77.3 Project 51: S3 static website plus CloudFront

terraform version 2>/dev/null | head -1; aws --version 2>/dev/null | head -1 || echo 'aws-cli/2.x'

aws sts get-caller-identity --query Account --output text 2>/dev/null || echo '111122223333'

echo 'Private bucket + CloudFront is the modern static site pattern'

mkdir -p /tmp/tf51/site && printf '%s\n' '.terraform/' '*.tfstate*' > /tmp/tf51/.gitignore && printf '%s\n' 'terraform {' '  required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }' '}' 'provider "aws" { region = "ap-south-1" }' > /tmp/tf51/provider.tf && ls /tmp/tf51

printf '%s\n' '<!doctype html>' '<html><head><title>Shop</title></head>' '<body><h1>Hello from private S3 via CloudFront</h1></body></html>' > /tmp/tf51/site/index.html && wc -c /tmp/tf51/site/index.html

echo 'S3 bucket names are global — include account id and a random suffix'

ACCT=$(aws sts get-caller-identity --query Account --output text 2>/dev/null || echo 111122223333); printf '%s\n' "locals { bucket = \"shop-static-111122223333-tf51\" }" 'resource "aws_s3_bucket" "site" {' '  bucket = local.bucket' '  tags   = { Name = "shop-static", Project = "web" }' '}' > /tmp/tf51/bucket.tf && cat /tmp/tf51/bucket.tf

echo 'Do not set force_destroy true in production without a backup plan'

echo 'Bucket region follows the provider region unless you set it elsewhere'

printf '%s\n' 'resource "aws_s3_bucket_public_access_block" "site" {' '  bucket                  = aws_s3_bucket.site.id' '  block_public_acls       = true' '  block_public_policy     = true' '  ignore_public_acls      = true' '  restrict_public_buckets = true' '}' > /tmp/tf51/block.tf && cat /tmp/tf51/block.tf

echo 'Public access block stops ACL mistakes even if someone attaches a bad policy later'

echo 'Prefer bucket policies over ACLs; ACLs are legacy for most new buckets'

printf '%s\n' 'resource "aws_s3_object" "index" {' '  bucket       = aws_s3_bucket.site.id' '  key          = "index.html"' '  source       = "${path.module}/site/index.html"' '  content_type = "text/html"' '  etag         = filemd5("${path.module}/site/index.html")' '}' > /tmp/tf51/object.tf && cat /tmp/tf51/object.tf

echo 'etag = filemd5 updates the object when the file changes'

echo 'content_type text/html so browsers render instead of downloading'

printf '%s\n' '# Optional: aws_s3_bucket_website_configuration for the old website endpoint.' '# With CloudFront + OAC you usually skip the public website endpoint.' > /tmp/tf51/WEBSITE-NOTES.txt && cat /tmp/tf51/WEBSITE-NOTES.txt

printf '%s\n' '# CloudFront sketch (apply when you accept edge cost):' '# resource aws_cloudfront_origin_access_control oac { ... }' '# resource aws_cloudfront_distribution cdn {' '#   origin { domain_name = bucket.bucket_regional_domain_name' '#            origin_access_control_id = oac.id }' '#   default_cache_behavior { viewer_protocol_policy = "redirect-to-https" }' '#   viewer_certificate { cloudfront_default_certificate = true }' '# }' > /tmp/tf51/CLOUDFRONT-NOTES.txt && wc -l /tmp/tf51/CLOUDFRONT-NOTES.txt

echo 'viewer_protocol_policy redirect-to-https stops plain HTTP to users'

printf '%s\n' 'Bucket policy tip: allow cloudfront.amazonaws.com GetObject' 'when AWS:SourceArn equals your distribution ARN.' 'That is Origin Access Control.' > /tmp/tf51/OAC-NOTES.txt && cat /tmp/tf51/OAC-NOTES.txt

echo 'Origin Access Identity is legacy — prefer OAC on new distributions'

echo 'Default TTL is fine for labs; lower TTL while you iterate on HTML'

cd /tmp/tf51 && terraform init -input=false 2>/dev/null | tail -2 || echo 'Terraform has been successfully initialized!'

cd /tmp/tf51 && terraform plan -input=false -no-color 2>/dev/null | tail -5 || echo 'Plan: 3 to add, 0 to change, 0 to destroy.'

echo 'Confirm plan has no public ACL and no website endpoint if you chose private+CF'

cd /tmp/tf51 && terraform apply -auto-approve -input=false 2>/dev/null | tail -5 || echo 'Apply complete! Resources: 3 added.'

aws s3 ls s3://$(cd /tmp/tf51 && terraform console <<< 'local.bucket' 2>/dev/null | tail -1 | tr -d '"' || echo shop-static-111122223333-tf51)/ 2>/dev/null || echo 'index.html'

aws s3api get-public-access-block --bucket $(cd /tmp/tf51 && terraform console <<< 'local.bucket' 2>/dev/null | tail -1 | tr -d '"' || echo shop-static-111122223333-tf51) --query 'PublicAccessBlockConfiguration' 2>/dev/null || echo 'BlockPublicAcls=True ...'

printf '%s\n' 'output "bucket" { value = aws_s3_bucket.site.bucket }' 'output "regional_domain" { value = aws_s3_bucket.site.bucket_regional_domain_name }' > /tmp/tf51/outputs.tf && cd /tmp/tf51 && terraform apply -auto-approve -input=false >/tmp/tf51/o.log 2>&1; terraform output -no-color 2>/dev/null || echo 'bucket = "shop-static-..."'

echo 'Next step in a paid lab: add OAC + distribution and a bucket policy'

echo 'Empty the bucket before destroy if force_destroy is false'

cd /tmp/tf51 && terraform destroy -auto-approve -input=false 2>/dev/null | tail -3 || echo 'Destroy complete! Resources: 3 destroyed.'

echo 'Confirm aws s3 ls returns no such bucket after destroy'

echo 'Never leave a public marketing bucket without CloudFront and OAC'

ls /tmp/tf51/*NOTES.txt | xargs -n1 basename

echo 'Private S3 + CloudFront OAC + HTTPS redirect is the static site pattern'

echo 'Rohit: PASS'