SvelteKitSite

Deploy SvelteKit to AWS in one component: S3, CloudFront, Lambda, HTTPS and DNS. Security headers on, form actions working, WAF ready.

Hosting · anvil:aws:SvelteKitSite

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

path
string

Path to the SvelteKit project directory (the folder with package.json), relative to the project root, e.g. "web". Anvil installs dependencies if needed and runs npm run build using the node on your PATH.

domain
string

Custom domain for the site, e.g. "myapp.com". When set, Anvil provisions the ACM certificate and Route53 record automatically. Omit to use the default CloudFront domain.

environment
map<string, string>

Environment vars available at BOTH build time and runtime. Values must be string literals since they're needed before the build runs.

runtimeEnvironment
map<string, Output<string>>

Runtime-only environment vars set on the Lambda function. Supports Pulumi Output values (e.g. bucket.name, fn.arn). Only available at request time, NOT during build/prerendering.

protection
string

Who can call the server Lambda's Function URL. Default: "none", or "edge-oac" when waf or originProtection is set. An explicit value always wins. See Hosting: all sites.

  • none— Public Function URL — anyone who learns it can bypass CloudFront and any WAF.
  • oac— Locked to CloudFront via IAM. Requests with a body are rejected — read-only sites only.
  • edge-oac— Locked to CloudFront via IAM; a Lambda@Edge function adds the required header so forms and POSTs work. Bodies over 1 MB are rejected.
waf
object (SiteWaf)

Attaches a WAF to the site's CloudFront distribution. arn (required): a WebACL with CLOUDFRONT scope in us-east-1. Protection defaults to "edge-oac" while attached.

originProtection
boolean

For sites behind a CDN/proxy (Cloudflare, Fastly, Akamai, nginx). CloudFront only accepts requests carrying the x-origin-secret header — configure the proxy to send it with the originSecret output. Protection defaults to "edge-oac".

securityHeaders
object (SiteSecurityHeaders)

Browser security headers added to every response. On by default: Strict-Transport-Security (1 year), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (camera, microphone, geolocation, USB and Topics off) and Cross-Origin-Opener-Policy: same-origin-allow-popups. Headers your app sets take priority. Options: enabled (default true), frameOptions ("sameorigin" | "deny" | "none"), hsts.includeSubDomains, hsts.preload, permissionsPolicy (full value, or "none"), crossOriginOpenerPolicy ("same-origin-allow-popups" | "same-origin" | "none"). See Hosting: all sites.

securityHeaders 5 fields

SiteSecurityHeadersArgs configures the security headers CloudFront adds to every response. On by default: Strict-Transport-Security (1 year), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that turns off camera, microphone, geolocation, USB and Topics, and Cross-Origin-Opener-Policy: same-origin-allow-popups. A header your app sets itself always takes priority. Content-Security-Policy is not set — configure it in the framework (e.g. SvelteKit's kit.csp).

crossOriginOpenerPolicy
string

CrossOriginOpenerPolicy isolates the site's browser window from windows on other sites. "same-origin-allow-popups" (default): isolated, but popups it opens (OAuth sign-in, payments) still work. "same-origin": strict isolation — breaks sign-in and payment popups that report back. "none": no Cross-Origin-Opener-Policy header.

  • same-origin-allow-popups— Isolated from other sites, but popups it opens (OAuth sign-in, payments) still work. Default.
  • same-origin— Strict isolation. Breaks sign-in and payment popups that report back to the page.
  • none— No Cross-Origin-Opener-Policy header.
enabled
boolean

Enabled turns the security headers on or off. Default: true.

frameOptions
string

FrameOptions controls whether other sites can embed this one in a frame. "sameorigin" (default): only pages on this site. "deny": never. "none": no X-Frame-Options header — the site can be embedded anywhere.

  • sameorigin— Only pages on this site can frame it. Default.
  • deny— No site can frame it, including this one.
  • none— No X-Frame-Options header — any site can embed it. Use only for sites meant to be embedded elsewhere.
hsts
object (SiteHsts)

Hsts adds optional Strict-Transport-Security directives.

permissionsPolicy
string

PermissionsPolicy is the Permissions-Policy header value: which browser features the site (and anything it embeds) may use. Default: "camera=(), microphone=(), geolocation=(), usb=(), browsing-topics=()". Set your own value to allow a feature, e.g. "camera=(self), microphone=(self)", or "none" to send no Permissions-Policy header.

securityHeaders.hsts 2 fields

SiteHstsArgs configures optional Strict-Transport-Security directives. Both are hard to undo — browsers remember them for the max-age (1 year).

includeSubDomains
boolean

IncludeSubDomains applies HSTS to every subdomain of the site's domain. Default: false.

preload
boolean

Preload marks the domain as eligible for browsers' built-in HSTS preload list. Requires includeSubDomains. Default: false.

waf 1 field

SiteWafArgs attaches a WAF to the site. Composes freely with originProtection. While a WAF is attached, protection defaults to "edge-oac" so the server Function URL can't be used to bypass the WAF.

arn required
string

Arn is the ARN of a WAF WebACL with CLOUDFRONT scope (us-east-1). Pass waf.arn from an Anvil Waf component.

This component also accepts a hatch argument to override the underlying resource configuration. See Overrides & Escape Hatch.

Attributes

Outputs available once the resource is deployed.

url
string

The public URL of the deployed site.

bucketName
string

The S3 bucket name holding static assets.

cloudFrontDistributionId
string

The CloudFront distribution ID.

functionName
string

The name of the Lambda function serving SSR requests.

dnsRecords
string

DNS records created for the custom domain, when domain is set.

originSecret
string

The x-origin-secret header value to configure in your CDN/proxy. Secret, and stable across deploys. Only populated when originProtection is enabled.