554 cloudfront; arclight s3 access; specify prod task containers v0.1.5-beta (#615)

barbarahui · amywieliczka · web-flow · commit b66c5669b1e3 · 2025-07-17T14:37:38.000-07:00
* Add cloudfront distro templates

* Give Arclight service full s3 access [infra]

* Specify container version v0.1.5-beta for prod stack

---------

Co-authored-by: amy wieliczka &lt;amywieliczka@gmail.com&gt;
diff --git a/infrastructure/cinco/config/prd/arclight/app.yaml b/infrastructure/cinco/config/prd/arclight/app.yaml
@@ -6,8 +6,11 @@ parameters:
   Namespace: cinco-arclight-prd
   VpcId: {{ var.prd.VPC_ID }}
   SubnetIDs: {{ var.prd.SUBNET_IDS }}
-  ContainerImage: !stack_output prd/arclight/build.yaml::ECRRepository
+  ContainerImage: !sub
+    - "{container_image}:v0.1.5-beta"
+    - container_image: !stack_output prd/arclight/build.yaml::ECRRepository
   ContainerPort: 3000
+  ContainerCount: 2
   HealthCheckPath: '/'
   DBInstanceSecurityGroup: !stack_output prd/arclight/db.yaml::RDSSecurityGroup
 sceptre_user_data:
@@ -30,5 +33,7 @@ sceptre_user_data:
     - POSTGRES_USER: {{ var.prd.ARCLIGHT_DB_USERNAME }}
     - POSTGRES_PASSWORD: {{ var.prd.ARCLIGHT_DB_PASSWORD }}
     - MATOMO_SITE_ID: {{ var.prd.MATOMO_SITE_ID }}
+  TaskPolicies:
+    - !stack_output prd/s3.yaml::Policy
   GrantHttpAccessFromThisServiceTo:
     - !stack_output prd/solr/solr.yaml::LoadBalancerSecurityGroup
diff --git a/infrastructure/cinco/config/prd/arclight/cloudfront.yaml b/infrastructure/cinco/config/prd/arclight/cloudfront.yaml
@@ -0,0 +1,10 @@
+template:
+  path: cloudfront.j2
+  type: file
+parameters:
+  CNAME: oac.cdlib.org
+  SSLCertARN: arn:aws:acm:us-east-1:777968769372:certificate/60c6f9da-da7f-4ce9-9fd3-3a0c53114752
+sceptre_user_data:
+  origins:
+  - name: arclight
+    DomainName: !stack_output prd/arclight/app.yaml::LoadBalancerDNS
diff --git a/infrastructure/cinco/config/prd/cincoctrl/app.yaml b/infrastructure/cinco/config/prd/cincoctrl/app.yaml
@@ -6,7 +6,9 @@ parameters:
   Namespace: cinco-ctrl-prd
   VpcId: {{ var.prd.VPC_ID }}
   SubnetIDs: {{ var.prd.SUBNET_IDS }}
-  ContainerImage: !stack_output prd/cincoctrl/build.yaml::ECRRepository
+  ContainerImage: !sub
+    - "{container_image}:v0.1.5-beta"
+    - container_image: !stack_output prd/cincoctrl/build.yaml::ECRRepository
   ContainerPort: 5000
   HealthCheckPath: '/accounts/login/'
   DBInstanceSecurityGroup: !stack_output prd/cincoctrl/db.yaml::RDSSecurityGroup
diff --git a/infrastructure/cinco/config/prd/cincoctrl/cloudfront.yaml b/infrastructure/cinco/config/prd/cincoctrl/cloudfront.yaml
@@ -0,0 +1,11 @@
+template:
+  path: cloudfront.j2
+  type: file
+parameters:
+  CNAME: dashboard.oac.cdlib.org
+  SSLCertARN: arn:aws:acm:us-east-1:777968769372:certificate/60c6f9da-da7f-4ce9-9fd3-3a0c53114752
+
+sceptre_user_data:
+  origins:
+  - name: cincoctrl
+    DomainName: !stack_output prd/cincoctrl/app.yaml::LoadBalancerDNS
diff --git a/infrastructure/cinco/config/prd/solr/solr-follower-1.yaml b/infrastructure/cinco/config/prd/solr/solr-follower-1.yaml
@@ -6,7 +6,9 @@ parameters:
   Namespace: cinco-solr-follower-1-prd
   VpcId: {{ var.prd.VPC_ID }}
   SubnetIDs: {{ var.prd.SUBNET_IDS }}
-  ContainerImage: !stack_output prd/solr/build.yaml::ECRRepository
+  ContainerImage: !sub
+    - "{container_image}:v0.1.5-beta"
+    - container_image: !stack_output prd/solr/build.yaml::ECRRepository
   ContainerPort: 8983
   ContainerCount: 1
   HealthCheckPath: "/solr/arclight/admin/ping"
diff --git a/infrastructure/cinco/config/prd/solr/solr-follower-2.yaml b/infrastructure/cinco/config/prd/solr/solr-follower-2.yaml
@@ -6,7 +6,9 @@ parameters:
   Namespace: cinco-solr-follower-2-prd
   VpcId: {{ var.prd.VPC_ID }}
   SubnetIDs: {{ var.prd.SUBNET_IDS }}
-  ContainerImage: !stack_output prd/solr/build.yaml::ECRRepository
+  ContainerImage: !sub
+    - "{container_image}:v0.1.5-beta"
+    - container_image: !stack_output prd/solr/build.yaml::ECRRepository
   ContainerPort: 8983
   ContainerCount: 1
   HealthCheckPath: "/solr/arclight/admin/ping"
diff --git a/infrastructure/cinco/config/prd/solr/solr.yaml b/infrastructure/cinco/config/prd/solr/solr.yaml
@@ -6,7 +6,9 @@ parameters:
   Namespace: cinco-solr-prd
   VpcId: {{ var.prd.VPC_ID }}
   SubnetIDs: {{ var.prd.SUBNET_IDS }}
-  ContainerImage: !stack_output prd/solr/build.yaml::ECRRepository
+  ContainerImage: !sub
+    - "{container_image}:v0.1.5-beta"
+    - container_image: !stack_output prd/solr/build.yaml::ECRRepository
   ContainerPort: 8983
   ContainerCount: 1
   HealthCheckPath: "/solr/arclight/admin/ping"
diff --git a/infrastructure/cinco/config/stage/arclight/app.yaml b/infrastructure/cinco/config/stage/arclight/app.yaml
@@ -30,5 +30,7 @@ sceptre_user_data:
     - POSTGRES_DB: postgres
     - POSTGRES_USER: {{ var.stage.ARCLIGHT_DB_USERNAME }}
     - POSTGRES_PASSWORD: {{ var.stage.ARCLIGHT_DB_PASSWORD }}
+  TaskPolicies:
+    - !stack_output stage/s3.yaml::Policy
   GrantHttpAccessFromThisServiceTo:
     - !stack_output stage/solr/solr.yaml::LoadBalancerSecurityGroup
diff --git a/infrastructure/cinco/config/stage/arclight/cloudfront.yaml b/infrastructure/cinco/config/stage/arclight/cloudfront.yaml
@@ -0,0 +1,10 @@
+template:
+  path: cloudfront.j2
+  type: file
+parameters:
+  CNAME: oac-stg.cdlib.org
+  SSLCertARN: arn:aws:acm:us-east-1:777968769372:certificate/f0097032-d6cc-46c0-a6d1-985f3f6cbd55
+sceptre_user_data:
+  origins:
+    - name: arclight
+      DomainName: !stack_output stage/arclight/app.yaml::LoadBalancerDNS
diff --git a/infrastructure/cinco/config/stage/cincoctrl/cloudfront.yaml b/infrastructure/cinco/config/stage/cincoctrl/cloudfront.yaml
@@ -0,0 +1,11 @@
+template:
+  path: cloudfront.j2
+  type: file
+parameters:
+  CNAME: dashboard.oac-stg.cdlib.org
+  SSLCertARN: arn:aws:acm:us-east-1:777968769372:certificate/f0097032-d6cc-46c0-a6d1-985f3f6cbd55
+
+sceptre_user_data:
+  origins:
+    - name: cincoctrl
+      DomainName: !stack_output stage/cincoctrl/app.yaml::LoadBalancerDNS
diff --git a/infrastructure/cinco/templates/cloudfront.j2 b/infrastructure/cinco/templates/cloudfront.j2
@@ -0,0 +1,56 @@
+AWSTemplateFormatVersion: 2010-09-09
+Description: CloudFront distribution
+Parameters:
+  CNAME:
+    Type: String
+  SSLCertARN:
+   Type: String
+
+Resources:
+
+  CloudfrontDistribution:
+    Type: AWS::CloudFront::Distribution
+    Properties:
+      DistributionConfig:
+        Comment: !Sub "${CNAME} cloudfront distro"
+        Enabled: true
+        HttpVersion: http1.1  # default
+        IPV6Enabled: false
+        ViewerCertificate:
+          AcmCertificateArn: !Ref SSLCertARN
+          MinimumProtocolVersion: "TLSv1.2_2021"
+          SslSupportMethod: sni-only
+        {# Logging:
+          IncludeCookies: false
+          Bucket: !Sub "${LogS3Bucket}.s3.amazonaws.com"
+          Prefix: !Ref LogPrefix #}
+        Origins:
+          {% for origin in sceptre_user_data.origins %}
+          - Id: {{ origin.name }}
+            DomainName: {{ origin.DomainName }}
+            {% if origin.OriginPath is defined %}
+            OriginPath: {{ origin.OriginPath }}
+            {% endif %}
+            CustomOriginConfig:
+              HTTPPort: 80
+              HTTPSPort: 443
+              OriginProtocolPolicy: http-only
+              OriginReadTimeout: 30
+              OriginKeepaliveTimeout: 5
+              OriginSSLProtocols:
+                - TLSv1.2
+            ConnectionAttempts: 3
+            ConnectionTimeout: 10
+          {% endfor %}
+        DefaultCacheBehavior:
+          TargetOriginId: {{ sceptre_user_data.origins.0.name }}
+          ViewerProtocolPolicy: redirect-to-https
+          AllowedMethods:
+            - HEAD
+            - GET
+          CachedMethods:
+            - HEAD
+            - GET
+          # Managed Cache Policy: UseOriginCacheControlHeaders-QueryStrings
+          # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html#managed-cache-policy-origin-cache-headers-query-strings
+          CachePolicyId: 4cc15a8a-d715-48a4-82b8-cc0b614638fe
