Skip to content

Commit 35e5da5

Browse files
sgtojsgtoj
authored
Merge pull request #1 from sgtoj/dev
2 parents 5a2b7d2 + d651007 commit 35e5da5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+20089
-16
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"ghcr.io/devcontainers/features/docker-in-docker:2.0.1": {},
66
},
77
"containerEnv": {
8-
"TF_PLUGIN_CACHE_DIR": "/workspaces/terraform-aws-cloudfront-middleware-at-edge/.devcontainers/tmp/.terraform.d/"
8+
"TF_PLUGIN_CACHE_DIR": "/workspaces/terraform-aws-cloudfront-middleware-at-edge/.devcontainer/tmp/.terraform.d/"
99
},
1010
"customizations": {
1111
"vscode": {

‎.devcontainer/tmp/.terraform.d/.gitkeep‎

Whitespace-only changes.

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,20 @@ jobs:
1414
steps:
1515
- name: Checkout Code
1616
uses: actions/checkout@v3
17+
- name: Setup Node
18+
uses: actions/[email protected]
19+
with:
20+
node-version: 18
21+
- name: Tests for auth-at-edge
22+
run: |
23+
cd assets/cf-mw-auth
24+
npm install
25+
npm test
26+
- name: Tests for url-rewriter
27+
run: |
28+
cd assets/cf-mw-urlrewrite
29+
npm install
30+
npm test
1731
- name: Bump Version
1832
id: tag_version
1933
uses: mathieudutour/[email protected]

‎.github/workflows/test.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: test
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout Code
13+
uses: actions/checkout@v3
14+
- name: Setup Node
15+
uses: actions/[email protected]
16+
with:
17+
node-version: 18
18+
- name: Tests for auth-at-edge
19+
run: |
20+
cd assets/cf-mw-auth
21+
npm install
22+
npm test
23+
- name: Tests for url-rewriter
24+
run: |
25+
cd assets/cf-mw-urlrewrite
26+
npm install
27+
npm test

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
11
# .gitignore
22

33
# terraform files
4+
.terraform.lock.hcl
5+
.terraform.tfstate.lock.info
46
*.tfstate
57
*.tfstate.*.backup
68
*.tfstate.backup
79
*.tfplan
810
*.terraform/
11+
*.tfvars
912
.grunt
1013

1114
# node.js / typescript

‎Makefile‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
PROJ_ROOT := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
2+
3+
# allows args to pass to run-cmd example: make run-cmd echo "hello world"
4+
ifeq (run-cmd,$(firstword $(MAKECMDGOALS)))
5+
RUN_ARGS := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
6+
$(eval $(RUN_ARGS):;@:)
7+
endif
8+
9+
all: deps build
10+
@exit 0
11+
12+
deps:
13+
@exit 0
14+
15+
build:
16+
@exit 0
17+
18+
clean:
19+
@find . -type d -name "dist" -exec rm -rf {} +
20+
@find . -type d -name ".terraform" -exec rm -rf {} +
21+
@find . -type d -name ".terraform.d" -exec rm -rf {} +
22+
@find . -type d -name ".tfstate" -exec rm -rf {} +
23+
@find . -type d -name ".tfstate.backup" -exec rm -rf {} +
24+
@touch .devcontainer/.terraform.d/.gitkeep || true

‎README.md‎

Lines changed: 72 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
# Terraform Module: CloudFront Middleware-at-Edge
22

3-
_This module is under active development and is not yet ready for use. Please
4-
see `dev` branch for current progress._
3+
This Terraform module deploys customizable and reusable Lambda@Edge functions
4+
that provide middleware for AWS CloudFront.
55

66
## Features
77

8-
- TBA
8+
- **Authentication & Authorization**: This feature provides authentication and
9+
authorization to restrict access to a site hosted on CloudFront. Users can
10+
optionally customize the authorization rules via an Open Policy Agent (OPA)
11+
policy.
12+
- **URL Rewriting**: This feature rewrites the URLs of requests. Users can
13+
define URL rewrite rules via an Open Policy Agent (OPA) policy.
914

1015
## Usage
1116

@@ -14,7 +19,29 @@ module "cloudfront_middleware_at_edge" {
1419
source = "sgtoj/cloudfront-middleware-at-edge/aws"
1520
version = "x.x.x"
1621
17-
# TBD
22+
auth_service_config = {
23+
enabled = true
24+
cognito_idp_arn = "arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_TESTPOOL"
25+
cognito_idp_domain = "test.auth.us-east-1.amazoncognito.com"
26+
cognito_idp_client_id = "your-client-id"
27+
cognito_idp_client_secret = "your-client-secret"
28+
cognito_idp_client_scopes = ["openid", "email", "profile"]
29+
30+
cognito_idp_jwks = {
31+
keys = [
32+
{ "alg": "RS256", "e": "AQAB", "kid": "...", "kty": "RSA", "n": "...", "use": "sig" },
33+
{ "alg": "RS256", "e": "AQAB", "kid": "...", "kty": "RSA", "n": "...", "use": "sig" },
34+
]
35+
}
36+
}
37+
38+
urlrewrite_service_config = {
39+
enabled = true
40+
policy_content = <<-EOF
41+
package urlrewriter
42+
result := []
43+
EOF
44+
}
1845
}
1946
```
2047

@@ -27,18 +54,50 @@ module "cloudfront_middleware_at_edge" {
2754

2855
## Inputs
2956

30-
_This module does not currently provide any input._
31-
32-
### Note
33-
34-
This module uses the `cloudposse/label/null` module for naming and tagging
35-
resources. As such, it also includes a `context.tf` file with additional
36-
optional variables you can set. Refer to the [`cloudposse/label` documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest)
37-
for more details on these variables.
57+
In addition to the variables documented below, this module includes several
58+
other optional variables (e.g., `name`, `tags`, etc.) provided by the
59+
`cloudposse/label/null` module. Please refer to the [`cloudposse/label` documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest) for more details on these variables.
60+
61+
| Name | Description | Type | Default | Required |
62+
|---------------------------|---------------------------------------------------------------------------|:------:|:-------:|:--------:|
63+
| auth_service_config | Configuration details for the authentication service. More details below. | object | `{}` | no |
64+
| urlrewrite_service_config | Configuration details for the URL rewrite service, More details below. | object | `{}` | no |
65+
| destruction_delay | Delay before destroying resources when they are deleted | string | `"20m"` | no |
66+
| aws_account_id | The AWS account ID that the module will be deployed in | string | `""` | no |
67+
| aws_region_name | The AWS region name where the module will be deployed | string | `""` | no |
68+
69+
### `auth_service_config`
70+
71+
| Property | Description | Type | Default | Required |
72+
|---------------------------|------------------------------------------------|--------------------------------------|----------|----------|
73+
| enabled | Enable the authentication service | bool | `true` | no |
74+
| log_level | Logging level | string | `"info"` | no |
75+
| aws_region | AWS region for the service | string | `null` | no |
76+
| cognito_idp_arn | ARN of the Cognito Identity Provider | string | n/a | yes |
77+
| cognito_idp_domain | Domain of the Cognito Identity Provider | string | n/a | yes |
78+
| cognito_idp_jwks | JWKS of the Cognito Identity Provider | object({ keys = list(map(string)) }) | n/a | yes |
79+
| cognito_idp_client_id | Client ID of the Cognito Identity Provider | string | n/a | yes |
80+
| cognito_idp_client_secret | Client secret of the Cognito Identity Provider | string | n/a | yes |
81+
| cognito_idp_client_scopes | Client scopes of the Cognito Identity Provider | list(string) | n/a | yes |
82+
| opa_policy_content | Content of the OPA policy | string | `null` | no |
83+
| opa_policy_data | Data for the OPA policy | map(string) | `{}` | no |
84+
85+
### `urlrewrite_service_config`
86+
87+
| Property | Description | Type | Default | Required |
88+
|----------------|-----------------------------------|--------|---------------------------------------|----------|
89+
| enabled | Enable the URL rewrite service | bool | `false` | no |
90+
| log_level | Logging level | string | `"info"` | no |
91+
| aws_region | AWS region for the service | string | `null` | no |
92+
| policy_content | Content of the URL rewrite policy | string | `"package urlrewriter\nresult := []"` | no |
3893

3994
## Outputs
4095

41-
_This module does not currently provide any outputs._
96+
| Name | Description |
97+
|---------------------|---------------------------------------------------------------------------|
98+
| auth_services | Details of the created AWS Lambda functions for each of the auth services |
99+
| auth_routes | Route configurations for the auth services |
100+
| urlrewrite_services | Details of the created AWS Lambda function for the URL rewrite service |
42101

43102
## Contributing
44103

‎assets/cf-mw-auth/.dockerignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.gitignore
2+
.git
3+
4+
*Dockerfile*
5+
*docker-compose*
6+
.dockerignore
7+
8+
.vscode/
9+
node_modules/
10+
11+
*.env

‎assets/cf-mw-auth/.eslintrc.js‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
module.exports = {
2+
plugins: [
3+
'import',
4+
'jest',
5+
],
6+
rules: {
7+
'func-style': 'error',
8+
},
9+
overrides: [
10+
{
11+
files: [
12+
'**/*.{ts,tsx}',
13+
],
14+
parser: '@typescript-eslint/parser',
15+
parserOptions: {
16+
ecmaVersion: 2019,
17+
sourceType: 'module',
18+
tsconfigRootDir: __dirname,
19+
project: [
20+
'./tsconfig.json',
21+
],
22+
},
23+
plugins: [
24+
'@typescript-eslint',
25+
],
26+
extends: [
27+
'airbnb-typescript/base',
28+
],
29+
rules: {
30+
'@typescript-eslint/no-unused-vars': 'warn',
31+
'@typescript-eslint/no-floating-promises': 'error',
32+
},
33+
},
34+
{
35+
files: [
36+
'scripts/**/*.js',
37+
],
38+
parserOptions: {
39+
ecmaVersion: "latest",
40+
},
41+
env: {
42+
es6: true
43+
}
44+
}
45+
],
46+
};

‎assets/cf-mw-auth/Dockerfile‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# ------------------------------------------------------------------- base ---
2+
3+
FROM node:18 as base
4+
5+
RUN mkdir -p /opt/app
6+
WORKDIR /opt/app
7+
8+
ENV NODE_ENV development
9+
10+
# intentally not installing node_modules inside the /opt/app dir; this makes
11+
# for a better experience when using image in development environment
12+
ADD package*.json /opt/
13+
RUN npm ci
14+
15+
ADD ./ ./
16+
17+
# -------------------------------------------------------------------- test ---
18+
19+
FROM base as test
20+
21+
RUN npm run lint && npm run test
22+
23+
# -------------------------------------------------------------------- test ---
24+
25+
FROM test as build
26+
27+
ENV OPA_VERSION=0.49.0
28+
RUN SYSTEM_ARCH=$(dpkg --print-architecture) \
29+
&& curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v${OPA_VERSION}/opa_linux_${SYSTEM_ARCH}_static \
30+
&& mv opa /usr/bin/opa \
31+
&& chmod +x /usr/bin/opa \
32+
&& opa -h
33+
34+
RUN npm run build
35+
36+
ARG SERVICE_POLICY_ENCODED=cGFja2FnZSBhdXRoX2F0X2VkZ2VfYXV0aHoKcmVzdWx0cyA6PSBbXQo=
37+
RUN echo "$SERVICE_POLICY_ENCODED" | base64 -d > /opt/app/dist/policy.rego
38+
39+
RUN opa build -t wasm -e auth_at_edge_authz/results /opt/app/dist/policy.rego \
40+
&& tar -zxv -C /opt/app/dist -f bundle.tar.gz '/policy.wasm'
41+
42+
# ----------------------------------------------------------------- package ---
43+
44+
FROM alpine:latest as package
45+
46+
RUN apk add jq
47+
48+
ARG SERVICE_CONFIG_ENCODED=e30K
49+
50+
COPY --from=build /opt/app/dist /opt/app/dist
51+
COPY --from=build /opt/package-lock.json /opt/app/dist/
52+
53+
RUN echo "$SERVICE_CONFIG_ENCODED" | base64 -d | jq > /opt/app/dist/configuration.json
54+
55+
RUN apk add zip \
56+
&& cd /opt/app/dist \
57+
&& zip -r /tmp/package.zip .
58+

0 commit comments

Comments
 (0)