feat: Add cdn for static assets

src/infra/api/oi-admin.tpl.json

@@ -36,6 +36,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -150,6 +151,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -239,6 +241,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -349,6 +352,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -449,6 +453,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -655,6 +660,7 @@
         "x-amazon-apigateway-integration": {
           "credentials": "${lambda_apigateway_proxy_role}",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "httpMethod": "POST",
@@ -900,6 +906,7 @@
           "uri": "${assets_bucket_control_panel_uri}/index.html",
           "type": "aws",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.querystring.client_id": "method.request.querystring.client_id",
             "integration.request.querystring.response_type": "method.request.querystring.response_type",
@@ -982,6 +989,7 @@
           "uri": "${assets_bucket_control_panel_uri}/index.html",
           "type": "aws",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {},
           "responseParameters": {},
           "responses": {
@@ -1030,6 +1038,7 @@
           "uri": "${assets_bucket_control_panel_uri}/index.html",
           "type": "aws",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {},
           "responseParameters": {},
           "responses": {
@@ -1114,6 +1123,7 @@
             "integration.request.path.proxy": "method.request.path.proxy"
           },
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "cacheKeyParameters": [
             "method.request.path.proxy"
           ]

src/infra/api/oi-internal-idp.tpl.json

@@ -80,6 +80,7 @@
             "integration.request.path.proxy": "method.request.path.proxy"
           },
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "cacheKeyParameters": [
             "method.request.path.proxy"
           ]
@@ -99,6 +100,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'"
           },
@@ -178,6 +180,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'"
           },
@@ -267,6 +270,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'"
           },

src/infra/api/oi.tpl.json

@@ -35,6 +35,7 @@
           "type": "mock",
           "requestParameters": {},
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "contentHandling": "CONVERT_TO_TEXT",
           "responses": {
             "302": {
@@ -78,6 +79,7 @@
           "connectionId": "${connection_id}",
           "requestParameters": {},
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 5000,
           "responses": {
             "200": {
               "statusCode": "200",
@@ -187,6 +189,7 @@
             "integration.request.querystring.state": "method.request.querystring.state"
           },
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 10000,
           "responseParameters": {},
           "type": "aws",
           "responses": {
@@ -195,7 +198,7 @@
               "responseParameters": {
                 "method.response.header.content-type": "integration.response.header.Content-Type",
                 "method.response.header.location": "integration.response.header.location",
-                "method.response.header.Content-Security-Policy": "'default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
+                "method.response.header.Content-Security-Policy": "'default-src 'self' https://*.oneid.pagopa.it ; script-src 'self' https://*.oneid.pagopa.it; object-src 'none'; style-src 'self' 'unsafe-inline' https://*.oneid.pagopa.it; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
               }
             },
             "404": {
@@ -237,6 +240,7 @@
           "uri": "${assets_bucket_uri}/index.html",
           "type": "aws",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.querystring.errorCode": "method.request.querystring.errorCode"
           },
@@ -246,7 +250,7 @@
               "statusCode": "200",
               "responseParameters": {
                 "method.response.header.content-type": "integration.response.header.Content-Type",
-                "method.response.header.Content-Security-Policy": "'default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
+                "method.response.header.Content-Security-Policy": "'default-src 'self' https://*.oneid.pagopa.it ; script-src 'self' https://*.oneid.pagopa.it; object-src 'none'; style-src 'self' 'unsafe-inline' https://*.oneid.pagopa.it; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
               }
             },
             "404": {
@@ -276,6 +280,7 @@
           "httpMethod": "POST",
           "uri": "arn:aws:apigateway:${aws_region}:lambda:path/2015-03-31/functions/${retrieve_status_lambda_arn}/invocations",
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 5000,
           "contentHandling": "CONVERT_TO_TEXT",
           "type": "aws_proxy",
           "responses": {
@@ -450,6 +455,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'"
           },
@@ -567,6 +573,7 @@
             "integration.request.querystring.access_token": "method.request.querystring.access_token"
           },
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "responses": {
             "200": {
               "statusCode": "200",
@@ -657,6 +664,7 @@
           "uri": "${assets_bucket_uri}/{id_type}.xml",
           "type": "aws",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 2000,
           "requestParameters": {
             "integration.request.path.id_type": "method.request.path.id_type"
           },
@@ -794,6 +802,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 10000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'",
             "integration.request.header.X-Forwarded-For": "method.request.header.X-Forwarded-For",
@@ -1065,6 +1074,7 @@
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 20000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'",
             "integration.request.header.authorization": "method.request.header.authorization"
@@ -1192,6 +1202,7 @@
             "integration.request.header.Origin": "method.request.header.Origin"
           },
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 2000,
           "responses": {
             "200": {
               "statusCode": "200",
@@ -1363,6 +1374,7 @@
             "integration.request.header.Origin": "method.request.header.Origin"
           },
           "passthroughBehavior": "WHEN_NO_TEMPLATES",
+          "timeoutInMillis" : 2000,
           "responses": {
             "204": {
               "statusCode": "204",
@@ -1482,6 +1494,7 @@
           "uri": "${uri}/idps",
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
+          "timeoutInMillis" : 5000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'"
           },
@@ -1523,6 +1536,7 @@
           "uri": "${uri}/clients/{client_id}",
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
+          "timeoutInMillis" : 5000,
           "requestParameters": {
             "integration.request.header.accept": "'*/*'",
             "integration.request.path.client_id": "method.request.path.client_id"
@@ -1583,6 +1597,7 @@
           "uri": "${uri}/clients",
           "connectionType": "VPC_LINK",
           "connectionId": "${connection_id}",
+          "timeoutInMillis" : 5000,
           "responses": {
             "200": {
               "statusCode": "200",
@@ -1657,7 +1672,7 @@
               "statusCode": "200",
               "responseParameters": {
                 "method.response.header.Content-Type": "integration.response.header.Content-Type",
-                "method.response.header.Content-Security-Policy": "'default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
+                "method.response.header.Content-Security-Policy": "'default-src 'self' https://*.oneid.pagopa.it ; script-src 'self' https://*.oneid.pagopa.it; object-src 'none'; style-src 'self' 'unsafe-inline' https://*.oneid.pagopa.it; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
               }
             },
             "404": {
@@ -1669,114 +1684,12 @@
             "integration.request.path.proxy": "method.request.path.proxy"
           },
           "passthroughBehavior": "when_no_match",
+          "timeoutInMillis" : 5000,
           "cacheKeyParameters": [
             "method.request.path.proxy"
           ]
         }
       }
-    },
-    "/assets/{proxy+}": {
-      "get": {
-        "parameters": [
-          {
-            "name": "proxy",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "200 response",
-            "headers": {
-              "Content-Type": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Content-Length": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Content-Security-Policy": {
-                "type": "string"
-              }
-            },
-            "content": {}
-          },
-          "404": {
-            "$ref": "#/components/responses/notFound"
-          }
-        },
-        "x-amazon-apigateway-integration": {
-          "type": "aws",
-          "credentials": "${s3_apigateway_proxy_role}",
-          "httpMethod": "GET",
-          "uri": "${assets_bucket_uri}/assets/{proxy}",
-          "responses": {
-            "default": {
-              "statusCode": "200",
-              "responseParameters": {
-                "method.response.header.Content-Type": "integration.response.header.Content-Type",
-                "method.response.header.Content-Security-Policy": "'default-src 'self'; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*.pagopa.it; frame-ancestors 'none';'"
-              }
-            },
-            "404": {
-              "statusCode": "404",
-              "responseParameters": {}
-            }
-          },
-          "requestParameters": {
-            "integration.request.path.proxy": "method.request.path.proxy"
-          },
-          "passthroughBehavior": "when_no_match",
-          "cacheKeyParameters": [
-            "method.request.path.proxy"
-          ]
-        }
-      }
-    },
-    "/asset-manifest.json": {
-      "get": {
-        "tags": [
-          "asset-manifest.json static file"
-        ],
-        "description": "This route will serve the asset-manifest.json file",
-        "parameters": [],
-        "x-amazon-apigateway-integration": {
-          "credentials": "${s3_apigateway_proxy_role}",
-          "httpMethod": "GET",
-          "uri": "${assets_bucket_uri}/asset-manifest.json",
-          "requestParameters": {},
-          "passthroughBehavior": "when_no_match",
-          "responseParameters": {},
-          "type": "aws",
-          "responses": {
-            "200": {
-              "statusCode": "200",
-              "responseParameters": {
-                "method.response.header.content-type": "integration.response.header.Content-Type",
-                "method.response.header.location": "integration.response.header.location"
-              }
-            },
-            "404": {
-              "statusCode": "404",
-              "responseParameters": {}
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "$ref": "#/components/responses/responseOkHtml"
-          },
-          "404": {
-            "$ref": "#/components/responses/notFound"
-          }
-        }
-      }
     }
   },
   "components": {

src/infra/dev/eu-south-1/main.tf

@@ -41,6 +41,7 @@ module "frontend" {
   domain_admin_name        = module.r53_zones.dns_zone_name
   domain_internal_idp_name = module.r53_zones.dns_zone_name
   domain_auth_name         = module.r53_zones.dns_zone_name
+  domain_assets_name       = module.r53_zones.dns_zone_name
   r53_dns_zone_id          = module.r53_zones.dns_zone_id
   role_prefix              = local.project
 
@@ -107,6 +108,12 @@ module "frontend" {
   cognito_domain_cloudfront_distribution         = module.cognito.cloudfront_distribution
   cognito_domain_cloudfront_distribution_zone_id = module.cognito.cloudfront_distribution_zone_id
 
+  cloudfront = {
+    name                      = format("%s-cloudfront", local.project)
+    bucket_arn                = module.storage.assets_bucket_arn
+    bucket_id                 = module.storage.assets_bucket_name
+    bucket_origin_domain_name = module.storage.assets_bucket_regional_domain_name
+  }
 }