# Cloud laboratory: files published with the articles These files form a demonstrative Terraform module and mock-provider tests. No AWS deployment has been performed. To reproduce the checks, download the files and rename them as follows: - versions.tf.txt -> versions.tf - main.tf.txt -> main.tf - variables.tf.txt -> variables.tf - outputs.tf.txt -> outputs.tf - provider-lock.hcl.txt -> .terraform.lock.hcl - security.tftest.hcl.txt -> tests/security.tftest.hcl (create the tests directory) - verify.py.txt -> verify.py Use a verified Terraform 1.16.x binary. From that directory run: python3 verify.py /absolute/path/to/terraform The script downloads the pinned provider during initialization and runs local checks with a mocked AWS provider. All test runs use plan; no apply is performed. validation.json on this site records the actual results of the published version. --- # Private S3 origin and public CloudFront website — laboratory This is a demonstrative Terraform implementation, not an AWS deployment or a customer project. Its checks use mocked AWS resources and plan-only test runs. No AWS account, live certificate, DNS record or website is created by validation. Test identifiers and `example.invalid` are synthetic. The configuration describes nine resources: an S3 bucket, ownership controls, four public-access blocks, SSE-S3 encryption, versioning, a CloudFront Origin Access Control, a short-lived cache policy, a distribution and the bucket policy. The four access flags belong to one resource. The bucket is a private origin; content served by CloudFront would be publicly readable. This design does not provide user authentication or private document delivery. S3 uses its regional REST endpoint, not website hosting. OAC signs origin requests with SigV4. The bucket policy grants CloudFront only `s3:GetObject`, scoped to the distribution ARN, and denies insecure transport to non-service principals. Account-level IAM permissions and other policies are outside this module; this grant does not remove an account administrator's rights. Bucket ownership disables ACLs, and forced deletion of stored objects is disabled. CloudFront redirects HTTP viewers to HTTPS, allows GET/HEAD, and uses an existing custom-domain ACM certificate from `us-east-1` with the `TLSv1.2_2021` policy and SNI. The cache has minimum/default/maximum TTL values of 0/60/300 seconds. Cookies, query strings and selected headers are excluded from its key and origin inputs; gzip/Brotli negotiation remains enabled. Use this policy only for public, non-personalized content. Versioning preserves old object versions and can add storage cost if deployed; retention/lifecycle management is not configured. ## Inputs and exclusions Required inputs are `bucket_name`, `site_domain` and `certificate_arn`; `aws_region` defaults to `eu-west-1`. Bucket names are deliberately restricted to lowercase letters, digits and hyphens. Hostname and certificate validation checks syntax and the certificate region only. Bucket uniqueness, certificate issuance, hostname coverage, AWS permissions and actual runtime behavior cannot be established by mocks. The module does not create domains, certificates, certificate validation records, DNS aliases, uploaded objects, cache invalidations, access logs, monitoring or budget alerts. An empty bucket has no working homepage. `index.html` is the default object only at the root; directory rewrites, SPA routing and error-to-index fallbacks are not implemented. Geographic restrictions are not configured; `PriceClass_100` controls the selected CloudFront price class, not a guaranteed cost or residency boundary. No real provider plan or apply is part of the checks. Deployment and its associated costs are outside this laboratory's scope. Before any separately authorized deployment, inputs, account permissions, certificate/DNS ownership, content publication, state management, logging, retention and costs need an operational decision. No deployment instructions are executed here. ## Repeatable checks Terraform is constrained to `~> 1.16.0`; AWS provider `6.68.0` is pinned. The generated `.terraform.lock.hcl` records the provider checksums. The verification helper removes inherited environment values, disables AWS metadata discovery and points both AWS configuration files and Terraform CLI configuration to `/dev/null`. It invokes only version, formatting, backend-disabled initialization, validation and tests. Initialization downloads the provider from the Terraform registry; the mock tests perform no AWS resource operations. Run the helper with an already verified Terraform binary: ```sh python3 verify.py /absolute/path/to/terraform ``` `tests/security.tftest.hcl` declares a mocked AWS provider with plan-time synthetic computed values. All twelve runs explicitly use `command = plan`. Assertions cover the private origin, signed requests, TLS, read-only distribution-scoped bucket permission, insecure-transport denial, cache policy and invalid inputs. The reserved `amzn-s3-demo-` prefix and the `-an` suffix for the unconfigured account-regional namespace are rejected. Tests validate the configuration contract, not live cloud authorization, availability or performance. Command outputs and their actual return codes are written to `reports/`; `verification.json` records the tool version, executable hash and each command result. A successful report is evidence of local checks only. ## Primary references - [Terraform mock providers and plan-time overrides](https://developer.hashicorp.com/terraform/language/tests/mocking) - [CloudFront access to an S3 origin with OAC](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) - [CloudFront certificate requirements](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html) - [S3 policy conditions and AWS service network context](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-bucket-policies-tls-version) - [AWS provider CloudFront distribution](https://registry.terraform.io/providers/hashicorp/aws/6.68.0/docs/resources/cloudfront_distribution) - [S3 bucket naming rules and reserved names](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html)