Cloudfront in front of ALB

[afgallo]

Hi there,

Wondering if anyone has an addon example on how to add a cloudfront distribution in front of an ALB and lock down the ALB to serve traffic only from Cloudfront?

Thanks!

[afgallo]

Hi @efekarakus would love your view on the below, just not sure whether I'm using the right variable names on my Ref statements, namely PublicLoadBalancerDNSName, DomainNameRecordSet, EnvironmentHostedZone and HTTPCert. This would help me mitigate #2602 before v.1.9.0 is released. And I also think having CloudFront in front of my front-end service is a really good architecture option too 😃

Cheers,
Andre

AWSTemplateFormatVersion: '2010-09-09'
Description: Cloudfront instance for the front-end service

Parameters:
  App:
    Type: String
    Description: Your application's name.
  Env:
    Type: String
    Description: The environment name your service, job, or workflow is being deployed to.
  Name:
    Type: String
    Description: The name of the service, job, or workflow being deployed.

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
        - Id: alb
          DomainName: !Ref PublicLoadBalancerDNSName
          OriginPath: /
          CustomOriginConfig:
            HTTPSPort: 443
            OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          AllowedMethods:
          - GET
          - HEAD
          - OPTIONS
          CachedMethods:
          - GET
          - HEAD
          - OPTIONS
          Compress: true
          DefaultTTL: 3600 # in seconds
          ForwardedValues:
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: all
              Headers:
                - Access-Control-Request-Headers
                - Access-Control-Request-Method
                - Origin
                - Authorization
                - Accept
                - Accept-Encoding
          MaxTTL: 86400 # in seconds
          MinTTL: 60 # in seconds
          TargetOriginId: alb
          ViewerProtocolPolicy: redirect-to-https
        CustomErrorResponses:
        - ErrorCode: 403
          ResponseCode: 200
          ResponsePagePath: '/index.html'
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Aliases:
          - !Sub ${Env}.${App}.domain.com
        PriceClass: PriceClass_All
        ViewerCertificate:
          AcmCertificateArn: !Ref HTTPSCert
          SslSupportMethod: sni-only
          MinimumProtocolVersion: TLSv1.2_2018

  DNSARecord:
    Type: AWS::Route53::RecordSetGroup
    Properties:
      HostedZoneName: !Join ['', [!Sub ${Env}.${App}.domain.com, .]]
      RecordSets:
      - Name: !Ref DomainNameRecordSet
        Type: A
        AliasTarget:
          HostedZoneId: !Ref EnvironmentHostedZone
          DNSName: !GetAtt CloudFrontDistribution.DomainName

Outputs:
  CloudFrontDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName

[huanjani]

Hi, @afgallo! Hope this helps:

👍🏼 PublicLoadBalancerDNSName:

copilot-cli/templates/environment/cf.yml

Line 322 in ea29075

PublicLoadBalancerDNSName:

👎🏼 DomainNameRecordSet:

copilot-cli/templates/workloads/services/lb-web/cf.yml

Lines 169 to 188 in 1ba3833

	LoadBalancerDNSAlias:
	Type: AWS::Route53::RecordSetGroup
	Condition: HTTPSLoadBalancer
	Properties:
	HostedZoneId:
	Fn::ImportValue:
	!Sub "${AppName}-${EnvName}-HostedZone"
	Comment: !Sub "LoadBalancer alias for service ${WorkloadName}"
	RecordSets:
	- Name:
	!Join
	- '.'
	- - !Ref WorkloadName
	- Fn::ImportValue:
	!Sub "${AppName}-${EnvName}-SubDomain"
	- ""
	Type: A
	AliasTarget:
	HostedZoneId: !GetAtt EnvControllerAction.PublicLoadBalancerHostedZone
	DNSName: !GetAtt EnvControllerAction.PublicLoadBalancerDNSName

👍🏼 EnvironmentHostedZone:

copilot-cli/templates/environment/cf.yml

Line 274 in ea29075

EnvironmentHostedZone:

👍🏼 HTTPSCert:

copilot-cli/templates/environment/partials/custom-resources.yml

Line 25 in d8f9ac5

HTTPSCert:

[afgallo]

Hi @huanjani, thanks for your reply.

• An Addons CloudFormation Stack for your additional AWS resources [rollback complete] [13.4s]
  No export named HTTPSCert found. Rollback requested by user.

Unfortunately, it doesn't look like the stack outputs HTTPSCert. Is there any other way to get this? I can hard code it for now but that isn't ideal.

UPDATE:

This also makes me realise that CloudFront needs a certificate in us-east-1 and I use a different region. I'll probably have to create a cert from within my addon template.

[huanjani]

Hi @afgallo!

What if you were to remove those four lines of your ViewerCertificate field? (It's not required: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-viewercertificate)
Then you can hard-code the cert field via the console or the aws-cli...though maybe that is how you're currently hard-coding it.

There could be security implications in outputting HTTPSCert from the stack.

And yes--CloudFront's us-east-1 requirement for ACM certs adds another layer of fun! 😄