CloudFront 按国家展示不同内容

用户请求 /
  → CloudFront 识别国家
  → viewer-request Function 改写为 /_geo/jp/index.html
  → 按改写后的 URI、国家和压缩格式查缓存
  → 命中：直接返回
  → 未命中：通过 OAC 获取私有 S3 对象并缓存

set -euo pipefail
export AWS_PROFILE=lab
export AWS_REGION=ap-southeast-1
export AWS_PAGER=''
export GEO_STACK=cloudfront-geo-lab

aws sts get-caller-identity
aws cloudformation deploy --stack-name "$GEO_STACK" --template-file geo-lab.yaml

aws cloudformation describe-stacks --stack-name "$GEO_STACK" --query 'Stacks[0].Outputs' --output json > geo-outputs.json

GEO_BUCKET=$(jq -r '.[] | select(.OutputKey=="BucketName") | .OutputValue' geo-outputs.json)
GEO_DIST=$(jq -r '.[] | select(.OutputKey=="DistributionId") | .OutputValue' geo-outputs.json)
GEO_DOMAIN=$(jq -r '.[] | select(.OutputKey=="DomainName") | .OutputValue' geo-outputs.json)
GEO_FUNCTION=$(jq -r '.[] | select(.OutputKey=="FunctionName") | .OutputValue' geo-outputs.json)
aws cloudfront wait distribution-deployed --id "$GEO_DIST"

mkdir -p geo-site/_geo/{us,jp,hk,default}
cat > geo-site/_geo/us/index.html <<'HTML'
<!doctype html><html lang="en-US"><meta charset="utf-8">
<title>US Store</title><h1>US edition</h1><p>Currency: USD</p></html>
HTML
cat > geo-site/_geo/jp/index.html <<'HTML'
<!doctype html><html lang="ja"><meta charset="utf-8">
<title>日本ストア</title><h1>JP edition</h1><p>通貨: JPY</p></html>
HTML
cat > geo-site/_geo/hk/index.html <<'HTML'
<!doctype html><html lang="zh-Hant"><meta charset="utf-8">
<title>香港商店</title><h1>HK edition</h1><p>貨幣：HKD</p></html>
HTML
cat > geo-site/_geo/default/index.html <<'HTML'
<!doctype html><html lang="en"><meta charset="utf-8">
<title>Global Store</title><h1>Global edition</h1><p>Select your market.</p></html>
HTML

aws s3 cp geo-site/ "s3://$GEO_BUCKET/" --recursive --content-type 'text/html; charset=utf-8' --cache-control 'public,max-age=0,s-maxage=300'

var header = request.headers['cloudfront-viewer-country'];
var country = header ? header.value : '';
var variant = 'default';
if (country === 'US') variant = 'us';
else if (country === 'JP') variant = 'jp';
else if (country === 'HK') variant = 'hk';
request.uri = '/_geo/' + variant + '/index.html';

cat > geo-event.json <<'JSON'
{
  "version": "1.0",
  "context": {"eventType": "viewer-request"},
  "viewer": {"ip": "198.51.100.10"},
  "request": {
    "method": "GET",
    "uri": "/",
    "querystring": {},
    "headers": {
      "host": {"value": "example.com"},
      "cloudfront-viewer-country": {"value": "US"}
    },
    "cookies": {}
  }
}
JSON

GEO_ETAG=$(aws cloudfront describe-function --name "$GEO_FUNCTION" --stage LIVE --query ETag --output text)

for GEO_COUNTRY in US JP HK DE; do
  jq --arg country "$GEO_COUNTRY" '.request.headers["cloudfront-viewer-country"].value = $country' geo-event.json > geo-test.json
  aws cloudfront test-function --name "$GEO_FUNCTION" --stage LIVE --if-match "$GEO_ETAG" --event-object fileb://geo-test.json > geo-result.json
  jq -e '(.TestResult.FunctionErrorMessage // "") == ""' geo-result.json
  jq -r '.TestResult.FunctionOutput | fromjson | .uri' geo-result.json
done

curl -fsS -D geo-headers.txt "https://$GEO_DOMAIN/" -o geo-page.html
cat geo-page.html
cat geo-headers.txt

# 在同一出口重复请求，观察 X-Cache、Age 和页面内容。
curl -fsS -D - "https://$GEO_DOMAIN/"

# 两项均应失败：直接访问内部路径为 404，匿名直连 S3 为 403。
curl -sS -o /dev/null -w '%{http_code}\n' "https://$GEO_DOMAIN/_geo/us/index.html"
curl -sS -o /dev/null -w '%{http_code}\n' "https://$GEO_BUCKET.s3.$AWS_REGION.amazonaws.com/_geo/us/index.html"

GEO_INVALIDATION=$(aws cloudfront create-invalidation --distribution-id "$GEO_DIST" --paths '/*' --query Invalidation.Id --output text)
aws cloudfront wait invalidation-completed --distribution-id "$GEO_DIST" --id "$GEO_INVALIDATION"

aws s3 rm "s3://$GEO_BUCKET/" --recursive
aws cloudformation delete-stack --stack-name "$GEO_STACK"
aws cloudformation wait stack-delete-complete --stack-name "$GEO_STACK"