Feature/md 7071 set security headers #8
Conversation
marns93
force-pushed
the
feature/MD-7071-set-security-headers
branch
from
7524e2a
to
c5a364a
Compare
| return ( | ||
| f"aws s3 sync dist/ {ARTIFACTS_BUCKET} --cache-control 'max-age=60' --delete --no-progress", | ||
| f"aws s3 cp {ARTIFACTS_BUCKET} {ARTIFACTS_BUCKET} --recursive --no-progress --exclude '*' " | ||
| f"--include {pattern} --metadata-directive REPLACE --content-type '{mime_type}' --cache-control '{max_age}'", | ||
| _get_metadata_command(), |
There was a problem hiding this comment.
I think it would be important to check whether this overrides cache-control or not.
There was a problem hiding this comment.
I will not override the other settings.
But we have to check if it works like it is, because during the upload x-amz-meta- will be added automatically as a prefix...
There was a problem hiding this comment.
Maybe S3 doesn't support it in the first place? Interestingly CloudFront advises to go for Lambda:
There was a problem hiding this comment.
So another option would be a CloudFront function, which returns the headers for the response. But we will execute the function for every response for the app... :(
Will check what options we have.
There was a problem hiding this comment.
:D @zyv Same comment and idea.
There was a problem hiding this comment.
I think a better option would be adding response headers policy with CloudFront.
@zyv WDYT?
There was a problem hiding this comment.
But we will execute the function for every response for the app... :(
Yes, but this with Lambda@Edge I think is annoying, but non-factor in terms of both costs and performance.
There was a problem hiding this comment.
Oh wow, this is cool. Do you have a link to the docs?
There was a problem hiding this comment.
Oh wow, this is cool. Do you have a link to the docs?
There are some pre-defined ones, which are not exactly what we need, but we can create our custom one.
https://us-east-1.console.aws.amazon.com/cloudfront/v4/home#/policies/responseHeaders/create
There was a problem hiding this comment.
So we will close this PR and create a new one in moneymeets-pulumi by settings the response headers with CloudFront. There are more security headers we could set, which can be discussed.
|
Close this PR, because we can't set the headers with the expected names. We will add a custom response policy to our CloudFront distribution. (#8 (comment)) |
@felix11h FYI
We added additional security headers for our websites.