DDoS-resistant CloudFront CDN Website Construct

[sam-goodwin]

We need to build a Construct which deploys a website to AWS CloudFront that is DDoS resistant. The developer should be able to point at an arbitrary folder containing a compiled website and have it uploaded to AWS.

It's super important to be DDoS resistant in preparation for any raiding from malicious actors looking to kill a coin or crypto project.

[thantos]

Basic, Mutable:

1. S3.Asset pointing to local folder
2. S3 Bucket Deployment to CFN fronted bucket with Prune mode on.

Advanced, Immutable:

1. S3.Asset pointing to local folder
2. S3 Bucket Deployment to CFN fronted bucket with unique ID.
3. Update SSM parameter with unique ID
4. Website root is resolved from either API Gateway Lambda or Cloud Front resource fronted by Lambda@Edge to resolve the current immutable ID.

[thantos]

Existing code bases for reference. Both basic react sites with some backend. Nothing too special for the frontend, but hard to tell the hosting without going deeper. TODO: understand existing hosting strategies. https://github.com/spartacus-finance/Spartacus-Landing https://github.com/Wonderland-Money/wonderland-frontend

[thantos]

https://docs.ipfs.io/ IPFS instead of or along side CloudFront? https://docs.ipfs.io/concepts/usage-ideas-examples/#content-delivery-networks

[sam-goodwin]

https://docs.ipfs.io/ IPFS instead of or along side CDN?

I know of projects that use IPFS to store things like videos or songs for building decentralized services like YouTube and Spotify. I wonder what the latency would be like. I don't think it's strictly necessary but it would be a useful Construct - an Asset which stores on IPFS!

[thantos]

Found IPFS when looking at the ETH dApp docs, suggesting the frontend be hosted on it https://ethereum.org/en/developers/docs/dapps/#definition-of-a-dapp

Looks fairly inexpensive to start with a shadow of the content on IPFS and CloufFront, then we could measure performance. IPFS relies on peer to peer, but claims performance.

Can speed up the web when you're far away or disconnected. If you can retrieve a file from someone nearby instead of hundreds or thousands of miles away, you can often get it faster. This is especially valuable if your community is networked locally but doesn't have a good connection to the wider internet. (Well-funded organizations with technical expertise do this today by using multiple data centers or CDNs — content distribution networks (opens new window). IPFS hopes to make this possible for everyone.)

Cloud Front and S3 are dirt cheap (need to run numbers), but "free" is cheaper: https://aws.amazon.com/cloudfront/pricing/

• Future interop with Filecoin (paid): https://filecoin.io/ https://docs.ipfs.io/concepts/faq/#ipfs-and-filecoin
• We can claim more or have the option for more decentralization (at a cost, like latency).

[sam-goodwin]

Agree with IPFS and FileCoin integration. cdk3 can perhaps provide an abstraction over centralized and decentralized alternatives. Another example would be using Akash instead of Fargate: https://akash.network/

[github-actions[bot]]

This issue is now marked as stale because it hasn't seen activity for a while. Add a comment or it will be closed soon.

[github-actions[bot]]

Closing this issue as it hasn't seen activity for a while. Please add a comment @mentioning a maintainer to reopen.