python-cdn-url-auth-tf.svrlss.advancelocal.dev
python-cdn-url-auth-tf
Two sites from OpenTofu: a public page with a cached API and short links answered at the edge, and an admin site at admin.<hostname> where invited people sign in with Cognito, by email code or Entra, to manage the links. The admin function keeps the session in an HttpOnly cookie, so the browser never holds a token.
App
- Python handlers, no framework
- Admin page in plain HTML and JavaScript
Runs on
- CloudFront, one distribution per site
- origin access control for S3 and Lambda
- response headers policies
- S3
- Lambda function URLs, IAM auth, Python, deployed with OpenTofu
- Cognito user pool
- managed login
- email codes
- Entra federation
- DynamoDB
Foundation
- inf-baseline
- Wiz scanning
- Scheduled deploys and checks
Cache, live
Polling /api/time every second through CloudFront.
waiting for the first poll
CloudFront hittrip to the app