FEAT: Init Infra App

2026-08-12 13:29:42 +03:00
parent 3f8a807254
commit d531c111aa
6 changed files with 664 additions and 0 deletions
@@ -0,0 +1,117 @@
+package main
+
+import (
+	"encoding/json"
+
+	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
+	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/s3"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+const originId = "encoded-bucket-origin"
+
+// AWS managed "CachingOptimized" cache policy (same ID in every account/region).
+const cachingOptimizedPolicyId = "658327ea-f89d-4fab-a63d-7e88639e58f6"
+
+func main() {
+	pulumi.Run(func(ctx *pulumi.Context) error {
+		// Create an AWS resource (S3 Bucket) that holds encoded assets
+		bucket, err := s3.NewBucket(ctx, "encoded-bucket", nil)
+		if err != nil {
+			return err
+		}
+
+		// Keep the bucket private; CloudFront reaches it via Origin Access Control.
+		_, err = s3.NewBucketPublicAccessBlock(ctx, "encoded-bucket-public-access-block", &s3.BucketPublicAccessBlockArgs{
+			Bucket:                bucket.ID(),
+			BlockPublicAcls:       pulumi.Bool(true),
+			BlockPublicPolicy:     pulumi.Bool(true),
+			IgnorePublicAcls:      pulumi.Bool(true),
+			RestrictPublicBuckets: pulumi.Bool(true),
+		})
+		if err != nil {
+			return err
+		}
+
+		oac, err := cloudfront.NewOriginAccessControl(ctx, "encoded-bucket-oac", &cloudfront.OriginAccessControlArgs{
+			Description:                   pulumi.String("OAC for encoded-bucket assets"),
+			OriginAccessControlOriginType: pulumi.String("s3"),
+			SigningBehavior:               pulumi.String("always"),
+			SigningProtocol:               pulumi.String("sigv4"),
+		})
+		if err != nil {
+			return err
+		}
+
+		distribution, err := cloudfront.NewDistribution(ctx, "encoded-bucket-cdn", &cloudfront.DistributionArgs{
+			Enabled: pulumi.Bool(true),
+			Comment: pulumi.String("Edge caching for encoded-bucket assets"),
+			Origins: cloudfront.DistributionOriginArray{
+				&cloudfront.DistributionOriginArgs{
+					DomainName:            bucket.BucketRegionalDomainName,
+					OriginId:              pulumi.String(originId),
+					OriginAccessControlId: oac.ID(),
+					S3OriginConfig: &cloudfront.DistributionOriginS3OriginConfigArgs{
+						OriginAccessIdentity: pulumi.String(""),
+					},
+				},
+			},
+			DefaultCacheBehavior: &cloudfront.DistributionDefaultCacheBehaviorArgs{
+				TargetOriginId:       pulumi.String(originId),
+				ViewerProtocolPolicy: pulumi.String("redirect-to-https"),
+				AllowedMethods:       pulumi.ToStringArray([]string{"GET", "HEAD"}),
+				CachedMethods:        pulumi.ToStringArray([]string{"GET", "HEAD"}),
+				Compress:             pulumi.Bool(true),
+				CachePolicyId:        pulumi.String(cachingOptimizedPolicyId),
+			},
+			Restrictions: &cloudfront.DistributionRestrictionsArgs{
+				GeoRestriction: &cloudfront.DistributionRestrictionsGeoRestrictionArgs{
+					RestrictionType: pulumi.String("none"),
+				},
+			},
+			ViewerCertificate: &cloudfront.DistributionViewerCertificateArgs{
+				CloudfrontDefaultCertificate: pulumi.Bool(true),
+			},
+		})
+		if err != nil {
+			return err
+		}
+
+		// Allow only this distribution to read objects from the bucket.
+		policy := pulumi.All(bucket.Arn, distribution.Arn).ApplyT(func(args []interface{}) (string, error) {
+			bucketArn := args[0].(string)
+			distributionArn := args[1].(string)
+
+			doc := map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{
+						"Sid":       "AllowCloudFrontServicePrincipal",
+						"Effect":    "Allow",
+						"Principal": map[string]string{"Service": "cloudfront.amazonaws.com"},
+						"Action":    "s3:GetObject",
+						"Resource":  bucketArn + "/*",
+						"Condition": map[string]interface{}{
+							"StringEquals": map[string]string{"AWS:SourceArn": distributionArn},
+						},
+					},
+				},
+			}
+			b, err := json.Marshal(doc)
+			return string(b), err
+		}).(pulumi.StringOutput)
+
+		_, err = s3.NewBucketPolicy(ctx, "encoded-bucket-policy", &s3.BucketPolicyArgs{
+			Bucket: bucket.ID(),
+			Policy: policy,
+		})
+		if err != nil {
+			return err
+		}
+
+		// Export the name of the bucket
+		ctx.Export("bucketName", bucket.ID())
+		ctx.Export("cdnDomainName", distribution.DomainName)
+		return nil
+	})
+}