[OSDEV-899] Move React application to the S3 bucket

[roninzp]

After moving the React application to an S3 bucket, we transfer the processing of part of the traffic to the CDN, which allows us to use the computing resources of the ECS cluster more efficiently.

[coderabbitai]

Actionable comments posted: 4

🧹 Outside diff range and nitpick comments (2)

deployment/terraform/cdn.tf (2)

26-32: Consider enabling versioning for production environments

Versioning is currently suspended, which could make it difficult to recover from accidental deletions or modifications. For production environments, it's recommended to enable versioning.

Consider enabling versioning and adding lifecycle rules:

resource "aws_s3_bucket_versioning" "react" {
  bucket = aws_s3_bucket.react.id
  versioning_configuration {
    status = "Enabled"  # Enable for production
  }
}

resource "aws_s3_bucket_lifecycle_rule" "react" {
  bucket = aws_s3_bucket.react.id
  id      = "cleanup-old-versions"
  enabled = true

  noncurrent_version_expiration {
    days = 30  # Adjust retention period as needed
  }
}

---

Line range hint 42-467: Add security headers and origin failover

The CloudFront distribution is missing important security headers and origin failover configuration.

Consider adding:

1. Security headers using Lambda@Edge or CloudFront Functions
2. Origin failover for high availability

Example configuration for security headers using CloudFront Functions:

resource "aws_cloudfront_function" "security_headers" {
  name    = "security-headers"
  runtime = "cloudfront-js-1.0"
  code    = <<-EOT
function handler(event) {
    var response = event.response;
    var headers = response.headers;
    
    headers['strict-transport-security'] = { value: 'max-age=63072000; includeSubdomains; preload'};
    headers['x-content-type-options'] = { value: 'nosniff'};
    headers['x-frame-options'] = { value: 'DENY'};
    headers['x-xss-protection'] = { value: '1; mode=block'};
    headers['referrer-policy'] = { value: 'same-origin'};
    headers['content-security-policy'] = { value: "default-src 'self'"};
    
    return response;
}
EOT
}

For the CloudFront distribution, add:

  # In default_cache_behavior and ordered_cache_behavior blocks
  function_association {
    event_type   = "viewer-response"
    function_arn = aws_cloudfront_function.security_headers.arn
  }

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0c90d10 and 149d104.

📒 Files selected for processing (1)

• deployment/terraform/cdn.tf (4 hunks)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud