Configuring custom TLS certificates for secure content delivery

Question

Pulumi · Accepted Answer

To configure custom TLS certificates for secure content delivery using Pulumi, you will need to set up a content delivery network (CDN) that supports TLS termination with custom certificates. In this example, I'll guide you through the process of setting up an Amazon CloudFront distribution with a custom TLS certificate from AWS Certificate Manager (ACM).

Before we start coding, let me explain the key components:
- **AWS Certificate Manager (ACM)**: This service is used to create and manage SSL/TLS certificates. You will request a certificate and use it to enable secure connections to your CloudFront distribution.
- **Amazon CloudFront**: Amazon's CDN service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. We'll create a distribution which will serve your content over HTTPS.
- **AWS S3 Bucket**: A simple storage service that offers industry-leading scalability, data availability, security, and performance. This is where you'll store the content that you want to distribute via CloudFront.

Here is an outline of the steps you will follow in the code:
1. Request a TLS certificate from AWS Certificate Manager.
2. Validate the certificate; in a real-world scenario, you would need to prove ownership of the domain by creating DNS records based on the information provided by ACM.
3. Create an S3 bucket to store your content.
4. Set up a CloudFront distribution, and configure it to use the certificate for HTTPS.

In this example code, I will assume that you have already configured your Pulumi environment for AWS and that `my-domain.com` is the domain that you own and wish to use with CloudFront. In a real-world scenario, you would replace this with your actual domain name.

Let's create a Pulumi program in TypeScript:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';
import * as tls from '@pulumi/aws/acm';

// Create a new ACM certificate
const cert = new aws.acm.Certificate('my-cert', {
    domainName: 'my-domain.com',
    validationMethod: 'DNS',
});

// This step showcases where you would normally add domain validation records to your DNS.
// The process involves using the `cert.domainValidationOptions` as input for DNS record resources.
// For this example, we're skipping the actual DNS validation for simplicity.

// Create an S3 bucket to store files
const myBucket = new aws.s3.Bucket('myBucket', {
    website: {
        indexDocument: 'index.html',
    },
});

// Create a CloudFront distribution
const myDistribution = new aws.cloudfront.Distribution('myDistribution', {
    origins: [{
        domainName: myBucket.bucketDomainName,
        originId: 'myS3Origin',
        s3OriginConfig: {
            originAccessIdentity: 'origin-access-identity/cloudfront/EDFDVBD6EXAMPLE',
        },
    }],
    defaultRootObject: 'index.html',
    defaultCacheBehavior: {
        targetOriginId: 'myS3Origin',
        viewerProtocolPolicy: 'redirect-to-https',
        allowedMethods: ['GET', 'HEAD', 'OPTIONS'],
        cachedMethods: ['GET', 'HEAD', 'OPTIONS'],
        forwardedValues: {
            queryString: false,
            cookies: { forward: 'none' },
        },
    },
    viewerCertificate: {
        acmCertificateArn: cert.arn, // The ARN of the ACM certificate
        sslSupportMethod: 'sni-only', // Server Name Indication (SNI) - modern method of serving multiple HTTPS sites from a single IP address
    },
    restrictions: {
        geoRestriction: {
            restrictionType: 'none',
        },
    },
    enabled: true,
});

// Export the URLs of the bucket and the CloudFront distribution
export const bucketUrl = myBucket.websiteEndpoint;
export const distributionUrl = myDistribution.domainName;
```

In the code above:

- We initiate a certificate request using `aws.acm.Certificate`, which will generate a new certificate in AWS Certificate Manager for the specified domain. Normally, you would need to create DNS records to validate ownership; however, this is skipped for simplicity.
- We create an S3 bucket that will host our content. In this example, we're defining a website configuration with an index document that CloudFront will fetch to serve as the default document.
- We setup the CloudFront distribution with `aws.cloudfront.Distribution` and specify our S3 bucket as the origin. We also configure the distribution to serve content over HTTPS using the certificate we created, and set up a default cache behavior.
- We export the S3 bucket URL and the CloudFront distribution domain name for easy access after the deployment is complete.

Please replace the placeholders like `my-domain.com` with your actual domain details and complete the validation steps in a real implementation. This program is meant to illustrate how to work with Pulumi and TLS certificates and should serve as a foundational example for deploying secure content delivery infrastructure.