block'}; return response; }",
627+
"FunctionConfig": {
628+
"Comment": "SetHttpSecurityHeadersc8118ca6b46a588ddfb2f1826effa6addb3adda75e",
629+
"Runtime": "cloudfront-js-1.0"
763630
}
764631
}
765632
},
@@ -854,11 +721,14 @@
854721
"DefaultCacheBehavior": {
855722
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
856723
"Compress": true,
857-
"LambdaFunctionAssociations": [
724+
"FunctionAssociations": [
858725
{
859-
"EventType": "origin-response",
860-
"LambdaFunctionARN": {
861-
"Ref": "testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeadersVersion1946ABC2"
726+
"EventType": "viewer-response",
727+
"FunctionARN": {
728+
"Fn::GetAtt": [
729+
"testcloudfrontapigatewaylambdaCloudFrontToApiGatewaySetHttpSecurityHeaders6945414A",
730+
"FunctionARN"
731+
]
862732
}
863733
}
864734
],

0 commit comments

Comments
 (0)