Skip to content

Commit 6be4cf6

Browse files
bradleadbradlead
authored
fix(cloudfront): OriginShield not easily disabled once enabled on an origin (#22791)
Fixes #22233. Previous PR now closed #22334. Added new prop originShieldEnabled as suggested by @corymhall which can be set to false if the user needs to explicitly disable origin shield. Updated unit test origin.test.ts Added new integ test. ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent b25e526 commit 6be4cf6

12 files changed

+449
-6
lines changed

‎packages/@aws-cdk/aws-cloudfront-origins/test/http-origin.test.ts

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ test('Renders minimal example with just a domain name', () => {
1919
expect(originBindConfig.originProperty).toEqual({
2020
id: 'StackOrigin029E19582',
2121
domainName: 'www.example.com',
22+
originCustomHeaders: undefined,
23+
originPath: undefined,
2224
customOriginConfig: {
2325
originProtocolPolicy: 'https-only',
2426
originSslProtocols: [

‎packages/@aws-cdk/aws-cloudfront/lib/origin.ts

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,13 @@ export interface OriginOptions {
8282
*/
8383
readonly originShieldRegion?: string;
8484

85+
/**
86+
* Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false.
87+
*
88+
* @default - true
89+
*/
90+
readonly originShieldEnabled?: boolean;
91+
8592
/**
8693
* A unique identifier for the origin. This value must be unique within the distribution.
8794
*
@@ -114,6 +121,7 @@ export interface OriginBindOptions {
114121
readonly originId: string;
115122
}
116123

124+
117125
/**
118126
* Represents a distribution origin, that describes the Amazon S3 bucket, HTTP server (for example, a web server),
119127
* Amazon MediaStore, or other server from which CloudFront gets your files.
@@ -124,7 +132,8 @@ export abstract class OriginBase implements IOrigin {
124132
private readonly connectionTimeout?: Duration;
125133
private readonly connectionAttempts?: number;
126134
private readonly customHeaders?: Record<string, string>;
127-
private readonly originShieldRegion?: string
135+
private readonly originShieldRegion?: string;
136+
private readonly originShieldEnabled: boolean;
128137
private readonly originId?: string;
129138

130139
protected constructor(domainName: string, props: OriginProps = {}) {
@@ -139,6 +148,7 @@ export abstract class OriginBase implements IOrigin {
139148
this.customHeaders = props.customHeaders;
140149
this.originShieldRegion = props.originShieldRegion;
141150
this.originId = props.originId;
151+
this.originShieldEnabled = props.originShieldEnabled ?? true;
142152
}
143153

144154
/**
@@ -162,7 +172,7 @@ export abstract class OriginBase implements IOrigin {
162172
originCustomHeaders: this.renderCustomHeaders(),
163173
s3OriginConfig,
164174
customOriginConfig,
165-
originShield: this.renderOriginShield(this.originShieldRegion),
175+
originShield: this.renderOriginShield(this.originShieldEnabled, this.originShieldRegion),
166176
},
167177
};
168178
}
@@ -200,10 +210,11 @@ export abstract class OriginBase implements IOrigin {
200210
/**
201211
* Takes origin shield region and converts to CfnDistribution.OriginShieldProperty
202212
*/
203-
private renderOriginShield(originShieldRegion?: string): CfnDistribution.OriginShieldProperty | undefined {
204-
return originShieldRegion
205-
? { enabled: true, originShieldRegion }
206-
: undefined;
213+
private renderOriginShield(originShieldEnabled: boolean, originShieldRegion?: string): CfnDistribution.OriginShieldProperty | undefined {
214+
if (!originShieldEnabled) {
215+
return { enabled: false };
216+
}
217+
return originShieldRegion ? { enabled: true, originShieldRegion } : undefined;
207218
}
208219
}
209220

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/cdk.out

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/integ-distribution-origin-shield.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"2dad510c7288df819a57567a15bdbfd3396640d1c4a5b7dbb139c67cc8cd290a": {
5+
"source": {
6+
"path": "integ-distribution-origin-shield.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "2dad510c7288df819a57567a15bdbfd3396640d1c4a5b7dbb139c67cc8cd290a.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/integ-distribution-origin-shield.template.json

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"Resources": {
3+
"DistB3B78991": {
4+
"Type": "AWS::CloudFront::Distribution",
5+
"Properties": {
6+
"DistributionConfig": {
7+
"DefaultCacheBehavior": {
8+
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
9+
"Compress": true,
10+
"TargetOriginId": "integdistributionoriginshieldDistOrigin11F51234E",
11+
"ViewerProtocolPolicy": "allow-all"
12+
},
13+
"Enabled": true,
14+
"HttpVersion": "http2",
15+
"IPV6Enabled": true,
16+
"Origins": [
17+
{
18+
"CustomOriginConfig": {
19+
"OriginProtocolPolicy": "https-only"
20+
},
21+
"DomainName": "www.example.com",
22+
"Id": "integdistributionoriginshieldDistOrigin11F51234E",
23+
"OriginShield": {
24+
"Enabled": false
25+
}
26+
}
27+
]
28+
}
29+
}
30+
}
31+
},
32+
"Parameters": {
33+
"BootstrapVersion": {
34+
"Type": "AWS::SSM::Parameter::Value<String>",
35+
"Default": "/cdk-bootstrap/hnb659fds/version",
36+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
37+
}
38+
},
39+
"Rules": {
40+
"CheckBootstrapVersion": {
41+
"Assertions": [
42+
{
43+
"Assert": {
44+
"Fn::Not": [
45+
{
46+
"Fn::Contains": [
47+
[
48+
"1",
49+
"2",
50+
"3",
51+
"4",
52+
"5"
53+
],
54+
{
55+
"Ref": "BootstrapVersion"
56+
}
57+
]
58+
}
59+
]
60+
},
61+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
62+
}
63+
]
64+
}
65+
}
66+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/integ.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "21.0.0",
3+
"testCases": {
4+
"DistributionOriginShield/DefaultTest": {
5+
"stacks": [
6+
"integ-distribution-origin-shield"
7+
],
8+
"assertionStack": "DistributionOriginShield/DefaultTest/DeployAssert",
9+
"assertionStackName": "DistributionOriginShieldDefaultTestDeployAssertDF7E33F9"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-cloudfront/test/integ.distribution-origin-shield.js.snapshot/manifest.json

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
{
2+
"version": "21.0.0",
3+
"artifacts": {
4+
"Tree": {
5+
"type": "cdk:tree",
6+
"properties": {
7+
"file": "tree.json"
8+
}
9+
},
10+
"integ-distribution-origin-shield.assets": {
11+
"type": "cdk:asset-manifest",
12+
"properties": {
13+
"file": "integ-distribution-origin-shield.assets.json",
14+
"requiresBootstrapStackVersion": 6,
15+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
16+
}
17+
},
18+
"integ-distribution-origin-shield": {
19+
"type": "aws:cloudformation:stack",
20+
"environment": "aws://unknown-account/unknown-region",
21+
"properties": {
22+
"templateFile": "integ-distribution-origin-shield.template.json",
23+
"validateOnSynth": false,
24+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
25+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/2dad510c7288df819a57567a15bdbfd3396640d1c4a5b7dbb139c67cc8cd290a.json",
27+
"requiresBootstrapStackVersion": 6,
28+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
29+
"additionalDependencies": [
30+
"integ-distribution-origin-shield.assets"
31+
],
32+
"lookupRole": {
33+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
34+
"requiresBootstrapStackVersion": 8,
35+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
36+
}
37+
},
38+
"dependencies": [
39+
"integ-distribution-origin-shield.assets"
40+
],
41+
"metadata": {
42+
"/integ-distribution-origin-shield/Dist/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "DistB3B78991"
46+
}
47+
],
48+
"/integ-distribution-origin-shield/BootstrapVersion": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "BootstrapVersion"
52+
}
53+
],
54+
"/integ-distribution-origin-shield/CheckBootstrapVersion": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "CheckBootstrapVersion"
58+
}
59+
]
60+
},
61+
"displayName": "integ-distribution-origin-shield"
62+
},
63+
"DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.assets": {
64+
"type": "cdk:asset-manifest",
65+
"properties": {
66+
"file": "DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.assets.json",
67+
"requiresBootstrapStackVersion": 6,
68+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
69+
}
70+
},
71+
"DistributionOriginShieldDefaultTestDeployAssertDF7E33F9": {
72+
"type": "aws:cloudformation:stack",
73+
"environment": "aws://unknown-account/unknown-region",
74+
"properties": {
75+
"templateFile": "DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.template.json",
76+
"validateOnSynth": false,
77+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
78+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
79+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
80+
"requiresBootstrapStackVersion": 6,
81+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
82+
"additionalDependencies": [
83+
"DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.assets"
84+
],
85+
"lookupRole": {
86+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
87+
"requiresBootstrapStackVersion": 8,
88+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
89+
}
90+
},
91+
"dependencies": [
92+
"DistributionOriginShieldDefaultTestDeployAssertDF7E33F9.assets"
93+
],
94+
"metadata": {
95+
"/DistributionOriginShield/DefaultTest/DeployAssert/BootstrapVersion": [
96+
{
97+
"type": "aws:cdk:logicalId",
98+
"data": "BootstrapVersion"
99+
}
100+
],
101+
"/DistributionOriginShield/DefaultTest/DeployAssert/CheckBootstrapVersion": [
102+
{
103+
"type": "aws:cdk:logicalId",
104+
"data": "CheckBootstrapVersion"
105+
}
106+
]
107+
},
108+
"displayName": "DistributionOriginShield/DefaultTest/DeployAssert"
109+
}
110+
}
111+
}

0 commit comments

Comments
 (0)