| # CDK deployment (doc_redaction) |
| |
| Interactive installer: [`cdk_install.py`](cdk_install.py). Configuration: [`config/cdk_config.env`](config/cdk_config.env). |
| |
| Human-oriented walkthrough: [Installation Guide](https://seanpedrick-case.github.io/doc_redaction/src/installation_guide.html). |
| |
| ## CloudFront response headers (CSP / CORS) |
| |
| When `USE_CLOUDFRONT=True` and `CLOUDFRONT_ENABLE_SECURE_RESPONSE_HEADERS=True`, the stack **creates** a CloudFront **response headers policy** (see [`cdk_cloudfront_headers.py`](cdk_cloudfront_headers.py) and [`config/response-headers-policy-config.json`](config/response-headers-policy-config.json)). The policy is created as a standalone resource so it appears in the account's CloudFront policy list and can be attached manually. |
|
|
| Attaching the policy to the distribution's behaviors is controlled separately by `CLOUDFRONT_ATTACH_SECURE_RESPONSE_HEADERS` (**default `False`**). Attaching the CSP/security headers tends to break demonstration mode (Cognito redirect flows and mixed Express origins), so by default the policy is created but **left detached**. Set `CLOUDFRONT_ATTACH_SECURE_RESPONSE_HEADERS=True` to wire it onto the distribution. |
|
|
| The policy’s **CORS origin** and **Content-Security-Policy** `connect-src` (Gradio WebSocket: `wss://…`) must match the browser-facing app URL. |
|
|
| ### Why `cloudfront_placeholder.net` appears on first deploy |
| |
| The real `*.cloudfront.net` domain is only assigned **after** the distribution is created. The response headers policy is a **separate** CloudFormation resource referenced by the distribution; it cannot reference `distribution.domain_name` without a **circular dependency** (distribution → policy → distribution). |
|
|
| On the first deploy, `CLOUDFRONT_DOMAIN` and `COGNITO_REDIRECTION_URL` therefore use a synth-time placeholder (`cloudfront_placeholder.net`). CSP/CORS are built from those values. |
|
|
| ### Automatic fix (installer) |
|
|
| After the initial `cdk deploy`, [`cdk_install.py`](cdk_install.py): |
|
|
| 1. Reads `CloudFrontDistributionURL` from stack outputs. |
| 2. Writes the real domain to `CLOUDFRONT_DOMAIN` and `COGNITO_REDIRECTION_URL` in `cdk_config.env` (and updates Cognito callback URLs via API). |
| 3. Prompts for a **one-off refresh deploy** of `RedactionStack` so the response headers policy and related config use the real domain. |
|
|
| Use `--yes` to accept the refresh deploy without prompting. If you skip it, run manually: |
|
|
| ```bash |
| cd cdk |
| cdk deploy RedactionStack |
| ``` |
|
|
| ### Single-pass alternative (custom domain) |
|
|
| If you set `SSL_CERTIFICATE_DOMAIN` and `ACM_SSL_CERTIFICATE_ARN` (production profile), the app origin is known at synth time and CSP/CORS are correct on the **first** deploy—no placeholder and no refresh deploy. |
|
|
| ### Verify after deploy |
|
|
| In the AWS console: **CloudFront** → your distribution → **Behaviors** → response headers policy. CORS should list `https://<your-domain>` and CSP `connect-src` should include `wss://<your-domain>` (not `cloudfront_placeholder.net`). |
|
|
