cloudfront

Creates CloudFront distributions with OAC for S3, WAF integration, custom TLS, and access logging.

Provisions CloudFront distributions with multiple origins (S3 via OAC, or custom HTTP/HTTPS origins), ordered cache behaviors with optional managed cache policies, WAF web ACL attachment, custom domain aliases with ACM certificate (must be in us-east-1), geo-restriction, and access log delivery to S3.

Usage

module "cloudfront" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/networking/cloudfront/aws"
  version = "0.1.0"

  origin_access_controls = {
    s3_oac = { name = "my-s3-oac" }
  }

  distributions = {
    web = {
      aliases             = ["www.example.com"]
      acm_certificate_arn = module.acm.certificate_arns["web"]
      origins = [{
        origin_id   = "s3"
        domain_name = module.s3.bucket_regional_domain_name
        s3_oac_id   = module.cloudfront.oac_ids["s3_oac"]
      }]
      default_cache_behavior = {
        target_origin_id = "s3"
      }
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_cloudfront_distribution.this	resource
aws_cloudfront_origin_access_control.this	resource

Inputs

Name	Description	Type	Default	Required
distributions	Map of CloudFront distribution definitions	map(object({ comment = optional(string, "") enabled = optional(bool, true) http_version = optional(string, "http2and3") price_class = optional(string, "PriceClass_100") aliases = optional(list(string), []) acm_certificate_arn = optional(string, null) waf_web_acl_id = optional(string, null) logging_bucket = optional(string, null) logging_prefix = optional(string, "cloudfront/") origins = list(object({ origin_id = string domain_name = string s3_oac_id = optional(string, null) # OAC ID for S3 origins custom_origin = optional(object({ http_port = optional(number, 80) https_port = optional(number, 443) protocol_policy = optional(string, "https-only") ssl_protocols = optional(list(string), ["TLSv1.2"]) }), null) origin_path = optional(string, null) custom_headers = optional(map(string), {}) })) default_cache_behavior = object({ target_origin_id = string viewer_protocol_policy = optional(string, "redirect-to-https") allowed_methods = optional(list(string), ["GET", "HEAD"]) cached_methods = optional(list(string), ["GET", "HEAD"]) cache_policy_id = optional(string, null) compress = optional(bool, true) ttl_min = optional(number, 0) ttl_default = optional(number, 86400) ttl_max = optional(number, 31536000) }) ordered_cache_behaviors = optional(list(object({ path_pattern = string target_origin_id = string viewer_protocol_policy = optional(string, "redirect-to-https") allowed_methods = optional(list(string), ["GET", "HEAD"]) cached_methods = optional(list(string), ["GET", "HEAD"]) cache_policy_id = optional(string, null) compress = optional(bool, true) ttl_min = optional(number, 0) ttl_default = optional(number, 86400) ttl_max = optional(number, 31536000) })), []) geo_restriction = optional(object({ restriction_type = optional(string, "none") locations = optional(list(string), []) }), { restriction_type = "none", locations = [] }) }))	{}	no
origin_access_controls	Map of Origin Access Controls for S3 origins	map(object({ name = string description = optional(string, "") origin_access_control_origin_type = optional(string, "s3") signing_behavior = optional(string, "always") signing_protocol = optional(string, "sigv4") }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
distribution_arns	Map of distribution logical key to distribution ARN
distribution_domain_names	Map of distribution logical key to CloudFront domain name
distribution_hosted_zone_ids	Map of distribution logical key to hosted zone ID (for alias records)
distribution_ids	Map of distribution logical key to CloudFront distribution ID
oac_ids	Map of OAC logical key to OAC ID