diff --git a/.github/mergify.yml b/.github/mergify.yml index 148d85c0..526045d4 100644 --- a/.github/mergify.yml +++ b/.github/mergify.yml @@ -1,76 +1 @@ -# https://docs.mergify.io/conditions.html -# https://docs.mergify.io/actions.html -pull_request_rules: -- name: "approve automated PRs that have passed checks" - conditions: - - "author~=^(cloudpossebot|renovate\\[bot\\])$" - - "-closed" - - "head~=^(auto-update|renovate)/.*" - - "check-success=test/bats" - - "check-success=test/readme" - - "check-success=test/terratest" - - "check-success=validate-codeowners" - - or: - - "base=master" - - "base=main" - - "base~=^release/v\\d{1,2}$" - - actions: - review: - type: "APPROVE" - bot_account: "cloudposse-mergebot" - message: "We've automatically approved this PR because the checks from the automated Pull Request have passed." - -- name: "merge automated PRs when approved and tests pass" - conditions: - - "author~=^(cloudpossebot|renovate\\[bot\\])$" - - "-closed" - - "head~=^(auto-update|renovate)/.*" - - "check-success=test/bats" - - "check-success=test/readme" - - "check-success=test/terratest" - - "check-success=validate-codeowners" - - "#approved-reviews-by>=1" - - "#changes-requested-reviews-by=0" - - "#commented-reviews-by=0" - - or: - - "base=master" - - "base=main" - - "base~=^release/v\\d{1,2}$" - - actions: - merge: - method: "squash" - -- name: "delete the head branch after merge" - conditions: - - "merged" - actions: - delete_head_branch: {} - -- name: "ask to resolve conflict" - conditions: - - "conflict" - - "-closed" - actions: - comment: - message: "This pull request is now in conflict. Could you fix it @{{author}}? πŸ™" - -- name: "remove outdated reviews" - conditions: - - or: - - "base=master" - - "base=main" - - "base~=^release/v\\d{1,2}$" - actions: - dismiss_reviews: - changes_requested: true - approved: true - message: "This Pull Request has been updated, so we're dismissing all reviews." - -- name: "close Pull Requests without files changed" - conditions: - - "#files=0" - actions: - close: - message: "This pull request has been automatically closed by Mergify because there are no longer any changes." +extends: .github diff --git a/.github/settings.yml b/.github/settings.yml new file mode 100644 index 00000000..1ae78d03 --- /dev/null +++ b/.github/settings.yml @@ -0,0 +1,7 @@ +# Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. +_extends: .github +repository: + name: terraform-aws-cloudfront-s3-cdn + description: Terraform module to easily provision CloudFront CDN backed by an S3 origin + homepage: https://cloudposse.com/accelerate + topics: terraform, terraform-module, cloudfront, aws, cloudfront-logs, s3, cdn, hcl2 diff --git a/.github/workflows/feature-branch.yml b/.github/workflows/feature-branch.yml index 8faa955f..ebd8854f 100644 --- a/.github/workflows/feature-branch.yml +++ b/.github/workflows/feature-branch.yml @@ -11,9 +11,9 @@ permissions: pull-requests: write id-token: write contents: write + issues: write jobs: terraform-module: uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/feature-branch.yml@main - secrets: - github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }} + secrets: inherit diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml index b30901ea..852d5e3e 100644 --- a/.github/workflows/release-branch.yml +++ b/.github/workflows/release-branch.yml @@ -4,20 +4,17 @@ on: push: branches: - main - - release/** + - release/v* paths-ignore: - '.github/**' - 'docs/**' - 'examples/**' - 'test/**' - - 'README.*' + - 'README.md' -permissions: - contents: write - id-token: write +permissions: {} jobs: terraform-module: uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-branch.yml@main - secrets: - github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }} + secrets: inherit diff --git a/.github/workflows/release-published.yml b/.github/workflows/release-published.yml index b31232b6..1b0aaca7 100644 --- a/.github/workflows/release-published.yml +++ b/.github/workflows/release-published.yml @@ -5,10 +5,9 @@ on: types: - published -permissions: - contents: write - id-token: write +permissions: {} jobs: terraform-module: uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/release-published.yml@main + secrets: inherit diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml index 163be0b4..7bc09ab9 100644 --- a/.github/workflows/scheduled.yml +++ b/.github/workflows/scheduled.yml @@ -13,5 +13,4 @@ permissions: jobs: scheduled: uses: cloudposse/github-actions-workflows-terraform-module/.github/workflows/scheduled.yml@main - secrets: - github_access_token: ${{ secrets.REPO_ACCESS_TOKEN }} + secrets: inherit diff --git a/README.md b/README.md index cba1745e..8d934817 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,10 @@ + -# terraform-aws-cloudfront-s3-cdn [![Codefresh Build Status](https://g.codefresh.io/api/badges/pipeline/cloudposse/terraform-modules%2Fterraform-aws-cloudfront-s3-cdn?type=cf-1)](https://g.codefresh.io/public/accounts/cloudposse/pipelines/5d169121757962ff25679794) [![Latest Release](https://img.shields.io/github/release/cloudposse/terraform-aws-cloudfront-s3-cdn.svg)](https://travis-ci.org/cloudposse/terraform-aws-cloudfront-s3-cdn/releases) [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) +# terraform-aws-cloudfront-s3-cdn +Latest ReleaseLast UpdatedSlack Community -[![README Header][readme_header_img]][readme_header_link] - -[![Cloud Posse][logo]](https://cpco.io/homepage) - - -## Share the Love - -Like this project? Please give it a β˜… on [our GitHub](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn)! (it helps us **a lot**) - -Are you using this project or any of our other projects? Consider [leaving a testimonial][testimonial]. =) - - - ## Related Projects Check out these related projects. @@ -627,86 +588,94 @@ Check out these related projects. - [terraform-aws-cloudfront-cdn](https://github.com/cloudposse/terraform-aws-cloudfront-cdn) - Terraform Module that implements a CloudFront Distribution (CDN) for a custom origin. - [terraform-aws-s3-log-storage](https://github.com/cloudposse/terraform-aws-s3-log-storage) - S3 bucket with built in IAM policy to allow CloudTrail logs -## Help - -**Got a question?** We got answers. - -File a GitHub [issue](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/issues), send us an [email][email] or join our [Slack Community][slack]. - -[![README Commercial Support][readme_commercial_support_img]][readme_commercial_support_link] - -## DevOps Accelerator for Startups - -We are a [**DevOps Accelerator**][commercial_support]. We'll help you build your cloud infrastructure from the ground up so you can own it. Then we'll show you how to operate it and stick around for as long as you need us. - -[![Learn More](https://img.shields.io/badge/learn%20more-success.svg?style=for-the-badge)][commercial_support] - -Work directly with our team of DevOps experts via email, slack, and video conferencing. - -We deliver 10x the value for a fraction of the cost of a full-time engineer. Our track record is not even funny. If you want things done right and you need it done FAST, then we're your best bet. - -- **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. -- **Release Engineering.** You'll have end-to-end CI/CD with unlimited staging environments. -- **Site Reliability Engineering.** You'll have total visibility into your apps and microservices. -- **Security Baseline.** You'll have built-in governance with accountability and audit logs for all changes. -- **GitOps.** You'll be able to operate your infrastructure via Pull Requests. -- **Training.** You'll receive hands-on training so your team can operate what we build. -- **Questions.** You'll have a direct line of communication between our teams via a Shared Slack channel. -- **Troubleshooting.** You'll get help to triage when things aren't working. -- **Code Reviews.** You'll receive constructive feedback on Pull Requests. -- **Bug Fixes.** We'll rapidly work with you to fix any bugs in our projects. - -## Slack Community - -Join our [Open Source Community][slack] on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. - -## Discourse Forums - -Participate in our [Discourse Forums][discourse]. Here you'll find answers to commonly asked questions. Most questions will be related to the enormous number of projects we support on our GitHub. Come here to collaborate on answers, find solutions, and get ideas about the products and services we value. It only takes a minute to get started! Just sign in with SSO using your GitHub account. - -## Newsletter - -Sign up for [our newsletter][newsletter] that covers everything on our technology radar. Receive updates on what we're up to on GitHub as well as awesome new projects we discover. - -## Office Hours - -[Join us every Wednesday via Zoom][office_hours] for our weekly "Lunch & Learn" sessions. It's **FREE** for everyone! - -[![zoom](https://img.cloudposse.com/fit-in/200x200/https://cloudposse.com/wp-content/uploads/2019/08/Powered-by-Zoom.png")][office_hours] - -## Contributing - -### Bug Reports & Feature Requests - -Please use the [issue tracker](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/issues) to report any bugs or file feature requests. - -### Developing - -If you are interested in being a contributor and want to get involved in developing this project or [help out](https://cpco.io/help-out) with our other projects, we would love to hear from you! Shoot us an [email][email]. +> [!TIP] +> #### Use Terraform Reference Architectures for AWS +> +> Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. +> +> βœ… We build it with you.
+> βœ… You own everything.
+> βœ… Your team wins.
+> +> Request Quote +>
πŸ“š Learn More +> +>
+> +> Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=commercial_support) for funded startups and enterprises. +> +> *Your team can operate like a pro today.* +> +> Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. +> #### Day-0: Your Foundation for Success +> - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. +> - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. +> - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. +> - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. +> - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. +> +> Request Quote +> +> #### Day-2: Your Operational Mastery +> - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. +> - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. +> - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. +> - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. +> - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. +> - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. +> - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. +> +> Request Quote +>
+ +## ✨ Contributing + +This project is under active development, and we encourage contributions from our community. + + + +Many thanks to our outstanding contributors: + + + + + +For πŸ› bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/issues). In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. - - 1. **Fork** the repo on GitHub - 2. **Clone** the project to your own machine - 3. **Commit** changes to your own branch - 4. **Push** your work back up to your fork - 5. Submit a **Pull Request** so that we can review your changes + 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). + 2. **Fork** the repo on GitHub + 3. **Clone** the project to your own machine + 4. **Commit** changes to your own branch + 5. **Push** your work back up to your fork + 6. Submit a **Pull Request** so that we can review your changes **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! +### 🌎 Slack Community -## Copyright +Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. -Copyright Β© 2017-2023 [Cloud Posse, LLC](https://cpco.io/copyright) +### πŸ“° Newsletter +Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. +Dropped straight into your Inbox every week β€” and usually a 5-minute read. +### πŸ“† Office Hours +[Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. +It's **FREE** for everyone! ## License -[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) +License + +
+Preamble to the Apache License, Version 2.0 +
+
-See [LICENSE](LICENSE) for full details. +Complete license is available in the [`LICENSE`](LICENSE) file. ```text Licensed to the Apache Software Foundation (ASF) under one @@ -726,90 +695,17 @@ KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ``` - - - - - - - - +
## Trademarks All other trademarks referenced herein are the property of their respective owners. -## About - -This project is maintained and funded by [Cloud Posse, LLC][website]. Like it? Please let us know by [leaving a testimonial][testimonial]! - -[![Cloud Posse][logo]][website] - -We're a [DevOps Professional Services][hire] company based in Los Angeles, CA. We ❀️ [Open Source Software][we_love_open_source]. - -We offer [paid support][commercial_support] on all of our projects. - -Check out [our other projects][github], [follow us on twitter][twitter], [apply for a job][jobs], or [hire us][hire] to help with your cloud strategy and implementation. +--- +Copyright © 2017-2024 [Cloud Posse, LLC](https://cpco.io/copyright) -### Contributors +README footer - -| [![Erik Osterman][osterman_avatar]][osterman_homepage]
[Erik Osterman][osterman_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]
[Andriy Knysh][aknysh_homepage] | [![Jamie Nelson][Jamie-BitFlight_avatar]][Jamie-BitFlight_homepage]
[Jamie Nelson][Jamie-BitFlight_homepage] | [![Clive Zagno][cliveza_avatar]][cliveza_homepage]
[Clive Zagno][cliveza_homepage] | [![David Mattia][dmattia_avatar]][dmattia_homepage]
[David Mattia][dmattia_homepage] | [![RB][nitrocode_avatar]][nitrocode_homepage]
[RB][nitrocode_homepage] | [![John McGehee][jmcgeheeiv_avatar]][jmcgeheeiv_homepage]
[John McGehee][jmcgeheeiv_homepage] | [![Yonatan Koren][korenyoni_avatar]][korenyoni_homepage]
[Yonatan Koren][korenyoni_homepage] | [![Lucas Caparelli][lcaparelli_avatar]][lcaparelli_homepage]
[Lucas Caparelli][lcaparelli_homepage] | -|---|---|---|---|---|---|---|---|---| - - - [osterman_homepage]: https://github.com/osterman - [osterman_avatar]: https://img.cloudposse.com/150x150/https://github.com/osterman.png - [aknysh_homepage]: https://github.com/aknysh - [aknysh_avatar]: https://img.cloudposse.com/150x150/https://github.com/aknysh.png - [Jamie-BitFlight_homepage]: https://github.com/Jamie-BitFlight - [Jamie-BitFlight_avatar]: https://img.cloudposse.com/150x150/https://github.com/Jamie-BitFlight.png - [cliveza_homepage]: https://github.com/cliveza - [cliveza_avatar]: https://img.cloudposse.com/150x150/https://github.com/cliveza.png - [dmattia_homepage]: https://github.com/dmattia - [dmattia_avatar]: https://img.cloudposse.com/150x150/https://github.com/dmattia.png - [nitrocode_homepage]: https://github.com/nitrocode - [nitrocode_avatar]: https://img.cloudposse.com/150x150/https://github.com/nitrocode.png - [jmcgeheeiv_homepage]: https://github.com/jmcgeheeiv - [jmcgeheeiv_avatar]: https://img.cloudposse.com/150x150/https://github.com/jmcgeheeiv.png - [korenyoni_homepage]: https://github.com/korenyoni - [korenyoni_avatar]: https://img.cloudposse.com/150x150/https://github.com/korenyoni.png - [lcaparelli_homepage]: https://github.com/lcaparelli - [lcaparelli_avatar]: https://img.cloudposse.com/150x150/https://github.com/lcaparelli.png - -[![README Footer][readme_footer_img]][readme_footer_link] -[![Beacon][beacon]][website] - - [logo]: https://cloudposse.com/logo-300x69.svg - [docs]: https://cpco.io/docs?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=docs - [website]: https://cpco.io/homepage?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=website - [github]: https://cpco.io/github?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=github - [jobs]: https://cpco.io/jobs?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=jobs - [hire]: https://cpco.io/hire?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=hire - [slack]: https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=slack - [linkedin]: https://cpco.io/linkedin?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=linkedin - [twitter]: https://cpco.io/twitter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=twitter - [testimonial]: https://cpco.io/leave-testimonial?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=testimonial - [office_hours]: https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=office_hours - [newsletter]: https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=newsletter - [discourse]: https://ask.sweetops.com/?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=discourse - [email]: https://cpco.io/email?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=email - [commercial_support]: https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=commercial_support - [we_love_open_source]: https://cpco.io/we-love-open-source?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=we_love_open_source - [terraform_modules]: https://cpco.io/terraform-modules?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=terraform_modules - [readme_header_img]: https://cloudposse.com/readme/header/img - [readme_header_link]: https://cloudposse.com/readme/header/link?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=readme_header_link - [readme_footer_img]: https://cloudposse.com/readme/footer/img - [readme_footer_link]: https://cloudposse.com/readme/footer/link?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=readme_footer_link - [readme_commercial_support_img]: https://cloudposse.com/readme/commercial-support/img - [readme_commercial_support_link]: https://cloudposse.com/readme/commercial-support/link?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-s3-cdn&utm_content=readme_commercial_support_link - [share_twitter]: https://twitter.com/intent/tweet/?text=terraform-aws-cloudfront-s3-cdn&url=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [share_linkedin]: https://www.linkedin.com/shareArticle?mini=true&title=terraform-aws-cloudfront-s3-cdn&url=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [share_reddit]: https://reddit.com/submit/?url=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [share_facebook]: https://facebook.com/sharer/sharer.php?u=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [share_googleplus]: https://plus.google.com/share?url=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [share_email]: mailto:?subject=terraform-aws-cloudfront-s3-cdn&body=https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn - [beacon]: https://ga-beacon.cloudposse.com/UA-76589703-4/cloudposse/terraform-aws-cloudfront-s3-cdn?pixel&cs=github&cm=readme&an=terraform-aws-cloudfront-s3-cdn - +Beacon diff --git a/README.yaml b/README.yaml index 2ef85ec6..9e034cbd 100644 --- a/README.yaml +++ b/README.yaml @@ -1,4 +1,3 @@ ---- # # This is the canonical configuration for the `README.md` # To rebuild `README.md`: @@ -34,16 +33,17 @@ github_repo: cloudposse/terraform-aws-cloudfront-s3-cdn # Badges to display badges: - - name: "Codefresh Build Status" - image: "https://g.codefresh.io/api/badges/pipeline/cloudposse/terraform-modules%2Fterraform-aws-cloudfront-s3-cdn?type=cf-1" - url: "https://g.codefresh.io/public/accounts/cloudposse/pipelines/5d169121757962ff25679794" - - name: "Latest Release" - image: "https://img.shields.io/github/release/cloudposse/terraform-aws-cloudfront-s3-cdn.svg" - url: "https://travis-ci.org/cloudposse/terraform-aws-cloudfront-s3-cdn/releases" - - name: "Slack Community" - image: "https://slack.cloudposse.com/badge.svg" - url: "https://slack.cloudposse.com" - + - name: Latest Release + image: https://img.shields.io/github/release/cloudposse/terraform-aws-cloudfront-s3-cdn.svg?style=for-the-badge + url: https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/releases/latest + - name: Last Updated + image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-cloudfront-s3-cdn.svg?style=for-the-badge + url: https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/commits + - name: Slack Community + image: https://slack.cloudposse.com/for-the-badge.svg + url: https://slack.cloudposse.com + +# List any related terraform modules that this module may be used with or that this module depends on. related: - name: "terraform-aws-cloudfront-cdn" description: "Terraform Module that implements a CloudFront Distribution (CDN) for a custom origin." @@ -57,7 +57,7 @@ description: |- Terraform module to provision an AWS CloudFront CDN with an S3 origin. # How to use this project -usage: |- +usage: |2- For a complete example, see [examples/complete](examples/complete). @@ -143,57 +143,57 @@ usage: |- ``` ### Background on CDNs, "Origins", S3 Buckets, and Web Servers - + #### CDNs and Origin Servers - + There are some settings you need to be aware of when using this module. In order to understand the settings, you need to understand some of the basics of CDNs and web servers, so we are providing this _highly simplified_ explanation of how they work in order for you to understand the implications of the settings you are providing. - + A "**CDN**" ([Content Distribution Network](https://www.cloudflare.com/learning/cdn/what-is-a-cdn/)) is a collection of servers scattered around the internet with the aim of making it faster for people to retrieve content from a website. The details of why that is wanted/needed are beyond the scope of this document, as are most of the details of how a CDN is implemented. For this discussion, we will simply treat a CDN as a set of web servers all serving the same content to different users. - + In a normal web server (again, greatly simplified), you place files on the server and the web server software receives requests from browsers and responds with the contents of the files. - + For a variety of reasons, the web servers in a CDN do not work the way normal web servers work. Instead of getting their content from files on the local server, the CDN web servers get their content by acting like web browsers (proxies). When they get a request from a browser, they make the same request to what is called an "**Origin Server**". It is called an origin server because it _serves_ the original content of the website, and thus is the _origin_ of the content. - + As a website publisher, you put content on an Origin Server (which users usually should be prevented from accessing) and configure your CDN to use your Origin Server. Then you direct users to a URL hosted by your CDN provider, the users' browsers connect to the CDN, the CDN gets the content from your Origin Server, your Origin Server gets the content from a file on the server, and the data gets sent back hop by hop to the user. (The reason this ends up being a good idea is that the CDN can cache the content for a while, serving multiple users the same content while only contacting the origin server once.) - + #### S3 Buckets: file storage and web server - + S3 buckets were originally designed just to store files, and they are still most often used for that. The have a lot of access controls to make it possible to strictly limit who can read what files in the bucket, so that companies can store sensitive information there. You may have heard of a number of "data breaches" being caused by misconfigured permissions on S3 buckets, making them publicly accessible. As a result of that, Amazon has some extra settings on top of everything else to keep S3 buckets from being publicly accessible, which is usually a good thing. - + However, at some point someone realized that since these files were in the cloud, and Amazon already had these web servers running to provide access to the files in the cloud, it was only a tiny leap to turn an S3 bucket into a web server. So now S3 buckets [can be published as websites](https://docs.aws.amazon.com/AmazonS3/latest/userguide/EnableWebsiteHosting.html) with a few configuration settings, including making the contents publicly accessible. - + #### Web servers, files, and the different modes of S3 buckets - + In the simplest websites, the URL "path" (the part after the site name) corresponds directly to the path (under a special directory we will call `/webroot`) and name of a file on the web server. So if the web server gets a request for "http://example.com/foo/bar/baz.html" it will look for a file `/webroot/foo/bar/baz.html`. If it exists, the server will return its contents, and if it does not exist, the server will return a `Not Found` error. An S3 bucket, whether configured as a file store or a website, will always do both of these things. - + Web servers, however, do some helpful extra things. To name a few: - If the URL ends with a `/`, as in `http://example.com/foo/bar/`, the web server (depending on how it is configured) will either return a list of files in the directory or it will return the contents of a file in the directory with @@ -204,30 +204,30 @@ usage: |- turns out to be quite helpful. - If the URL does not point to a directory or a file, instead of just sending back a cryptic `Not Found` error code, it can return the contents of a special file called an "error document". - + #### Your Critical Decision: S3 bucket or website? - + All of this background is to help you decide how to set `website_enabled` and `s3_website_password_enabled`. The default for `website_enabled` is `false` which is the easiest to configure and the most secure, and with this setting, `s3_website_password_enabled` is ignored. - + S3 buckets, in file storage mode (`website_enabled = false`), do none of these extra things that web servers do. If the URL points to a file, it will return the file, and if it does not _exactly_ match a file, it will return `Not Found`. One big advantage, though, is that the S3 bucket can remain private (not publicly accessible). A second, related advantage is that you can limit the website to a portion of the S3 bucket (everything under a certain prefix) and keep the contents under the the other prefixes private. - + S3 buckets configured as static websites (`website_enabled = true`), however, have these extra web server features like redirects, `index.html`, and error documents. The disadvantage is that you have to make the entire bucket public (although you can still restrict access to some portions of the bucket). - + Another feature or drawback (depending on your point of view) of S3 buckets configured as static websites is that they are directly accessible via their [website endpoint](https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteEndpoints.html) as well as through Cloudfront. This module has a feature, `s3_website_password_enabled`, that requires a password be passed in the HTTP request header and configures the CDN to do that, which will make it much harder to access the S3 website directly. So set `s3_website_password_enabled = true` to limit direct access to the S3 website or set it to false if you want to be able to bypass Cloudfront when you want to. - + In addition to setting `website_enabled=true`, you must also: * Specify at least one `aliases`, like `["example.com"]` or @@ -235,10 +235,10 @@ usage: |- * Specify an ACM certificate ### Custom Domain Names and Generating a TLS Certificate with ACM - + When you set up Cloudfront, Amazon will generate a domain name for your website. You amost certainly will not want to publish that. Instead, you will want to use a custom domain name. This module refers to them as "aliases". - + To use the custom domain names, you need to - Pass them in as `aliases` so that Cloudfront will respond to them with your content - Create CNAMEs for the aliases to point to the Cloudfront domain name. If your alias domains are hosted by @@ -383,22 +383,4 @@ include: - "docs/terraform.md" # Contributors to this project -contributors: - - name: "Erik Osterman" - github: "osterman" - - name: "Andriy Knysh" - github: "aknysh" - - name: "Jamie Nelson" - github: "Jamie-BitFlight" - - name: "Clive Zagno" - github: "cliveza" - - name: "David Mattia" - github: "dmattia" - - name: "RB" - github: "nitrocode" - - name: "John McGehee" - github: "jmcgeheeiv" - - name: "Yonatan Koren" - github: "korenyoni" - - name: "Lucas Caparelli" - github: "lcaparelli" \ No newline at end of file +contributors: [] diff --git a/docs/terraform.md b/docs/terraform.md index 11cb67ff..06fa2ccd 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -32,9 +32,13 @@ | [aws_cloudfront_distribution.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution) | resource | | [aws_cloudfront_origin_access_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_identity) | resource | | [aws_s3_bucket.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | +| [aws_s3_bucket_acl.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource | +| [aws_s3_bucket_cors_configuration.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_cors_configuration) | resource | | [aws_s3_bucket_ownership_controls.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_ownership_controls) | resource | | [aws_s3_bucket_policy.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource | | [aws_s3_bucket_public_access_block.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | +| [aws_s3_bucket_server_side_encryption_configuration.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | +| [aws_s3_bucket_versioning.origin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_versioning) | resource | | [random_password.referer](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | | [time_sleep.wait_for_aws_s3_bucket_settings](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource | | [aws_iam_policy_document.combined](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | @@ -60,6 +64,7 @@ | [allowed\_methods](#input\_allowed\_methods) | List of allowed methods (e.g. GET, PUT, POST, DELETE, HEAD) for AWS CloudFront | `list(string)` | 
[
  "DELETE",
  "GET",
  "HEAD",
  "OPTIONS",
  "PATCH",
  "POST",
  "PUT"
]
| no | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | | [block\_origin\_public\_access\_enabled](#input\_block\_origin\_public\_access\_enabled) | When set to 'true' the s3 origin bucket will have public access block enabled | `bool` | `false` | no | +| [bucket\_versioning](#input\_bucket\_versioning) | State of bucket versioning option | `string` | `"Disabled"` | no | | [cache\_policy\_id](#input\_cache\_policy\_id) | The unique identifier of the existing cache policy to attach to the default cache behavior.
If not provided, this module will add a default cache policy using other provided inputs. | `string` | `null` | no | | [cached\_methods](#input\_cached\_methods) | List of cached methods (e.g. GET, PUT, POST, DELETE, HEAD) | `list(string)` | 
[
  "GET",
  "HEAD"
]
| no | | [cloudfront\_access\_log\_bucket\_name](#input\_cloudfront\_access\_log\_bucket\_name) | When `cloudfront_access_log_create_bucket` is `false`, this is the name of the existing S3 Bucket where
Cloudfront Access Logs are to be delivered and is required. IGNORED when `cloudfront_access_log_create_bucket` is `true`. | `string` | `""` | no | @@ -124,7 +129,7 @@ | [minimum\_protocol\_version](#input\_minimum\_protocol\_version) | Cloudfront TLS minimum protocol version.
If `var.acm_certificate_arn` is unset, only "TLSv1" can be specified. See: [AWS Cloudfront create-distribution documentation](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/create-distribution.html)
and [Supported protocols and ciphers between viewers and CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers) for more information.
Defaults to "TLSv1.2\_2019" unless `var.acm_certificate_arn` is unset, in which case it defaults to `TLSv1` | `string` | `""` | no | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | -| [ordered\_cache](#input\_ordered\_cache) | An ordered list of [cache behaviors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#cache-behavior-arguments) resource for this distribution.
List in order of precedence (first match wins). This is in addition to the default cache policy.
Set `target_origin_id` to `""` to specify the S3 bucket origin created by this module. | 
list(object({
    target_origin_id = string
    path_pattern     = string

    allowed_methods    = list(string)
    cached_methods     = list(string)
    compress           = bool
    trusted_signers    = list(string)
    trusted_key_groups = list(string)

    cache_policy_id          = string
    origin_request_policy_id = string

    viewer_protocol_policy     = string
    min_ttl                    = number
    default_ttl                = number
    max_ttl                    = number
    response_headers_policy_id = string

    forward_query_string              = bool
    forward_header_values             = list(string)
    forward_cookies                   = string
    forward_cookies_whitelisted_names = list(string)

    lambda_function_association = list(object({
      event_type   = string
      include_body = bool
      lambda_arn   = string
    }))

    function_association = list(object({
      event_type   = string
      function_arn = string
    }))
  }))
| `[]` | no | +| [ordered\_cache](#input\_ordered\_cache) | An ordered list of [cache behaviors](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#cache-behavior-arguments) resource for this distribution.
List in order of precedence (first match wins). This is in addition to the default cache policy.
Set `target_origin_id` to `""` to specify the S3 bucket origin created by this module. | 
list(object({
    target_origin_id = string
    path_pattern     = string

    allowed_methods    = list(string)
    cached_methods     = list(string)
    compress           = bool
    trusted_signers    = list(string)
    trusted_key_groups = list(string)

    cache_policy_id          = string
    origin_request_policy_id = string
    realtime_log_config_arn  = optional(string)

    viewer_protocol_policy     = string
    min_ttl                    = number
    default_ttl                = number
    max_ttl                    = number
    response_headers_policy_id = string

    forward_query_string              = bool
    forward_header_values             = list(string)
    forward_cookies                   = string
    forward_cookies_whitelisted_names = list(string)

    lambda_function_association = list(object({
      event_type   = string
      include_body = bool
      lambda_arn   = string
    }))

    function_association = list(object({
      event_type   = string
      function_arn = string
    }))
  }))
| `[]` | no | | [origin\_bucket](#input\_origin\_bucket) | Name of an existing S3 bucket to use as the origin. If this is not provided, it will create a new s3 bucket using `var.name` and other context related inputs | `string` | `null` | no | | [origin\_force\_destroy](#input\_origin\_force\_destroy) | Delete all objects from the bucket so that the bucket can be destroyed without error (e.g. `true` or `false`) | `bool` | `false` | no | | [origin\_groups](#input\_origin\_groups) | List of [Origin Groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#origin-group-arguments) to create in the distribution.
The values of `primary_origin_id` and `failover_origin_id` must correspond to origin IDs existing in `var.s3_origins` or `var.custom_origins`.

If `primary_origin_id` is set to `null` or `""`, then the origin id of the origin created by this module will be used in its place.
This is to allow for the use case of making the origin created by this module the primary origin in an origin group. | 
list(object({
    group_id           = optional(string)
    primary_origin_id  = string
    failover_origin_id = string
    failover_criteria  = list(string)
  }))
| `[]` | no | diff --git a/main.tf b/main.tf index ba1afcce..c534ce87 100644 --- a/main.tf +++ b/main.tf @@ -254,26 +254,9 @@ resource "aws_s3_bucket" "origin" { count = local.create_s3_origin_bucket ? 1 : 0 bucket = module.origin_label.id - acl = "private" tags = module.origin_label.tags force_destroy = var.origin_force_destroy - dynamic "server_side_encryption_configuration" { - for_each = var.encryption_enabled ? ["true"] : [] - - content { - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "AES256" - } - } - } - } - - versioning { - enabled = var.versioning_enabled - } - dynamic "logging" { for_each = local.s3_access_logging_enabled ? [1] : [] content { @@ -291,6 +274,35 @@ resource "aws_s3_bucket" "origin" { routing_rules = lookup(website.value, "routing_rules", null) } } +} + + +resource "aws_s3_bucket_versioning" "origin" { + count = local.create_s3_origin_bucket ? 1 : 0 + + bucket = one(aws_s3_bucket.origin).id + + versioning_configuration { + status = var.bucket_versioning + } +} + +resource "aws_s3_bucket_server_side_encryption_configuration" "origin" { + count = var.encryption_enabled && local.create_s3_origin_bucket ? 1 : 0 + + bucket = one(aws_s3_bucket.origin).id + + rule { + apply_server_side_encryption_by_default { + sse_algorithm = "AES256" + } + } +} + +resource "aws_s3_bucket_cors_configuration" "origin" { + count = local.create_s3_origin_bucket ? 1 : 0 + + bucket = one(aws_s3_bucket.origin).id dynamic "cors_rule" { for_each = distinct(compact(concat(var.cors_allowed_origins, var.aliases, var.external_aliases))) @@ -304,6 +316,15 @@ resource "aws_s3_bucket" "origin" { } } +resource "aws_s3_bucket_acl" "origin" { + depends_on = [aws_s3_bucket_ownership_controls.origin] + count = local.create_s3_origin_bucket && var.s3_object_ownership != "BucketOwnerEnforced" ? 1 : 0 + + bucket = one(aws_s3_bucket.origin).id + acl = "private" +} + + resource "aws_s3_bucket_public_access_block" "origin" { count = (local.create_s3_origin_bucket || local.override_origin_bucket_policy) ? 1 : 0 @@ -584,6 +605,7 @@ resource "aws_cloudfront_distribution" "default" { cache_policy_id = ordered_cache_behavior.value.cache_policy_id origin_request_policy_id = ordered_cache_behavior.value.origin_request_policy_id + realtime_log_config_arn = ordered_cache_behavior.value.realtime_log_config_arn dynamic "forwarded_values" { # If a cache policy or origin request policy is specified, we cannot include a `forwarded_values` block at all in the API request diff --git a/modules/lambda@edge/main.tf b/modules/lambda@edge/main.tf index c5187667..985ecf7a 100644 --- a/modules/lambda@edge/main.tf +++ b/modules/lambda@edge/main.tf @@ -48,7 +48,7 @@ module "role" { for_each = local.functions source = "cloudposse/iam-role/aws" - version = "0.16.0" + version = "0.19.0" use_fullname = true policy_description = "Allow ${module.function_label[each.key].id} Lambda function to write to CloudWatch Logs" diff --git a/variables.tf b/variables.tf index 2d546dd9..dfc7779a 100644 --- a/variables.tf +++ b/variables.tf @@ -393,6 +393,7 @@ variable "ordered_cache" { cache_policy_id = string origin_request_policy_id = string + realtime_log_config_arn = optional(string) viewer_protocol_policy = string min_ttl = number @@ -688,4 +689,15 @@ variable "http_version" { type = string default = "http2" description = "The maximum HTTP version to support on the distribution. Allowed values are http1.1, http2, http2and3 and http3" -} \ No newline at end of file +} + +variable "bucket_versioning" { + type = string + default = "Disabled" + description = "State of bucket versioning option" + + validation { + condition = contains(["Enabled", "Disabled", "Suspended"], var.bucket_versioning) + error_message = "Please choose one of 'Enabled', 'Disabled', or 'Suspended'" + } +}