What in `StaticSite` is giving the CF Distro access to the b Serverless Stack #help

What in `StaticSite` is giving the CF Distro acces...

Dan Van Brunt

10/13/2021, 3:30 PM

What in

StaticSite

is giving the CF Distro access to the bucket? In our CFN we normally create a CF OAI and then give it read access to the bucket to that only the distro can and there is no direct access to the bucket. Seems like you have this working in StaticSite…. but I can’t see anything that sets this up? Is this maybe a sane default of cdk?

Frank

10/13/2021, 4:15 PM

Hey @Dan Van Brunt, I need to double check, but i think when u set the S3 bucket as the distribution origin, CDK hooks up the bucket policy.

Frank

10/13/2021, 4:16 PM

So if u inspect the CFN template, the BucketPolicy should look like:

Copy code

"FrontendBucketPolicyB05AF112": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "FrontendBucket5DAC5524"
        },
        "PolicyDocument": {
          "Statement": [
             ...
             {
              "Action": "s3:GetObject",
              "Effect": "Allow",
              "Principal": {
                "CanonicalUser": {
                  "Fn::GetAtt": [
                    "FrontendDistributionOrigin1S3Origin0C7BC470",
                    "S3CanonicalUserId"
                  ]
                }
              },
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    {
                      "Fn::GetAtt": [
                        "FrontendBucket5DAC5524",
                        "Arn"
                      ]
                    },
                    "/*"
                  ]
                ]
              }
            }
          ],
          "Version": "2012-10-17"
        }
      },
      "Metadata": {
        "aws:cdk:path": "dev-playground-site/Frontend/Bucket/Policy/Resource"
      }
    },

Dan Van Brunt

10/13/2021, 4:48 PM

yup… figured it was CDK… Thanks!

Dan Van Brunt

10/13/2021, 4:49 PM

Need to suck out that `

Copy code

"FrontendDistributionOrigin1S3Origin0C7BC470",
                    "S3CanonicalUserId"

for use elsewhere.

Dan Van Brunt

10/13/2021, 4:52 PM

@Frank https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/core/lib/lazy.ts#L366

Dan Van Brunt

10/13/2021, 4:57 PM

https://docs.aws.amazon.com/cdk/latest/guide/tokens.html#tokens_lazy

“You can construct tokens representing synth-time lazy values using static methods on the
Lazy
class, such as Lazy.stringValue (Python:
Lazy.string_value
) and Lazy.numberValue (Python:
Lazy.number_value
. These methods accept an object whose
produce
property is a function that accepts a context argument and returns the final value when called.”

Frank

10/13/2021, 4:58 PM

Yeah can u try

Stack.resolve(origins)

? (replied in the other thread)

Dan Van Brunt

10/13/2021, 5:01 PM

How do I get

origins

from this… ?

const cfDistribution = this.cfDistribution.node.defaultChild as cf.CfnDistribution

Dan Van Brunt

10/13/2021, 5:01 PM

very newb on this part of CDK

Dan Van Brunt

10/13/2021, 5:01 PM

tried

this.cfDistribution.node.findChild('origins')

but no luck

Frank

10/13/2021, 5:02 PM

Let’s see, what does this show

Stack.resolve(this.cfDistribution)

Dan Van Brunt

10/13/2021, 5:02 PM

Dan Van Brunt

10/13/2021, 5:03 PM

*cdk*.Stack.resolve(this.cfDistribution)

I assume

Dan Van Brunt

10/13/2021, 5:04 PM

nope…resolve isn’t a function on cdk.Stack

Frank

10/13/2021, 5:04 PM

i see.. lemme give it a try

Dan Van Brunt

10/13/2021, 5:05 PM

I think resolve is a function on a stack instance

Dan Van Brunt

10/13/2021, 5:05 PM

const stack = cdk.Stack.of(this)

Open in Slack

Previous Next