From f36330beae6b8f0d0ba01a4e5ece734150fcc70f Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Sat, 30 May 2026 21:24:19 +0200 Subject: [PATCH] sec(iac): require AWS_IAM auth on production Lambda Function URL (closes #424) Set enable_cdn = true in github-prod.tfvars and github-staging.tfvars. The compute.tf local derives lambda_function_url_auth_type = "AWS_IAM" when enable_cdn = true, so these two tfvars changes are the single lever that activates the full security chain: CloudFront OAC (frontend module) -> SigV4-signed request -> Lambda Function URL (authorization_type = AWS_IAM) -> aws_lambda_permission.function_url_cloudfront (principal = cloudfront.amazonaws.com, source_arn = distribution ARN) The dev environment retains enable_cdn = false (NONE auth) because the browser-served SPA hits the Lambda URL directly and cannot SigV4-sign. Auth in dev is enforced at the application layer (login session, CSRF, API keys) as documented in compute.tf. Prod and staging lambda_allowed_origins still carry .invalid placeholders (the envs are not yet deployed); any accidental terraform apply will fail fast at hostname resolution until the operator supplies real origins. --- terraform/environments/aws/github-prod.tfvars | 2 +- terraform/environments/aws/github-staging.tfvars | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/terraform/environments/aws/github-prod.tfvars b/terraform/environments/aws/github-prod.tfvars index 99470778c..c0964fe7d 100644 --- a/terraform/environments/aws/github-prod.tfvars +++ b/terraform/environments/aws/github-prod.tfvars @@ -70,7 +70,7 @@ secret_recovery_window_days = 30 # Frontend / CDN # ============================================== -enable_cdn = false +enable_cdn = true frontend_price_class = "PriceClass_200" create_subdomain_zone = false diff --git a/terraform/environments/aws/github-staging.tfvars b/terraform/environments/aws/github-staging.tfvars index 7e38b86d7..dd2e5ff52 100644 --- a/terraform/environments/aws/github-staging.tfvars +++ b/terraform/environments/aws/github-staging.tfvars @@ -69,7 +69,7 @@ secret_recovery_window_days = 14 # Frontend / CDN # ============================================== -enable_cdn = false +enable_cdn = true frontend_price_class = "PriceClass_100" create_subdomain_zone = false