From cd22dc6e8c28712efe70e1da3276b4b90ee4f2b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Szostek?= Date: Thu, 2 Dec 2021 18:05:26 +0000 Subject: [PATCH] feat: add origin_request_policy_id variable for default cache behavior (#193) * feat: add origin_request_policy_id variable for default cache behavior * Auto Format Co-authored-by: cloudpossebot <11232728+cloudpossebot@users.noreply.github.com> --- README.md | 1 + docs/terraform.md | 1 + main.tf | 6 ++++-- variables.tf | 9 +++++++++ 4 files changed, 15 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6bb64f65..051e8c32 100644 --- a/README.md +++ b/README.md @@ -480,6 +480,7 @@ Available targets: | [origin\_force\_destroy](#input\_origin\_force\_destroy) | Delete all objects from the bucket so that the bucket can be destroyed without error (e.g. `true` or `false`) | `bool` | `false` | no | | [origin\_groups](#input\_origin\_groups) | List of [Origin Groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#origin-group-arguments) to create in the distribution.
The values of `primary_origin_id` and `failover_origin_id` must correspond to origin IDs existing in `var.s3_origins` or `var.custom_origins`.

If `primary_origin_id` is set to `null` or `""`, then the origin id of the origin created by this module will be used in its place.
This is to allow for the use case of making the origin created by this module the primary origin in an origin group. | 
list(object({
    primary_origin_id  = string
    failover_origin_id = string
    failover_criteria  = list(string)
  }))
| `[]` | no | | [origin\_path](#input\_origin\_path) | An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin. It must begin with a /. Do not add a / at the end of the path. | `string` | `""` | no | +| [origin\_request\_policy\_id](#input\_origin\_request\_policy\_id) | The unique identifier of the origin request policy that is attached to the behavior.
Should be used in conjunction with `cache_policy_id`. | `string` | `null` | no | | [origin\_ssl\_protocols](#input\_origin\_ssl\_protocols) | The SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. | `list(string)` | 
[
  "TLSv1",
  "TLSv1.1",
  "TLSv1.2"
]
| no | | [override\_origin\_bucket\_policy](#input\_override\_origin\_bucket\_policy) | When using an existing origin bucket (through var.origin\_bucket), setting this to 'false' will make it so the existing bucket policy will not be overriden | `bool` | `true` | no | | [parent\_zone\_id](#input\_parent\_zone\_id) | ID of the hosted zone to contain this record (or specify `parent_zone_name`). Requires `dns_alias_enabled` set to true | `string` | `""` | no | diff --git a/docs/terraform.md b/docs/terraform.md index 18ebc09e..c76f7c1f 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -119,6 +119,7 @@ | [origin\_force\_destroy](#input\_origin\_force\_destroy) | Delete all objects from the bucket so that the bucket can be destroyed without error (e.g. `true` or `false`) | `bool` | `false` | no | | [origin\_groups](#input\_origin\_groups) | List of [Origin Groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#origin-group-arguments) to create in the distribution.
The values of `primary_origin_id` and `failover_origin_id` must correspond to origin IDs existing in `var.s3_origins` or `var.custom_origins`.

If `primary_origin_id` is set to `null` or `""`, then the origin id of the origin created by this module will be used in its place.
This is to allow for the use case of making the origin created by this module the primary origin in an origin group. | 
list(object({
    primary_origin_id  = string
    failover_origin_id = string
    failover_criteria  = list(string)
  }))
| `[]` | no | | [origin\_path](#input\_origin\_path) | An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin. It must begin with a /. Do not add a / at the end of the path. | `string` | `""` | no | +| [origin\_request\_policy\_id](#input\_origin\_request\_policy\_id) | The unique identifier of the origin request policy that is attached to the behavior.
Should be used in conjunction with `cache_policy_id`. | `string` | `null` | no | | [origin\_ssl\_protocols](#input\_origin\_ssl\_protocols) | The SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. | `list(string)` | 
[
  "TLSv1",
  "TLSv1.1",
  "TLSv1.2"
]
| no | | [override\_origin\_bucket\_policy](#input\_override\_origin\_bucket\_policy) | When using an existing origin bucket (through var.origin\_bucket), setting this to 'false' will make it so the existing bucket policy will not be overriden | `bool` | `true` | no | | [parent\_zone\_id](#input\_parent\_zone\_id) | ID of the hosted zone to contain this record (or specify `parent_zone_name`). Requires `dns_alias_enabled` set to true | `string` | `""` | no | diff --git a/main.tf b/main.tf index 702790ff..73c70ddc 100644 --- a/main.tf +++ b/main.tf @@ -440,6 +440,7 @@ resource "aws_cloudfront_distribution" "default" { allowed_methods = var.allowed_methods cached_methods = var.cached_methods cache_policy_id = var.cache_policy_id + origin_request_policy_id = var.origin_request_policy_id target_origin_id = local.origin_id compress = var.compress trusted_signers = var.trusted_signers @@ -447,8 +448,9 @@ resource "aws_cloudfront_distribution" "default" { response_headers_policy_id = var.response_headers_policy_id dynamic "forwarded_values" { - # If a cache policy is specified, we cannot include a `forwarded_values` block at all in the API request - for_each = var.cache_policy_id == null ? [true] : [] + # If a cache policy or origin request policy is specified, + # we cannot include a `forwarded_values` block at all in the API request. + for_each = (var.cache_policy_id == null && var.origin_request_policy_id == null) ? [true] : [] content { query_string = var.forward_query_string query_string_cache_keys = var.query_string_cache_keys diff --git a/variables.tf b/variables.tf index 48608246..4f75899b 100644 --- a/variables.tf +++ b/variables.tf @@ -208,6 +208,15 @@ variable "cache_policy_id" { EOT } +variable "origin_request_policy_id" { + type = string + default = null + description = <<-EOT + The unique identifier of the origin request policy that is attached to the behavior. + Should be used in conjunction with `cache_policy_id`. + EOT +} + variable "default_ttl" { type = number default = 60