add custom domain support for apigw

[petrkalos]

Feature or Bugfix

• Bugfix

Detail

Adding custom domain support for apigw with minimum TLS1.2

Be aware that by enabling this feature the automatically generated apigw URL will be disabled. As a prereq users must already have a custom domain in Route53 and have an ACM certificate. The domain must be setup according to this. To enable this feature one must specify the following in cdk.json.

  "context": {
    "DeploymentEnvironments": [
      {
        ...
        "apigw_custom_domain": {         
            "hosted_zone_name": "custom.domain.com",
            "hosted_zone_id": "...",
            "certificate_arn": "arn:aws:acm:us-east-1:..." # edge optimized domain thus cert must be in us-east-1
        }
        ...
    }
  }

Relates

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?
• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?
• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?
• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[dlpzx]

I am posting here this blogpost that explains this architecture and benefits and that I found very useful.

I have one question: could we reuse the existing custom_domain parameter in the cdk.json? I mean it is already linked to a certificate...

[dlpzx]

Looks good! It just needs a PR to update the docs in the GitHub pages