From 3216561425f11f21caf0009eff41fb07863755ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Galais?= Date: Tue, 5 Dec 2023 17:32:08 +0100 Subject: [PATCH] Add origin_access_control_id feature --- README.md | 3 ++- main.tf | 15 +++++++++------ variables.tf | 14 +++++++++++--- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index d6719fa..3131c07 100644 --- a/README.md +++ b/README.md @@ -151,7 +151,7 @@ Available targets: | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | | [custom\_error\_response](#input\_custom\_error\_response) | List of one or more custom error response element maps | 
list(object({
    error_caching_min_ttl = string
    error_code            = string
    response_code         = string
    response_page_path    = string
  }))
| `[]` | no | | [custom\_header](#input\_custom\_header) | List of one or more custom headers passed to the origin | 
list(object({
    name  = string
    value = string
  }))
| `[]` | no | -| [custom\_origins](#input\_custom\_origins) | One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments | 
list(object({
    domain_name = string
    origin_id   = string
    origin_path = string
    custom_headers = list(object({
      name  = string
      value = string
    }))
    custom_origin_config = object({
      http_port                = number
      https_port               = number
      origin_protocol_policy   = string
      origin_ssl_protocols     = list(string)
      origin_keepalive_timeout = number
      origin_read_timeout      = number
    })
    s3_origin_config = object({
      origin_access_identity = string
    })
  }))
| `[]` | no | +| [custom\_origins](#input\_custom\_origins) | One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments | 
list(object({
    domain_name              = string
    origin_id                = string
    origin_path              = string
    origin_access_control_id = string
    custom_headers = list(object({
      name  = string
      value = string
    }))
    custom_origin_config = object({
      http_port                = number
      https_port               = number
      origin_protocol_policy   = string
      origin_ssl_protocols     = list(string)
      origin_keepalive_timeout = number
      origin_read_timeout      = number
    })
    s3_origin_config = object({
      origin_access_identity = string
    })
  }))
| `[]` | no | | [default\_root\_object](#input\_default\_root\_object) | Object that CloudFront return when requests the root URL | `string` | `"index.html"` | no | | [default\_ttl](#input\_default\_ttl) | Default amount of time (in seconds) that an object is in a CloudFront cache | `number` | `60` | no | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | @@ -188,6 +188,7 @@ Available targets: | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | | [ordered\_cache](#input\_ordered\_cache) | An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.
The fields can be described by the other variables in this file. For example, the field 'lambda\_function\_association' in this object has
a description in var.lambda\_function\_association variable earlier in this file. The only difference is that fields on this object are in ordered caches, whereas the rest
of the vars in this file apply only to the default cache. Put value `""` on field `target_origin_id` to specify default s3 bucket origin. | 
list(object({
    target_origin_id = string
    path_pattern     = string

    allowed_methods          = list(string)
    cached_methods           = list(string)
    cache_policy_id          = string
    origin_request_policy_id = string
    compress                 = bool

    viewer_protocol_policy = string
    min_ttl                = number
    default_ttl            = number
    max_ttl                = number

    forward_query_string  = bool
    forward_header_values = list(string)
    forward_cookies       = string

    response_headers_policy_id = string

    lambda_function_association = list(object({
      event_type   = string
      include_body = bool
      lambda_arn   = string
    }))

    function_association = list(object({
      event_type   = string
      function_arn = string
    }))
  }))
| `[]` | no | +| [origin\_access\_control\_id](#input\_origin\_access\_control\_id) | CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3. | `string` | `null` | no | | [origin\_access\_identity\_enabled](#input\_origin\_access\_identity\_enabled) | When true, creates origin access identity resource | `bool` | `true` | no | | [origin\_domain\_name](#input\_origin\_domain\_name) | The DNS domain name of your custom origin (e.g. website) | `string` | `""` | no | | [origin\_http\_port](#input\_origin\_http\_port) | The HTTP port the custom origin listens on | `number` | `"80"` | no | diff --git a/main.tf b/main.tf index 3fd125c..f1a51ab 100644 --- a/main.tf +++ b/main.tf @@ -75,9 +75,10 @@ resource "aws_cloudfront_distribution" "default" { } origin { - domain_name = var.origin_domain_name - origin_id = module.this.id - origin_path = var.origin_path + domain_name = var.origin_domain_name + origin_id = module.this.id + origin_path = var.origin_path + origin_access_control_id = var.origin_access_control_id custom_origin_config { http_port = var.origin_http_port @@ -108,9 +109,11 @@ resource "aws_cloudfront_distribution" "default" { dynamic "origin" { for_each = var.custom_origins content { - domain_name = origin.value.domain_name - origin_id = origin.value.origin_id - origin_path = lookup(origin.value, "origin_path", "") + domain_name = origin.value.domain_name + origin_id = origin.value.origin_id + origin_path = lookup(origin.value, "origin_path", "") + origin_access_control_id = lookup(origin.value, "origin_access_control_id", null) + dynamic "custom_header" { for_each = lookup(origin.value, "custom_headers", []) content { diff --git a/variables.tf b/variables.tf index e22a549..f2959e8 100644 --- a/variables.tf +++ b/variables.tf @@ -65,6 +65,13 @@ variable "origin_path" { default = "" } +variable "origin_access_control_id" { + # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html + type = string + description = "CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3." + default = null +} + variable "origin_http_port" { type = number description = "The HTTP port the custom origin listens on" @@ -349,9 +356,10 @@ DESCRIPTION variable "custom_origins" { type = list(object({ - domain_name = string - origin_id = string - origin_path = string + domain_name = string + origin_id = string + origin_path = string + origin_access_control_id = string custom_headers = list(object({ name = string value = string