QA plan: Frontend module — S3 + CloudFront (#24)

Story: Frontend module — S3 + CloudFront (#24)
Capability: AWS infrastructure (#19)

Test scope

Type	Coverage
IaC lint	terraform validate and tflint on modules/frontend pass
Static (plan review)	S3 bucket has block_public_acls = true and restrict_public_buckets = true; CloudFront OAI or OAC is the only allowed reader
Static (plan review)	CloudFront distribution has HTTPS-only viewer protocol policy
Static (plan review)	Path-based routing routes /api/* to the API Gateway origin and /* to S3
Static (plan review)	No VITE_API_URL or other secrets in the S3 bucket objects (build-time injection, not runtime)
Integration (manual, QA)	CloudFront URL loads the SPA (index.html returns 200)
Integration (manual, QA)	/api/healthz via CloudFront reaches the Lambda and returns 200
Integration (manual, QA)	Direct S3 URL returns 403 (bucket is not publicly accessible)
Security	No secrets in dist/ bundle; CI step: grep -r "rks_" dist/ exits 1

Entry criteria

• Story #17 (React chat UI) build produces dist/
• Story #23 (API module) deployed to QA for the origin configuration

Exit criteria

• IaC lint exits 0
• Plan: S3 public access blocked, HTTPS-only CloudFront, path routing confirmed
• Manual QA: SPA loads via CloudFront; API paths proxied; S3 direct access blocked
• No secrets in bundle (CI grep check)

Environments

IaC lint: CI. Integration: manual against QA env. Bundle secret check: CI on every PR.

Tooling

terraform validate, tflint, curl, grep.

How tests are written

Structural plan assertions in CI. Post-deploy manual checks:

# Given the QA CloudFront distribution is deployed
# When the SPA URL is fetched
curl -o /dev/null -s -w "%{http_code}" "$CLOUDFRONT_URL"
# Then status is 200

Risks

• CloudFront cache can serve a stale SPA after a new dist/ upload. The deploy step (Story #30) must include a cache invalidation; this plan verifies the infrastructure supports it (invalidation path exists in the Terraform module).
• OAI vs OAC: AWS prefers OAC for new distributions. Confirm the module uses OAC and that the S3 bucket policy is compatible.

Capability acceptance criteria link

Spec: npm run build produces deployable static assets; served via S3 + CloudFront. Exit criteria verify the infrastructure side of that acceptance.