Skip to content

AWS CDK Construct to Enforce API Gateway or Application Load Balancer traffic via CloudFront.

License

Notifications You must be signed in to change notification settings

alma-cdk/origin-verify

Repository files navigation



Alma CDK Origin Verify

npm i -D @alma-cdk/origin-verify

Enforce API Gateway REST API, AppSync GraphQL API, or Application Load Balancer traffic via CloudFront by generating a Secrets Manager secret value which is used as a CloudFront Origin Custom header and a WAFv2 WebACL header match rule.



diagram


Essentially this is an implementation of AWS SolutionEnhance Amazon CloudFront Origin Security with AWS WAF and AWS Secrets Manager” without the secret rotation.


🚧   Project Stability

experimental

This construct is still versioned with v0 major version and breaking changes might be introduced if necessary (without a major version bump), though we aim to keep the API as stable as possible (even within v0 development). We aim to publish v1.0.0 soon and after that breaking changes will be introduced via major version bumps.


Getting Started

import { OriginVerify } from '@alma-cdk/origin-verify';
import { Distribution } from 'aws-cdk-lib/aws-cloudfront';
const api: RestApi; // TODO: implement the RestApi
const apiDomain: string; // TODO: implement the domain

const verification = new OriginVerify(this, 'OriginVerify', {
  origin: api.deploymentStage,
});

new Distribution(this, 'CDN', {
  defaultBehavior: {
    origin: new HttpOrigin(apiDomain, {
      customHeaders: {
        [verification.headerName]: verification.headerValue,
      },
      protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
    })
  },
})

For more detailed example usage see /examples directory.


Custom Secret Value

Additionally, you may pass in custom secretValue if you don't want to use a generated secret (which you should use in most cases):

const myCustomValue = SecretValue.unsafePlainText('foobar');

const verification = new OriginVerify(this, 'OriginVerify', {
  origin: api.deploymentStage,
  secretValue: myCustomValue,
});

Notes

Use OriginProtocolPolicy.HTTPS_ONLY!

In your CloudFront distribution Origin configuration use OriginProtocolPolicy.HTTPS_ONLY to avoid exposing the verification.headerValue secret to the world.

Why secretValue.unsafeUnwrap()?

Internally this construct creates the headerValue by using AWS Secrets Manager but the secret value is exposed directly by using secretValue.unsafeUnwrap() method: This is:

  • required, because we must be able to set it into the WAFv2 WebACL rule
  • required, because you must be able to set it into the CloudFront Origin Custom Header
  • okay, because it's meant to protect the API externally and it's not considered as a secret that should be kept – well – secret within your AWS account