A terraform script to create all resources one might need to self-host a static page on S3. Includes a SSL cert, DNS records, Bucket, and a Cloudfront distribution.

s3-static-hosting.tf

terraform {
  required_providers {
    aws = {
      version = "3.11"
    }
  }
}

provider "aws" {
  shared_credentials_file = "$HOME/.aws/creds"
  profile                 = "default"
  region = "us-east-1"
}

provider "aws" {
  shared_credentials_file = "$HOME/.aws/creds"
  profile                 = "default"
  region = "eu-central-1"
  alias = "eu-central"
}

variable "domain" {
  type = string
}

variable "zone" {
  type = string
}

variable "sans" {
  type    = list
  default = []
}

locals {
  # zone = format("%s.", trimprefix(var.domain, regex("(\\w+)\\.\\w+\\.", var.domain)))
  # zone = "zenml.io."
  zone = var.zone
  s3_origin_id = var.domain
  aliases = concat([var.domain], var.sans)
}

data "aws_route53_zone" "zone" {
  name         = local.zone
  private_zone = false
}

# create a bucket with public access
resource "aws_s3_bucket" "b" {
  provider = aws.eu-central
  bucket = var.domain
  acl    = "public-read"
  # region = "eu-central-1"
  policy = <<EOF
{
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::${var.domain}/*"
        }
    ],
    "Version": "2012-10-17"
}
EOF

  website {
    index_document = "index.html"
    error_document = "404.html"
  }
}

# create cert and validation record for cert

resource "aws_acm_certificate" "cert" {
  domain_name       = var.domain
  validation_method = "DNS"
  subject_alternative_names = var.sans
}

# resource "aws_route53_record" "cert_validation" {
#   name    = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
#   type    = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
#   zone_id = data.aws_route53_zone.zone.zone_id
#   records = [aws_acm_certificate.cert.domain_validation_options.0.resource_record_value]
#   ttl     = 60
# }

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.cert.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.zone.zone_id
}


# resource "aws_acm_certificate_validation" "cert" {
#   certificate_arn         = aws_acm_certificate.cert.arn
#   validation_record_fqdns = [aws_route53_record.cert_validation.fqdn]
# }

resource "aws_acm_certificate_validation" "cert" {
  certificate_arn         = aws_acm_certificate.cert.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
}

# cloudfront

resource "aws_cloudfront_distribution" "s3_distribution" {
  origin {
    domain_name = aws_s3_bucket.b.bucket_regional_domain_name
    origin_id   = local.s3_origin_id
  }

  enabled             = true
  is_ipv6_enabled     = true
  comment             = "Some comment"
  default_root_object = "index.html"

  aliases = local.aliases

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = local.s3_origin_id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  price_class = "PriceClass_100"

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.cert.arn
    ssl_support_method = "sni-only"
    minimum_protocol_version = "TLSv1.2_2018"
  }
  depends_on = [
    aws_acm_certificate_validation.cert
  ]
}

resource "aws_route53_record" "endpoint" {
  zone_id = data.aws_route53_zone.zone.zone_id
  name    = var.domain
  type    = "A"

  alias {
    name = aws_cloudfront_distribution.s3_distribution.domain_name
    zone_id = aws_cloudfront_distribution.s3_distribution.hosted_zone_id
    evaluate_target_health = false
  }
}