# static-assets — Production static asset stack (S3 + CloudFront + WAF)

> **Module kind:** module pattern  |  **Version:** 1.0.0

A production-ready pattern that references the `s3`, `cloudfront`, and
`waf` primitives to deploy a static asset site with a CloudFront CDN
edge (S3 origin via Origin Access Control) and WAF protection. A simpler
S3-only variation is documented below.

## Resources

The pattern references these primitives:

| Primitive | Purpose | README |
|-----------|---------|--------|
| `s3` | S3 bucket (origin) | [README](../l1/s3/README.md) |
| `cloudfront` | CloudFront distribution + OAC | [README](../l1/cloudfront/README.md) |
| `waf` | WAFv2 Web ACL (CloudFront-scoped) | [README](../l1/waf/README.md) |

## Inputs

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `bucket_name` | string | yes | Globally-unique S3 bucket name |
| `region` | string | yes | AWS region the bucket is created in |

## Outputs

| Name | Type | Description |
|------|------|-------------|
| `distribution_domain_name` | string | The CloudFront distribution domain name |
| `bucket_arn` | arn | The S3 bucket ARN |
| `web_acl_arn` | arn | The WAF Web ACL ARN |

## Usage

Define a contract referencing this module (the production stack —
S3 + CloudFront + WAF):

```yaml
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
  bucket_name: my-static-assets
  region: us-east-1
```

The composition wires the s3 bucket regional domain name to the
CloudFront origin and the WAF web ACL ARN to the CloudFront distribution
automatically.

### Simpler variation (S3 only)

For a simple S3-only static asset site (no CDN, no WAF), a consumer can
declare a contract that references the `s3` primitive directly:

```yaml
uses: acdl/pipelines/deploy.yaml@v1.6
module: s3
environment: dev
inputs:
  bucket_name: my-static-assets
  region: us-east-1
```

This deploys a single S3 bucket (no CloudFront edge, no WAF). Use this
for low-traffic internal sites where a CDN edge is not required.

See the [consumer guide](../../docs/consumer-guide.md) for a
step-by-step walkthrough, and the [s3](../l1/s3/README.md),
[cloudfront](../l1/cloudfront/README.md), and [waf](../l1/waf/README.md)
READMEs for the underlying primitives.

## Compliance extension points

The pattern can wire compliance resources when the compliance
milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:

- **KMS key** — shared encryption key for S3 SSE.
- **S3 access logs** — access logging to a separate audit bucket.
- **Object Lock** — 7-year immutable retention for evidence.
- **Public access block** — prevent data exfiltration.
- **CloudFront TLS/HTTPS** — viewer protocol policy defaults to
  `redirect-to-https`; a custom ACM certificate can pin TLS to a
  customer domain.
- **CloudFront geo restriction** — whitelist/blacklist countries for
  data-residency compliance.
- **CloudFront logging** — access logs to an S3 bucket for auditability.
- **WAF rate limiting / geo blocking / custom rules / logging** — see
  the [waf README](../l1/waf/README.md).

See the per-primitive READMEs for the per-module compliance extension
points.

## Examples

Validated example contracts are in [`examples/`](examples/). The platform-test
pipeline validates them against `schemas/contract.schema.json`.

### Simple

A minimal deployment (S3 bucket only — no CloudFront/WAF):

[`examples/simple.yaml`](examples/simple.yaml)
```yaml
# Simple static-assets deployment (S3 bucket only — no CloudFront/WAF)
# This is the simplest way to deploy a static site: just an S3 bucket.
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
  bucket_name: my-static-site
  region: us-east-1
```

### Complex

A production deployment with optional inputs (S3 + CloudFront + WAF):

[`examples/complex.yaml`](examples/complex.yaml)
```yaml
# Complex static-assets deployment (S3 + CloudFront + WAF)
# The full production stack: S3 origin + CloudFront CDN edge + WAF protection.
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
  bucket_name: my-production-static-site
  region: us-east-1
  price_class: PriceClass_100
  viewer_protocol_policy: redirect-to-https
  default_ttl: 3600
  max_ttl: 86400
  waf_enabled: true
```

## Versioning

`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.