Jon Chery
0eb578c606
---ci---
project: acdl
phase: 28
milestone: v1.8
status: execute
---/ci---
P1-4: WAF custom rules now emit nested `rules { ... }` blocks per rule
instead of `rules = [...]` attribute syntax (invalid HCL).
P1-5: WAF default_action input is honored (allow/block) instead of
hardcoding `allow {}`. Default is `allow` when absent (backward compat).
P1-7: L2 composition outputs[] array is now processed by resolve_l2().
The resolver builds stack.outputs from the composition outputs wires.
The adapter emits `output` blocks from stack.outputs.
Tests: +10 (275 -> 285). All pass. run_platform.sh --check-only green.
112 lines
2.5 KiB
Terraform
112 lines
2.5 KiB
Terraform
resource "aws_s3_bucket" "s3" {
|
|
bucket = "acdl-spike-bucket"
|
|
versioning {
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
output "bucket_arn" {
|
|
value = aws_s3_bucket.s3.arn
|
|
}
|
|
|
|
output "bucket_name" {
|
|
value = aws_s3_bucket.s3.id
|
|
}
|
|
|
|
output "bucket_regional_domain_name" {
|
|
value = aws_s3_bucket.s3.bucket_regional_domain_name
|
|
}
|
|
|
|
resource "aws_cloudfront_distribution" "cloudfront-distribution" {
|
|
origin {
|
|
domain_name = aws_s3_bucket.s3.bucket_regional_domain_name
|
|
origin_access_control = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
|
|
s3_origin_config {}
|
|
}
|
|
enabled = true
|
|
default_cache_behavior {
|
|
viewer_protocol_policy = "redirect-to-https"
|
|
target_origin_id = "cloudfront-distribution"
|
|
min_ttl = 0
|
|
default_ttl = 3600
|
|
max_ttl = 86400
|
|
allowed_methods = ["GET", "HEAD"]
|
|
cached_methods = ["GET", "HEAD"]
|
|
}
|
|
price_class = "PriceClass_100"
|
|
restrictions {
|
|
geo_restriction {
|
|
restriction_type = "none"
|
|
}
|
|
}
|
|
viewer_certificate {
|
|
cloudfront_default_certificate = true
|
|
}
|
|
web_acl_id = aws_wafv2_web_acl.waf.arn
|
|
}
|
|
|
|
output "distribution_arn" {
|
|
value = aws_cloudfront_distribution.cloudfront-distribution.arn
|
|
}
|
|
|
|
output "distribution_domain_name" {
|
|
value = aws_cloudfront_distribution.cloudfront-distribution.domain_name
|
|
}
|
|
|
|
resource "aws_cloudfront_origin_access_control" "cloudfront-originaccesscontrol" {
|
|
name = "acdl-oac"
|
|
origin_access_control_origin_type = "s3"
|
|
origin_access_control_signing_behavior = "always"
|
|
}
|
|
|
|
output "oac_id" {
|
|
value = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
|
|
}
|
|
|
|
resource "aws_wafv2_web_acl" "waf" {
|
|
name = "acdl-waf"
|
|
scope = "cloudfront"
|
|
default_action {
|
|
allow {}
|
|
}
|
|
visibility_config {
|
|
cloudwatch_metrics_enabled = true
|
|
metric_name = "acdl-waf-metrics"
|
|
sampled_requests_enabled = true
|
|
}
|
|
rules {
|
|
name = "aws-managed-rules"
|
|
priority = 0
|
|
override_action {
|
|
none {}
|
|
}
|
|
statement {
|
|
managed_rule_group_statement {
|
|
name = "AWSManagedRulesCommonRuleSet"
|
|
vendor_name = "AWS"
|
|
}
|
|
}
|
|
visibility_config {
|
|
cloudwatch_metrics_enabled = true
|
|
metric_name = "aws-managed-rules-metrics"
|
|
sampled_requests_enabled = true
|
|
}
|
|
}
|
|
}
|
|
|
|
output "web_acl_arn" {
|
|
value = aws_wafv2_web_acl.waf.arn
|
|
}
|
|
|
|
output "distribution_domain_name" {
|
|
value = aws_cloudfront_distribution.cloudfront-distribution.domain_name
|
|
}
|
|
|
|
output "bucket_arn" {
|
|
value = aws_s3_bucket.s3.arn
|
|
}
|
|
|
|
output "web_acl_arn" {
|
|
value = aws_wafv2_web_acl.waf.arn
|
|
}
|