feat(llmo): CloudFront CDN log delivery with assume-role setup (LLMO-5566)

[claudiaboldis]

Summary

• Adds server-side STS AssumeRole (connector role) so the LLMO UI CloudFront wizard never needs AWS credentials in the browser — all CloudFront and CloudWatch Logs calls are performed by the Lambda
• Adds 5 read-only wizard endpoints (connect, distributions, prerequisites, origins, behaviors) that power the step-by-step CloudFront BYOCDN setup flow
• Adds POST /sites/:siteId/llmo/cdn-log-delivery (diagram step 8) — idempotently creates a CloudWatch Logs delivery source in the customer's account and links it to Adobe's cross-account delivery destination, enabling CloudFront standard log push to the cdn-logs S3 bucket

New files

File	Purpose
src/support/edge-optimize.js	assumeConnectorRole (STS), listCloudFrontDistributions, getDistributionConfig, idempotent step-on-poll deploy orchestrator
src/support/cdn-log-delivery.js	Provider-agnostic log-delivery registry; CloudFront path uses logs:PutDeliverySource + logs:CreateDelivery via the assumed role

Endpoints (all POST, all INTERNAL_ROUTES — admin/IMS-only)

• POST /sites/:siteId/llmo/edge-optimize/connect
• POST /sites/:siteId/llmo/edge-optimize/distributions
• POST /sites/:siteId/llmo/edge-optimize/prerequisites
• POST /sites/:siteId/llmo/edge-optimize/origins
• POST /sites/:siteId/llmo/edge-optimize/behaviors
• POST /sites/:siteId/llmo/cdn-log-delivery

⚠️ Cross-service dependencies (not in this PR — must land before prod)

1. Connector-role IAM policy (customer-bootstrap-role.yaml in EDGE_OPTIMIZE_TEMPLATE_BUCKET) must add logs:PutDeliverySource, logs:CreateDelivery, logs:GetDeliverySource, logs:DescribeDeliveries — today the role only grants CloudFront perms
2. spacecat-auth-service must provision the cdn-logs-<org> delivery destination + cross-account policy for the BYOCDN CloudFront path (the handler surfaces a clear "destination not provisioned" 400 if it's missing)

Test plan

# verify connector role assumable
curl -s -X POST "https://spacecat.experiencecloud.live/sites/$SITE_ID/llmo/edge-optimize/connect" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"accountId":"123456789012","externalId":"<externalId>"}'
# Expected: HTTP 200 { "connected": true }

# list distributions via assumed role
curl -s -X POST "https://spacecat.experiencecloud.live/sites/$SITE_ID/llmo/edge-optimize/distributions" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"accountId":"123456789012","externalId":"<externalId>"}'
# Expected: HTTP 200 { "distributions": [...] }

# enable log delivery (idempotent)
curl -s -X POST "https://spacecat.experiencecloud.live/sites/$SITE_ID/llmo/cdn-log-delivery" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"accountId":"123456789012","externalId":"<externalId>","distributionId":"EDFDVBD6EXAMPLE"}'
# Expected: HTTP 200 { "alreadyExisted": false, "deliveryId": "..." }
# Re-run: HTTP 200 { "alreadyExisted": true }

Related

• Closes LLMO-5566
• Based on PR feat(llmo): add CloudFront wizard read endpoints #2654 (wizard read endpoints) and PR feat(llmo): CDN log-forwarding endpoint (BYOCDN CloudFront, step 8) #2671 (log-forwarding endpoint) by @Akbhardwaj

🤖 Generated with Claude Code

[github-actions]

This PR will trigger a minor release when merged.