Skip to content

Latest commit

 

History

History
62 lines (49 loc) · 4.08 KB

README.md

File metadata and controls

62 lines (49 loc) · 4.08 KB
Raw

terraform-aws-cloudfront-security-headers

Terraform module to create a Lambda@Edge function to add best practice security headers and support HSTS preload requirements.

Example

module "security_headers" {
  source                             = "Lupus-Metallum/cloudfront-security-headers/aws"
  version                            = "3.0.0"
  name                               = "AddSecurityHeaders"
  access_control_allow_methods       = "POST, GET, OPTIONS"
  access_control_allow_origin        = "https://example.com"
  content_security_policy            = "default-src 'self:'; img-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; object-src 'none'"
  referrer_policy                    = "same-origin"
  strict_transport_security          = "max-age=63072000; includeSubdomains; preload"
  x_content_type_options             = "nosniff"
  x_frame_options                    = "DENY"
  x_xss_protection                   = "1; mode=block"
  feature_policy                     = ""
}

Providers

Name Version
aws n/a

Resources

Name Type
aws_cloudfront_function.this resource
aws_partition.current data source

Inputs

Name Description Type Default Required
name Name to use for resource names created by this module string n/a yes
access_control_allow_methods Value to use for the Access-Control-Allow-Methods header, when not provided this header is omitted. string "" no
access_control_allow_origin Value to use for the Access-Control-Allow-Origin header, when not provided this header is omitted. string "" no
content_security_policy Value to use for the Content-Security-Policy header, when not provided this header is omitted. string "" no
description Description to use for resource description created by this module string "Adds security headers for Cloudfront" no
feature_policy Value to use for the Feature-Policy header, when not provided this header is omitted. string "" no
referrer_policy Value to use for the Referrer-Policy header, when not provided this header is omitted. string "" no
strict_transport_security Value to use for the Strict-Transport-Security header, when not provided this header is omitted. string "" no
x_content_type_options Value to use for the X-Content-Type-Options header, when not provided this header is omitted. string "" no
x_frame_options Value to use for the X-Frame-Options header, when not provided this header is omitted. string "" no
x_xss_protection Value to use for the X-XSS-Protection header, when not provided this header is omitted. string "" no

Outputs

Name Description
arn n/a