S3_Static_Website

This module allows the creation of a static S3 website, with Cloudfront as the CDN, with automatic ACM and Route53 configurations.

Motivation

I have seen modules that do exactly what I'm doing here a few times, but they always seem to be in a flat structure (nothing wrong with that!). I thought it may provide a little more value if we could separate the provisioning of ACM / Route53 into it's own module, since it accomplishes one goal. For instance, I may want to provision a cert and dns records, but not necessarily for a static S3 bucket. The s3_static_website module still isn't fully standalone yet, but hopefully with a few minor tweaks I can get that working as well :)

Optionally you can also use this module to:

• Deploy a redirect bucket to redirect www to non-www.
• Enable KMS encryption on your S3 log buckets.
• Enable KMS key rotation.
• Enable access logging for buckets and Cloudfront.
• Apply IaM policies so only Cloudfront can access your buckets directly.

This module can be ran stand-alone with just a .tfvars file / env variables; or you may couple it with other modules for CI/CD, etc.

If you notice any issues with the module, please raise an issue! I'm here to help! I plan on using my modules in a personal project, so I want them to be top-notch!

Please Note While I have tried to follow the best security practices out-of-the-box, there is still some recommended setup. Please consider creating a WAF (Web application Firewall) in front of your cloudfront distribution. It is highly recommended that you use one, especially in a production environment. That said, WAF's are very situation-specific, so I cannot guess how your setup should behave. WAF Terraform Docs. Last but not least, you may also want to add a Lambda@Edge function between cloudfront and your bucket, to add an extra layer of security headers.

Running the module

To run the module, simply plug in the values below into a .tfvars file or export the equivalent env variables, and run the below commands

• terraform init
• terraform plan (make sure you like what you see on the console before going to the next step!)
• terraform apply

Example

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "3.59.0"
    }
  }
}

module "aws_static_website" {
  source = "https://github.com/millbj92/terraform-aws-s3-static-website-cloudfront-ssl-r53"
  //common
  domain_name = var.domain_name

  //s3_static_site specific
  use_default_domain     = var.use_default_domain
  logging                = var.logging
  use_bucket_encryption  = var.use_bucket_encryption
  enable_key_rotation    = var.enable_key_rotation
  tags                   = var.tags
  deploy_redirect_bucket = var.deploy_redirect_bucket
  force_destroy          = var.force_destroy

  //acm & Route53 specific
  subject_alternative_name_prefixes = var.subject_alternative_name_prefixes
  hosted_zone                       = var.hosted_zone
  acm_certificate_domain            = var.acm_certificate_domain
  preprod_env_prefixes              = var.preprod_env_prefixes
}

 

Documentation

Requirements

No requirements.

Providers

Name	Version
aws	3.59.0

Modules

Name	Source	Version
acm	./acm	n/a
s3_static_website	./s3_static_website	n/a

Resources

Name	Type
aws_route53_record.website_cdn_root_record	resource
aws_route53_zone.main	data source

Inputs

Name	Description	Type
domain_name	Domain name. Must be unique, and already registered.	string
hosted_zone	The root domain of your website. No subdomains. (example.com)	string
acm_certificate_domain	Domain of the ACM certificate	string
aws_certificate_arn	ARN for SSL certificate. Only needed for custom domain names.	string
deploy_redirect_bucket	Set this to true to deploy a bucket what will redirect from www to non-www	bool
enable_key_rotation	Set this to true in order to enable key rotation. Only works if use_bucket_encryption is true. Recommend setting to true so you don't get locked out of your buckets!	bool
force_destroy	This value will force-delete your buckets with files sill inside. You have been warned. Do not use in Prod.	bool
log_cookies	Log cookies in cloudfront. Only works in logging is true.	bool
logging	Use logging for resources. Will create an extra bucket.	bool
preprod_env_prefixes	Use these to register subdomains in Route53. Leave this empty if you don't want subdomains.	list(string)
price_class	CloudFront distribution price class	string
subject_alternative_name_prefixes	Alternative names for the domain. Wildcards mau be used. (*.example.com, etc)	list(string)
tags	Tags to set on the resources.	map(string)
use_bucket_encryption	Set this to true to encrypt your buckets with a KMS key.	bool
use_default_domain	Use CloudFront website address without Route53 and ACM certificate	string

Outputs

Name	Description
acm_certificate_arn	The ARN of the SSL certificate returned from ACM.
cloudfront_dist_id	Cloudfront Distribution ID for this site.
cloudfront_domain_name	The domain name used by your cloudfront distribution. If you are using the 'default_domain' variable, you would use this.
log_bucket_KMS_key_arn	The arn of the created KMS key for the logging bucket. Used for encrypting/decrypting the bucket.
s3_domain_name	The domain name of your S3 bucket. For reference only. Either use the Cloudfront Distrobution, or 'website_address' output.
s3_log_bucket_arn	The arn of the created s3 logging bucket.
s3_log_bucket_name	The name of the created s3 logging bucket
website_address	If not using the 'default_domain' variable, this will return your Route53 domain name.
website_bucket_arn	The arn of the created s3 website bucket.
website_bucket_name	The name of the created s3 website bucket.