Jon Chery
031887ec56
Contract surface redesign: - New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title), infrastructure (map keyed by module name, replaces module:) - Drop uses: field (dead reference; version pin lives in CI workflow uses: line) - Drop top-level module/inputs (now nested under infrastructure map) - Per-module optional version (defaults to latest published from registry) - Multi-module contracts: one file deploys N modules in one pipeline run, resource IDs namespaced with module name to avoid collisions - stack.schema.json: add optional title field for display name Rename: - pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline) - pipelines/ci.yaml → pipelines/ci.yml - All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies) - .acdl/contract.yaml → .acdl/contract.yml Resolver (core/contract_resolver.py): - Rewrite resolve() to loop infrastructure map, default version to latest, merge module fragments into one stack with namespaced resource IDs - _latest_version() picks highest non-deprecated from registry - _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module - Single-module path: unprefixed IDs (backward compatible) Verification: - 494 tests pass (0 contract-shape failures) - Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox) ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci---
150 lines
4.3 KiB
Markdown
150 lines
4.3 KiB
Markdown
# static-assets — Production static asset stack (S3 + CloudFront + WAF)
|
|
|
|
> **Module kind:** module pattern | **Version:** 1.0.0
|
|
|
|
A production-ready pattern that references the `s3`, `cloudfront`, and
|
|
`waf` primitives to deploy a static asset site with a CloudFront CDN
|
|
edge (S3 origin via Origin Access Control) and WAF protection. A simpler
|
|
S3-only variation is documented below.
|
|
|
|
## Resources
|
|
|
|
The pattern references these primitives:
|
|
|
|
| Primitive | Purpose | README |
|
|
|-----------|---------|--------|
|
|
| `s3` | S3 bucket (origin) | [README](../l1/s3/README.md) |
|
|
| `cloudfront` | CloudFront distribution + OAC | [README](../l1/cloudfront/README.md) |
|
|
| `waf` | WAFv2 Web ACL (CloudFront-scoped) | [README](../l1/waf/README.md) |
|
|
|
|
## Inputs
|
|
|
|
| Name | Type | Required | Description |
|
|
|------|------|----------|-------------|
|
|
| `bucket_name` | string | yes | Globally-unique S3 bucket name |
|
|
| `region` | string | yes | AWS region the bucket is created in |
|
|
|
|
## Outputs
|
|
|
|
| Name | Type | Description |
|
|
|------|------|-------------|
|
|
| `distribution_domain_name` | string | The CloudFront distribution domain name |
|
|
| `bucket_arn` | arn | The S3 bucket ARN |
|
|
| `web_acl_arn` | arn | The WAF Web ACL ARN |
|
|
|
|
## Usage
|
|
|
|
Define a contract referencing this module (the production stack —
|
|
S3 + CloudFront + WAF):
|
|
|
|
```yaml
|
|
environment: dev
|
|
id: assets
|
|
infrastructure:
|
|
static-assets:
|
|
inputs:
|
|
bucket_name: my-static-assets
|
|
region: us-east-1
|
|
version: 1.0.0
|
|
name: static-assets
|
|
```
|
|
|
|
The composition wires the s3 bucket regional domain name to the
|
|
CloudFront origin and the WAF web ACL ARN to the CloudFront distribution
|
|
automatically.
|
|
|
|
### Simpler variation (S3 only)
|
|
|
|
For a simple S3-only static asset site (no CDN, no WAF), a consumer can
|
|
declare a contract that references the `s3` primitive directly:
|
|
|
|
```yaml
|
|
environment: dev
|
|
id: assets
|
|
infrastructure:
|
|
static-assets:
|
|
inputs:
|
|
bucket_name: my-static-assets
|
|
region: us-east-1
|
|
version: 1.0.0
|
|
name: static-assets
|
|
```
|
|
|
|
This deploys a single S3 bucket (no CloudFront edge, no WAF). Use this
|
|
for low-traffic internal sites where a CDN edge is not required.
|
|
|
|
See the [consumer guide](../../docs/consumer-guide.md) for a
|
|
step-by-step walkthrough, and the [s3](../l1/s3/README.md),
|
|
[cloudfront](../l1/cloudfront/README.md), and [waf](../l1/waf/README.md)
|
|
READMEs for the underlying primitives.
|
|
|
|
## Compliance extension points
|
|
|
|
The pattern can wire compliance resources when the compliance
|
|
milestone (GDPR, SOX, SOC2, DORA) lands:
|
|
|
|
- **KMS key** — shared encryption key for S3 SSE.
|
|
- **S3 access logs** — access logging to a separate audit bucket.
|
|
- **Object Lock** — 7-year immutable retention for evidence.
|
|
- **Public access block** — prevent data exfiltration.
|
|
- **CloudFront TLS/HTTPS** — viewer protocol policy defaults to
|
|
`redirect-to-https`; a custom ACM certificate can pin TLS to a
|
|
customer domain.
|
|
- **CloudFront geo restriction** — whitelist/blacklist countries for
|
|
data-residency compliance.
|
|
- **CloudFront logging** — access logs to an S3 bucket for auditability.
|
|
- **WAF rate limiting / geo blocking / custom rules / logging** — see
|
|
the [waf README](../l1/waf/README.md).
|
|
|
|
See the per-primitive READMEs for the per-module compliance extension
|
|
points.
|
|
|
|
## Examples
|
|
|
|
Validated example contracts are in [`examples/`](examples/). The platform-test
|
|
pipeline validates them against `schemas/contract.schema.json`.
|
|
|
|
### Simple
|
|
|
|
A minimal deployment (S3 bucket only — no CloudFront/WAF):
|
|
|
|
[`examples/simple.yml`](examples/simple.yml)
|
|
```yaml
|
|
environment: dev
|
|
id: assets
|
|
infrastructure:
|
|
static-assets:
|
|
inputs:
|
|
bucket_name: my-static-site
|
|
region: us-east-1
|
|
version: 1.0.0
|
|
name: static-assets
|
|
```
|
|
|
|
### Complex
|
|
|
|
A production deployment with optional inputs (S3 + CloudFront + WAF):
|
|
|
|
[`examples/complex.yml`](examples/complex.yml)
|
|
```yaml
|
|
environment: dev
|
|
id: assets
|
|
infrastructure:
|
|
static-assets:
|
|
inputs:
|
|
bucket_name: my-production-static-site
|
|
default_ttl: 3600
|
|
max_ttl: 86400
|
|
price_class: PriceClass_100
|
|
region: us-east-1
|
|
viewer_protocol_policy: redirect-to-https
|
|
waf_enabled: true
|
|
version: 1.0.0
|
|
name: static-assets
|
|
```
|
|
|
|
## Versioning
|
|
|
|
`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
|
|
require a new registry entry (immutable publication); old entries enter
|
|
a 12-month deprecation window. |