Static Website with Signed CloudFront URLs

This project provisions a CloudFront distribution with Terraform and generates signed URLs for secure access to a static website.

---

Prerequisites

Make sure you have the following installed:

• Terraform
• AWS CLI with valid credentials configured
• Python 3

---

Setup Guide

1. Create a CloudFront Key Group and Public Key

First, create a Public Key and Key Group in CloudFront via the AWS console. Follow this AWS tutorial.

---

2. Setup your Metadata

In the root of the project is a file called sample-metadata.json which defines the people who need to clean and the rooms that need to be cleaned. Edit this file or create a file with the same structure in the root of the project in order to define your participants. The name of the file is expected as a variable for the Terraform scripts.

---

3. Configure Terraform

Create a terraform.tfvars file in the project root with the CloudFront Key Group ID you just created and the filename of your metadata JSON:

key_group_cloudfront = "<key group ID>"
metadata_filename = "<filename-metadata.json>"

Alternatively, you can pass the variables directly when running Terraform.

Initialize and apply the Terraform configuration:

terraform init
terraform apply -var-file="terraform.tfvars"

---

4. Generate a Signed URL

To sign our cloudfront URL and be able to access the putzplan, we first go into the url-signer directory

cd url-signer

a) Add Environment Variables

Create a .env file in the url-signer directory to reference your key created in the previous steps and the cloudfront distribution:

PRIVATE_KEY_PATH="<path to private key file>"
KEY_PAIR_ID="<key pair ID>"
RESOURCE_URL="https://<your-cloudfront-domain>/index.html"

b) Install Python Dependencies

pip install -r requirements.txt

c) Run the Signer Script

python signer.py

This will output a signed URL that allows access to your static website.

---

Remarks

• CORS: CORS is disabled on the API Gateway to avoid circular dependencies with CloudFront. Since requests are authorized via CloudFront, this is not strictly required.

  • For extra security, you may manually add the CloudFront domain to the list of allowed CORS origins in the API Gateway console.