Skip to content

Commit 90dc450

Browse files
dmurvihilldmurvihill
authored
Support additional origins and cache behaviors (#64)
* Support additional origins and cache behaviors * Fix formatter errors
1 parent 873dc5a commit 90dc450

File tree

4 files changed

+170
-4
lines changed

4 files changed

+170
-4
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ In order to run all checks at any point run the following command:
7878
|------|-------------|------|---------|:--------:|
7979
| <a name="input_acm_certificate_arn_to_use"></a> [acm\_certificate\_arn\_to\_use](#input\_acm\_certificate\_arn\_to\_use) | ACM Certificate ARN to use in case you disable automatic certificate creation. Certificate must be in us-east-1 region. | `string` | `""` | no |
8080
| <a name="input_aws_accounts_with_read_view_log_bucket"></a> [aws\_accounts\_with\_read\_view\_log\_bucket](#input\_aws\_accounts\_with\_read\_view\_log\_bucket) | List of AWS accounts with read permissions to log bucket | `list(string)` | `[]` | no |
81+
| <a name="input_cloudfront_additional_origins"></a> [cloudfront\_additional\_origins](#input\_cloudfront\_additional\_origins\_) | (Optional) List of [origin configurations](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#origin-arguments) in addiiton to the bucket that hosts the static web site. No support yet for origin shield. | `list(object)` | `[]` | no |
8182
| <a name="input_cloudfront_allowed_cached_methods"></a> [cloudfront\_allowed\_cached\_methods](#input\_cloudfront\_allowed\_cached\_methods) | (Optional) Specifies which methods are allowed and cached by CloudFront. Can be GET, PUT, POST, DELETE or HEAD. Defaults to GET and HEAD | `list(string)` | <pre>[<br> "GET",<br> "HEAD"<br>]</pre> | no |
8283
| <a name="input_cloudfront_custom_error_responses"></a> [cloudfront\_custom\_error\_responses](#input\_cloudfront\_custom\_error\_responses) | A list of custom error responses | <pre>list(object({<br> error_caching_min_ttl = number<br> error_code = number<br> response_code = number<br> response_page_path = string<br> }))</pre> | `[]` | no |
8384
| <a name="input_cloudfront_default_root_object"></a> [cloudfront\_default\_root\_object](#input\_cloudfront\_default\_root\_object) | (Optional) - The object that you want CloudFront to return (for example, index.html) when an end user requests the root URL. Defaults to index.html | `string` | `"index.html"` | no |
@@ -86,6 +87,7 @@ In order to run all checks at any point run the following command:
8687
| <a name="input_cloudfront_geo_restriction_locations"></a> [cloudfront\_geo\_restriction\_locations](#input\_cloudfront\_geo\_restriction\_locations) | (Optional) - The ISO 3166-1-alpha-2 codes for which you want CloudFront either to distribute your content (whitelist) or not distribute your content (blacklist). Defaults to [] | `list(string)` | `[]` | no |
8788
| <a name="input_cloudfront_geo_restriction_type"></a> [cloudfront\_geo\_restriction\_type](#input\_cloudfront\_geo\_restriction\_type) | The method that you want to use to restrict distribution of your content by country: none, whitelist, or blacklist. Defaults to none | `string` | `"none"` | no |
8889
| <a name="input_cloudfront_http_version"></a> [cloudfront\_http\_version](#input\_cloudfront\_http\_version) | (Optional) - The maximum HTTP version to support on the distribution. Allowed values are http1.1 and http2. The default is http2. | `string` | `"http2"` | no |
90+
| <a name="input_cloudfront_ordered_cache_behaviors"></a> [cloudfront\_ordered\_cache\_behaviors](#input\_cloudfront\_ordered\_cache\_behaviors) | (Optional) - List of [ordered cache behavior](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#cache-behavior-arguments) configurations. No support yet for function associations or trusted key groups. | `list(object)` | `[]` | no |
8991
| <a name="input_cloudfront_price_class"></a> [cloudfront\_price\_class](#input\_cloudfront\_price\_class) | (Optional) - The price class for this distribution. One of PriceClass\_All, PriceClass\_200, PriceClass\_100. Defaults to PriceClass\_100 | `string` | `"PriceClass_100"` | no |
9092
| <a name="input_cloudfront_viewer_protocol_policy"></a> [cloudfront\_viewer\_protocol\_policy](#input\_cloudfront\_viewer\_protocol\_policy) | Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of allow-all, https-only, or redirect-to-https. Defautls to redirect-to-https | `string` | `"redirect-to-https"` | no |
9193
| <a name="input_cloudfront_web_acl_id"></a> [cloudfront\_web\_acl\_id](#input\_cloudfront\_web\_acl\_id) | (Optional) A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. | `string` | `null` | no |

‎examples/ordered-cache-behavior/main.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
module "test_website" {
2+
source = "../../"
3+
name_prefix = "test-website"
4+
5+
providers = {
6+
aws.main = aws.main
7+
aws.acm_provider = aws.acm_provider
8+
}
9+
10+
website_domain_name = "test.com"
11+
12+
create_acm_certificate = true
13+
14+
create_route53_hosted_zone = true
15+
16+
cloudfront_additional_origins = [
17+
{
18+
domain_name = "api.test.com"
19+
origin_id = "api"
20+
custom_origin_config = {
21+
http_port = 80
22+
https_port = 443
23+
origin_protocol_policy = "https-only"
24+
origin_ssl_protocols = ["TLSv1.2"]
25+
}
26+
}
27+
]
28+
29+
cloudfront_ordered_cache_behaviors = [
30+
{
31+
allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
32+
cached_methods = ["GET", "HEAD", "OPTIONS"]
33+
cache_policy_id = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
34+
origin_request_policy_id = "b689b0a8-53d0-40ab-baf2-68738e2966ac"
35+
path_pattern = "api/*"
36+
target_origin_id = "api"
37+
viewer_protocol_policy = "redirect-to-https"
38+
}
39+
]
40+
}

‎variables.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,62 @@ variable "cloudfront_custom_error_responses" {
204204
default = []
205205
}
206206

207+
variable "cloudfront_ordered_cache_behaviors" {
208+
description = "A list of custom ordered cache behaviors"
209+
type = list(object({
210+
allowed_methods = list(string)
211+
cached_methods = list(string)
212+
cache_policy_id = string
213+
compress = optional(bool)
214+
default_ttl = optional(number)
215+
field_level_encryption_id = optional(string)
216+
# forwarded_values will not be supported as Hashicorp had already deprecated it at the time of implementing this module
217+
# TODO support lambda_function_association and function_association
218+
max_ttl = optional(number)
219+
min_ttl = optional(number)
220+
origin_request_policy_id = string
221+
path_pattern = optional(string)
222+
realtime_log_config_arn = optional(string)
223+
response_headers_policy_id = optional(string)
224+
smooth_streaming = optional(bool)
225+
target_origin_id = string
226+
# TODO support trusted_key_groups and trusted_signers
227+
viewer_protocol_policy = string
228+
}))
229+
default = []
230+
}
231+
232+
variable "cloudfront_additional_origins" {
233+
description = "(Optional) A list of additional origins besides the web site"
234+
type = list(object({
235+
connection_attempts = optional(number)
236+
connection_timeout = optional(number)
237+
custom_origin_config = optional(object({
238+
http_port = number
239+
https_port = number
240+
origin_protocol_policy = string
241+
origin_ssl_protocols = list(string)
242+
origin_keepalive_timeout = optional(number)
243+
origin_read_timeout = optional(number)
244+
}))
245+
domain_name = string
246+
custom_header : optional(list(
247+
object({
248+
name = string
249+
value = string
250+
}))
251+
)
252+
origin_access_control_id = optional(string)
253+
origin_id = string
254+
origin_path = optional(string)
255+
# TODO support origin_shield
256+
s3_origin_config = optional(object({
257+
origin_access_identity = string
258+
}))
259+
}))
260+
default = []
261+
}
262+
207263
variable "cloudfront_web_acl_id" {
208264
description = "(Optional) A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution."
209265
type = string

‎website.tf‎

Lines changed: 72 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ resource "aws_cloudfront_origin_access_identity" "cf_oai" {
1111
# Website S3 Bucket
1212
#------------------------------------------------------------------------------
1313
#tfsec:ignore:aws-s3-enable-versioning tfsec:ignore:aws-s3-encryption-customer-key tfsec:ignore:aws-s3-enable-bucket-logging
14-
resource "aws_s3_bucket" "website" { # tfsec:ignore:AWS017
14+
resource "aws_s3_bucket" "website" {
15+
# tfsec:ignore:AWS017
1516
provider = aws.main
1617

1718
bucket = local.website_bucket_name
@@ -133,7 +134,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "website_bucket_we
133134
#------------------------------------------------------------------------------
134135
# tfsec issues ignored
135136
# - AWS045: Enable WAF for the CloudFront distribution. Pending to implement.
136-
resource "aws_cloudfront_distribution" "website" { # tfsec:ignore:AWS045
137+
resource "aws_cloudfront_distribution" "website" {
138+
# tfsec:ignore:AWS045
137139
provider = aws.main
138140

139141
aliases = var.www_website_redirect_enabled ? [
@@ -188,8 +190,29 @@ resource "aws_cloudfront_distribution" "website" { # tfsec:ignore:AWS045
188190
prefix = "cloudfront_website"
189191
}
190192

191-
# TODO - Add variable to support ordered_cache_behavior
192-
# ordered_cache_behavior (Optional) - An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.
193+
dynamic "ordered_cache_behavior" {
194+
for_each = var.cloudfront_ordered_cache_behaviors
195+
content {
196+
allowed_methods = tolist(ordered_cache_behavior.value.allowed_methods)
197+
cached_methods = tolist(ordered_cache_behavior.value.cached_methods)
198+
cache_policy_id = ordered_cache_behavior.value.cache_policy_id
199+
compress = ordered_cache_behavior.value.compress
200+
default_ttl = ordered_cache_behavior.value.default_ttl
201+
field_level_encryption_id = ordered_cache_behavior.value.field_level_encryption_id
202+
max_ttl = ordered_cache_behavior.value.max_ttl
203+
min_ttl = ordered_cache_behavior.value.min_ttl
204+
origin_request_policy_id = ordered_cache_behavior.value.origin_request_policy_id
205+
path_pattern = ordered_cache_behavior.value.path_pattern
206+
realtime_log_config_arn = ordered_cache_behavior.value.realtime_log_config_arn
207+
response_headers_policy_id = ordered_cache_behavior.value.response_headers_policy_id
208+
smooth_streaming = ordered_cache_behavior.value.smooth_streaming
209+
target_origin_id = ordered_cache_behavior.value.target_origin_id
210+
viewer_protocol_policy = ordered_cache_behavior.value.viewer_protocol_policy
211+
}
212+
}
213+
214+
# TODO support origin groups
215+
# origin_group (Optional) - One or more origin_group for this distribution (multiples allowed).
193216

194217
origin {
195218
domain_name = aws_s3_bucket.website.bucket_regional_domain_name
@@ -199,6 +222,51 @@ resource "aws_cloudfront_distribution" "website" { # tfsec:ignore:AWS045
199222
}
200223
}
201224

225+
dynamic "origin" {
226+
for_each = var.cloudfront_additional_origins
227+
content {
228+
domain_name = origin.value.domain_name
229+
230+
dynamic "custom_header" {
231+
for_each = origin.value.custom_header == null ? [] : [
232+
for h in origin.value.custom_header : {
233+
name = h.name
234+
value = h.value
235+
}
236+
]
237+
content {
238+
name = custom_header.value.name
239+
value = custom_header.value.value
240+
}
241+
}
242+
243+
origin_id = origin.value.origin_id
244+
connection_attempts = origin.value.connection_attempts
245+
connection_timeout = origin.value.connection_timeout
246+
origin_access_control_id = origin.value.origin_access_control_id
247+
origin_path = origin.value.origin_path
248+
249+
dynamic "s3_origin_config" {
250+
for_each = origin.value.s3_origin_config[*]
251+
content {
252+
origin_access_identity = s3_origin_config.value.origin_access_identity
253+
}
254+
}
255+
256+
dynamic "custom_origin_config" {
257+
for_each = origin.value.custom_origin_config[*]
258+
content {
259+
http_port = custom_origin_config.value.http_port
260+
https_port = custom_origin_config.value.https_port
261+
origin_protocol_policy = custom_origin_config.value.origin_protocol_policy
262+
origin_ssl_protocols = custom_origin_config.value.origin_ssl_protocols
263+
origin_keepalive_timeout = custom_origin_config.value.origin_keepalive_timeout
264+
origin_read_timeout = custom_origin_config.value.origin_read_timeout
265+
}
266+
}
267+
}
268+
}
269+
202270
price_class = var.cloudfront_price_class
203271

204272
restrictions {

0 commit comments

Comments
 (0)