improve x-allow secret handling

thunderbird · Apr 17, 2024 · 5feb90e · 5feb90e
1 parent d5f21a3
commit 5feb90e
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 6 deletions.
diff --git a/tofu/environments/stage/services/frontend/terragrunt.hcl b/tofu/environments/stage/services/frontend/terragrunt.hcl
@@ -43,4 +43,5 @@ inputs = {
   ssl_cert         = local.ssl_cert
   backend_id       = dependency.backend.outputs.alb_id
   backend_dns_name = dependency.backend.outputs.dns_name
+  x_allow_secret = dependency.backend.outputs.x_allow_secret
 }
diff --git a/tofu/modules/services/backend-infra/outputs.tf b/tofu/modules/services/backend-infra/outputs.tf
@@ -24,4 +24,8 @@ output "log_group" {
 
 output "cluster_id" {
   value = module.ecs_cluster.id
+}
+
+output "x_allow_secret" {
+  value = aws_secretsmanager_secret.x_allow_secret.name
 }
diff --git a/tofu/modules/services/frontend/main.tf b/tofu/modules/services/frontend/main.tf
@@ -81,7 +81,7 @@ data "aws_cloudfront_origin_request_policy" "AllViewer" {
 } 
 
 data "aws_secretsmanager_secret_version" "x_allow_value" {
-  secret_id = "${var.name_prefix}-x-allow-secret"
+  secret_id = var.x_allow_secret
 }
 
 resource "aws_cloudfront_distribution" "appointment" {
@@ -199,10 +199,6 @@ resource "aws_cloudfront_function" "rewrite_api" {
     if (request.uri.indexOf(apiPath) === 0) {
         request.uri = request.uri.replace(apiPath, "");
     }
-    // Remove the index.html default root object added by Cloudfront
-    //if (request.uri.endsWith('index.html')) {
-    //    request.uri = request.uri.replace('index.html', "");
-    //}
     // else carry on like normal.
     return request;
   }
@@ -222,7 +218,7 @@ resource "aws_cloudfront_function" "add_index" {
         request.uri += 'index.html';
     } 
     // Check whether the URI is missing a file extension.
-    else if (uri == '') {
+    else if (!uri.includes('.')) {
         request.uri += '/index.html';
     }
 

diff --git a/tofu/modules/services/frontend/variables.tf b/tofu/modules/services/frontend/variables.tf
@@ -37,3 +37,8 @@ variable "backend_dns_name" {
   description = "Backend DNS name"
   type        = string
 }
+
+variable "x_allow_secret" {
+  description = "X-Allow header secret"
+  type = string
+}