Add/document ways to secure frontend

[phitoduck]

Description

If this is already implemented, please forgive me.

After reading the docs and perusing the construct-hub source code, I've been unable to find a recommended way to protect the HTML frontend for the webapp served by the CloudFront distribution.

Does a recommended method of doing this exist?

If not, would it be acceptable to directly expose the CloudFront Distribution as a property of the ConstructHub construct? My thinking here is that a reference to this CloudFront Distribution resource could be used to gate access to the served webpage using something like the AWS Cognito Hosted UI or simply Basic Auth.

Use Case

Without the ability to restrict access to the frontend, I believe having a self-hosted construct hub isn't useful to companies. How could an enterprise use a self-hosted ConstructHub if the whole world can see their docs?

If a company doesn't mind their docs being exposed, I imagine they'd use the public instance of Construct Hub.

Other information

No response

[phitoduck]

If this feature seems unlikely to be prioritized in the near future. Could anyone suggest a workaround? One idea I have is simply writing a separate CDK application that is deployed after the ConstructHub construct is fully created.

From there, you could find the reference to the CloudFront Distribution in the CloudFormation console and plug it into the separate CDK application, which would add a CloudFront Lambda@Edge function to carry out BasicAuth or a authorization_code OAuth flow with a login screen (e.g. using the Cognito Hosted UI, Auth0, Okta, etc.)

[knightjoel]

Seems related to #318

[pharindoko]

@phitoduck I have the same opinion.
I wanna use it internal in the company.

[pharindoko]

In the cdk workshop it is mentioned that a internal construct hub can be created using one of several solutions:
https://cdkworkshop.com/70-construct-hub/100-internal-construct-hub/2000-create-construct-hub.html

For access inside of an Intranet or private networks, disable your CloudFront distribution and provide access to the origin S3 bucket through an internal Application Load Balancer using interface endpoints on AWS PrivateLink for Amazon S3.

How can I disable the cloudfront distribution directly for construct hub using cdk ?

[srobroek]

Bumping this, as this seems like an absolute minimum for private deployments.