1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

variable "distributions" {
  description = "Map of CloudFront distribution definitions"
  type = map(object({
    comment             = optional(string, "")
    enabled             = optional(bool, true)
    http_version        = optional(string, "http2and3")
    price_class         = optional(string, "PriceClass_100")
    aliases             = optional(list(string), [])
    acm_certificate_arn = optional(string, null)
    waf_web_acl_id      = optional(string, null)
    logging_bucket      = optional(string, null)
    logging_prefix      = optional(string, "cloudfront/")

    origins = list(object({
      origin_id   = string
      domain_name = string
      s3_oac_id   = optional(string, null) # OAC ID for S3 origins
      custom_origin = optional(object({
        http_port       = optional(number, 80)
        https_port      = optional(number, 443)
        protocol_policy = optional(string, "https-only")
        ssl_protocols   = optional(list(string), ["TLSv1.2"])
      }), null)
      origin_path    = optional(string, null)
      custom_headers = optional(map(string), {})
    }))

    default_cache_behavior = object({
      target_origin_id       = string
      viewer_protocol_policy = optional(string, "redirect-to-https")
      allowed_methods        = optional(list(string), ["GET", "HEAD"])
      cached_methods         = optional(list(string), ["GET", "HEAD"])
      cache_policy_id        = optional(string, null)
      compress               = optional(bool, true)
      ttl_min                = optional(number, 0)
      ttl_default            = optional(number, 86400)
      ttl_max                = optional(number, 31536000)
    })

    ordered_cache_behaviors = optional(list(object({
      path_pattern           = string
      target_origin_id       = string
      viewer_protocol_policy = optional(string, "redirect-to-https")
      allowed_methods        = optional(list(string), ["GET", "HEAD"])
      cached_methods         = optional(list(string), ["GET", "HEAD"])
      cache_policy_id        = optional(string, null)
      compress               = optional(bool, true)
      ttl_min                = optional(number, 0)
      ttl_default            = optional(number, 86400)
      ttl_max                = optional(number, 31536000)
    })), [])

    geo_restriction = optional(object({
      restriction_type = optional(string, "none")
      locations        = optional(list(string), [])
    }), { restriction_type = "none", locations = [] })
  }))
  default = {}
}

variable "origin_access_controls" {
  description = "Map of Origin Access Controls for S3 origins"
  type = map(object({
    name                              = string
    description                       = optional(string, "")
    origin_access_control_origin_type = optional(string, "s3")
    signing_behavior                  = optional(string, "always")
    signing_protocol                  = optional(string, "sigv4")
  }))
  default = {}
}

variable "tags" {
  description = "Resource tags to apply to all resources"
  type        = map(string)
  default     = {}
}