Fix: Mitigate public access and add deployment stack (#153)

* fix: mitigate public S3 access by implementing CloudFront OAC

- Set publicReadAccess=false for both dashboard and SDK buckets
- Enable BLOCK_ALL public access on S3 buckets
- Implement Origin Access Control (OAC) for CloudFront distributions
- Add proper IAM policies for CloudFront to access S3 buckets
- Remove insecure CORS configurations

* Update Tracker

* Add MLEW Tracker deployment CloudFormation stack

Author: icoxfog417

.amazonq/cli-agents/developer.json

@@ -0,0 +1,80 @@
+{
+  "name": "developer",
+  "description": "Default agent configuration",
+  "mcpServers": {
+    "AWS Core MCP Server": {
+      "command": "uvx",
+      "args": [
+        "awslabs.core-mcp-server@latest"
+      ],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      },
+      "timeout": 60000
+    },
+    "AWS Documentation MCP Server": {
+      "command": "uvx",
+      "args": [
+        "awslabs.aws-documentation-mcp-server@latest"
+      ],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR",
+        "AWS_DOCUMENTATION_PARTITION": "aws"
+      },
+      "timeout": 60000
+    },
+    "awslabs.aws-diagram-mcp-server": {
+      "command": "uvx",
+      "args": [
+        "awslabs.aws-diagram-mcp-server"
+      ],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      }
+    },
+    "awslabs.cdk-mcp-server": {
+      "command": "uvx",
+      "args": [
+        "awslabs.cdk-mcp-server@latest"
+      ],
+      "env": {
+        "FASTMCP_LOG_LEVEL": "ERROR"
+      }
+    },
+    "aws-knowledge-mcp-server": {
+      "command": "npx",
+      "args": [
+          "mcp-remote",
+          "https://knowledge-mcp.global.api.aws"
+      ]
+    }
+  },
+  "tools": [
+	"*"
+  ],
+  "allowedTools": [
+    "fs_read",
+    "fs_write",
+    "prompt_understanding",
+    "read_documentation",
+    "search_documentation"
+  ],
+  "toolsSettings": {
+    "execute_bash": {
+      "alwaysAllow": [
+        {
+          "preset": "readOnly"
+        }
+      ]
+    },
+    "use_aws": {
+      "alwaysAllow": [
+        {
+          "preset": "readOnly"
+        }
+      ]
+    }
+  },
+  "resources": [
+  ]
+}

yourwork/tracker/cdk-app/lib/tracker-stack.ts

@@ -83,53 +83,37 @@ export class TrackerStack extends Stack {
       versioned: isProd,
       autoDeleteObjects: !isProd,
       encryption: s3.BucketEncryption.S3_MANAGED,
-      blockPublicAccess: new s3.BlockPublicAccess({
-        blockPublicAcls: false,
-        blockPublicPolicy: false,
-        ignorePublicAcls: false,
-        restrictPublicBuckets: false,
-      }),
-      publicReadAccess: true,
-      websiteIndexDocument: 'index.html',
-      websiteErrorDocument: 'error.html',
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      publicReadAccess: false,
       removalPolicy: persistentResourcePolicy,
     });
-    dashboardBucket.addCorsRule({
-      allowedHeaders: ['*'],
-      allowedMethods: [s3.HttpMethods.GET],
-      allowedOrigins: ['*'],
-      maxAge: 3600,
-    });
     tagResource(dashboardBucket, 'Storage');
 
     const sdkBucket = new s3.Bucket(this, 'SdkBucket', {
       bucketName: `mlew-sdk-${accountId}`,
       versioned: isProd,
       autoDeleteObjects: !isProd,
       encryption: s3.BucketEncryption.S3_MANAGED,
-      blockPublicAccess: new s3.BlockPublicAccess({
-        blockPublicAcls: false,
-        blockPublicPolicy: false,
-        ignorePublicAcls: false,
-        restrictPublicBuckets: false,
-      }),
-      publicReadAccess: true,
+      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
+      publicReadAccess: false,
       removalPolicy: persistentResourcePolicy,
     });
-    sdkBucket.addCorsRule({
-      allowedHeaders: ['*'],
-      allowedMethods: [s3.HttpMethods.GET],
-      allowedOrigins: ['*'],
-      maxAge: 3600,
-    });
     tagResource(sdkBucket, 'Storage');
 
 
     // CloudFront Distributions
+    const dashboardOAC = new cloudfront.S3OriginAccessControl(this, 'DashboardOAC', {
+      originAccessControlName: `mlew-dashboard-oac-${accountId}`,
+      description: 'OAC for Dashboard S3 bucket',
+      signing: cloudfront.Signing.SIGV4_ALWAYS,
+    });
+
     const dashboardDistribution = new cloudfront.Distribution(this, 'DashboardDistribution', {
       defaultRootObject: 'index.html',
       defaultBehavior: {
-        origin: new origins.S3Origin(dashboardBucket),
+        origin: origins.S3BucketOrigin.withOriginAccessControl(dashboardBucket, {
+          originAccessControl: dashboardOAC,
+        }),
         viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
         allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD_OPTIONS,
         cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
@@ -145,9 +129,17 @@ export class TrackerStack extends Stack {
       ],
     });
 
+    const sdkOAC = new cloudfront.S3OriginAccessControl(this, 'SdkOAC', {
+      originAccessControlName: `mlew-sdk-oac-${accountId}`,
+      description: 'OAC for SDK S3 bucket',
+      signing: cloudfront.Signing.SIGV4_ALWAYS,
+    });
+
     const sdkDistribution = new cloudfront.Distribution(this, 'SdkDistribution', {
       defaultBehavior: {
-        origin: new origins.S3Origin(sdkBucket),
+        origin: origins.S3BucketOrigin.withOriginAccessControl(sdkBucket, {
+          originAccessControl: sdkOAC,
+        }),
         viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
         allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD,
         cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
@@ -158,6 +150,31 @@ export class TrackerStack extends Stack {
     tagResource(dashboardDistribution, 'Delivery');
     tagResource(sdkDistribution, 'Delivery');
 
+    // Grant CloudFront OAC access to S3 buckets
+    dashboardBucket.addToResourcePolicy(new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      principals: [new iam.ServicePrincipal('cloudfront.amazonaws.com')],
+      actions: ['s3:GetObject'],
+      resources: [dashboardBucket.arnForObjects('*')],
+      conditions: {
+        StringEquals: {
+          'AWS:SourceArn': `arn:aws:cloudfront::${accountId}:distribution/${dashboardDistribution.distributionId}`,
+        },
+      },
+    }));
+
+    sdkBucket.addToResourcePolicy(new iam.PolicyStatement({
+      effect: iam.Effect.ALLOW,
+      principals: [new iam.ServicePrincipal('cloudfront.amazonaws.com')],
+      actions: ['s3:GetObject'],
+      resources: [sdkBucket.arnForObjects('*')],
+      conditions: {
+        StringEquals: {
+          'AWS:SourceArn': `arn:aws:cloudfront::${accountId}:distribution/${sdkDistribution.distributionId}`,
+        },
+      },
+    }));
+
     // Lambda functions
     const bundling: lambdaNodejs.BundlingOptions = {
       externalModules: ['aws-sdk'],