Skip to content

Commit 02cc39b

Browse files
Stretch96Stretch96
authored
Merge pull request #20 from chris-qa-org/cloudfront-invalidation-on-publii-push
CloudFront invalidation on Publii push
2 parents 29b2ffb + 47f49f3 commit 02cc39b

File tree

6 files changed

+90
-0
lines changed

6 files changed

+90
-0
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,6 @@ override.tf.json
2727

2828
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
2929
# example: *tfplan*
30+
31+
# tfsec
32+
.tfsec

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Terraform module to host a static site generated by Publii
3535
| [aws_kms_key.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
3636
| [aws_kms_key.s3_bucket_frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
3737
| [aws_kms_key.s3_bucket_frontend_www_redirect](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
38+
| [aws_lambda_permission.cloudfront_invalidation_frontend_alllow_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
3839
| [aws_s3_bucket.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
3940
| [aws_s3_bucket.frontend_www_redirect](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
4041
| [aws_s3_bucket.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
@@ -43,6 +44,7 @@ Terraform module to host a static site generated by Publii
4344
| [aws_s3_bucket_acl.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |
4445
| [aws_s3_bucket_logging.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
4546
| [aws_s3_bucket_logging.frontend_www_redirect](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_logging) | resource |
47+
| [aws_s3_bucket_notification.frontend_cloudfront_invalidation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |
4648
| [aws_s3_bucket_policy.frontend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
4749
| [aws_s3_bucket_policy.frontend_www_redirect](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
4850
| [aws_s3_bucket_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
@@ -66,6 +68,7 @@ Terraform module to host a static site generated by Publii
6668
| [template_file.frontend_www_redirect_bucket_cloudfront_read](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
6769
| [template_file.frontend_www_redirect_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
6870
| [template_file.frontend_www_redirect_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
71+
| [template_file.lambda_cloudfront_invalidation_frontend_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
6972
| [template_file.logs_bucket_enforce_tls_statement](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7073
| [template_file.logs_bucket_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
7174
| [template_file.publii_s3_frontend_policy](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |

‎lambda-cloudfront-invalidation-frontend.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
data "template_file" "lambda_cloudfront_invalidation_frontend_policy" {
2+
template = file("${path.module}/policies/cloudfront-invalidation.json.tpl")
3+
4+
vars = {
5+
cloudfront_arn = aws_cloudfront_distribution.frontend.arn
6+
}
7+
}
8+
9+
module "lambda_cloudfront_invalidation_frontend" {
10+
source = "github.com/claranet/terraform-aws-lambda?ref=v1.4.0"
11+
12+
function_name = "${local.project_name}-cloudfront-invalidation-frontend"
13+
description = "${local.project_name} CloudFront invalidation frontend"
14+
handler = "function.lambda_handler"
15+
runtime = "python3.9"
16+
timeout = 900
17+
memory_size = 128
18+
19+
source_path = "${path.module}/lambdas/cloudfront-invalidation/function.py"
20+
21+
policy = {
22+
json = data.template_file.lambda_cloudfront_invalidation_frontend_policy.rendered
23+
}
24+
25+
tracing_config = {
26+
mode = "Active"
27+
}
28+
29+
environment = {
30+
variables = {
31+
cloudFrontDistributionId = aws_cloudfront_distribution.frontend.id
32+
}
33+
}
34+
}
35+
36+
resource "aws_lambda_permission" "cloudfront_invalidation_frontend_alllow_s3" {
37+
statement_id = "AllowExecutionFromS3Bucket"
38+
action = "lambda:InvokeFunction"
39+
function_name = module.lambda_cloudfront_invalidation_frontend.function_name
40+
principal = "s3.amazonaws.com"
41+
source_arn = aws_s3_bucket.frontend.arn
42+
}

‎lambdas/cloudfront-invalidation/function.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import boto3
2+
import time
3+
import os
4+
import json
5+
6+
def lambda_handler(event, context):
7+
client = boto3.client('cloudfront')
8+
response = client.create_invalidation(
9+
DistributionId=os.environ['cloudFrontDistributionId'],
10+
InvalidationBatch={
11+
'Paths': {
12+
'Quantity': 1,
13+
'Items': [
14+
'/*',
15+
]
16+
},
17+
'CallerReference': str(time.time())
18+
},
19+
)
20+
return json.dumps(response, default=str)

‎policies/cloudfront-invalidation.json.tpl‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": "cloudfront:CreateInvalidation",
6+
"Effect": "Allow",
7+
"Resource": "${cloudfront_arn}"
8+
}
9+
]
10+
}

‎s3-frontend.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,3 +105,15 @@ resource "aws_s3_bucket_policy" "frontend" {
105105
bucket = aws_s3_bucket.frontend.id
106106
policy = data.template_file.frontend_bucket_policy.rendered
107107
}
108+
109+
resource "aws_s3_bucket_notification" "frontend_cloudfront_invalidation" {
110+
bucket = aws_s3_bucket.frontend.id
111+
112+
lambda_function {
113+
lambda_function_arn = module.lambda_cloudfront_invalidation_frontend.function_arn
114+
events = ["s3:ObjectCreated:*"]
115+
filter_prefix = "files.publii.json"
116+
}
117+
118+
depends_on = [aws_lambda_permission.cloudfront_invalidation_frontend_alllow_s3]
119+
}

0 commit comments

Comments
 (0)