Jon Chery
4bd07a4fae
Add modules/<name>/examples/ directories with simple.yaml + complex.yaml (+ mysql.yaml for RDS) for every primitive and module pattern. All 25 example contracts validate against schemas/contract.schema.json. Update the contract schema to allow object/array input values (for env vars). Fix the platform-test schema-validation glob to modules/*/*/examples/*.yaml to match the nested l1/l2 path structure. Update the microservice sample contract note (env objects now permitted by the schema). ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---
static-assets — Production static asset stack (S3 + CloudFront + WAF)
Module kind: module pattern | Version: 1.0.0
A production-ready pattern that references the s3, cloudfront, and
waf primitives to deploy a static asset site with a CloudFront CDN
edge (S3 origin via Origin Access Control) and WAF protection. A simpler
S3-only variation is documented below.
Resources
The pattern references these primitives:
| Primitive | Purpose | README |
|---|---|---|
s3 |
S3 bucket (origin) | README |
cloudfront |
CloudFront distribution + OAC | README |
waf |
WAFv2 Web ACL (CloudFront-scoped) | README |
Inputs
| Name | Type | Required | Description |
|---|---|---|---|
bucket_name |
string | yes | Globally-unique S3 bucket name |
region |
string | yes | AWS region the bucket is created in |
Outputs
| Name | Type | Description |
|---|---|---|
distribution_domain_name |
string | The CloudFront distribution domain name |
bucket_arn |
arn | The S3 bucket ARN |
web_acl_arn |
arn | The WAF Web ACL ARN |
Usage
Define a contract referencing this module (the production stack — S3 + CloudFront + WAF):
uses: acdl/pipelines/deploy.yaml@v1.6
module: static-assets
environment: dev
inputs:
bucket_name: my-static-assets
region: us-east-1
The composition wires the s3 bucket regional domain name to the CloudFront origin and the WAF web ACL ARN to the CloudFront distribution automatically.
Simpler variation (S3 only)
For a simple S3-only static asset site (no CDN, no WAF), a consumer can
declare a contract that references the s3 primitive directly:
uses: acdl/pipelines/deploy.yaml@v1.6
module: s3
environment: dev
inputs:
bucket_name: my-static-assets
region: us-east-1
This deploys a single S3 bucket (no CloudFront edge, no WAF). Use this for low-traffic internal sites where a CDN edge is not required.
See the consumer guide for a step-by-step walkthrough, and the s3, cloudfront, and waf READMEs for the underlying primitives.
Compliance extension points
The pattern can wire compliance resources when the compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
- KMS key — shared encryption key for S3 SSE.
- S3 access logs — access logging to a separate audit bucket.
- Object Lock — 7-year immutable retention for evidence.
- Public access block — prevent data exfiltration.
- CloudFront TLS/HTTPS — viewer protocol policy defaults to
redirect-to-https; a custom ACM certificate can pin TLS to a customer domain. - CloudFront geo restriction — whitelist/blacklist countries for data-residency compliance.
- CloudFront logging — access logs to an S3 bucket for auditability.
- WAF rate limiting / geo blocking / custom rules / logging — see the waf README.
See the per-primitive READMEs for the per-module compliance extension points.
Versioning
1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.