# cloudfront

Creates CloudFront distributions with OAC for S3, WAF integration, custom TLS, and access logging.

Provisions CloudFront distributions with multiple origins (S3 via OAC, or custom HTTP/HTTPS origins), ordered cache behaviors with optional managed cache policies, WAF web ACL attachment, custom domain aliases with ACM certificate (must be in us-east-1), geo-restriction, and access log delivery to S3.

## Usage

```hcl
module "cloudfront" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/networking/cloudfront/aws"
  version = "0.1.0"

  origin_access_controls = {
    s3_oac = { name = "my-s3-oac" }
  }

  distributions = {
    web = {
      aliases             = ["www.example.com"]
      acm_certificate_arn = module.acm.certificate_arns["web"]
      origins = [{
        origin_id   = "s3"
        domain_name = module.s3.bucket_regional_domain_name
        s3_oac_id   = module.cloudfront.oac_ids["s3_oac"]
      }]
      default_cache_behavior = {
        target_origin_id = "s3"
      }
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_cloudfront_distribution.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution) | resource |
| [aws_cloudfront_origin_access_control.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_distributions"></a> [distributions](#input_distributions) | Map of CloudFront distribution definitions | <pre>map(object({<br/>    comment             = optional(string, "")<br/>    enabled             = optional(bool, true)<br/>    http_version        = optional(string, "http2and3")<br/>    price_class         = optional(string, "PriceClass_100")<br/>    aliases             = optional(list(string), [])<br/>    acm_certificate_arn = optional(string, null)<br/>    waf_web_acl_id      = optional(string, null)<br/>    logging_bucket      = optional(string, null)<br/>    logging_prefix      = optional(string, "cloudfront/")<br/><br/>    origins = list(object({<br/>      origin_id   = string<br/>      domain_name = string<br/>      s3_oac_id   = optional(string, null) # OAC ID for S3 origins<br/>      custom_origin = optional(object({<br/>        http_port       = optional(number, 80)<br/>        https_port      = optional(number, 443)<br/>        protocol_policy = optional(string, "https-only")<br/>        ssl_protocols   = optional(list(string), ["TLSv1.2"])<br/>      }), null)<br/>      origin_path    = optional(string, null)<br/>      custom_headers = optional(map(string), {})<br/>    }))<br/><br/>    default_cache_behavior = object({<br/>      target_origin_id       = string<br/>      viewer_protocol_policy = optional(string, "redirect-to-https")<br/>      allowed_methods        = optional(list(string), ["GET", "HEAD"])<br/>      cached_methods         = optional(list(string), ["GET", "HEAD"])<br/>      cache_policy_id        = optional(string, null)<br/>      compress               = optional(bool, true)<br/>      ttl_min                = optional(number, 0)<br/>      ttl_default            = optional(number, 86400)<br/>      ttl_max                = optional(number, 31536000)<br/>    })<br/><br/>    ordered_cache_behaviors = optional(list(object({<br/>      path_pattern           = string<br/>      target_origin_id       = string<br/>      viewer_protocol_policy = optional(string, "redirect-to-https")<br/>      allowed_methods        = optional(list(string), ["GET", "HEAD"])<br/>      cached_methods         = optional(list(string), ["GET", "HEAD"])<br/>      cache_policy_id        = optional(string, null)<br/>      compress               = optional(bool, true)<br/>      ttl_min                = optional(number, 0)<br/>      ttl_default            = optional(number, 86400)<br/>      ttl_max                = optional(number, 31536000)<br/>    })), [])<br/><br/>    geo_restriction = optional(object({<br/>      restriction_type = optional(string, "none")<br/>      locations        = optional(list(string), [])<br/>    }), { restriction_type = "none", locations = [] })<br/>  }))</pre> | `{}` | no |
| <a name="input_origin_access_controls"></a> [origin_access_controls](#input_origin_access_controls) | Map of Origin Access Controls for S3 origins | <pre>map(object({<br/>    name                              = string<br/>    description                       = optional(string, "")<br/>    origin_access_control_origin_type = optional(string, "s3")<br/>    signing_behavior                  = optional(string, "always")<br/>    signing_protocol                  = optional(string, "sigv4")<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_distribution_arns"></a> [distribution_arns](#output_distribution_arns) | Map of distribution logical key to distribution ARN |
| <a name="output_distribution_domain_names"></a> [distribution_domain_names](#output_distribution_domain_names) | Map of distribution logical key to CloudFront domain name |
| <a name="output_distribution_hosted_zone_ids"></a> [distribution_hosted_zone_ids](#output_distribution_hosted_zone_ids) | Map of distribution logical key to hosted zone ID (for alias records) |
| <a name="output_distribution_ids"></a> [distribution_ids](#output_distribution_ids) | Map of distribution logical key to CloudFront distribution ID |
| <a name="output_oac_ids"></a> [oac_ids](#output_oac_ids) | Map of OAC logical key to OAC ID |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->