@alma-cdk/origin-verify

npm i -D @alma-cdk/origin-verify

Enforce API Gateway or Application Load Balancer traffic via CloudFront by generating a Secrets Manager secret value which is used as a CloudFront Origin Custom header and a WAFv2 WebACL header match rule.

Work in Progress

🚧  Do not use for production critial stuff! This construct is still very much work in progress and breaking changes may occur. 🚧

Getting Started

import { OriginVerify } from '@alma-cdk/origin-verify';
import { Distribution } from 'aws-cdk-lib/aws-cloudfront';

const api: RestApi; // TODO: actually define the RestApi
const apiDomain: string = api.domainName; // TODO: actually define the domain

const verification = new OriginVerify(this, 'OriginVerify', {
  origin: api.deploymentStage,
});

new Distribution(this, 'CDN', {
  defaultBehavior: { origin: new HttpOrigin(apiDomain, {
    customHeaders: {
      [verification.headerName]: verification.headerValue,
    },
  }) },
})