Add Cloudfront config using EKS load balancers as origin.

[rtrinque]

This upgrade our previous Cloudfront configuration that used S3 bucket as origins and could only serve static content. This new config will be able to serve dynamic content as well.

Trello: https://trello.com/c/XXhD9LfI/3257-apply-cloudfront-terraform-to-production

[robinjam]

Staging plan output looks good:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudfront_distribution.assets_distribution[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "assets_distribution" {
        id                             = "E2RBIQQ8CNPY8"
        tags                           = {
            "govuk_environment" = "staging"
        }
      + web_acl_id                     = "arn:aws:wafv2:us-east-1:696911096973:global/webacl/cdn_poc_govuk/8fcb1569-44ff-4dd8-b634-748ca3e2b255"
        # (20 unchanged attributes hidden)

      ~ default_cache_behavior {
          ~ default_ttl            = 0 -> 86400
          ~ max_ttl                = 0 -> 31536000
            # (10 unchanged attributes hidden)
        }

        # (4 unchanged blocks hidden)
    }

  # aws_cloudfront_distribution.www_distribution[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "www_distribution" {
        id                             = "E1TA1GIAQMC2TZ"
        tags                           = {
            "govuk_environment" = "staging"
        }
        # (21 unchanged attributes hidden)

      ~ default_cache_behavior {
          ~ default_ttl              = 0 -> 86400
          ~ max_ttl                  = 0 -> 31536000
            # (11 unchanged attributes hidden)
        }

        # (9 unchanged blocks hidden)
    }

  # aws_wafv2_web_acl.cdn_poc_govuk will be imported
    resource "aws_wafv2_web_acl" "cdn_poc_govuk" {
        arn           = "arn:aws:wafv2:us-east-1:696911096973:global/webacl/cdn_poc_govuk/8fcb1569-44ff-4dd8-b634-748ca3e2b255"
        capacity      = 777
        id            = "8fcb1569-44ff-4dd8-b634-748ca3e2b255"
        lock_token    = "2e3c330c-6f5d-45dc-885e-698692c00572"
        name          = "cdn_poc_govuk"
        scope         = "CLOUDFRONT"
        tags          = {}
        tags_all      = {}
        token_domains = []

        default_action {
            block {
            }
        }

        rule {
            name     = "ALLOW_EC2_EKS"
            priority = 4

            action {
                allow {
                }
            }

            statement {
                ip_set_reference_statement {
                    arn = "arn:aws:wafv2:us-east-1:696911096973:global/ipset/EC2_EKS_NAT_Gateways/94286465-8456-489f-aa40-8e23f16d52ad"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "ALLOW_EC2_EKS"
                sampled_requests_enabled   = true
            }
        }
        rule {
            name     = "ALLOW_GDS_IPS"
            priority = 3

            action {
                allow {
                }
            }

            statement {
                ip_set_reference_statement {
                    arn = "arn:aws:wafv2:us-east-1:696911096973:global/ipset/cloudfront_cdn_gds/d594f8ed-8e3f-4dd9-a0e1-bb643a07eed5"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "ALLOW_GDS_IPS"
                sampled_requests_enabled   = true
            }
        }
        rule {
            name     = "AWS-AWSManagedRulesAmazonIpReputationList"
            priority = 1

            override_action {
                none {}
            }

            statement {
                managed_rule_group_statement {
                    name        = "AWSManagedRulesAmazonIpReputationList"
                    vendor_name = "AWS"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "AWS-AWSManagedRulesAmazonIpReputationList"
                sampled_requests_enabled   = true
            }
        }
        rule {
            name     = "AWS-AWSManagedRulesAnonymousIpList"
            priority = 0

            override_action {
                none {}
            }

            statement {
                managed_rule_group_statement {
                    name        = "AWSManagedRulesAnonymousIpList"
                    vendor_name = "AWS"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "AWS-AWSManagedRulesAnonymousIpList"
                sampled_requests_enabled   = true
            }
        }
        rule {
            name     = "AWS-AWSManagedRulesCommonRuleSet"
            priority = 2

            override_action {
                none {}
            }

            statement {
                managed_rule_group_statement {
                    name        = "AWSManagedRulesCommonRuleSet"
                    vendor_name = "AWS"
                }
            }

            visibility_config {
                cloudwatch_metrics_enabled = true
                metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
                sampled_requests_enabled   = true
            }
        }

        visibility_config {
            cloudwatch_metrics_enabled = true
            metric_name                = "cdn_poc_govuk"
            sampled_requests_enabled   = true
        }
    }

Plan: 1 to import, 0 to add, 2 to change, 0 to destroy.

[robinjam]

Production plan output also looks good:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # aws_cloudfront_distribution.assets_distribution[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "assets_distribution" {
        id                             = "E1WZQ0VC06YFM2"
        tags                           = {
            "govuk_environment" = "production"
        }
      + web_acl_id                     = (known after apply)
        # (20 unchanged attributes hidden)

      ~ default_cache_behavior {
          ~ default_ttl            = 0 -> 86400
          ~ max_ttl                = 0 -> 31536000
            # (10 unchanged attributes hidden)
        }

        # (4 unchanged blocks hidden)
    }

  # aws_cloudfront_distribution.www_distribution[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "www_distribution" {
        id                             = "E31ESY2JHMP4Q"
        tags                           = {
            "govuk_environment" = "production"
        }
      + web_acl_id                     = (known after apply)
        # (20 unchanged attributes hidden)

      ~ default_cache_behavior {
          ~ default_ttl              = 0 -> 86400
          ~ max_ttl                  = 0 -> 31536000
            # (11 unchanged attributes hidden)
        }

        # (9 unchanged blocks hidden)
    }

  # aws_wafv2_web_acl.cdn_poc_govuk will be created
  + resource "aws_wafv2_web_acl" "cdn_poc_govuk" {
      + arn        = (known after apply)
      + capacity   = (known after apply)
      + id         = (known after apply)
      + lock_token = (known after apply)
      + name       = "cdn_poc_govuk"
      + scope      = "CLOUDFRONT"
      + tags_all   = (known after apply)

      + default_action {
          + allow {
            }
        }

      + rule {
          + name     = "AWS-AWSManagedRulesAmazonIpReputationList"
          + priority = 1

          + override_action {
              + none {}
            }

          + statement {
              + managed_rule_group_statement {
                  + name        = "AWSManagedRulesAmazonIpReputationList"
                  + vendor_name = "AWS"
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "AWS-AWSManagedRulesAmazonIpReputationList"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "AWS-AWSManagedRulesAnonymousIpList"
          + priority = 0

          + override_action {
              + none {}
            }

          + statement {
              + managed_rule_group_statement {
                  + name        = "AWSManagedRulesAnonymousIpList"
                  + vendor_name = "AWS"
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "AWS-AWSManagedRulesAnonymousIpList"
              + sampled_requests_enabled   = true
            }
        }
      + rule {
          + name     = "AWS-AWSManagedRulesCommonRuleSet"
          + priority = 2

          + override_action {
              + none {}
            }

          + statement {
              + managed_rule_group_statement {
                  + name        = "AWSManagedRulesCommonRuleSet"
                  + vendor_name = "AWS"
                }
            }

          + visibility_config {
              + cloudwatch_metrics_enabled = true
              + metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
              + sampled_requests_enabled   = true
            }
        }

      + visibility_config {
          + cloudwatch_metrics_enabled = true
          + metric_name                = "cdn_poc_govuk"
          + sampled_requests_enabled   = true
        }
    }

Plan: 1 to add, 2 to change, 0 to destroy.

[robinjam]

This has been applied in both staging and production now.