블로그 릴레이 - CDK 에서 다른 리전에서 만들어진 리소스를 참조하는 방법

...

const webSecurityStackResult = new WebSecurityStack(app,'WebSecurityStack',{
    env: {
      account: process.env.CDK_DEFAULT_ACCOUNT,
      region: 'us-east-1', // 버지니아
    },
  }
);

new WebStack(app, 'WebStack', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: 'ap-northeast-2' //서울
  },
  webAclArn: webSecurityStackResult.webAcl.attrArn,
  crossRegionReferences: true,
});

...
export class WebSecurityStack extends cdk.Stack {
  public readonly webAcl: wafv2.CfnWebACL;

  constructor(scope: Construct, id: string, props: WebSecurityStackProps) {
    super(scope, id, props);

    // Whitelist IP Set
    const allowedIpSet = new wafv2.CfnIPSet(this, 'AllowedIPSet', {
      name: 'allowed-ips',
      scope: 'CLOUDFRONT',
      ipAddressVersion: 'IPV4',
      addresses: [],
    });

    this.webAcl = new wafv2.CfnWebACL(this, 'WebACL', {
      name: 'web-acl',
      scope: 'CLOUDFRONT',
      defaultAction: { block: {} },
      visibilityConfig: {
        metricName: 'web-acl-metric',
        sampledRequestsEnabled: true,
        cloudWatchMetricsEnabled: true, 
      },
      rules: [
        {
          name: 'allow-whitelisted-ips',
          priority: 1,
          statement: {
            ipSetReferenceStatement: {
              arn: allowedIpSet.attrArn,
            },
          },
          action: { allow: {} },
          visibilityConfig: {
            metricName: 'allow-whitelisted-ips-metric',
            sampledRequestsEnabled: true
            cloudWatchMetricsEnabled: true
          },
        },
      ],
    });
  }
}

...
export class WebStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: WebStackProps) {
    super(scope, id, props);

    const hostingBucket = new s3.Bucket(this, 'HostingBucket', {
      bucketName: '...',
      publicReadAccess: false,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    const distribution = new cloudfront.Distribution(this, 'Distribution', {
      defaultRootObject: 'index.html',
      webAclId: props.webAclArn, // NOTE: WAF ACL ARN 지정
      errorResponses: [
        {
          ttl: cdk.Duration.seconds(300),
          httpStatus: 404,
          responseHttpStatus: 200,
          responsePagePath: '/index.html',
        },
      ],
      defaultBehavior: {
        allowedMethods: cloudfront.AllowedMethods.ALLOW_GET_HEAD,
        cachedMethods: cloudfront.CachedMethods.CACHE_GET_HEAD,
        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        origin: cloudfrontOrigins.S3BucketOrigin.withOriginAccessControl(hostingBucket),
        responseHeadersPolicy: new cloudfront.ResponseHeadersPolicy(this, 'ResponseHeaderPolicy', {
          securityHeadersBehavior: {
            contentTypeOptions: { override: true },
            referrerPolicy: {
              referrerPolicy: cloudfront.HeadersReferrerPolicy.SAME_ORIGIN,
              override: true,
            },
            frameOptions: {
              frameOption: cloudfront.HeadersFrameOption.DENY,
              override: true,
            },
            strictTransportSecurity: {
              accessControlMaxAge: cdk.Duration.seconds(63072000),
              includeSubdomains: true,
              preload: true,
              override: true,
            },
            xssProtection: {
              protection: true,
              modeBlock: true,
              override: true,
            },
          },
        }),
      },
    });

    new s3Deployment.BucketDeployment(this, 'Deployment', {
      sources: [],
      destinationBucket: hostingBucket,
      distribution: distribution,
      distributionPaths: ['/*'],
    });
  }
}