From 1c4fe4d635a301f6446034b400c65ae32aabc0af Mon Sep 17 00:00:00 2001 From: Marek Skrajnowski Date: Mon, 11 Feb 2019 20:25:05 +0100 Subject: [PATCH 1/4] Added middleware_common --- main.tf | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/main.tf b/main.tf index db17803..8b76e99 100644 --- a/main.tf +++ b/main.tf @@ -1,3 +1,8 @@ +provider "aws" { + alias = "middleware" + region = "us-east-1" +} + resource "aws_s3_bucket" "assets" { bucket = "${local.name_prefix}-assets" acl = "private" @@ -112,3 +117,14 @@ resource "aws_cloudfront_distribution" "assets" { tags = "${local.tags}" } + +module "middleware_common" { + source = "./middleware_common" + + name_prefix = "${local.name_prefix}" + tags = "${local.tags}" + + providers = { + aws = "aws.middleware" + } +} From b0b00c0e745f3f69d72397850a50b92dae92dab7 Mon Sep 17 00:00:00 2001 From: Marek Skrajnowski Date: Mon, 11 Feb 2019 20:25:45 +0100 Subject: [PATCH 2/4] Added basic auth --- example/main.tf | 5 +++-- main.tf | 28 ++++++++++++++++++++++++++++ templates/basic-auth.js | 26 ++++++++++++++++++++++++++ variables.tf | 4 ++++ 4 files changed, 61 insertions(+), 2 deletions(-) create mode 100644 templates/basic-auth.js diff --git a/example/main.tf b/example/main.tf index 7db8eaf..78c85c0 100644 --- a/example/main.tf +++ b/example/main.tf @@ -9,8 +9,9 @@ module "basic" { source = ".." # only project name and environment are required - project = "terraform-spa" - environment = "example" + project = "terraform-spa-auth" + environment = "example" + basic_auth_credentials = "example:app" } resource "aws_s3_bucket_object" "basic_index" { diff --git a/main.tf b/main.tf index 8b76e99..9edab35 100644 --- a/main.tf +++ b/main.tf @@ -100,6 +100,12 @@ resource "aws_cloudfront_distribution" "assets" { forward = "none" } } + + lambda_function_association { + event_type = "viewer-request" + lambda_arn = "${module.basic_auth.arn}" + include_body = false + } } restrictions { @@ -128,3 +134,25 @@ module "middleware_common" { aws = "aws.middleware" } } + +data "template_file" "basic_auth" { + template = "${file("${path.module}/templates/basic-auth.js")}" + + vars { + credentials = "${base64encode("${var.basic_auth_credentials}")}" + } +} + +module "basic_auth" { + source = "./middleware" + + name = "${local.name_prefix}-basic-auth" + code = "${data.template_file.basic_auth.rendered}" + code_bucket = "${module.middleware_common.source_bucket_name}" + role_arn = "${module.middleware_common.role_arn}" + tags = "${local.tags}" + + providers = { + aws = "aws.middleware" + } +} diff --git a/templates/basic-auth.js b/templates/basic-auth.js new file mode 100644 index 0000000..316d1d2 --- /dev/null +++ b/templates/basic-auth.js @@ -0,0 +1,26 @@ +// Expected Authorization header value +const authorization = "Basic ${credentials}" + +exports.handler = (event, context, callback) => { + // Get request and request headers + const request = event.Records[0].cf.request + const headers = request.headers + + // Require Basic authentication + if ( + !headers.authorization || + headers.authorization[0].value !== authorization + ) { + return callback(null, { + status: "401", + statusDescription: "Unauthorized", + body: "Unauthorized", + headers: { + "www-authenticate": [{ key: "WWW-Authenticate", value: "Basic" }], + }, + }) + } + + // Continue request processing if authentication passed + callback(null, request) +} diff --git a/variables.tf b/variables.tf index 767bcbf..9d85ecf 100644 --- a/variables.tf +++ b/variables.tf @@ -41,3 +41,7 @@ variable "cloudfront_price_class" { default = "PriceClass_100" } + +variable "basic_auth_credentials" { + description = "Basic auth credentials in user:pass format" +} From 61ffec65a9f4d78cbbeeb2bba723e39d92f4b164 Mon Sep 17 00:00:00 2001 From: Marek Skrajnowski Date: Mon, 11 Feb 2019 21:18:57 +0100 Subject: [PATCH 3/4] Added basic auth to the readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index d8d56a2..20860e9 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,7 @@ The [`master`](https://github.com/codequest-eu/terraform-single-page-app/tree/ma | Name | Description | Type | Default | Required | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | :----: | :----------------: | :------: | +| basic\_auth\_credentials | Basic auth credentials in user:pass format | string | n/a | yes | | certificate\_arn | ACM certificate ARN to use instead of the default cloudfront certificate | string | `""` | no | | cloudfront\_price\_class | CloudFront price class, which specifies where the distribution should be replicated, one of: PriceClass_100, PriceClass_200, PriceClass_All | string | `"PriceClass_100"` | no | | domains | List of domains which will serve the application. If empty, will use the default cloudfront domain | list | `` | no | From ec899884624c3a06078fa5249a5c7ba11280ec95 Mon Sep 17 00:00:00 2001 From: Marek Skrajnowski Date: Fri, 15 Feb 2019 21:44:14 +0100 Subject: [PATCH 4/4] Fixes after code bucket removal --- main.tf | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/main.tf b/main.tf index c736ed7..8ad95a2 100644 --- a/main.tf +++ b/main.tf @@ -127,7 +127,6 @@ module "middleware_common" { source = "./middleware_common" name_prefix = "${local.name_prefix}" - tags = "${local.tags}" providers = { aws = "aws.middleware" @@ -145,11 +144,10 @@ data "template_file" "basic_auth" { module "basic_auth" { source = "./middleware" - name = "${local.name_prefix}-basic-auth" - code = "${data.template_file.basic_auth.rendered}" - code_bucket = "${module.middleware_common.source_bucket_name}" - role_arn = "${module.middleware_common.role_arn}" - tags = "${local.tags}" + name = "${local.name_prefix}-basic-auth" + code = "${data.template_file.basic_auth.rendered}" + role_arn = "${module.middleware_common.role_arn}" + tags = "${local.tags}" providers = { aws = "aws.middleware"