Skip to content

Commit

Permalink
Add origin_access_control_id feature (#112)
Browse files Browse the repository at this point in the history
  • Loading branch information
@Genesys05
Genesys05 authored Jul 25, 2024
1 parent ee2342b commit cfebe9f
Show file tree
Hide file tree
Showing 3 changed files with 22 additions and 10 deletions.
3 changes: 2 additions & 1 deletion README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ Available targets:
| <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br> "additional_tag_map": {},<br> "attributes": [],<br> "delimiter": null,<br> "descriptor_formats": {},<br> "enabled": true,<br> "environment": null,<br> "id_length_limit": null,<br> "label_key_case": null,<br> "label_order": [],<br> "label_value_case": null,<br> "labels_as_tags": [<br> "unset"<br> ],<br> "name": null,<br> "namespace": null,<br> "regex_replace_chars": null,<br> "stage": null,<br> "tags": {},<br> "tenant": null<br>}</pre> | no |
| <a name="input_custom_error_response"></a> [custom\_error\_response](#input\_custom\_error\_response) | List of one or more custom error response element maps | <pre>list(object({<br> error_caching_min_ttl = string<br> error_code = string<br> response_code = string<br> response_page_path = string<br> }))</pre> | `[]` | no |
| <a name="input_custom_header"></a> [custom\_header](#input\_custom\_header) | List of one or more custom headers passed to the origin | <pre>list(object({<br> name = string<br> value = string<br> }))</pre> | `[]` | no |
| <a name="input_custom_origins"></a> [custom\_origins](#input\_custom\_origins) | One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments | <pre>list(object({<br> domain_name = string<br> origin_id = string<br> origin_path = string<br> custom_headers = list(object({<br> name = string<br> value = string<br> }))<br> custom_origin_config = object({<br> http_port = number<br> https_port = number<br> origin_protocol_policy = string<br> origin_ssl_protocols = list(string)<br> origin_keepalive_timeout = number<br> origin_read_timeout = number<br> })<br> s3_origin_config = object({<br> origin_access_identity = string<br> })<br> }))</pre> | `[]` | no |
| <a name="input_custom_origins"></a> [custom\_origins](#input\_custom\_origins) | One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments | <pre>list(object({<br> domain_name = string<br> origin_id = string<br> origin_path = string<br> origin_access_control_id = string<br> custom_headers = list(object({<br> name = string<br> value = string<br> }))<br> custom_origin_config = object({<br> http_port = number<br> https_port = number<br> origin_protocol_policy = string<br> origin_ssl_protocols = list(string)<br> origin_keepalive_timeout = number<br> origin_read_timeout = number<br> })<br> s3_origin_config = object({<br> origin_access_identity = string<br> })<br> }))</pre> | `[]` | no |
| <a name="input_default_root_object"></a> [default\_root\_object](#input\_default\_root\_object) | Object that CloudFront return when requests the root URL | `string` | `"index.html"` | no |
| <a name="input_default_ttl"></a> [default\_ttl](#input\_default\_ttl) | Default amount of time (in seconds) that an object is in a CloudFront cache | `number` | `60` | no |
| <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
Expand Down Expand Up @@ -188,6 +188,7 @@ Available targets:
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_ordered_cache"></a> [ordered\_cache](#input\_ordered\_cache) | An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.<br>The fields can be described by the other variables in this file. For example, the field 'lambda\_function\_association' in this object has<br>a description in var.lambda\_function\_association variable earlier in this file. The only difference is that fields on this object are in ordered caches, whereas the rest<br>of the vars in this file apply only to the default cache. Put value `""` on field `target_origin_id` to specify default s3 bucket origin. | <pre>list(object({<br> target_origin_id = string<br> path_pattern = string<br><br> allowed_methods = list(string)<br> cached_methods = list(string)<br> cache_policy_id = string<br> origin_request_policy_id = string<br> compress = bool<br><br> viewer_protocol_policy = string<br> min_ttl = number<br> default_ttl = number<br> max_ttl = number<br><br> forward_query_string = bool<br> forward_header_values = list(string)<br> forward_cookies = string<br><br> response_headers_policy_id = string<br><br> lambda_function_association = list(object({<br> event_type = string<br> include_body = bool<br> lambda_arn = string<br> }))<br><br> function_association = list(object({<br> event_type = string<br> function_arn = string<br> }))<br> }))</pre> | `[]` | no |
| <a name="input_origin_access_control_id"></a> [origin\_access\_control\_id](#input\_origin\_access\_control\_id) | CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3. | `string` | `null` | no |
| <a name="input_origin_access_identity_enabled"></a> [origin\_access\_identity\_enabled](#input\_origin\_access\_identity\_enabled) | When true, creates origin access identity resource | `bool` | `true` | no |
| <a name="input_origin_domain_name"></a> [origin\_domain\_name](#input\_origin\_domain\_name) | The DNS domain name of your custom origin (e.g. website) | `string` | `""` | no |
| <a name="input_origin_http_port"></a> [origin\_http\_port](#input\_origin\_http\_port) | The HTTP port the custom origin listens on | `number` | `"80"` | no |
Expand Down
15 changes: 9 additions & 6 deletions main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,10 @@ resource "aws_cloudfront_distribution" "default" {
}

origin {
domain_name = var.origin_domain_name
origin_id = module.this.id
origin_path = var.origin_path
domain_name = var.origin_domain_name
origin_id = module.this.id
origin_path = var.origin_path
origin_access_control_id = var.origin_access_control_id

custom_origin_config {
http_port = var.origin_http_port
Expand Down Expand Up @@ -108,9 +109,11 @@ resource "aws_cloudfront_distribution" "default" {
dynamic "origin" {
for_each = var.custom_origins
content {
domain_name = origin.value.domain_name
origin_id = origin.value.origin_id
origin_path = lookup(origin.value, "origin_path", "")
domain_name = origin.value.domain_name
origin_id = origin.value.origin_id
origin_path = lookup(origin.value, "origin_path", "")
origin_access_control_id = lookup(origin.value, "origin_access_control_id", null)

dynamic "custom_header" {
for_each = lookup(origin.value, "custom_headers", [])
content {
Expand Down
14 changes: 11 additions & 3 deletions variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,13 @@ variable "origin_path" {
default = ""
}

variable "origin_access_control_id" {
# https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html
type = string
description = "CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3."
default = null
}

variable "origin_http_port" {
type = number
description = "The HTTP port the custom origin listens on"
Expand Down Expand Up @@ -349,9 +356,10 @@ DESCRIPTION

variable "custom_origins" {
type = list(object({
domain_name = string
origin_id = string
origin_path = string
domain_name = string
origin_id = string
origin_path = string
origin_access_control_id = string
custom_headers = list(object({
name = string
value = string
Expand Down

0 comments on commit cfebe9f

Please sign in to comment.