Files

T

Jon Chery 031887ec56 refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

2026-07-27 21:37:40 +00:00

4.3 KiB

Raw Blame History

static-assets — Production static asset stack (S3 + CloudFront + WAF)

Module kind: module pattern | Version: 1.0.0

A production-ready pattern that references the s3, cloudfront, and waf primitives to deploy a static asset site with a CloudFront CDN edge (S3 origin via Origin Access Control) and WAF protection. A simpler S3-only variation is documented below.

Resources

The pattern references these primitives:

Primitive	Purpose	README
`s3`	S3 bucket (origin)	README
`cloudfront`	CloudFront distribution + OAC	README
`waf`	WAFv2 Web ACL (CloudFront-scoped)	README

Inputs

Name	Type	Required	Description
`bucket_name`	string	yes	Globally-unique S3 bucket name
`region`	string	yes	AWS region the bucket is created in

Outputs

Name	Type	Description
`distribution_domain_name`	string	The CloudFront distribution domain name
`bucket_arn`	arn	The S3 bucket ARN
`web_acl_arn`	arn	The WAF Web ACL ARN

Usage

Define a contract referencing this module (the production stack — S3 + CloudFront + WAF):

environment: dev
id: assets
infrastructure:
  static-assets:
    inputs:
      bucket_name: my-static-assets
      region: us-east-1
    version: 1.0.0
name: static-assets

The composition wires the s3 bucket regional domain name to the CloudFront origin and the WAF web ACL ARN to the CloudFront distribution automatically.

Simpler variation (S3 only)

For a simple S3-only static asset site (no CDN, no WAF), a consumer can declare a contract that references the s3 primitive directly:

environment: dev
id: assets
infrastructure:
  static-assets:
    inputs:
      bucket_name: my-static-assets
      region: us-east-1
    version: 1.0.0
name: static-assets

This deploys a single S3 bucket (no CloudFront edge, no WAF). Use this for low-traffic internal sites where a CDN edge is not required.

See the consumer guide for a step-by-step walkthrough, and the s3, cloudfront, and waf READMEs for the underlying primitives.

Compliance extension points

The pattern can wire compliance resources when the compliance milestone (GDPR, SOX, SOC2, DORA) lands:

KMS key — shared encryption key for S3 SSE.
S3 access logs — access logging to a separate audit bucket.
Object Lock — 7-year immutable retention for evidence.
Public access block — prevent data exfiltration.
CloudFront TLS/HTTPS — viewer protocol policy defaults to redirect-to-https; a custom ACM certificate can pin TLS to a customer domain.
CloudFront geo restriction — whitelist/blacklist countries for data-residency compliance.
CloudFront logging — access logs to an S3 bucket for auditability.
WAF rate limiting / geo blocking / custom rules / logging — see the waf README.

See the per-primitive READMEs for the per-module compliance extension points.

Examples

Validated example contracts are in examples/. The platform-test pipeline validates them against schemas/contract.schema.json.

Simple

A minimal deployment (S3 bucket only — no CloudFront/WAF):

examples/simple.yml

environment: dev
id: assets
infrastructure:
  static-assets:
    inputs:
      bucket_name: my-static-site
      region: us-east-1
    version: 1.0.0
name: static-assets

Complex

A production deployment with optional inputs (S3 + CloudFront + WAF):

examples/complex.yml

environment: dev
id: assets
infrastructure:
  static-assets:
    inputs:
      bucket_name: my-production-static-site
      default_ttl: 3600
      max_ttl: 86400
      price_class: PriceClass_100
      region: us-east-1
      viewer_protocol_policy: redirect-to-https
      waf_enabled: true
    version: 1.0.0
name: static-assets

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

4.3 KiB Raw Blame History