terraform-aws-fingerprint-cloudfront-proxy-integration/main.tf at main · fingerprintjs/terraform-aws-fingerprint-cloudfront-proxy-integration · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
terraform {
  required_version = ">= 1.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.21"
    }
    random = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

resource "random_id" "integration_id" {
  byte_length = 6
}

locals {
  integration_id = random_id.integration_id.hex
}

# region cache policy

resource "aws_cloudfront_cache_policy" "fpjs_procdn" {
  name        = "FingerprintProCDNCachePolicy-${local.integration_id}"
  default_ttl = 180
  max_ttl     = 180
  min_ttl     = 0

  parameters_in_cache_key_and_forwarded_to_origin {
    cookies_config {
      cookie_behavior = "none"
    }

    headers_config {
      header_behavior = "none"
    }

    query_strings_config {
      query_string_behavior = "whitelist"
      query_strings {
        items = ["version", "loaderVersion"]
      }
    }

    enable_accept_encoding_brotli = true
    enable_accept_encoding_gzip   = true
  }
}

# endregion

# region proxy lambda

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"
    sid    = "AllowAwsToAssumeRole"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role_policy" "fpjs_proxy_lambda" {
  name = "AWSSecretAccess"
  role = aws_iam_role.fpjs_proxy_lambda.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "secretsmanager:GetSecretValue",
        ]
        Effect   = "Allow"
        Resource = aws_secretsmanager_secret.fpjs_proxy_lambda_secret.arn
      },
    ]
  })
}

resource "aws_iam_role_policy_attachment" "fpjs_proxy_lambda" {
  role       = aws_iam_role.fpjs_proxy_lambda.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role" "fpjs_proxy_lambda" {
  name                 = "fingerprint-pro-lambda-role-${local.integration_id}"
  permissions_boundary = var.fpjs_proxy_lambda_role_permissions_boundary_arn
  assume_role_policy   = data.aws_iam_policy_document.assume_role.json
}

data "aws_s3_object" "fpjs_integration_s3_bucket" {
  bucket = "fingerprint-pro-cloudfront-integration"
  key    = "v2/lambda_latest.zip"
}

resource "aws_lambda_function" "fpjs_proxy_lambda" {
  description      = "Fingerprint Proxy Lambda@Edge function"
  s3_bucket        = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.bucket : null
  s3_key           = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.key : null
  filename         = !var.fetch_lambda_from_s3 ? var.local_lambda_path : null
  function_name    = "fingerprint-pro-cloudfront-lambda-${local.integration_id}"
  role             = aws_iam_role.fpjs_proxy_lambda.arn
  handler          = "fingerprintjs-pro-cloudfront-lambda-function.handler"
  source_code_hash = var.fetch_lambda_from_s3 ? data.aws_s3_object.fpjs_integration_s3_bucket.etag : filemd5(var.local_lambda_path)
  memory_size      = 128
  timeout          = 10

  runtime = "nodejs24.x"

  publish = true
}

# endregion

# region secrets manager

resource "aws_secretsmanager_secret" "fpjs_proxy_lambda_secret" {
  name        = "fingerprint-pro-cloudfront-integration-settings-secret-${local.integration_id}"
  description = "AWS Secret with a custom Fingerprint integration settings (created via Terraform)"
}

resource "aws_secretsmanager_secret_version" "fpjs_proxy_lambda_secret" {
  secret_id = aws_secretsmanager_secret.fpjs_proxy_lambda_secret.id
  secret_string = jsonencode(
    {
      fpjs_get_result_path        = var.fpjs_get_result_path
      fpjs_agent_download_path    = var.fpjs_agent_download_path
      fpjs_pre_shared_secret      = var.fpjs_shared_secret
      fpjs_integration_path_depth = tostring(var.integration_path_depth)
    }
  )
}

# endregion