Automated Cloud Hosting Using AWS, Terraform and GitHub Actions

# ---Configure the AWS provider---
provider "aws" {
  region = "ap-south-1" 
}

provider "aws" {
  alias  = "us_east_1"
  region = "us-east-1"
}


# ---DNS and SSL (Route 53 & ACM)---
data "aws_route53_zone" "main" {
  name = "youdomain.com"
}

resource "aws_acm_certificate" "cert" {
  provider          = aws.us_east_1
  domain_name       = "www.youdomain.com"
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.cert.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = data.aws_route53_zone.main.zone_id
}

# This tells Terraform: "Wait until the certificate is actually issued before moving on"
resource "aws_acm_certificate_validation" "cert" {
  provider                = aws.us_east_1
  certificate_arn         = aws_acm_certificate.cert.arn
  validation_record_fqdns = [for record in aws_route53_record.cert_validation : record.fqdn]
}


# ---S3 Bucket for Static Website Hosting---
resource "aws_s3_bucket" "website_bucket" {
  bucket = "www.yourdomain.com"
}

resource "aws_s3_bucket_public_access_block" "block_public" {
  bucket = aws_s3_bucket.website_bucket.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}


# ---CloudFront with OAC (Origin Access Control)---
# Create the OAC
resource "aws_cloudfront_origin_access_control" "oac" {
  name                              = "s3-oac-test-site"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "distro" {
  origin {
    domain_name              = aws_s3_bucket.website_bucket.bucket_regional_domain_name
    origin_id                = "S3Origin"
    origin_access_control_id = aws_cloudfront_origin_access_control.oac.id
  }

  enabled             = true
  default_root_object = "index.html"
  aliases             = ["www.yourdomain.com"]

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "S3Origin"
    viewer_protocol_policy = "redirect-to-https"

    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate_validation.cert.certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }
}


# ---(Final) IAM Role and Policy for CloudFront OAC---
# Allow CloudFront to access S3
resource "aws_s3_bucket_policy" "allow_cloudfront" {
  bucket = aws_s3_bucket.website_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "AllowCloudFrontServicePrincipalReadOnly"
        Effect    = "Allow"
        Principal = { Service = "cloudfront.amazonaws.com" }
        Action    = "s3:GetObject"
        Resource  = "${aws_s3_bucket.website_bucket.arn}/*"
        Condition = {
          StringEquals = {
            "AWS:SourceArn" = aws_cloudfront_distribution.distro.arn
          }
        }
      }
    ]
  })
}

# Route 53 Alias Record
resource "aws_route53_record" "www" {
  zone_id = data.aws_route53_zone.main.zone_id
  name    = "www.yourdomain.com"
  type    = "A"

  alias {
    name                   = aws_cloudfront_distribution.distro.domain_name
    zone_id                = aws_cloudfront_distribution.distro.hosted_zone_id
    evaluate_target_health = false
  }
}

output "s3_bucket_name" {
  value = aws_s3_bucket.website_bucket.id
}

output "cloudfront_distribution_id" {
  value = aws_cloudfront_distribution.distro.id
}

output "website_url" {
  value = "https://www.yourdomain.com"
}

# --- 1. AWS Provider Configuration --- Provider is already defined in main.tf, so we don't need to repeat it here. Just make sure to run `terraform init` in the root directory to set everything up before applying this IAM configuration.
# --- 2. Create the IAM User ---
# This is the "Identity" that GitHub Actions will use to log in.
resource "aws_iam_user" "github_actions" {
  name = "github-actions-auto-cloud-deploy"
  tags = {
    Project = "AutoCloudDeploy"
    Owner   = "yourname"
  }
}


# --- 3. Define the Least Privilege Policy ---
# We are only giving GitHub permission to touch what it absolutely needs.
resource "aws_iam_policy" "deploy_policy" {
  name        = "GitHubActionsDeployPolicy"
  description = "Allows S3 sync and CloudFront invalidation for the test subdomain"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        # Permission: Manage files in the specific S3 bucket
        Effect = "Allow"
        Action = [
          "s3:PutObject",
          "s3:ListBucket",
          "s3:DeleteObject",
          "s3:GetBucketLocation"
        ]
        Resource = [
          "${aws_s3_bucket.website_bucket.arn}",
          "${aws_s3_bucket.website_bucket.arn}/*"
        ]
      },
      {
        # Permission: Tell CloudFront to refresh its cache
        Effect = "Allow"
        Action = [
          "cloudfront:CreateInvalidation"
        ]
        Resource = [
          "${aws_cloudfront_distribution.distro.arn}"
        ]
      }
    ]
  })
}


# --- 4. Attach Policy to User ---
# This links the "locked door" (the policy) to the "key holder" (the user).
resource "aws_iam_user_policy_attachment" "attach_deploy" {
  user       = aws_iam_user.github_actions.name
  policy_arn = aws_iam_policy.deploy_policy.arn
}


# --- 5. Create Access Keys ---
# This generates the credentials you will paste into GitHub Secrets.
resource "aws_iam_access_key" "github_keys" {
  user = aws_iam_user.github_actions.name
}


# --- 6. Outputs (The "The Goods") ---
# These are sensitive. Terraform won't show them unless you specifically ask.
output "github_actions_access_key" {
  value     = aws_iam_access_key.github_keys.id
  sensitive = true
}

output "github_actions_secret_key" {
  value     = aws_iam_access_key.github_keys.secret
  sensitive = true
}

name: Auto Cloud Deploy

on:
  push:
    branches: [ main ]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-south-1

      - name: Sync to S3
        run: aws s3 sync . s3://your-bucket-name --delete --exclude ".git/*" --exclude "*.tf"

      - name: Refresh Cache
        run: aws cloudfront create-invalidation --distribution-id ${{ secrets.DIST_ID }} --paths "/*"