Cloud Resume Challenge - Name Changes & Redirecting DNS

Overview#

This ended up being a supplemental piece to my portfolio, I got married (yay!) and I changed my name (also yay!). So I wanted to update my domain as such to have a cohesive online presence. This might be a pretty short article since the fix was quite simple. The main idea was to put CloudFront in front of an S3 bucket which redirects users to my new domain.

The Desired Behavior#

NOTE
When users attempt to reach nicoxmcd.com, they will automatically be redirected to nicolexan.com

The Fix#

I removed most of the original infrastructure of my original portfolio and kept the route53, certificate, cloudfront, and s3 files and edited them as needed. Only cloudfront and s3 have significant changes, while route53 and certificate have the same functionality as the original.

route53.tf is dynamically assigning the nameservers and created the necessary hosted zones for the domain:

1
resource "aws_route53_zone" "main" {
2
  name = var.domain_name
3

4
  tags = {
5
    Project = var.domain_name
6
  }
7
}
8

9
resource "aws_route53domains_registered_domain" "main" {
10
  domain_name = var.domain_name
11

12
  dynamic "name_server" {
13
    for_each = aws_route53_zone.main.name_servers
14
    content {
15
      name = name_server.value
16
    }
17
  }
18
}
19

20
resource "aws_route53_record" "www_a" {
21
  zone_id = aws_route53_zone.main.zone_id
22
  name    = "www.${var.domain_name}"
23
  type    = "A"
24

25
  alias {
26
    name                   = aws_cloudfront_distribution.cdn.domain_name
27
    zone_id                = aws_cloudfront_distribution.cdn.hosted_zone_id
28
    evaluate_target_health = false
29
  }
30
}
31

32
resource "aws_route53_record" "apex_redirect" {
33
  zone_id = aws_route53_zone.main.zone_id
34
  name    = var.domain_name
35
  type    = "A"
36

37
  alias {
38
    name                   = aws_cloudfront_distribution.cdn.domain_name
39
    zone_id                = aws_cloudfront_distribution.cdn.hosted_zone_id
40
    evaluate_target_health = false
41
  }
42
}

cloudfront.tf is mainly responsible for the redirect! So when users try to connect to nicoxmcd.com it returns a status code of 301 (Moved Permanently) and then grabs the redirect target from the variables.tf

1
resource "aws_cloudfront_origin_access_control" "oac" {
2
  name                              = "${replace(var.domain_name, ".", "-")}-oac"
3
  description                       = "OAC for ${var.domain_name} redirect origin"
4
  origin_access_control_origin_type = "s3"
5
  signing_behavior                  = "always"
6
  signing_protocol                  = "sigv4"
7
}
8

9
resource "aws_cloudfront_function" "redirect" {
10
  name    = "${replace(var.domain_name, ".", "-")}-redirect"
11
  runtime = "cloudfront-js-2.0"
12
  publish = true
13

14
  code = <<-EOT
15
    function handler(event) {
16
      return {
17
        statusCode: 301,
18
        statusDescription: "Moved Permanently",
19
        headers: {
20
          location: { value: "https://${var.redirect_target}" + event.request.uri }
21
        }
22
      };
23
    }
24
  EOT
25
}
26

27
resource "aws_cloudfront_distribution" "cdn" {
28
  origin {
29
    domain_name              = aws_s3_bucket.redirect_origin.bucket_regional_domain_name
30
    origin_id                = "S3-redirect-origin"
31
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
32
  }
33

34
  enabled         = true
35
  is_ipv6_enabled = true
36
  comment         = "Redirect ${var.domain_name} to ${var.redirect_target}"
37

38
  aliases = [var.domain_name, "www.${var.domain_name}"]
39

40
  default_cache_behavior {
41
    allowed_methods        = ["GET", "HEAD"]
42
    cached_methods         = ["GET", "HEAD"]
43
    target_origin_id       = "S3-redirect-origin"
44
    viewer_protocol_policy = "allow-all"
45

46
    forwarded_values {
47
      query_string = false
48
      cookies {
49
        forward = "none"
50
      }
51
    }
52

53
    function_association {
54
      event_type   = "viewer-request"
55
      function_arn = aws_cloudfront_function.redirect.arn
56
    }
57

58
    min_ttl     = 0
59
    default_ttl = 0
60
    max_ttl     = 0
61
  }
62

63
  price_class = "PriceClass_100"
64

65
  restrictions {
66
    geo_restriction {
67
      restriction_type = "none"
68
    }
69
  }
70

71
  viewer_certificate {
72
    acm_certificate_arn      = aws_acm_certificate_validation.cert_validation.certificate_arn
73
    ssl_support_method       = "sni-only"
74
    minimum_protocol_version = "TLSv1.2_2021"
75
  }
76

77
  tags = {
78
    Project = var.domain_name
79
  }
80
}

s3.tf is a simple bucket used more or less as a placeholder for the cloudfront function to use to redirect users:

1
resource "aws_s3_bucket" "redirect_origin" {
2
  bucket = "${replace(var.domain_name, ".", "-")}-redirect-origin"
3

4
  tags = {
5
    Project = var.domain_name
6
  }
7
}

certificate.tfis doing the same as before, where it is assigning a certificate to the domain name and validating it:

1
resource "aws_acm_certificate" "cert" {
2
  domain_name               = var.domain_name
3
  subject_alternative_names = ["www.${var.domain_name}"]
4
  validation_method         = "DNS"
5

6
  tags = {
7
    Project = var.domain_name
8
  }
9

10
  lifecycle {
11
    create_before_destroy = true
12
  }
13
}
14

15
resource "aws_route53_record" "cert_validation" {
16
  allow_overwrite = true
17
  name            = tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_name
18
  type            = tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_type
19
  records         = [tolist(aws_acm_certificate.cert.domain_validation_options)[0].resource_record_value]
20
  zone_id         = aws_route53_zone.main.zone_id
21
  ttl             = 300
22
}
23

24
resource "aws_route53_record" "cert_validation_www" {
25
  allow_overwrite = true
26
  name            = tolist(aws_acm_certificate.cert.domain_validation_options)[1].resource_record_name
27
  type            = tolist(aws_acm_certificate.cert.domain_validation_options)[1].resource_record_type
28
  records         = [tolist(aws_acm_certificate.cert.domain_validation_options)[1].resource_record_value]
29
  zone_id         = aws_route53_zone.main.zone_id
30
  ttl             = 300
31
}
32

33
resource "aws_acm_certificate_validation" "cert_validation" {
34
  certificate_arn = aws_acm_certificate.cert.arn
35
  validation_record_fqdns = [
36
    aws_route53_record.cert_validation.fqdn,
37
    aws_route53_record.cert_validation_www.fqdn
38
  ]
39
}

Resources#

Feel free to check out the source code for both the cloud infrastructure and portfolio source code.

nicolexan

nicolexanportfolio

Waiting for api.github.com...

Waiting for api.github.com...

00K

Waiting...

Reflection
This was another piece to a puzzle that I was struggling to find a solution. As I’ve changed my name, I wanted to update my professional handles on LinkedIn, which I did. Yet, my GitHub and portfolio was still using my old handle. Though I also know that I’ve shared this website with many people, so I didn’t just want them to hit a 404 when trying to reach it. So this piece was simple but necessary!