feat: DNS updates to shared infra

jeastham1993 · jeastham1993 · commit d7170fa2af7b · 2026-02-02T16:53:33.000Z
diff --git a/shared/infra/aws/lib/network.ts b/shared/infra/aws/lib/network.ts
@@ -41,10 +41,13 @@ import {
   LoadBalancerV2Origin,
   S3BucketOrigin,
 } from "aws-cdk-lib/aws-cloudfront-origins";
+import { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+import { getPrimaryDomainName } from "./shared-resources-stack";
 
 export interface NetworkProps {
   env: string;
   account: string;
+  certificate?: ICertificate;
 }
 
 export class Network extends Construct {
@@ -96,16 +99,16 @@ export class Network extends Construct {
         allowAllOutbound: true,
         description: "No inbound / all outbound",
         securityGroupName: "noInboundAllOutboundSecurityGroup",
-      }
+      },
     );
     this.noInboundAllOutboundSecurityGroup.addIngressRule(
       this.noInboundAllOutboundSecurityGroup,
       Port.tcp(8080),
-      "allow self"
+      "allow self",
     );
     this.noInboundAllOutboundSecurityGroup.addIngressRule(
       Peer.ipv4(this.vpc.vpcCidrBlock),
-      Port.tcp(8080)
+      Port.tcp(8080),
     );
 
     this.vpcLink = new VpcLink(this, "HttpApiVpcLink", {
@@ -128,7 +131,7 @@ export class Network extends Construct {
       {
         stringValue: this.noInboundAllOutboundSecurityGroup.securityGroupId,
         parameterName: `/stickerlandia/${props.env}/shared/vpc-link-sg-id`,
-      }
+      },
     );
 
     this.httpApi = new HttpApi(this, "StickerlandiaHttpApi", {
@@ -159,28 +162,37 @@ export class Network extends Construct {
     });
     webFrontendBucket.grantRead(originIdentity);
 
+    // If the certificate is passed in, create a domain for that specific environment.
+    const primaryDomainName = getPrimaryDomainName(
+      props.certificate,
+      props.env,
+    );
+    const domainName = primaryDomainName ? [primaryDomainName] : undefined;
+
     this.distribution = new Distribution(this, `Stickerlandia-${props.env}`, {
+      certificate: props.certificate,
+      domainNames: domainName,
       minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1_2_2021,
       defaultRootObject: "index.html",
+      // SPA routing: return index.html for any unmatched routes on the frontend
+      // S3 with OAI returns 403 for non-existent files, so we handle both 403 and 404
+      // This only applies to the default behavior (S3/frontend), not API routes
+      errorResponses: [
+        {
+          httpStatus: 403,
+          responseHttpStatus: 200,
+          responsePagePath: "/index.html",
+        },
+        {
+          httpStatus: 404,
+          responseHttpStatus: 200,
+          responsePagePath: "/index.html",
+        },
+      ],
       defaultBehavior: {
         origin: S3BucketOrigin.withOriginAccessIdentity(webFrontendBucket, {
           originAccessIdentity: originIdentity,
         }),
-        // SPA routing: return index.html for any unmatched routes on the frontend
-        // S3 with OAI returns 403 for non-existent files, so we handle both 403 and 404
-        // This only applies to the default behavior (S3/frontend), not API routes
-        errorResponses: [
-          {
-            httpStatus: 403,
-            responseHttpStatus: 200,
-            responsePagePath: "/index.html",
-          },
-          {
-            httpStatus: 404,
-            responseHttpStatus: 200,
-            responsePagePath: "/index.html",
-          },
-        ],
       },
     });
 
@@ -192,15 +204,15 @@ export class Network extends Construct {
         `${this.httpApi.apiId}.execute-api.${region}.amazonaws.com`,
         {
           protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
-        }
+        },
       ),
       {
         cachePolicy: CachePolicy.CACHING_DISABLED,
         originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
         responseHeadersPolicy:
           ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS,
         allowedMethods: AllowedMethods.ALLOW_ALL,
-      }
+      },
     );
 
     this.distribution.addBehavior(
@@ -209,15 +221,15 @@ export class Network extends Construct {
         `${this.httpApi.apiId}.execute-api.${region}.amazonaws.com`,
         {
           protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
-        }
+        },
       ),
       {
         cachePolicy: CachePolicy.CACHING_DISABLED,
         originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
         responseHeadersPolicy:
           ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS,
         allowedMethods: AllowedMethods.ALLOW_ALL,
-      }
+      },
     );
 
     this.distribution.addBehavior(
@@ -226,15 +238,15 @@ export class Network extends Construct {
         `${this.httpApi.apiId}.execute-api.${region}.amazonaws.com`,
         {
           protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
-        }
+        },
       ),
       {
         cachePolicy: CachePolicy.CACHING_DISABLED,
         originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
         responseHeadersPolicy:
           ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS,
         allowedMethods: AllowedMethods.ALLOW_ALL,
-      }
+      },
     );
 
     this.distribution.addBehavior(
@@ -243,15 +255,15 @@ export class Network extends Construct {
         `${this.httpApi.apiId}.execute-api.${region}.amazonaws.com`,
         {
           protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
-        }
+        },
       ),
       {
         cachePolicy: CachePolicy.CACHING_DISABLED,
         originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
         responseHeadersPolicy:
           ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS,
         allowedMethods: AllowedMethods.ALLOW_ALL,
-      }
+      },
     );
   }
 }
diff --git a/shared/infra/aws/lib/shared-resources-stack.ts b/shared/infra/aws/lib/shared-resources-stack.ts
@@ -12,17 +12,45 @@ import { PrivateDnsNamespace } from "aws-cdk-lib/aws-servicediscovery";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
 import { EventBus } from "aws-cdk-lib/aws-events";
 import { Persistence } from "./persistence";
+import { CnameRecord, PublicHostedZone } from "aws-cdk-lib/aws-route53";
+import { Certificate, ICertificate } from "aws-cdk-lib/aws-certificatemanager";
 // import * as sqs from 'aws-cdk-lib/aws-sqs';
 
 export class StickerlandiaSharedResourcesStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props?: cdk.StackProps) {
     super(scope, id, props);
 
     const env = process.env.ENV || "dev";
+    const certificateArn = process.env.CERTIFICATE_ARN;
+    const hostedZoneId = process.env.HOSTED_ZONE_ID;
+
+    // Only deploy shared resources for 'prod' and 'dev' environments
+    if (env !== "prod" && env !== "dev") {
+      return;
+    }
+
+    const hostedZone = hostedZoneId
+      ? PublicHostedZone.fromPublicHostedZoneAttributes(
+          this,
+          "StickerlandiaHostedZone",
+          {
+            hostedZoneId: hostedZoneId,
+            zoneName: "stickerlandia.dev",
+          },
+        )
+      : undefined;
+
+    const cert = certificateArn
+      ? Certificate.fromCertificateArn(this, "Certificate", certificateArn)
+      : undefined;
+
+    const domainName = getPrimaryDomainName(cert, env);
+    const primaryDomainName = domainName ? `https://${domainName}` : undefined;
 
     const network = new Network(this, "Network", {
       env,
       account: this.account,
+      certificate: cert,
     });
 
     const persistence = new Persistence(this, "Persistence", {
@@ -31,6 +59,15 @@ export class StickerlandiaSharedResourcesStack extends cdk.Stack {
       vpc: network.vpc,
     });
 
+    if (hostedZone) {
+      const cNameRecord = new CnameRecord(this, "CnameRecord", {
+        zone: hostedZone,
+        domainName: network.distribution.domainName,
+        recordName: env,
+        ttl: cdk.Duration.minutes(5),
+      });
+    }
+
     const dnsNamespace = new PrivateDnsNamespace(this, "PrivateDnsNamespace", {
       name: `${env}.stickerlandia.local`,
       vpc: network.vpc,
@@ -62,9 +99,9 @@ export class StickerlandiaSharedResourcesStack extends cdk.Stack {
       this,
       "CloudFrontEndpointParam",
       {
-        stringValue: network.distribution.domainName,
+        stringValue: primaryDomainName ?? network.distribution.domainName,
         parameterName: `/stickerlandia/${env}/shared/cloudfront-endpoint`,
-      }
+      },
     );
 
     const cloudfrontId = new StringParameter(this, "CloudFrontIdParam", {
@@ -88,7 +125,7 @@ export class StickerlandiaSharedResourcesStack extends cdk.Stack {
 
     // CDK Outputs
     new cdk.CfnOutput(this, "BaseUrl", {
-      value: `https://${network.distribution.domainName}`,
+      value: primaryDomainName ?? network.distribution.domainName,
       description: "Base URL for Stickerlandia (CloudFront distribution)",
       exportName: `stickerlandia-${env}-base-url`,
     });
@@ -100,3 +137,14 @@ export class StickerlandiaSharedResourcesStack extends cdk.Stack {
     });
   }
 }
+
+export function getPrimaryDomainName(
+  cert: ICertificate | undefined,
+  env: string,
+): string | undefined {
+  return cert
+    ? env === "prod"
+      ? "stickerlandia.dev"
+      : `${env}.stickerlandia.dev`
+    : undefined;
+}
