Skip to content

Commit 649a201

Browse files
jamesiarmesjamesiarmes
committed
feat: Allow the managed request policy to be specified.
fix: Updated the default request policy to "AllViewer", as recommended for custom origins.
1 parent ac60472 commit 649a201

File tree

3 files changed

+48
-27
lines changed

3 files changed

+48
-27
lines changed

‎README.md‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -50,21 +50,22 @@ these rules are spaced out to allow for custom rules to be inserted between.
5050
## Inputs
5151

5252

53-
| Name | Description | Type | Default | Required |
54-
|--------------------|-----------------------------------------------------------------------------------------------------|----------------|---------|----------|
55-
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
56-
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
57-
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
58-
| project | Project that these resources are supporting. | `string` | n/a | yes |
59-
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
60-
| environment | The environment for the deployment. | `string` | `"dev"` | no |
61-
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
62-
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
63-
| origin_domain | Fully qualified domain name for the origin. Defaults to `origin.${subdomain}.${domain}`. | `string` | n/a | no |
64-
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
65-
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
66-
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
67-
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
53+
| Name | Description | Type | Default | Required |
54+
|--------------------|---------------------------------------------------------------------------------------------------------------------------|----------------|---------------|----------|
55+
| domain | Primary domain for the distribution. The hosted zone for this domain should be in the same account. | `string` | n/a | yes |
56+
| log_bucket | Domain name of the S3 bucket to send logs to. | `string` | n/a | yes |
57+
| log_group | CloudWatch log group to send WAF logs to. | `string` | n/a | yes |
58+
| project | Project that these resources are supporting. | `string` | n/a | yes |
59+
| [custom_headers] | Custom headers to send to the origin. | `map(string)` | `{}` | no |
60+
| environment | The environment for the deployment. | `string` | `"dev"` | no |
61+
| [ip_set_rules] | Custom IP Set rules for the WAF | `map(object)` | `{}` | no |
62+
| [rate_limit_rules] | Rate limiting configuration for the WAF. | `map(object)` | `{}` | no |
63+
| origin_domain | Fully qualified domain name for the origin. Defaults to `origin.${subdomain}.${domain}`. | `string` | n/a | no |
64+
| passive | Enable passive mode for the WAF, counting all requests rather than blocking. | `bool` | `false` | no |
65+
| request_policy | Managed request policy to associate with the distribution. See the [managed policies][managed-policies] for valid values. | `string` | `"AllViewer"` | no |
66+
| subdomain | Subdomain for the distribution. Defaults to the environment. | `string` | n/a | no |
67+
| tags | Optional tags to be applied to all resources. | `map(string)` | `{}` | no |
68+
| [upload_paths] | Optional paths to allow uploads to. | `list(object)` | `[]` | no |
6869

6970
### custom_headers
7071

@@ -236,6 +237,7 @@ module "cloudfront_waf" {
236237
[ip-rules]: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-ipset-match.html
237238
[ip_set_rules]: #ip_set_rules
238239
[latest-release]: https://github.com/codeforamerica/tofu-modules-aws-cloudfront-waf/releases/latest
240+
[managed-policies]: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html
239241
[rate_limit_rules]: #rate_limit_rules
240242
[rules-common]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-crs
241243
[rules-inputs]: https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-baseline.html#aws-managed-rule-groups-baseline-known-bad-inputs

‎data.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
data "aws_cloudfront_origin_request_policy" "managed_cors" {
2-
name = "Managed-CORS-CustomOrigin"
2+
name = "Managed-${var.request_policy}"
33
}
44

55
data "aws_cloudfront_response_headers_policy" "managed_cors" {

‎variables.tf‎

Lines changed: 30 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,17 @@ variable "environment" {
1515
default = "dev"
1616
}
1717

18+
variable "ip_set_rules" {
19+
type = map(object({
20+
name = optional(string, "")
21+
action = optional(string, "allow")
22+
priority = optional(number, null)
23+
arn = string
24+
}))
25+
description = "Custom IP Set rules for the WAF."
26+
default = {}
27+
}
28+
1829
variable "log_bucket" {
1930
type = string
2031
description = "S3 Bucket to send logs to."
@@ -42,17 +53,6 @@ variable "project" {
4253
description = "Project that these resources are supporting."
4354
}
4455

45-
variable "ip_set_rules" {
46-
type = map(object({
47-
name = optional(string, "")
48-
action = optional(string, "allow")
49-
priority = optional(number, null)
50-
arn = string
51-
}))
52-
description = "Custom IP Set rules for the WAF."
53-
default = {}
54-
}
55-
5656
variable "rate_limit_rules" {
5757
type = map(object({
5858
name = optional(string, "")
@@ -65,6 +65,25 @@ variable "rate_limit_rules" {
6565
default = {}
6666
}
6767

68+
variable "request_policy" {
69+
type = string
70+
description = "Managed request policy to associate with the distribution."
71+
default = "AllViewer"
72+
73+
validation {
74+
condition = contains([
75+
"AllViewer",
76+
"AllViewerAndCloudFrontHeaders-2022-06",
77+
"AllViewerExceptHostHeader",
78+
"CORS-CustomOrigin",
79+
"CORS-S3Origin",
80+
"Elemental-MediaTailor-PersonalizedManifests",
81+
"UserAgentRefererHeaders"
82+
], var.request_policy)
83+
error_message = "Invalid request policy. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html"
84+
}
85+
}
86+
6887
variable "subdomain" {
6988
type = string
7089
description = "Subdomain for the distribution. Defaults to the environment."

0 commit comments

Comments
 (0)