Skip to content

Commit 385a3cd

Browse files
steph-torres-nhssteph-torres-nhs
committed
[PRMP-579] add secondary bucket to distribution
1 parent 1f73761 commit 385a3cd

File tree

5 files changed

+100
-16
lines changed

5 files changed

+100
-16
lines changed

‎infrastructure/cloudfront.tf‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,23 @@ module "cloudfront_firewall_waf_v2" {
99
}
1010

1111
module "cloudfront-distribution-lg" {
12-
source = "./modules/cloudfront"
13-
bucket_domain_name = "${terraform.workspace}-${var.lloyd_george_bucket_name}.s3.eu-west-2.amazonaws.com"
14-
bucket_id = module.ndr-lloyd-george-store.bucket_id
15-
qualifed_arn = module.edge-presign-lambda.qualified_arn
16-
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name]
17-
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
12+
has_secondary_bucket = true
13+
secondary_bucket_domain_name = "${terraform.workspace}-${var.document_review_bucket_name}.s3.eu-west-2.amazonaws.com"
14+
secondary_bucket_id = module.ndr-document-pending-review-store.bucket_id
15+
secondary_bucket_path_pattern = "test/*"
16+
source = "./modules/cloudfront"
17+
bucket_domain_name = "${terraform.workspace}-${var.lloyd_george_bucket_name}.s3.eu-west-2.amazonaws.com"
18+
bucket_id = module.ndr-lloyd-george-store.bucket_id
19+
qualifed_arn = module.edge-presign-lambda.qualified_arn
20+
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name, module.ndr-document-pending-review-store]
21+
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
1822
}
1923

20-
module "cloudfront-distribution-document-pending-review" {
21-
source = "./modules/cloudfront"
22-
bucket_domain_name = "${terraform.workspace}-${var.document_review_bucket_name}.s3.eu-west-2.amazonaws.com"
23-
bucket_id = module.ndr-document-pending-review-store.bucket_id
24-
qualifed_arn = module.edge-presign-lambda.qualified_arn
25-
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-document-pending-review-store]
26-
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
27-
}
24+
# module "cloudfront-distribution-document-pending-review" {
25+
# source = "./modules/cloudfront"
26+
# bucket_domain_name = "${terraform.workspace}-${var.document_review_bucket_name}.s3.eu-west-2.amazonaws.com"
27+
# bucket_id = module.ndr-document-pending-review-store.bucket_id
28+
# qualifed_arn = module.edge-presign-lambda.qualified_arn
29+
# depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-document-pending-review-store]
30+
# web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
31+
# }

‎infrastructure/lambda-get-document-fhir.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ module "get-doc-fhir-lambda" {
5959
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
6060
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
6161
OIDC_CALLBACK_URL = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
62-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
62+
CLOUDFRONT_URL = module.cloudfront-distribution-lg[0].cloudfront_url
6363
PDS_FHIR_IS_STUBBED = local.is_sandbox
6464
}
6565
depends_on = [

‎infrastructure/lambda-lloyd-george-record-stitch.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ module "lloyd-george-stitch-lambda" {
7878
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
7979
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
8080
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.stitch_metadata_dynamodb_table_name}"
81-
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
81+
CLOUDFRONT_URL = module.cloudfront-distribution-lg[0].cloudfront_url
8282
WORKSPACE = terraform.workspace
8383
PRESIGNED_ASSUME_ROLE = aws_iam_role.stitch_presign_url_role.arn
8484
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name

‎infrastructure/modules/cloudfront/main.tf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ resource "aws_cloudfront_origin_access_control" "cloudfront_s3_oac" {
1212
}
1313

1414
resource "aws_cloudfront_distribution" "distribution" {
15+
count = var.has_secondary_bucket ? 0 : 1
1516
origin {
1617
domain_name = var.bucket_domain_name
1718
origin_id = var.bucket_id
@@ -32,6 +33,7 @@ resource "aws_cloudfront_distribution" "distribution" {
3233
lambda_arn = var.qualifed_arn
3334
}
3435
}
36+
3537
viewer_certificate {
3638
cloudfront_default_certificate = true
3739
}
@@ -44,6 +46,65 @@ resource "aws_cloudfront_distribution" "distribution" {
4446
web_acl_id = var.web_acl_id
4547
}
4648

49+
resource "aws_cloudfront_distribution" "distribution_with_secondary_bucket" {
50+
count = var.has_secondary_bucket ? 1 : 0
51+
enabled = true
52+
is_ipv6_enabled = true
53+
54+
origin {
55+
domain_name = var.bucket_domain_name
56+
origin_id = var.bucket_id
57+
origin_access_control_id = aws_cloudfront_origin_access_control.cloudfront_s3_oac.id
58+
}
59+
60+
default_cache_behavior {
61+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
62+
cached_methods = ["HEAD", "GET", "OPTIONS"]
63+
target_origin_id = var.bucket_id
64+
viewer_protocol_policy = "redirect-to-https"
65+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
66+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer_policy.id
67+
68+
lambda_function_association {
69+
event_type = "origin-request"
70+
lambda_arn = var.qualifed_arn
71+
}
72+
}
73+
74+
origin {
75+
domain_name = var.secondary_bucket_domain_name
76+
origin_id = var.secondary_bucket_id
77+
origin_access_control_id = aws_cloudfront_origin_access_control.cloudfront_s3_oac.id
78+
}
79+
80+
ordered_cache_behavior {
81+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
82+
cached_methods = ["HEAD", "GET", "OPTIONS"]
83+
path_pattern = var.secondary_bucket_path_pattern
84+
target_origin_id = var.secondary_bucket_id
85+
viewer_protocol_policy = "redirect-to-https"
86+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
87+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer_policy.id
88+
89+
lambda_function_association {
90+
event_type = "origin-request"
91+
lambda_arn = var.qualifed_arn
92+
}
93+
}
94+
95+
viewer_certificate {
96+
cloudfront_default_certificate = true
97+
}
98+
restrictions {
99+
geo_restriction {
100+
restriction_type = "whitelist"
101+
locations = local.allow_us_comms ? ["GB", "US"] : ["GB"]
102+
}
103+
}
104+
web_acl_id = var.web_acl_id
105+
}
106+
107+
47108
resource "aws_cloudfront_origin_request_policy" "viewer_policy" {
48109
name = "${terraform.workspace}_BlockQueriesAndAllowViewer"
49110

‎infrastructure/modules/cloudfront/variable.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,22 @@ variable "web_acl_id" {
1919
default = ""
2020
}
2121

22+
variable "has_secondary_bucket" {
23+
description = "Whether distribution is associated with a secondary buckets"
24+
type = bool
25+
}
26+
27+
variable "secondary_bucket_id" {
28+
description = "Secondary bucket IDs"
29+
type = string
30+
}
31+
32+
variable "secondary_bucket_domain_name" {
33+
description = "Secondary bucket domain names"
34+
type = string
35+
}
36+
37+
variable "secondary_bucket_path_pattern" {
38+
description = "Path patter for secondary bucket"
39+
type = string
40+
}

0 commit comments

Comments
 (0)