feat: ele-4721 add support for security headers for cdn site hosting

lib/cdn-site-hosting/README.md

@@ -9,7 +9,7 @@ Establishes infrastructure to host a static-site or single-page-application in S
 This construct will:
 
 - Create an S3 bucket with static website hosting enabled
-- Create a CloudFront web distribution to deliver site content
+- Create a CloudFront distribution to deliver site content
 - Register the CloudFront distribution with the provided certificate
 - Deploy provided source code to S3 and invalidate the CloudFront distribution
 

lib/cdn-site-hosting/cdn-site-hosting-construct.ts

@@ -3,8 +3,10 @@ import * as certificatemanager from "@aws-cdk/aws-certificatemanager";
 import * as cloudfront from "@aws-cdk/aws-cloudfront";
 import * as s3 from "@aws-cdk/aws-s3";
 import * as s3deploy from "@aws-cdk/aws-s3-deployment";
+import * as origins from "@aws-cdk/aws-cloudfront-origins";
 import { getSiteDomain } from "./utils";
 import { CommonCdnSiteHostingProps } from "./cdn-site-hosting-props";
+import { Duration } from "@aws-cdk/core";
 
 export interface CdnSiteHostingConstructProps
   extends CommonCdnSiteHostingProps {
@@ -22,7 +24,7 @@ export interface CdnSiteHostingConstructProps
  */
 export class CdnSiteHostingConstruct extends cdk.Construct {
   public readonly s3Bucket: s3.Bucket;
-  public readonly cloudfrontWebDistribution: cloudfront.CloudFrontWebDistribution;
+  public readonly cloudfrontDistribution: cloudfront.Distribution;
 
   constructor(
     scope: cdk.Construct,
@@ -35,18 +37,10 @@ export class CdnSiteHostingConstruct extends cdk.Construct {
 
     const siteDomain = getSiteDomain(props);
 
-    // certificate
-    const viewerCertificate = cloudfront.ViewerCertificate.fromAcmCertificate(
-      certificatemanager.Certificate.fromCertificateArn(
-        this,
-        `${siteDomain}-cert`,
-        props.certificateArn
-      ),
-      {
-        aliases: [siteDomain],
-        sslMethod: cloudfront.SSLMethod.SNI,
-        securityPolicy: cloudfront.SecurityPolicyProtocol.TLS_V1_1_2016,
-      }
+    const certificate = certificatemanager.Certificate.fromCertificateArn(
+      this,
+      `${siteDomain}-cert`,
+      props.certificateArn
     );
 
     let websiteErrorDocument: string | undefined = props.websiteErrorDocument;
@@ -67,36 +61,75 @@ export class CdnSiteHostingConstruct extends cdk.Construct {
     });
     new cdk.CfnOutput(this, "Bucket", { value: this.s3Bucket.bucketName });
 
+    const defaultSecurityHeaders: cloudfront.ResponseSecurityHeadersBehavior = {
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
+      contentSecurityPolicy: {
+        contentSecurityPolicy: "default-src 'self';",
+        override: true,
+      },
+      // https://web.dev/security-headers/#xcto
+      contentTypeOptions: { override: true },
+      // https://web.dev/security-headers/#recommended-usages-4
+      frameOptions: {
+        frameOption: cloudfront.HeadersFrameOption.DENY,
+        override: true,
+      },
+      // https://web.dev/referrer-best-practices/#setting-your-referrer-policy:-best-practices
+      referrerPolicy: {
+        referrerPolicy:
+          cloudfront.HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+        override: true,
+      },
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#examples
+      strictTransportSecurity: {
+        accessControlMaxAge: Duration.days(365 * 2),
+        includeSubdomains: true,
+        preload: true,
+        override: true,
+      },
+      // xxs-protection is overridden by the contentSecurityPolicy in modern browsers
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+      xssProtection: { protection: false, override: true },
+    };
+
+    const responseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(
+      this,
+      "ResponseHeadersPolicy",
+      {
+        securityHeadersBehavior: {
+          ...defaultSecurityHeaders,
+          ...props.securityHeaders,
+        },
+      }
+    );
+
     // Cloudfront distribution
-    this.cloudfrontWebDistribution = new cloudfront.CloudFrontWebDistribution(
+    this.cloudfrontDistribution = new cloudfront.Distribution(
       this,
       "SiteDistribution",
       {
-        viewerCertificate,
-        originConfigs: [
-          {
-            // We use a custom origin rather than S3 origin because the latter
-            // does not seem to support websiteErrorDocument correctly
-            customOriginSource: {
-              domainName: this.s3Bucket.bucketWebsiteDomainName,
-              originProtocolPolicy: cloudfront.OriginProtocolPolicy.HTTP_ONLY,
-            },
-            behaviors: [{ isDefaultBehavior: true }],
-          },
-        ],
-        errorConfigurations: props.isRoutedSpa
+        sslSupportMethod: cloudfront.SSLMethod.SNI,
+        minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_1_2016,
+        certificate,
+        domainNames: [siteDomain],
+        defaultRootObject: props.websiteIndexDocument,
+        defaultBehavior: {
+          origin: new origins.S3Origin(this.s3Bucket),
+          responseHeadersPolicy: responseHeadersPolicy,
+        },
+        errorResponses: props.isRoutedSpa
           ? [
               {
-                errorCode: 404,
-                responseCode: 200,
+                httpStatus: 404,
+                responseHttpStatus: 200,
                 responsePagePath: `/${props.websiteIndexDocument}`,
               },
             ]
           : undefined,
       }
     );
     new cdk.CfnOutput(this, "DistributionId", {
-      value: this.cloudfrontWebDistribution.distributionId,
+      value: this.cloudfrontDistribution.distributionId,
     });
 
     // Deploy site contents to S3 bucket
@@ -125,7 +158,7 @@ export class CdnSiteHostingConstruct extends cdk.Construct {
               prune: isSingleDeploymentStep,
               destinationBucket: this.s3Bucket,
               distribution: isInvalidationRequired
-                ? this.cloudfrontWebDistribution
+                ? this.cloudfrontDistribution
                 : undefined,
               distributionPaths: isInvalidationRequired
                 ? distributionPathsToInvalidate
@@ -145,7 +178,7 @@ export class CdnSiteHostingConstruct extends cdk.Construct {
       new s3deploy.BucketDeployment(this, "DeployAndInvalidate", {
         sources: props.sources,
         destinationBucket: this.s3Bucket,
-        distribution: this.cloudfrontWebDistribution,
+        distribution: this.cloudfrontDistribution,
         distributionPaths: ["/*"],
       });
     }

lib/cdn-site-hosting/cdn-site-hosting-props.ts

@@ -1,5 +1,6 @@
 import * as cdk from "@aws-cdk/core";
 import * as s3deploy from "@aws-cdk/aws-s3-deployment";
+import { ResponseSecurityHeadersBehavior } from "@aws-cdk/aws-cloudfront";
 
 export interface SourcesWithDeploymentOptions {
   name?: string;
@@ -17,4 +18,5 @@ export interface CommonCdnSiteHostingProps {
   sourcesWithDeploymentOptions?: SourcesWithDeploymentOptions[];
   websiteErrorDocument?: string;
   websiteIndexDocument: string;
+  securityHeaders?: ResponseSecurityHeadersBehavior;
 }

lib/cdn-site-hosting/cdn-site-hosting-with-dns-construct.ts

@@ -58,9 +58,7 @@ export class CdnSiteHostingWithDnsConstruct extends cdk.Construct {
     new route53.ARecord(this, `${siteDomain}-SiteAliasRecord`, {
       recordName: siteDomain,
       target: route53.RecordTarget.fromAlias(
-        new targets.CloudFrontTarget(
-          this.cdnSiteHosting.cloudfrontWebDistribution
-        )
+        new targets.CloudFrontTarget(this.cdnSiteHosting.cloudfrontDistribution)
       ),
       zone,
     });

test/infra/cdn-site-hosting/cdn-site-hosting-construct.test.ts

@@ -12,7 +12,9 @@ import { Template } from "@aws-cdk/assertions";
 
 // hosted-zone requires an environment be attached to the Stack
 const testEnv: Environment = {
-  region: "eu-west-1",
+  // region for Cloudfront Distribution certificates must be us-east-1
+  // https://stackoverflow.com/questions/37289994/aws-certificate-manager-do-regions-matter
+  region: "us-east-1",
   account: "abcdefg12345",
 };
 const fakeCertificateArn = `arn:aws:acm:${testEnv.region}:${testEnv.account}:certificate/123456789012-1234-1234-1234-12345678`;
@@ -74,6 +76,45 @@ describe("CdnSiteHostingConstruct", () => {
       );
     });
 
+    test("provisions a ResponseHeadersPolicy with default values", () => {
+      expectCDK(stack).to(countResources("AWS::CloudFront::Distribution", 1));
+      const template = Template.fromStack(stack);
+
+      template.hasResource("AWS::CloudFront::ResponseHeadersPolicy", {
+        Properties: {
+          ResponseHeadersPolicyConfig: {
+            SecurityHeadersConfig: {
+              ContentSecurityPolicy: {
+                ContentSecurityPolicy: "default-src self;",
+                Override: true,
+              },
+              ContentTypeOptions: {
+                Override: true,
+              },
+              FrameOptions: {
+                FrameOption: "DENY",
+                Override: true,
+              },
+              ReferrerPolicy: {
+                Override: true,
+                ReferrerPolicy: "strict-origin-when-cross-origin",
+              },
+              StrictTransportSecurity: {
+                AccessControlMaxAgeSec: 31536,
+                IncludeSubdomains: true,
+                Override: true,
+                Preload: true,
+              },
+              XSSProtection: {
+                Override: true,
+                Protection: false,
+              },
+            },
+          },
+        },
+      });
+    });
+
     test("issues a bucket deployment with CloudFront invalidation for the specified sources", () => {
       expectCDK(stack).to(countResources("Custom::CDKBucketDeployment", 1));
       expectCDK(stack).to(
@@ -307,4 +348,63 @@ describe("CdnSiteHostingConstruct", () => {
       expect(secondDeployment.DependsOn).toContain(firstDeploymentId);
     });
   });
+
+  describe("When securityHeaders are provided", () => {
+    let stack: Stack;
+
+    beforeAll(() => {
+      const app = new cdk.App();
+      stack = new cdk.Stack(app, "TestStack", { env: testEnv });
+      new CdnSiteHostingConstruct(stack, "MyTestConstruct", {
+        certificateArn: fakeCertificateArn,
+        siteSubDomain: fakeSiteSubDomain,
+        domainName: fakeDomain,
+        removalPolicy: RemovalPolicy.DESTROY,
+        sources: [s3deploy.Source.asset("./")],
+        websiteIndexDocument: "index.html",
+        securityHeaders: {
+          contentSecurityPolicy: {
+            contentSecurityPolicy: "default-src 'none';",
+            override: true,
+          },
+          frameOptions: undefined,
+        },
+      });
+    });
+
+    test("provisions a ResponseHeadersPolicy with overridden default values", () => {
+      expectCDK(stack).to(countResources("AWS::CloudFront::Distribution", 1));
+      const template = Template.fromStack(stack);
+
+      template.hasResource("AWS::CloudFront::ResponseHeadersPolicy", {
+        Properties: {
+          ResponseHeadersPolicyConfig: {
+            SecurityHeadersConfig: {
+              ContentSecurityPolicy: {
+                ContentSecurityPolicy: "default-src 'none';",
+                Override: true,
+              },
+              ContentTypeOptions: {
+                Override: true,
+              },
+              ReferrerPolicy: {
+                Override: true,
+                ReferrerPolicy: "strict-origin-when-cross-origin",
+              },
+              StrictTransportSecurity: {
+                AccessControlMaxAgeSec: 31536,
+                IncludeSubdomains: true,
+                Override: true,
+                Preload: true,
+              },
+              XSSProtection: {
+                Override: true,
+                Protection: false,
+              },
+            },
+          },
+        },
+      });
+    });
+  });
 });