-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcloudfront.tf
119 lines (96 loc) · 3.11 KB
/
cloudfront.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
resource "aws_cloudfront_distribution" "distribution" {
enabled = true
aliases = [var.domain_name]
price_class = "PriceClass_100"
origin {
domain_name = "${aws_s3_bucket.website.id}.${aws_s3_bucket.website.website_domain}"
origin_id = local.s3_origin_id
connection_attempts = 3
connection_timeout = 10
custom_header {
name = "referer"
value = random_password.referer.result
}
custom_origin_config {
http_port = 80
https_port = 443
origin_protocol_policy = "http-only"
origin_ssl_protocols = ["TLSv1.1", "TLSv1.2"]
}
}
default_cache_behavior {
allowed_methods = ["GET", "HEAD"]
cached_methods = ["GET", "HEAD"]
target_origin_id = local.s3_origin_id
compress = true
response_headers_policy_id = data.aws_cloudfront_response_headers_policy.security_headers_policy.id
cache_policy_id = data.aws_cloudfront_cache_policy.caching_optimized.id
viewer_protocol_policy = "redirect-to-https"
}
restrictions {
geo_restriction {
restriction_type = "none"
locations = []
}
}
custom_error_response {
error_code = 404
response_code = 404
response_page_path = "/404.html"
}
viewer_certificate {
acm_certificate_arn = var.acm_certificate_arn
ssl_support_method = "sni-only"
minimum_protocol_version = "TLSv1.2_2021"
}
}
resource "aws_cloudfront_distribution" "redirect_distribution" {
enabled = true
aliases = [var.redirect_domain_name]
price_class = "PriceClass_100"
origin {
domain_name = "${aws_s3_bucket.redirect.id}.${aws_s3_bucket.redirect.website_domain}"
origin_id = local.s3_redirect_origin_id
connection_attempts = 3
connection_timeout = 10
custom_header {
name = "referer"
value = random_password.referer.result
}
custom_origin_config {
http_port = 80
https_port = 443
origin_protocol_policy = "http-only"
origin_ssl_protocols = ["TLSv1.1", "TLSv1.2"]
}
}
default_cache_behavior {
allowed_methods = ["GET", "HEAD"]
cached_methods = ["GET", "HEAD"]
target_origin_id = local.s3_redirect_origin_id
compress = true
response_headers_policy_id = data.aws_cloudfront_response_headers_policy.security_headers_policy.id
cache_policy_id = data.aws_cloudfront_cache_policy.caching_optimized.id
viewer_protocol_policy = "redirect-to-https"
}
restrictions {
geo_restriction {
restriction_type = "none"
locations = []
}
}
viewer_certificate {
acm_certificate_arn = var.acm_certificate_arn
ssl_support_method = "sni-only"
minimum_protocol_version = "TLSv1.2_2021"
}
}
resource "aws_cloudfront_origin_access_identity" "blog" {
comment = "blog-website-bucket"
}
data "aws_cloudfront_response_headers_policy" "security_headers_policy" {
name = "Managed-SecurityHeadersPolicy"
}
data "aws_cloudfront_cache_policy" "caching_optimized" {
name = "Managed-CachingOptimized"
}