Files

T

Jon Chery dca35c78ec feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump

---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---

2026-07-22 19:56:52 +00:00

3.0 KiB

Raw Blame History

cloudfront — CloudFront distribution

Module kind: primitive | Version: 1.0.0

A CloudFront distribution with an S3 origin via Origin Access Control (OAC). The distribution serves the bucket's static content from the global edge network with HTTPS redirection by default. An optional WAF web ACL can be associated to filter traffic before it reaches the origin.

Resources

Resource	Type	Purpose
`oac`	`aws_cloudfront_origin_access_control`	Origin Access Control signing the S3 origin
`distribution`	`aws_cloudfront_distribution`	The CloudFront distribution with an S3 origin via OAC

Inputs

Name	Type	Required	Default	Description
`bucket_regional_domain_name`	string	yes	—	The S3 bucket regional domain name (ref to s3 origin)
`price_class`	string	no	`PriceClass_100`	CloudFront price class
`viewer_protocol_policy`	string	no	`redirect-to-https`	Viewer protocol policy
`default_ttl`	number	no	3600	Default TTL in seconds
`max_ttl`	number	no	86400	Max TTL in seconds
`waf_web_acl_arn`	string	no	—	WAF web ACL ARN to associate (ref to waf)
`region`	string	yes	—	AWS region (CloudFront is global but the provider region is used for the OAC)

Outputs

Name	Type	Description
`distribution_arn`	arn	The CloudFront distribution ARN
`distribution_domain_name`	string	The CloudFront distribution domain name (e.g. d111111abcdef8.cloudfront.net)
`oac_id`	string	The Origin Access Control ID

Usage

{
  "id": "cloudfront",
  "type": "aws:cloudfront:distribution",
  "module": "cloudfront@1.0.0",
  "inputs": {
    "bucket_regional_domain_name": "ref:s3.bucket_regional_domain_name",
    "price_class": "PriceClass_100",
    "viewer_protocol_policy": "redirect-to-https",
    "default_ttl": 3600,
    "max_ttl": 86400,
    "waf_web_acl_arn": "ref:waf.web_acl_arn",
    "region": "us-east-1"
  }
}

The bucket_regional_domain_name and waf_web_acl_arn inputs are typically wired as ref: expressions from the s3 and waf primitives inside a module composition (see modules/l2/static-assets).

Compliance extension points

TLS/HTTPS — viewer protocol policy defaults to redirect-to-https; a custom ACM certificate + viewer_certificate block can pin TLS to a customer domain (SOC2 CC6.1, GDPR Art.32).
Geo restriction — the restrictions.geo_restriction block can whitelist/blacklist countries for data-residency compliance (GDPR Art.44, SOC2 CC6.1).
Logging — CloudFront access logs to an S3 bucket for auditability (SOC2 CC7.2, DORA audit trail).
Field-level encryption — add field-level encryption for PII fields in POST bodies (HIPAA §164.312(a)(2)(iv), GDPR Art.32).

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

3.0 KiB Raw Blame History