{"id":29599388,"url":"https://github.com/deviant101/secure-s3-bucket-cdk","last_synced_at":"2025-07-20T11:06:30.244Z","repository":{"id":305226469,"uuid":"1022310081","full_name":"deviant101/secure-s3-bucket-cdk","owner":"deviant101","description":"Enterprise-ready AWS CDK construct for secure S3 buckets with KMS encryption, versioning, and GitHub OIDC integration for CI/CD deployments","archived":false,"fork":false,"pushed_at":"2025-07-18T20:29:12.000Z","size":11,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-19T01:24:30.967Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/deviant101.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-18T20:24:52.000Z","updated_at":"2025-07-18T20:29:15.000Z","dependencies_parsed_at":"2025-07-19T01:38:11.384Z","dependency_job_id":null,"html_url":"https://github.com/deviant101/secure-s3-bucket-cdk","commit_stats":null,"previous_names":["deviant101/secure-s3-bucket-cdk"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/deviant101/secure-s3-bucket-cdk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviant101%2Fsecure-s3-bucket-cdk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviant101%2Fsecure-s3-bucket-cdk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviant101%2Fsecure-s3-bucket-cdk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviant101%2Fsecure-s3-bucket-cdk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/deviant101","download_url":"https://codeload.github.com/deviant101/secure-s3-bucket-cdk/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/deviant101%2Fsecure-s3-bucket-cdk/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266112314,"owners_count":23878022,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-20T11:06:29.781Z","updated_at":"2025-07-20T11:06:30.234Z","avatar_url":"https://github.com/deviant101.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🧪 Secure S3 Bucket CDK Construct\n\nA reusable AWS CDK construct that provisions a secure S3 bucket with optional KMS encryption, versioning, and GitHub OIDC integration for CI/CD deployments.\n\n## 🚀 Features\n\n- **Secure S3 Bucket**: Creates an S3 bucket with security best practices\n- **Optional KMS Encryption**: Enable customer-managed KMS encryption with automatic key rotation\n- **Versioning Support**: Configurable S3 bucket versioning\n- **GitHub OIDC Integration**: Automatic GitHub Actions OIDC role creation for secure deployments\n- **Multi-Environment Support**: Separate dev and prod environments with manual approval gates\n- **Comprehensive Testing**: Full unit test coverage with Jest\n- **CI/CD Pipeline**: GitHub Actions workflow with linting, testing, and deployment\n\n## 📁 Project Structure\n\n```\n├── lib/\n│   ├── secure-bucket.ts        # Reusable CDK construct\n│   └── secure-bucket-stack.ts  # CDK stack implementation\n├── bin/\n│   └── app.ts                  # CDK app entry point\n├── test/\n│   └── secure-bucket.test.ts   # Unit tests for construct\n├── .github/\n│   └── workflows/\n│       └── deploy.yml          # GitHub Actions CI/CD workflow\n├── cdk.json                    # CDK configuration\n├── package.json                # Node.js dependencies and scripts\n├── tsconfig.json               # TypeScript configuration\n├── jest.config.js              # Jest testing configuration\n├── .eslintrc.json              # ESLint configuration\n└── .prettierrc.json            # Prettier configuration\n```\n\n## 🏗️ Usage\n\n### Basic Usage\n\n```typescript\nimport { SecureBucket } from './lib/secure-bucket';\n\nnew SecureBucket(this, 'MySecureBucket', {\n  projectId: 'my-project',\n  enableVersioning: true,\n  enableEncryption: true,\n  githubRepo: 'myorg/myrepo'\n});\n```\n\n### Advanced Configuration\n\n```typescript\nnew SecureBucket(this, 'MySecureBucket', {\n  projectId: 'my-project',\n  environment: 'prod',\n  enableVersioning: true,\n  enableEncryption: true,\n  githubRepo: 'myorg/myrepo',\n  additionalGithubRepos: ['myorg/another-repo', 'myorg/third-repo']\n});\n```\n\n## 🔧 Interface\n\n```typescript\nexport interface SecureBucketProps {\n  /**\n   * Project identifier used as prefix for bucket name\n   */\n  projectId: string;\n\n  /**\n   * Enable S3 bucket versioning\n   * @default false\n   */\n  enableVersioning?: boolean;\n\n  /**\n   * Enable KMS encryption for the bucket\n   * @default false\n   */\n  enableEncryption?: boolean;\n\n  /**\n   * GitHub repository in format 'owner/repo' for OIDC role\n   * @example 'myorg/myrepo'\n   */\n  githubRepo?: string;\n\n  /**\n   * Additional allowed GitHub repositories for OIDC\n   * @default []\n   */\n  additionalGithubRepos?: string[];\n\n  /**\n   * Environment name (e.g., 'dev', 'prod')\n   * @default 'dev'\n   */\n  environment?: string;\n}\n```\n\n## 🛠️ Development Setup\n\n### Prerequisites\n\n- Node.js 18+\n- AWS CLI configured\n- AWS CDK CLI (`npm install -g aws-cdk`)\n\n### Installation\n\n```bash\n# Clone the repository\ngit clone https://github.com/deviant101/secure-s3-bucket-cdk.git\ncd secure-s3-bucket-cdk\n\n# Install dependencies\nnpm install\n\n# Build the project\nnpm run build\n```\n\n### Testing\n\n```bash\n# Run unit tests\nnpm test\n\n# Run tests in watch mode\nnpm run test:watch\n\n# Run tests with coverage\nnpm test -- --coverage\n```\n\n### Linting and Formatting\n\n```bash\n# Run ESLint\nnpm run lint\n\n# Format code with Prettier\nnpm run format\n\n# Check formatting\nnpm run format -- --check\n```\n\n### CDK Commands\n\n```bash\n# Synthesize CloudFormation templates\nnpm run synth\n\n# Deploy to development\nnpm run deploy:dev\n\n# Deploy to production\nnpm run deploy:prod\n\n# Show diff for current changes\nnpm run diff\n```\n\n## 🔐 GitHub Actions Setup\n\n### Required Secrets\n\nConfigure the following secrets in your GitHub repository:\n\n- `AWS_ACCOUNT_ID`: Your AWS account ID\n- `AWS_ROLE_ARN_DEV`: ARN of the OIDC role for development deployments\n- `AWS_ROLE_ARN_PROD`: ARN of the OIDC role for production deployments\n\n### OIDC Provider Setup\n\nBefore running the workflow, ensure you have set up the GitHub OIDC provider in your AWS account:\n\n```bash\n# Create OIDC provider (one-time setup)\naws iam create-open-id-connect-provider \\\n  --url https://token.actions.githubusercontent.com \\\n  --client-id-list sts.amazonaws.com \\\n  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1\n```\n\n### Workflow Features\n\n- **Automatic Triggers**: Runs on push to `main`/`develop` branches and PRs\n- **Manual Deployment**: Supports workflow dispatch for manual deployments\n- **Multi-Environment**: Separate dev and prod environments\n- **Production Gates**: Manual approval required for production deployments\n- **Security Validation**: CDK diff validation to prevent unauthorized changes\n- **Comprehensive Testing**: Linting, formatting, and unit tests\n\n## 🏛️ Architecture\n\n### Security Features\n\n- **Block Public Access**: All public access blocked by default\n- **SSL/TLS Enforcement**: HTTPS-only access via bucket policy\n- **KMS Encryption**: Optional customer-managed encryption with key rotation\n- **OIDC Authentication**: Secure GitHub Actions authentication without long-lived secrets\n- **Least Privilege**: Minimal IAM permissions for deployment roles\n\n### Resource Naming Convention\n\n- **Bucket**: `{projectId}-secure-bucket-{environment}`\n- **OIDC Role**: `{projectId}-github-oidc-role-{environment}`\n- **KMS Key Alias**: `alias/{projectId}-bucket-key-{environment}`\n\n### Outputs\n\nThe construct provides the following CloudFormation outputs:\n\n- **BucketName**: Name of the created S3 bucket\n- **OIDCRoleArn**: ARN of the GitHub OIDC role (if created)\n- **KMSKeyArn**: ARN of the KMS encryption key (if created)\n\n## 🌍 Environment Configuration\n\n### Development Environment\n\n- Automatic deployment on push to `develop` branch\n- Relaxed security policies for development\n- Automatic resource cleanup on stack deletion\n\n### Production Environment\n\n- Manual approval required\n- Enhanced security validation\n- Drift detection and unauthorized change prevention\n- Immutable infrastructure approach\n\n## 📊 Monitoring and Logging\n\nThe construct automatically enables:\n\n- **CloudTrail Integration**: All S3 API calls logged\n- **Access Logging**: S3 access logs (when configured)\n- **KMS Key Usage**: CloudWatch metrics for key usage\n\n## 🚨 Troubleshooting\n\n### Common Issues\n\n1. **OIDC Provider Not Found**\n   ```\n   Error: OIDC provider not found\n   ```\n   Solution: Create the GitHub OIDC provider in your AWS account (see setup instructions above)\n\n2. **Permission Denied**\n   ```\n   Error: User is not authorized to perform sts:AssumeRoleWithWebIdentity\n   ```\n   Solution: Ensure the OIDC role trust policy includes your GitHub repository\n\n3. **Bucket Name Conflicts**\n   ```\n   Error: Bucket already exists\n   ```\n   Solution: S3 bucket names are globally unique. Change the `projectId` or add a unique suffix\n\n### Debug Mode\n\nEnable CDK debug mode for verbose output:\n\n```bash\nexport CDK_DEBUG=true\nnpm run deploy:dev\n```\n\n## 📝 Contributing\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add some amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n### Development Guidelines\n\n- Follow TypeScript best practices\n- Maintain 100% test coverage\n- Use conventional commit messages\n- Update documentation for new features\n\n## 📄 License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## 🤝 Support\n\n- Create an issue for bug reports or feature requests\n- Check existing issues before creating new ones\n- Provide detailed information for faster resolution\n\n## 🎯 Roadmap\n\n- [ ] Support for S3 Transfer Acceleration\n- [ ] Integration with AWS Config for compliance monitoring\n- [ ] Support for cross-region replication\n- [ ] CloudWatch dashboards for monitoring\n- [ ] Cost optimization recommendations\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeviant101%2Fsecure-s3-bucket-cdk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeviant101%2Fsecure-s3-bucket-cdk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeviant101%2Fsecure-s3-bucket-cdk/lists"}