1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

# Origin Access Controls =====================================================

resource "aws_cloudfront_origin_access_control" "this" {
  for_each = var.origin_access_controls

  name                              = each.value.name
  description                       = each.value.description
  origin_access_control_origin_type = each.value.origin_access_control_origin_type
  signing_behavior                  = each.value.signing_behavior
  signing_protocol                  = each.value.signing_protocol
}

# CloudFront distributions ===================================================

resource "aws_cloudfront_distribution" "this" {
  for_each = var.distributions

  comment         = each.value.comment
  enabled         = each.value.enabled
  http_version    = each.value.http_version
  price_class     = each.value.price_class
  aliases         = each.value.aliases
  web_acl_id      = each.value.waf_web_acl_id
  is_ipv6_enabled = true

  dynamic "origin" {
    for_each = each.value.origins
    content {
      origin_id   = origin.value.origin_id
      domain_name = origin.value.domain_name
      origin_path = origin.value.origin_path

      origin_access_control_id = origin.value.s3_oac_id

      dynamic "custom_header" {
        for_each = origin.value.custom_headers
        content {
          name  = custom_header.key
          value = custom_header.value
        }
      }

      dynamic "custom_origin_config" {
        for_each = origin.value.custom_origin != null ? [origin.value.custom_origin] : []
        content {
          http_port              = custom_origin_config.value.http_port
          https_port             = custom_origin_config.value.https_port
          origin_protocol_policy = custom_origin_config.value.protocol_policy
          origin_ssl_protocols   = custom_origin_config.value.ssl_protocols
        }
      }
    }
  }

  default_cache_behavior {
    target_origin_id       = each.value.default_cache_behavior.target_origin_id
    viewer_protocol_policy = each.value.default_cache_behavior.viewer_protocol_policy
    allowed_methods        = each.value.default_cache_behavior.allowed_methods
    cached_methods         = each.value.default_cache_behavior.cached_methods
    compress               = each.value.default_cache_behavior.compress
    cache_policy_id        = each.value.default_cache_behavior.cache_policy_id

    dynamic "forwarded_values" {
      for_each = each.value.default_cache_behavior.cache_policy_id == null ? [true] : []
      content {
        query_string = false
        cookies { forward = "none" }
      }
    }

    min_ttl     = each.value.default_cache_behavior.ttl_min
    default_ttl = each.value.default_cache_behavior.ttl_default
    max_ttl     = each.value.default_cache_behavior.ttl_max
  }

  dynamic "ordered_cache_behavior" {
    for_each = each.value.ordered_cache_behaviors
    content {
      path_pattern           = ordered_cache_behavior.value.path_pattern
      target_origin_id       = ordered_cache_behavior.value.target_origin_id
      viewer_protocol_policy = ordered_cache_behavior.value.viewer_protocol_policy
      allowed_methods        = ordered_cache_behavior.value.allowed_methods
      cached_methods         = ordered_cache_behavior.value.cached_methods
      compress               = ordered_cache_behavior.value.compress
      cache_policy_id        = ordered_cache_behavior.value.cache_policy_id
      min_ttl                = ordered_cache_behavior.value.ttl_min
      default_ttl            = ordered_cache_behavior.value.ttl_default
      max_ttl                = ordered_cache_behavior.value.ttl_max

      dynamic "forwarded_values" {
        for_each = ordered_cache_behavior.value.cache_policy_id == null ? [true] : []
        content {
          query_string = false
          cookies { forward = "none" }
        }
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = each.value.geo_restriction.restriction_type
      locations        = each.value.geo_restriction.locations
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = each.value.acm_certificate_arn == null
    acm_certificate_arn            = each.value.acm_certificate_arn
    ssl_support_method             = each.value.acm_certificate_arn != null ? "sni-only" : null
    minimum_protocol_version       = each.value.acm_certificate_arn != null ? "TLSv1.2_2021" : null
  }

  dynamic "logging_config" {
    for_each = each.value.logging_bucket != null ? [true] : []
    content {
      bucket          = each.value.logging_bucket
      prefix          = each.value.logging_prefix
      include_cookies = false
    }
  }

  tags = local.tags
}