cdk/README.md

CDK deployment (doc_redaction)

Interactive installer: cdk_install.py. Configuration: config/cdk_config.env.

Human-oriented walkthrough: Installation Guide.

CloudFront response headers (CSP / CORS)

When USE_CLOUDFRONT=True and CLOUDFRONT_ENABLE_SECURE_RESPONSE_HEADERS=True, the stack creates a CloudFront response headers policy (see cdk_cloudfront_headers.py and config/response-headers-policy-config.json). The policy is created as a standalone resource so it appears in the account's CloudFront policy list and can be attached manually.

Attaching the policy to the distribution's behaviors is controlled separately by CLOUDFRONT_ATTACH_SECURE_RESPONSE_HEADERS (default False). Attaching the CSP/security headers tends to break demonstration mode (Cognito redirect flows and mixed Express origins), so by default the policy is created but left detached. Set CLOUDFRONT_ATTACH_SECURE_RESPONSE_HEADERS=True to wire it onto the distribution.

The policy’s CORS origin and Content-Security-Policy connect-src (Gradio WebSocket: wss://…) must match the browser-facing app URL.

Why cloudfront_placeholder.net appears on first deploy

The real *.cloudfront.net domain is only assigned after the distribution is created. The response headers policy is a separate CloudFormation resource referenced by the distribution; it cannot reference distribution.domain_name without a circular dependency (distribution → policy → distribution).

On the first deploy, CLOUDFRONT_DOMAIN and COGNITO_REDIRECTION_URL therefore use a synth-time placeholder (cloudfront_placeholder.net). CSP/CORS are built from those values.

Automatic fix (installer)

After the initial cdk deploy, cdk_install.py:

1. Reads CloudFrontDistributionURL from stack outputs.
2. Writes the real domain to CLOUDFRONT_DOMAIN and COGNITO_REDIRECTION_URL in cdk_config.env (and updates Cognito callback URLs via API).
3. Prompts for a one-off refresh deploy of RedactionStack so the response headers policy and related config use the real domain.

Use --yes to accept the refresh deploy without prompting. If you skip it, run manually:

cd cdk
cdk deploy RedactionStack

Single-pass alternative (custom domain)

If you set SSL_CERTIFICATE_DOMAIN and ACM_SSL_CERTIFICATE_ARN (production profile), the app origin is known at synth time and CSP/CORS are correct on the first deploy—no placeholder and no refresh deploy.

Verify after deploy

In the AWS console: CloudFront → your distribution → Behaviors → response headers policy. CORS should list https://<your-domain> and CSP connect-src should include wss://<your-domain> (not cloudfront_placeholder.net).