An AWS Cloud Resume Retrospective

# Uploading images in the images folder
resource "aws_s3_object" "images" {
    for_each = fileset("website/images", "*.{jpg,png}")
    bucket = aws_s3_bucket.website_bucket.id
    key = "images/${each.value}"
    source = "website/images/${each.value}"
    etag = filemd5("website/images/${each.value}")
    content_type = endswith(each.value, ".jpg") ? "image/jpeg" : "image/png"
}
# Uploading JavaScript files
resource "aws_s3_object" "js_files" {
    for_each = fileset("website/assets/js", "*.js")
    bucket = aws_s3_bucket.website_bucket.id
    key = "assets/js/${each.value}"
    source = "website/assets/js/${each.value}"
    etag = filemd5("website/assets/js/${each.value}")
    content_type = "application/javascript"
}

# Create a CloudFront Origin Access Identity to securely access S3 content
resource "aws_cloudfront_origin_access_identity" "origin_access_identity" {
	comment = "Origin Access Identity for static website"
}
# Configure the CloudFront distribution
resource "aws_cloudfront_distribution" "cloudfront_distribution" {
    # Define the origin (S3 bucket) configuration
    origin {
    # Use the S3 bucket's regional domain name
    domain_name = aws_s3_bucket.website_bucket.bucket_regional_domain_name
    # Unique identifier for this origin
    origin_id = var.bucket_name

    # Configure S3 specific settings with OAI
    s3_origin_config {
        origin_access_identity = aws_cloudfront_origin_access_identity.
        origin_access_identity.cloudfront_access_identity_path
    }
    }
    # Enable the distribution and IPv6
    enabled = true
    is_ipv6_enabled = true
    # Set the default page (e.g., index.html)
    default_root_object = var.website_index_document

    # Configure caching behavior and security settings
    default_cache_behavior {
    # Define allowed HTTP methods
    allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    # Specify which methods to cache
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = var.bucket_name
    
    # Configure request forwarding
    forwarded_values {
        query_string = false
        cookies {
        forward = "none"
        }
    }

    # Force HTTPS for all requests
    viewer_protocol_policy = "redirect-to-https"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
    }

    # Configure SSL/TLS certificate settings
    viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.cert.arn
    ssl_support_method = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
    }

    # Set geographic restrictions (none in this case)
    restrictions {
    geo_restriction {
        restriction_type = "none"
    }
    }

    # Add tags for resource management
    tags = {
    Name = "Cloudfront Distribution"
    Environment = "Dev"
    }

    # Configure custom domain names
    aliases = [
    "jackieweng.com",
    "resume.jackieweng.com",
    "www.jackieweng.com"
    ]
}

# Define AWS provider specifically for ACM in us-east-1 region (required for CloudFront certificates)
provider "aws" {
    alias  = "acm"
    region = "us-east-1"  # CloudFront requires certificates in us-east-1
}

# Create SSL/TLS certificate through AWS Certificate Manager
resource "aws_acm_certificate" "cert" {
    provider = aws.acm  # Use the us-east-1 provider defined above
    domain_name = "jackieweng.com"  # Primary domain for the certificate
    subject_alternative_names = ["*.jackieweng.com"]  # Wildcard subdomain support
    validation_method = "DNS"  # Use DNS validation instead of email
    # Ensure new certificate is created before destroying old one
    lifecycle {
    create_before_destroy = true
    }
}

# Fetch existing Route53 hosted zone information
data "aws_route53_zone" "primary" {
    name = "jackieweng.com."  # Domain name with trailing dot (DNS format)
}

# Create DNS records for certificate validation
resource "aws_route53_record" "cert_validation" {
# Create records for each domain validation option
    for_each = {
        # Transform validation options into a map for easier handling
        for dvo in aws_acm_certificate.cert.domain_validation_options : dvo.domain_name => {
        name   = dvo.resource_record_name
        record = dvo.resource_record_value
        type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true  # Allow updating existing records
  name            = each.value.name  # DNS record name
  records         = [each.value.record]  # DNS record value
  ttl             = 60  # Time-to-live in seconds
  type            = each.value.type  # DNS record type
  zone_id         = data.aws_route53_zone.primary.zone_id  # Route53 zone ID
}

# Create a DynamoDB table for storing visitor count
resource "aws_dynamodb_table" "resume_table" {
    # Set the table name
    name           = "[redacted]"
    # Use on-demand pricing instead of provisioned capacity
    billing_mode   = "PAY_PER_REQUEST"
    # Define primary key field name
    hash_key       = "id"

    # Define the primary key attribute
    attribute {
        name = "id"
        type = "S"  # String type to match Lambda function's data type
    }
}

# Initialize the table with a counter item
resource "aws_dynamodb_table_item" "counter" {
    # Reference the table we created above
    table_name = aws_dynamodb_table.resume_table.name
    # Reference the primary key field
    hash_key   = aws_dynamodb_table.resume_table.hash_key

    # Create initial item with id and view count
    item = jsonencode({
        "id"    = {"S": "1"}    # Primary key value as string
        "views" = {"N": "0"}   # Initial view count as number
    })
}

import json
import boto3
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('[redacted]')
def lambda_handler(event, context):
    response = table.get_item(Key={
        'id':'1'
    })
    views = response['Item']['views']
    views = views + 1
    print(views)
    response = table.put_item(Item={
            'id':'1',
            'views':views
    })

    return views

# Create a ZIP archive of the Lambda function code
data "archive_file" "zip" {
    type        = "zip"                           # Specify archive type
    source_dir  = "${path.module}/lambda/"        # Directory containing Lambda code
    output_path = "${path.module}/packedlambda.zip"  # Where to save the ZIP file
}

# Create the Lambda function using the zipped code
resource "aws_lambda_function" "myfunc" {
    filename         = data.archive_file.zip.output_path    # Path to the ZIP file
    source_code_hash = data.archive_file.zip.output_base64sha256  # For detecting code changes
    function_name    = "myfunc"                            # Name of the Lambda function
    role            = aws_iam_role.iam_for_lambda.arn      # IAM role for permissions
    handler         = "func.lambda_handler"                # Function entry point
    runtime         = "python3.8"                         # Python version to use
}

# Create IAM role for Lambda function
resource "aws_iam_role" "iam_for_lambda" {
  name = "iam_for_lambda"  # Name of the IAM role

  # Define trust policy allowing Lambda to assume this role
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",      # Allow role assumption
      "Principal": {
        "Service": "lambda.amazonaws.com"  # Lambda service can assume this role
      },
      "Effect": "Allow",
      "Sid": ""                        # Statement identifier (optional)
    }
  ]
}
EOF
}

# Create custom IAM policy for Lambda permissions
resource "aws_iam_policy" "iam_policy_for_resume_project" {
  name        = "aws_iam_policy_for_terraform_resume_project"
  path        = "/"                    # Policy path in IAM
  description = "AWS IAM Policy for managing the resume project role"
  
  # Define policy permissions using jsonencode
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [                     # CloudWatch Logs permissions
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Resource = "arn:aws:logs:*:*:*"  # Apply to all log groups
        Effect   = "Allow"
      },
      {
        Effect = "Allow"
        Action = [                     # DynamoDB permissions
          "dynamodb:UpdateItem",
          "dynamodb:GetItem"
        ]
        Resource = "arn:aws:dynamodb:*:*:table/terraformed_cloudresume_test"
      }
    ]
  })
}

# Attach custom policy to Lambda role
resource "aws_iam_role_policy_attachment" "lambda_policy" {
  role       = aws_iam_role.iam_for_lambda.name
  policy_arn = aws_iam_policy.iam_policy_for_resume_project.arn
}

# Attach DynamoDB full access policy to Lambda role
resource "aws_iam_role_policy_attachment" "lambda_dynamodb_full_access" {
  role       = aws_iam_role.iam_for_lambda.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}

# Create function URL for Lambda with CORS settings
resource "aws_lambda_function_url" "url1" {
  function_name      = aws_lambda_function.myfunc.function_name
  authorization_type = "NONE"          # Public access

  # Configure CORS for specific domains
  cors {
    allow_credentials = false
    allow_origins = [                  # Allowed domain names
      "https://resume.jackieweng.com",
      "https://jackieweng.com",
      "https://www.jackieweng.com"
    ]
    allow_methods  = ["GET"]            # Allow only the GET HTTP method
    allow_headers  = ["content-type"]
    max_age        = 86400           # CORS cache duration
  }
}

		
  const counter = document.querySelector(".counter-number");

  async function updateCounter() {
  // Only update counter if we're on index.html
  if (window.location.pathname.endsWith('index.html') || window.location.pathname === '/') {
    try {
      let response = await fetch("[the function URL]");
      let data = await response.json();
      console.log("API Response:", data);
      
      if (data.body) {
        const views = typeof data.body === 'string' ? JSON.parse(data.body).views : data.body.views;
        counter.innerHTML = views;
      } else if (data.views) {
        counter.innerHTML = data.views;
      } else {
        counter.innerHTML = data;
      }
    } catch (error) {
      console.error("Error updating counter:", error);
      counter.innerHTML = "0";
    }
  }
}

// Only call updateCounter if the counter element exists
if (counter) {
  updateCounter();
}

  name: 'CI/CD'

  on:
    push:
      branches:
        - "main"
    pull_request:
  
  jobs:
    deploy:
      runs-on: ubuntu-latest
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      steps:
        - uses: actions/checkout@v3
        - uses: jakejarvis/s3-sync-action@master
          with:
            args: --acl public-read --follow-symlinks --delete
          env:
            AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
            AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
            AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
            AWS_REGION: 'us-east-2'
            SOURCE_DIR: 'website'

1.) Navigate to the settings of the GitHub repository.
2.) Select “Secrets and variables” from the left sidebar, under "Security"
3.) Click on "Actions".
4.) Click on “New repository secret”.
5.) Assign the variable name for the secret, e.g. “AWS_SECRET_ACCESS_KEY”.
6.) Input the corresponding value for the secret, e.g. the actual secret access key for your administrative account.
7.) Repeat steps 4 to 6 for the other secret environment variables, then save your secrets.

Brazeal, F. (2022, August 12). Terraform your cloud resume challenge. The Cloud 
    Resume Challenge. https://cloudresumechallenge.dev/docs/extensions/  
    terraform-getting-started/