├── .github ├── ISSUE_TEMPLATE │ ├── question.md │ ├── config.yml │ ├── bug_report.md │ ├── feature_request.md │ ├── bug_report.yml │ └── feature_request.yml ├── mergify.yml ├── banner.png ├── workflows │ ├── release.yml │ ├── scheduled.yml │ ├── chatops.yml │ └── branch.yml ├── renovate.json ├── settings.yml ├── PULL_REQUEST_TEMPLATE.md └── CODEOWNERS ├── test ├── src │ ├── .gitignore │ ├── Makefile │ ├── examples_complete_test.go │ ├── go.mod │ └── go.sum ├── .gitignore ├── Makefile.alpine └── Makefile ├── examples ├── multi-origin │ ├── fixtures.us-east-2.tfvars │ ├── versions.tf │ ├── variables.tf │ ├── main.tf │ └── context.tf ├── s3 │ ├── fixtures.us-east-2.tfvars │ ├── versions.tf │ ├── variables.tf │ ├── main.tf │ └── context.tf ├── wordpress │ ├── versions.tf │ ├── main.tf │ └── context.tf └── complete │ ├── versions.tf │ ├── main.tf │ ├── fixtures.us-east-2.tfvars │ ├── outputs.tf │ ├── variables.tf │ └── context.tf ├── .gitignore ├── versions.tf ├── atmos.yaml ├── outputs.tf ├── README.yaml ├── context.tf ├── LICENSE ├── main.tf ├── variables.tf └── README.md /.github/ISSUE_TEMPLATE/question.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.github/mergify.yml: -------------------------------------------------------------------------------- 1 | extends: .github 2 | -------------------------------------------------------------------------------- /test/src/.gitignore: -------------------------------------------------------------------------------- 1 | .gopath 2 | vendor/ 3 | -------------------------------------------------------------------------------- /.github/banner.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/cloudposse/terraform-aws-cloudfront-cdn/HEAD/.github/banner.png -------------------------------------------------------------------------------- /test/.gitignore: -------------------------------------------------------------------------------- 1 | # Compiled files 2 | *.tfstate 3 | *.tfstate.backup 4 | 5 | # Module directory 6 | .terraform 7 | .idea 8 | *.iml 9 | 10 | .build-harness 11 | build-harness -------------------------------------------------------------------------------- /test/Makefile.alpine: -------------------------------------------------------------------------------- 1 | ifneq (,$(wildcard /sbin/apk)) 2 | ## Install all dependencies for alpine 3 | deps:: init 4 | @apk add --update terraform-docs@cloudposse json2hcl@cloudposse 5 | endif 6 | -------------------------------------------------------------------------------- /examples/multi-origin/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | region = "us-east-2" 2 | 3 | namespace = "eg" 4 | 5 | stage = "test" 6 | 7 | name = "cdn" 8 | 9 | origin_domain_name = "origin.example.com" 10 | -------------------------------------------------------------------------------- /examples/s3/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | region = "us-east-2" 2 | 3 | namespace = "eg" 4 | 5 | stage = "test" 6 | 7 | name = "cdn" 8 | 9 | origin_domain_name = "example.s3.us-east-2.amazonaws.com" 10 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Compiled files 2 | *.tfstate 3 | *.tfstate.backup 4 | 5 | # Module directory 6 | .terraform 7 | .idea 8 | *.iml 9 | 10 | **/.build-harness 11 | **/build-harness 12 | .terraform.lock.hcl 13 | -------------------------------------------------------------------------------- /examples/s3/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 5.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /examples/wordpress/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 5.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /examples/multi-origin/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 5.0" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 4.9.0" 8 | } 9 | local = { 10 | source = "hashicorp/local" 11 | version = ">= 1.2" 12 | } 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 1.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 5.0" 8 | } 9 | local = { 10 | source = "hashicorp/local" 11 | version = ">= 1.2" 12 | } 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /examples/complete/main.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } 4 | 5 | module "cdn" { 6 | source = "../../" 7 | 8 | aliases = var.aliases 9 | origin_domain_name = var.origin_domain_name 10 | parent_zone_name = var.parent_zone_name 11 | log_force_destroy = true 12 | 13 | context = module.this.context 14 | } 15 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: release 3 | on: 4 | release: 5 | types: 6 | - published 7 | 8 | permissions: 9 | id-token: write 10 | contents: write 11 | pull-requests: write 12 | 13 | jobs: 14 | terraform-module: 15 | uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /examples/complete/fixtures.us-east-2.tfvars: -------------------------------------------------------------------------------- 1 | enabled = true 2 | 3 | region = "us-east-2" 4 | 5 | namespace = "eg" 6 | 7 | stage = "test" 8 | 9 | name = "cdn" 10 | 11 | dns_aliases_enabled = false 12 | 13 | aliases = [] 14 | 15 | origin_domain_name = "example.com" 16 | 17 | parent_zone_name = "testing.cloudposse.co" 18 | 19 | http_version = "http2and3" 20 | -------------------------------------------------------------------------------- /.github/renovate.json: -------------------------------------------------------------------------------- 1 | { 2 | "extends": [ 3 | "config:base", 4 | ":preserveSemverRanges" 5 | ], 6 | "baseBranches": ["main", "master", "/^release\\/v\\d{1,2}$/"], 7 | "labels": ["auto-update"], 8 | "dependencyDashboardAutoclose": true, 9 | "enabledManagers": ["terraform"], 10 | "terraform": { 11 | "ignorePaths": ["**/context.tf", "examples/**"] 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /.github/workflows/scheduled.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: scheduled 3 | on: 4 | workflow_dispatch: { } # Allows manually trigger this workflow 5 | schedule: 6 | - cron: "0 3 * * *" 7 | 8 | permissions: 9 | pull-requests: write 10 | id-token: write 11 | contents: write 12 | 13 | jobs: 14 | scheduled: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-scheduled.yml@main 16 | secrets: inherit 17 | -------------------------------------------------------------------------------- /.github/settings.yml: -------------------------------------------------------------------------------- 1 | # Upstream changes from _extends are only recognized when modifications are made to this file in the default branch. 2 | _extends: .github 3 | repository: 4 | name: terraform-aws-cloudfront-cdn 5 | description: 'Terraform Module that implements a CloudFront Distribution (CDN) for a custom origin. ' 6 | homepage: https://cloudposse.com/accelerate 7 | topics: cdn, bucket, aws, terraform, terraform-module, cloudfront 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /.github/workflows/chatops.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: chatops 3 | on: 4 | issue_comment: 5 | types: [created] 6 | 7 | permissions: 8 | pull-requests: write 9 | id-token: write 10 | contents: write 11 | statuses: write 12 | 13 | jobs: 14 | test: 15 | uses: cloudposse/.github/.github/workflows/shared-terraform-chatops.yml@main 16 | if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/terratest') }} 17 | secrets: inherit 18 | -------------------------------------------------------------------------------- /examples/multi-origin/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS region" 4 | } 5 | 6 | variable "origin_domain_name" { 7 | type = string 8 | description = "(Required) - The DNS domain name of your custom origin (e.g. website)" 9 | default = "" 10 | } 11 | 12 | variable "logging_enabled" { 13 | type = bool 14 | default = false 15 | description = "When true, access logs will be sent to a newly created s3 bucket" 16 | } 17 | -------------------------------------------------------------------------------- /atmos.yaml: -------------------------------------------------------------------------------- 1 | # Atmos Configuration — powered by https://atmos.tools 2 | # 3 | # This configuration enables centralized, DRY, and consistent project scaffolding using Atmos. 4 | # 5 | # Included features: 6 | # - Organizational custom commands: https://atmos.tools/core-concepts/custom-commands 7 | # - Automated README generation: https://atmos.tools/cli/commands/docs/generate 8 | # 9 | 10 | # Import shared configuration used by all modules 11 | import: 12 | - https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml 13 | -------------------------------------------------------------------------------- /.github/workflows/branch.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Branch 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - release/** 8 | types: [opened, synchronize, reopened, labeled, unlabeled] 9 | push: 10 | branches: 11 | - main 12 | - release/v* 13 | paths-ignore: 14 | - '.github/**' 15 | - 'docs/**' 16 | - 'examples/**' 17 | - 'test/**' 18 | - 'README.md' 19 | 20 | permissions: {} 21 | 22 | jobs: 23 | terraform-module: 24 | uses: cloudposse/.github/.github/workflows/shared-terraform-module.yml@main 25 | secrets: inherit 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: false 2 | 3 | contact_links: 4 | 5 | - name: Community Slack Team 6 | url: https://cloudposse.com/slack/ 7 | about: |- 8 | Please ask and answer questions here. 9 | 10 | - name: Office Hours 11 | url: https://cloudposse.com/office-hours/ 12 | about: |- 13 | Join us every Wednesday for FREE Office Hours (lunch & learn). 14 | 15 | - name: DevOps Accelerator Program 16 | url: https://cloudposse.com/accelerate/ 17 | about: |- 18 | Own your infrastructure in record time. We build it. You drive it. 19 | -------------------------------------------------------------------------------- /examples/s3/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS region" 4 | } 5 | 6 | variable "origin_domain_name" { 7 | type = string 8 | description = "(Required) - The DNS domain name of your custom origin (e.g. website)" 9 | default = "" 10 | } 11 | 12 | variable "origin_type" { 13 | type = string 14 | default = "s3" 15 | description = "The type of origin configuration to use. Valid values are 'custom' or 's3'." 16 | } 17 | 18 | variable "logging_enabled" { 19 | type = bool 20 | default = false 21 | description = "When true, access logs will be sent to a newly created s3 bucket" 22 | } 23 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | ## what 2 | 3 | 7 | 8 | ## why 9 | 10 | 15 | 16 | ## references 17 | 18 | 22 | -------------------------------------------------------------------------------- /test/src/Makefile: -------------------------------------------------------------------------------- 1 | export TERRAFORM_VERSION ?= $(shell curl -s https://checkpoint-api.hashicorp.com/v1/check/terraform | jq -r -M '.current_version' | cut -d. -f1) 2 | 3 | .DEFAULT_GOAL : all 4 | 5 | .PHONY: all 6 | ## Default target 7 | all: test 8 | 9 | .PHONY : init 10 | ## Initialize tests 11 | init: 12 | @exit 0 13 | 14 | .PHONY : test 15 | ## Run tests 16 | test: init 17 | go mod download 18 | go test -v -timeout 60m -run TestExamplesComplete 19 | 20 | ## Run tests in docker container 21 | docker/test: 22 | docker run --name terratest --rm -it -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e GITHUB_TOKEN \ 23 | -e PATH="/usr/local/terraform/$(TERRAFORM_VERSION)/bin:/go/bin:/usr/local/go/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \ 24 | -v $(CURDIR)/../../:/module/ cloudposse/test-harness:latest -C /module/test/src test 25 | 26 | .PHONY : clean 27 | ## Clean up files 28 | clean: 29 | rm -rf ../../examples/complete/*.tfstate* 30 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: 'bug' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Found a bug? Maybe our [Slack Community](https://slack.cloudposse.com) can help. 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Bug 15 | A clear and concise description of what the bug is. 16 | 17 | ## Expected Behavior 18 | A clear and concise description of what you expected to happen. 19 | 20 | ## Steps to Reproduce 21 | Steps to reproduce the behavior: 22 | 1. Go to '...' 23 | 2. Run '....' 24 | 3. Enter '....' 25 | 4. See error 26 | 27 | ## Screenshots 28 | If applicable, add screenshots or logs to help explain your problem. 29 | 30 | ## Environment (please complete the following information): 31 | 32 | Anything that will help us triage the bug will help. Here are some ideas: 33 | - OS: [e.g. Linux, OSX, WSL, etc] 34 | - Version [e.g. 10.15] 35 | 36 | ## Additional Context 37 | Add any other context about the problem here. -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "cf_id" { 2 | value = module.cdn.cf_id 3 | description = "ID of CloudFront distribution" 4 | } 5 | 6 | output "cf_arn" { 7 | value = module.cdn.cf_arn 8 | description = "ARN of CloudFront distribution" 9 | } 10 | 11 | output "cf_aliases" { 12 | value = var.aliases 13 | description = "Extra CNAMEs of AWS CloudFront" 14 | } 15 | 16 | output "cf_status" { 17 | value = module.cdn.cf_status 18 | description = "Current status of the distribution" 19 | } 20 | 21 | output "cf_domain_name" { 22 | value = module.cdn.cf_domain_name 23 | description = "Domain name corresponding to the distribution" 24 | } 25 | 26 | output "cf_etag" { 27 | value = module.cdn.cf_etag 28 | description = "Current version of the distribution's information" 29 | } 30 | 31 | output "cf_hosted_zone_id" { 32 | value = module.cdn.cf_hosted_zone_id 33 | description = "CloudFront Route 53 Zone ID" 34 | } 35 | 36 | output "cf_origin_access_identity" { 37 | value = module.cdn.cf_origin_access_identity 38 | description = "A shortcut to the full path for the origin access identity to use in CloudFront" 39 | } 40 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: 'feature request' 6 | assignees: '' 7 | 8 | --- 9 | 10 | Have a question? Please checkout our [Slack Community](https://slack.cloudposse.com) or visit our [Slack Archive](https://archive.sweetops.com/). 11 | 12 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 13 | 14 | ## Describe the Feature 15 | 16 | A clear and concise description of what the bug is. 17 | 18 | ## Expected Behavior 19 | 20 | A clear and concise description of what you expected to happen. 21 | 22 | ## Use Case 23 | 24 | Is your feature request related to a problem/challenge you are trying to solve? Please provide some additional context of why this feature or capability will be valuable. 25 | 26 | ## Describe Ideal Solution 27 | 28 | A clear and concise description of what you want to happen. If you don't know, that's okay. 29 | 30 | ## Alternatives Considered 31 | 32 | Explain what alternative solutions or features you've considered. 33 | 34 | ## Additional Context 35 | 36 | Add any other context or screenshots about the feature request here. 37 | -------------------------------------------------------------------------------- /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Use this file to define individuals or teams that are responsible for code in a repository. 2 | # Read more: 3 | # 4 | # Order is important: the last matching pattern has the highest precedence 5 | 6 | # These owners will be the default owners for everything 7 | * @cloudposse/engineering @cloudposse/contributors 8 | 9 | # Cloud Posse must review any changes to Makefiles 10 | **/Makefile @cloudposse/engineering 11 | **/Makefile.* @cloudposse/engineering 12 | 13 | # Cloud Posse must review any changes to GitHub actions 14 | .github/* @cloudposse/engineering 15 | 16 | # Cloud Posse must review any changes to standard context definition, 17 | # but some changes can be rubber-stamped. 18 | **/*.tf @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 19 | README.yaml @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 20 | README.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 21 | docs/*.md @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers 22 | 23 | # Cloud Posse Admins must review all changes to CODEOWNERS or the mergify configuration 24 | .github/mergify.yml @cloudposse/admins 25 | .github/CODEOWNERS @cloudposse/admins 26 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | output "cf_id" { 2 | value = try(aws_cloudfront_distribution.default[0].id, "") 3 | description = "ID of CloudFront distribution" 4 | } 5 | 6 | output "cf_arn" { 7 | value = try(aws_cloudfront_distribution.default[0].arn, "") 8 | description = "ARN of CloudFront distribution" 9 | } 10 | 11 | output "cf_aliases" { 12 | value = var.aliases 13 | description = "Extra CNAMEs of AWS CloudFront" 14 | } 15 | 16 | output "cf_status" { 17 | value = try(aws_cloudfront_distribution.default[0].status, "") 18 | description = "Current status of the distribution" 19 | } 20 | 21 | output "cf_domain_name" { 22 | value = try(aws_cloudfront_distribution.default[0].domain_name, "") 23 | description = "Domain name corresponding to the distribution" 24 | } 25 | 26 | output "cf_etag" { 27 | value = try(aws_cloudfront_distribution.default[0].etag, "") 28 | description = "Current version of the distribution's information" 29 | } 30 | 31 | output "cf_hosted_zone_id" { 32 | value = try(aws_cloudfront_distribution.default[0].hosted_zone_id, "") 33 | description = "CloudFront Route 53 Zone ID" 34 | } 35 | 36 | output "cf_origin_access_identity" { 37 | value = try(aws_cloudfront_origin_access_identity.default[0].cloudfront_access_identity_path, "") 38 | description = "A shortcut to the full path for the origin access identity to use in CloudFront" 39 | } 40 | 41 | output "logs" { 42 | value = module.logs 43 | description = "Logs resource" 44 | } 45 | -------------------------------------------------------------------------------- /test/Makefile: -------------------------------------------------------------------------------- 1 | TEST_HARNESS ?= https://github.com/cloudposse/test-harness.git 2 | TEST_HARNESS_BRANCH ?= master 3 | TEST_HARNESS_PATH = $(realpath .test-harness) 4 | BATS_ARGS ?= --tap 5 | BATS_LOG ?= test.log 6 | 7 | # Define a macro to run the tests 8 | define RUN_TESTS 9 | @echo "Running tests in $(1)" 10 | @cd $(1) && bats $(BATS_ARGS) $(addsuffix .bats,$(addprefix $(TEST_HARNESS_PATH)/test/terraform/,$(TESTS))) 11 | endef 12 | 13 | default: all 14 | 15 | -include Makefile.* 16 | 17 | ## Provision the test-harnesss 18 | .test-harness: 19 | [ -d $@ ] || git clone --depth=1 -b $(TEST_HARNESS_BRANCH) $(TEST_HARNESS) $@ 20 | 21 | ## Initialize the tests 22 | init: .test-harness 23 | 24 | ## Install all dependencies (OS specific) 25 | deps:: 26 | @exit 0 27 | 28 | ## Clean up the test harness 29 | clean: 30 | [ "$(TEST_HARNESS_PATH)" == "/" ] || rm -rf $(TEST_HARNESS_PATH) 31 | 32 | ## Run all tests 33 | all: module examples/complete 34 | 35 | ## Run basic sanity checks against the module itself 36 | # Disable provider-pinning check because we know this version does not support AWS v4 37 | module: export TESTS ?= installed lint module-pinning validate terraform-docs input-descriptions output-descriptions 38 | # module: export TESTS ?= installed lint module-pinning provider-pinning validate terraform-docs input-descriptions output-descriptions 39 | module: deps 40 | $(call RUN_TESTS, ../) 41 | 42 | ## Run tests against example 43 | examples/complete: export TESTS ?= installed lint validate 44 | examples/complete: deps 45 | $(call RUN_TESTS, ../$@) 46 | -------------------------------------------------------------------------------- /examples/s3/main.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } 4 | 5 | resource "aws_cloudfront_origin_access_control" "oac" { 6 | name = "custom-oac" 7 | origin_access_control_origin_type = "s3" 8 | signing_behavior = "always" 9 | signing_protocol = "sigv4" 10 | } 11 | 12 | resource "aws_cloudfront_origin_access_identity" "oai" { 13 | comment = "custom-oai" 14 | } 15 | 16 | # Public S3 endpoint without any OAI/OAC 17 | module "s3_plain" { 18 | source = "../../" 19 | 20 | origin_domain_name = var.origin_domain_name 21 | origin_type = "custom" 22 | 23 | logging_enabled = var.logging_enabled 24 | context = module.this.context 25 | } 26 | 27 | module "s3_oac" { 28 | source = "../../" 29 | 30 | origin_domain_name = var.origin_domain_name 31 | origin_type = var.origin_type 32 | origin_access_control_id = aws_cloudfront_origin_access_control.oac.id 33 | 34 | logging_enabled = var.logging_enabled 35 | context = module.this.context 36 | } 37 | 38 | module "s3_oai_default" { 39 | source = "../../" 40 | 41 | origin_domain_name = var.origin_domain_name 42 | origin_type = var.origin_type 43 | 44 | logging_enabled = var.logging_enabled 45 | context = module.this.context 46 | } 47 | 48 | module "s3_oai_custom" { 49 | source = "../../" 50 | 51 | origin_domain_name = var.origin_domain_name 52 | origin_type = var.origin_type 53 | s3_origin_config = { 54 | origin_access_identity = aws_cloudfront_origin_access_identity.oai.cloudfront_access_identity_path 55 | } 56 | 57 | logging_enabled = var.logging_enabled 58 | context = module.this.context 59 | } 60 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | description: Create a report to help us improve 4 | labels: ["bug"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Found a bug? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Bug 21 | description: A clear and concise description of what the bug is. 22 | placeholder: What is the bug about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: reproduction-steps 37 | attributes: 38 | label: Steps to Reproduce 39 | description: Steps to reproduce the behavior. 40 | placeholder: How do we reproduce it? 41 | validations: 42 | required: true 43 | 44 | - type: textarea 45 | id: screenshots 46 | attributes: 47 | label: Screenshots 48 | description: If applicable, add screenshots or logs to help explain. 49 | validations: 50 | required: false 51 | 52 | - type: textarea 53 | id: environment 54 | attributes: 55 | label: Environment 56 | description: Anything that will help us triage the bug. 57 | placeholder: | 58 | - OS: [e.g. Linux, OSX, WSL, etc] 59 | - Version [e.g. 10.15] 60 | - Module version 61 | - Terraform version 62 | validations: 63 | required: false 64 | 65 | - type: textarea 66 | id: additional 67 | attributes: 68 | label: Additional Context 69 | description: | 70 | Add any other context about the problem here. 71 | validations: 72 | required: false 73 | -------------------------------------------------------------------------------- /test/src/examples_complete_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "os" 5 | "strings" 6 | "testing" 7 | 8 | "github.com/gruntwork-io/terratest/modules/random" 9 | "github.com/gruntwork-io/terratest/modules/terraform" 10 | test_structure "github.com/gruntwork-io/terratest/modules/test-structure" 11 | "github.com/stretchr/testify/assert" 12 | ) 13 | 14 | func cleanup(t *testing.T, terraformOptions *terraform.Options, tempTestFolder string) { 15 | terraform.Destroy(t, terraformOptions) 16 | os.RemoveAll(tempTestFolder) 17 | } 18 | 19 | // Test the Terraform module in examples/complete using Terratest. 20 | func TestExamplesComplete(t *testing.T) { 21 | t.Parallel() 22 | randID := strings.ToLower(random.UniqueId()) 23 | attributes := []string{randID} 24 | 25 | rootFolder := "../../" 26 | terraformFolderRelativeToRoot := "examples/complete" 27 | varFiles := []string{"fixtures.us-east-2.tfvars"} 28 | 29 | tempTestFolder := test_structure.CopyTerraformFolderToTemp(t, rootFolder, terraformFolderRelativeToRoot) 30 | 31 | terraformOptions := &terraform.Options{ 32 | // The path to where our Terraform code is located 33 | TerraformDir: tempTestFolder, 34 | Upgrade: true, 35 | // Variables to pass to our Terraform code using -var-file options 36 | VarFiles: varFiles, 37 | Vars: map[string]interface{}{ 38 | "attributes": attributes, 39 | }, 40 | } 41 | 42 | // At the end of the test, run `terraform destroy` to clean up any resources that were created 43 | defer cleanup(t, terraformOptions, tempTestFolder) 44 | 45 | // This will run `terraform init` and `terraform apply` and fail the test if there are any errors 46 | terraform.InitAndApply(t, terraformOptions) 47 | 48 | // Run `terraform output` to get the value of an output variable 49 | cfDomainName := terraform.Output(t, terraformOptions, "cf_domain_name") 50 | // Verify we're getting back the outputs we expect 51 | assert.Contains(t, cfDomainName, ".cloudfront.net") 52 | 53 | // Run `terraform output` to get the value of an output variable 54 | cfArn := terraform.Output(t, terraformOptions, "cf_arn") 55 | // Verify we're getting back the outputs we expect 56 | assert.Contains(t, cfArn, "arn:aws:cloudfront::") 57 | } 58 | -------------------------------------------------------------------------------- /examples/multi-origin/main.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.region 3 | } 4 | 5 | resource "aws_cloudfront_origin_access_identity" "oai" { 6 | comment = "Managed by Terraform" 7 | } 8 | 9 | module "website" { 10 | source = "../../" 11 | 12 | origin_domain_name = var.origin_domain_name 13 | custom_origins = [ 14 | { 15 | domain_name = "assets.s3.us-east-1.amazonaws.com" 16 | origin_id = "assets" 17 | s3_origin_config = { 18 | origin_access_identity = aws_cloudfront_origin_access_identity.oai.cloudfront_access_identity_path 19 | } 20 | } 21 | ] 22 | 23 | ordered_cache = [ 24 | { 25 | target_origin_id = "assets" 26 | path_pattern = "/static/*" 27 | } 28 | ] 29 | 30 | logging_enabled = var.logging_enabled 31 | context = module.this.context 32 | } 33 | 34 | module "api" { 35 | source = "../../" 36 | 37 | origin_domain_name = var.origin_domain_name 38 | origin_shield = { 39 | enabled = true 40 | region = "us-east-1" 41 | } 42 | 43 | custom_origins = [ 44 | { 45 | domain_name = "api.example.com" 46 | origin_id = "grpc" 47 | https_port = 443 48 | origin_protocl_policy = "https-only" 49 | origin_ssl_protocols = ["TLSv1.2"] 50 | custom_origin_config = { 51 | origin_keepalive_timeout = 15 52 | origin_read_timeout = 45 53 | } 54 | } 55 | ] 56 | 57 | custom_error_response = [ 58 | { 59 | error_code = 404 60 | }, 61 | { 62 | error_caching_min_ttl = 10 63 | error_code = 403 64 | response_code = 404 65 | response_page_path = "/errors/404.html" 66 | } 67 | ] 68 | 69 | ordered_cache = [ 70 | { 71 | target_origin_id = "grpc" 72 | path_pattern = "/UserService/*" 73 | allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] 74 | min_ttl = 0 75 | default_ttl = 0 76 | max_ttl = 0 77 | grpc_config = { 78 | enabled = true 79 | } 80 | } 81 | ] 82 | 83 | logging_enabled = var.logging_enabled 84 | context = module.this.context 85 | } 86 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature Request 3 | description: Suggest an idea for this project 4 | labels: ["feature request"] 5 | assignees: [""] 6 | body: 7 | - type: markdown 8 | attributes: 9 | value: | 10 | Have a question? 11 | 12 | Please checkout our [Slack Community](https://slack.cloudposse.com) 13 | or visit our [Slack Archive](https://archive.sweetops.com/). 14 | 15 | [![Slack Community](https://slack.cloudposse.com/badge.svg)](https://slack.cloudposse.com) 16 | 17 | - type: textarea 18 | id: concise-description 19 | attributes: 20 | label: Describe the Feature 21 | description: A clear and concise description of what the feature is. 22 | placeholder: What is the feature about? 23 | validations: 24 | required: true 25 | 26 | - type: textarea 27 | id: expected 28 | attributes: 29 | label: Expected Behavior 30 | description: A clear and concise description of what you expected. 31 | placeholder: What happened? 32 | validations: 33 | required: true 34 | 35 | - type: textarea 36 | id: use-case 37 | attributes: 38 | label: Use Case 39 | description: | 40 | Is your feature request related to a problem/challenge you are trying 41 | to solve? 42 | 43 | Please provide some additional context of why this feature or 44 | capability will be valuable. 45 | validations: 46 | required: true 47 | 48 | - type: textarea 49 | id: ideal-solution 50 | attributes: 51 | label: Describe Ideal Solution 52 | description: A clear and concise description of what you want to happen. 53 | validations: 54 | required: true 55 | 56 | - type: textarea 57 | id: alternatives-considered 58 | attributes: 59 | label: Alternatives Considered 60 | description: Explain alternative solutions or features considered. 61 | validations: 62 | required: false 63 | 64 | - type: textarea 65 | id: additional 66 | attributes: 67 | label: Additional Context 68 | description: | 69 | Add any other context about the problem here. 70 | validations: 71 | required: false 72 | -------------------------------------------------------------------------------- /examples/wordpress/main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | wp_nocache_behavior = { 3 | viewer_protocol_policy = "redirect-to-https" 4 | cached_methods = ["GET", "HEAD"] 5 | allowed_methods = ["HEAD", "DELETE", "POST", "GET", "OPTIONS", "PUT", "PATCH"] 6 | default_ttl = 60 7 | min_ttl = 0 8 | max_ttl = 86400 9 | compress = true 10 | target_origin_id = "wordpress-cloudposse.com" 11 | forward_cookies = "all" 12 | forward_header_values = ["*"] 13 | forward_query_string = true 14 | lambda_function_association = [] 15 | cache_policy_id = "" 16 | origin_request_policy_id = "" 17 | } 18 | } 19 | 20 | module "cdn" { 21 | source = "../../" 22 | name = "wordpress" 23 | attributes = ["cloudposse.com"] 24 | 25 | aliases = ["cloudposse.com", "www.cloudposse.com"] 26 | origin_domain_name = "origin.cloudposse.com" 27 | origin_protocol_policy = "match-viewer" 28 | viewer_protocol_policy = "redirect-to-https" 29 | parent_zone_name = "cloudposse.com" 30 | default_root_object = "" 31 | acm_certificate_arn = "xxxxxxxxxxxxxxxxxxx" 32 | forward_cookies = "whitelist" 33 | forward_cookies_whitelisted_names = ["comment_author_*", "comment_author_email_*", "comment_author_url_*", "wordpress_logged_in_*", "wordpress_test_cookie", "wp-settings-*"] 34 | forward_headers = ["Host", "Origin", "Access-Control-Request-Headers", "Access-Control-Request-Method"] 35 | forward_query_string = true 36 | default_ttl = 60 37 | min_ttl = 0 38 | max_ttl = 86400 39 | compress = true 40 | cached_methods = ["GET", "HEAD"] 41 | allowed_methods = ["GET", "HEAD", "OPTIONS"] 42 | price_class = "PriceClass_All" 43 | 44 | ordered_cache = [ 45 | merge(local.wp_nocache_behavior, { path_pattern = "wp-admin/*" }), 46 | merge(local.wp_nocache_behavior, { path_pattern = "wp-login.php" }), 47 | merge(local.wp_nocache_behavior, { path_pattern = "wp-signup.php" }), 48 | merge(local.wp_nocache_behavior, { path_pattern = "wp-trackback.php" }), 49 | merge(local.wp_nocache_behavior, { path_pattern = "wp-cron.php" }), 50 | merge(local.wp_nocache_behavior, { path_pattern = "xmlrpc.php" }) 51 | ] 52 | 53 | context = module.this.context 54 | } 55 | -------------------------------------------------------------------------------- /README.yaml: -------------------------------------------------------------------------------- 1 | # 2 | # This is the canonical configuration for the `README.md` 3 | # Run `make readme` to rebuild the `README.md` 4 | # 5 | 6 | # Name of this project 7 | name: terraform-aws-cloudfront-cdn 8 | 9 | # Tags of this project 10 | tags: 11 | - aws 12 | - terraform 13 | - terraform-modules 14 | - cdn 15 | - bucket 16 | - cloudfront 17 | 18 | # Categories of this project 19 | categories: 20 | - terraform-modules/cdn 21 | 22 | # Logo for this project 23 | #logo: docs/logo.png 24 | 25 | # License of this project 26 | license: "APACHE2" 27 | 28 | # Canonical GitHub repo 29 | github_repo: cloudposse/terraform-aws-cloudfront-cdn 30 | 31 | # Badges to display 32 | badges: 33 | - name: Latest Release 34 | image: https://img.shields.io/github/release/cloudposse/terraform-aws-cloudfront-cdn.svg?style=for-the-badge 35 | url: https://github.com/cloudposse/terraform-aws-cloudfront-cdn/releases/latest 36 | - name: Last Updated 37 | image: https://img.shields.io/github/last-commit/cloudposse/terraform-aws-cloudfront-cdn.svg?style=for-the-badge 38 | url: https://github.com/cloudposse/terraform-aws-cloudfront-cdn/commits 39 | - name: Slack Community 40 | image: https://slack.cloudposse.com/for-the-badge.svg 41 | url: https://cloudposse.com/slack 42 | 43 | # List any related terraform modules that this module may be used with or that this module depends on. 44 | related: 45 | - name: "terraform-aws-cloudfront-s3-cdn" 46 | description: "Terraform module to easily provision CloudFront CDN backed by an S3 origin" 47 | url: "https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn" 48 | - name: "terraform-aws-s3-log-storage" 49 | description: "This module creates an S3 bucket suitable for receiving logs from other AWS services such as S3, CloudFront, and CloudTrail" 50 | url: "https://github.com/cloudposse/terraform-aws-s3-log-storage" 51 | - name: "terraform-aws-cloudtrail" 52 | description: "Terraform module to provision an AWS CloudTrail and an encrypted S3 bucket with versioning to store CloudTrail logs" 53 | url: "https://github.com/cloudposse/terraform-aws-cloudtrail" 54 | - name: "terraform-aws-s3-website" 55 | description: "Terraform module to provision S3-backed websites" 56 | url: "https://github.com/cloudposse/terraform-aws-s3-website" 57 | - name: "terraform-root-modules/aws/docs" 58 | description: "Reference implementation combining `terraform-aws-s3-website` with `terraform-aws-cdn`" 59 | url: "https://github.com/cloudposse/terraform-root-modules/tree/master/aws/docs" 60 | 61 | # Short description of this project 62 | description: |- 63 | Terraform Module that implements a CloudFront Distribution (CDN) for a custom origin (e.g. website) and [ships logs to a bucket](https://github.com/cloudposse/terraform-aws-log-storage). 64 | 65 | If you need to accelerate an S3 bucket, we suggest using [`terraform-aws-cloudfront-s3-cdn`](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn) instead. 66 | 67 | # How to use this project 68 | usage: |- 69 | For a complete example, see [examples/complete](examples/complete). 70 | 71 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) 72 | and [Terratest](https://github.com/gruntwork-io/terratest) (which tests and deploys the example on AWS), see [test](test). 73 | 74 | ```hcl 75 | module "cdn" { 76 | source = "cloudposse/cloudfront-cdn/aws" 77 | # Cloud Posse recommends pinning every module to a specific version 78 | # version = "x.x.x" 79 | namespace = "eg" 80 | stage = "prod" 81 | name = "app" 82 | aliases = ["www.example.net"] 83 | origin_domain_name = "origin.example.com" 84 | parent_zone_name = "example.net" 85 | } 86 | ``` 87 | 88 | 89 | Complete example of setting up CloudFront Distribution with Cache Behaviors for a WordPress site: [`examples/wordpress`](examples/wordpress) 90 | 91 | 92 | ### Generating ACM Certificate 93 | 94 | Use the AWS cli to [request new ACM certifiates](http://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request.html) (requires email validation) 95 | ``` 96 | aws acm request-certificate --domain-name example.com --subject-alternative-names a.example.com b.example.com *.c.example.com 97 | ``` 98 | 99 | include: [] 100 | contributors: [] 101 | -------------------------------------------------------------------------------- /test/src/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/cloudposse/terraform-aws-cloudfront-cdn 2 | 3 | go 1.24 4 | 5 | toolchain go1.24.0 6 | 7 | require ( 8 | github.com/gruntwork-io/terratest v0.49.0 9 | github.com/stretchr/testify v1.10.0 10 | ) 11 | 12 | require ( 13 | filippo.io/edwards25519 v1.1.0 // indirect 14 | github.com/agext/levenshtein v1.2.3 // indirect 15 | github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect 16 | github.com/aws/aws-sdk-go-v2 v1.32.5 // indirect 17 | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.7 // indirect 18 | github.com/aws/aws-sdk-go-v2/config v1.28.5 // indirect 19 | github.com/aws/aws-sdk-go-v2/credentials v1.17.46 // indirect 20 | github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.20 // indirect 21 | github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.41 // indirect 22 | github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.24 // indirect 23 | github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.24 // indirect 24 | github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect 25 | github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.24 // indirect 26 | github.com/aws/aws-sdk-go-v2/service/acm v1.30.6 // indirect 27 | github.com/aws/aws-sdk-go-v2/service/autoscaling v1.51.0 // indirect 28 | github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.44.0 // indirect 29 | github.com/aws/aws-sdk-go-v2/service/dynamodb v1.37.1 // indirect 30 | github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 // indirect 31 | github.com/aws/aws-sdk-go-v2/service/ecr v1.36.6 // indirect 32 | github.com/aws/aws-sdk-go-v2/service/ecs v1.52.0 // indirect 33 | github.com/aws/aws-sdk-go-v2/service/iam v1.38.1 // indirect 34 | github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.1 // indirect 35 | github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.5 // indirect 36 | github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.10.5 // indirect 37 | github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.5 // indirect 38 | github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.5 // indirect 39 | github.com/aws/aws-sdk-go-v2/service/kms v1.37.6 // indirect 40 | github.com/aws/aws-sdk-go-v2/service/lambda v1.69.0 // indirect 41 | github.com/aws/aws-sdk-go-v2/service/rds v1.91.0 // indirect 42 | github.com/aws/aws-sdk-go-v2/service/route53 v1.46.2 // indirect 43 | github.com/aws/aws-sdk-go-v2/service/s3 v1.69.0 // indirect 44 | github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.34.6 // indirect 45 | github.com/aws/aws-sdk-go-v2/service/sns v1.33.6 // indirect 46 | github.com/aws/aws-sdk-go-v2/service/sqs v1.37.1 // indirect 47 | github.com/aws/aws-sdk-go-v2/service/ssm v1.56.0 // indirect 48 | github.com/aws/aws-sdk-go-v2/service/sso v1.24.6 // indirect 49 | github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.5 // indirect 50 | github.com/aws/aws-sdk-go-v2/service/sts v1.33.1 // indirect 51 | github.com/aws/smithy-go v1.22.1 // indirect 52 | github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect 53 | github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect 54 | github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect 55 | github.com/davecgh/go-spew v1.1.1 // indirect 56 | github.com/emicklei/go-restful/v3 v3.9.0 // indirect 57 | github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 // indirect 58 | github.com/go-logr/logr v1.4.2 // indirect 59 | github.com/go-openapi/jsonpointer v0.19.6 // indirect 60 | github.com/go-openapi/jsonreference v0.20.2 // indirect 61 | github.com/go-openapi/swag v0.22.3 // indirect 62 | github.com/go-sql-driver/mysql v1.8.1 // indirect 63 | github.com/gogo/protobuf v1.3.2 // indirect 64 | github.com/golang/protobuf v1.5.4 // indirect 65 | github.com/google/gnostic-models v0.6.8 // indirect 66 | github.com/google/go-cmp v0.6.0 // indirect 67 | github.com/google/gofuzz v1.2.0 // indirect 68 | github.com/google/uuid v1.6.0 // indirect 69 | github.com/gruntwork-io/go-commons v0.8.0 // indirect 70 | github.com/hashicorp/errwrap v1.0.0 // indirect 71 | github.com/hashicorp/go-cleanhttp v0.5.2 // indirect 72 | github.com/hashicorp/go-getter/v2 v2.2.3 // indirect 73 | github.com/hashicorp/go-multierror v1.1.1 // indirect 74 | github.com/hashicorp/go-safetemp v1.0.0 // indirect 75 | github.com/hashicorp/go-version v1.7.0 // indirect 76 | github.com/hashicorp/hcl/v2 v2.22.0 // indirect 77 | github.com/hashicorp/terraform-json v0.23.0 // indirect 78 | github.com/imdario/mergo v0.3.11 // indirect 79 | github.com/jackc/pgpassfile v1.0.0 // indirect 80 | github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect 81 | github.com/jackc/pgx/v5 v5.7.1 // indirect 82 | github.com/jackc/puddle/v2 v2.2.2 // indirect 83 | github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a // indirect 84 | github.com/jmespath/go-jmespath v0.4.0 // indirect 85 | github.com/josharian/intern v1.0.0 // indirect 86 | github.com/json-iterator/go v1.1.12 // indirect 87 | github.com/klauspost/compress v1.16.5 // indirect 88 | github.com/mailru/easyjson v0.7.7 // indirect 89 | github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect 90 | github.com/mitchellh/go-homedir v1.1.0 // indirect 91 | github.com/mitchellh/go-testing-interface v1.14.1 // indirect 92 | github.com/mitchellh/go-wordwrap v1.0.1 // indirect 93 | github.com/moby/spdystream v0.2.0 // indirect 94 | github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect 95 | github.com/modern-go/reflect2 v1.0.2 // indirect 96 | github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect 97 | github.com/pmezard/go-difflib v1.0.0 // indirect 98 | github.com/pquerna/otp v1.4.0 // indirect 99 | github.com/russross/blackfriday/v2 v2.1.0 // indirect 100 | github.com/spf13/pflag v1.0.5 // indirect 101 | github.com/tmccombs/hcl2json v0.6.4 // indirect 102 | github.com/ulikunitz/xz v0.5.10 // indirect 103 | github.com/urfave/cli v1.22.16 // indirect 104 | github.com/zclconf/go-cty v1.15.0 // indirect 105 | golang.org/x/crypto v0.36.0 // indirect 106 | golang.org/x/mod v0.18.0 // indirect 107 | golang.org/x/net v0.38.0 // indirect 108 | golang.org/x/oauth2 v0.24.0 // indirect 109 | golang.org/x/sync v0.12.0 // indirect 110 | golang.org/x/sys v0.31.0 // indirect 111 | golang.org/x/term v0.30.0 // indirect 112 | golang.org/x/text v0.23.0 // indirect 113 | golang.org/x/time v0.8.0 // indirect 114 | golang.org/x/tools v0.22.0 // indirect 115 | google.golang.org/protobuf v1.35.1 // indirect 116 | gopkg.in/inf.v0 v0.9.1 // indirect 117 | gopkg.in/yaml.v2 v2.4.0 // indirect 118 | gopkg.in/yaml.v3 v3.0.1 // indirect 119 | k8s.io/api v0.28.4 // indirect 120 | k8s.io/apimachinery v0.28.4 // indirect 121 | k8s.io/client-go v0.28.4 // indirect 122 | k8s.io/klog/v2 v2.100.1 // indirect 123 | k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect 124 | k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect 125 | sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect 126 | sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect 127 | sigs.k8s.io/yaml v1.3.0 // indirect 128 | ) 129 | -------------------------------------------------------------------------------- /examples/complete/variables.tf: -------------------------------------------------------------------------------- 1 | variable "region" { 2 | type = string 3 | description = "AWS region" 4 | } 5 | 6 | variable "dns_aliases_enabled" { 7 | default = "true" 8 | description = "Set to false to prevent dns records for aliases from being created" 9 | } 10 | 11 | variable "acm_certificate_arn" { 12 | description = "Existing ACM Certificate ARN" 13 | default = "" 14 | } 15 | 16 | variable "aliases" { 17 | type = list(string) 18 | default = [] 19 | description = "List of aliases. CAUTION! Names MUSTN'T contain trailing `.`" 20 | } 21 | 22 | variable "custom_error_response" { 23 | # http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html#custom-error-pages-procedure 24 | # https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#custom-error-response-arguments 25 | type = list(object({ 26 | error_caching_min_ttl = string 27 | error_code = string 28 | response_code = string 29 | response_page_path = string 30 | })) 31 | 32 | description = "List of one or more custom error response element maps" 33 | default = [] 34 | } 35 | 36 | variable "custom_header" { 37 | type = list(object({ 38 | name = string 39 | value = string 40 | })) 41 | 42 | description = "List of one or more custom headers passed to the origin" 43 | default = [] 44 | } 45 | 46 | variable "web_acl_id" { 47 | description = "(Optional) - Web ACL ID that can be attached to the Cloudfront distribution" 48 | default = "" 49 | } 50 | 51 | variable "origin_domain_name" { 52 | description = "(Required) - The DNS domain name of your custom origin (e.g. website)" 53 | default = "" 54 | } 55 | 56 | variable "origin_path" { 57 | description = "(Optional) - An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin" 58 | default = "" 59 | } 60 | 61 | variable "origin_http_port" { 62 | description = "(Required) - The HTTP port the custom origin listens on" 63 | default = "80" 64 | } 65 | 66 | variable "origin_https_port" { 67 | description = "(Required) - The HTTPS port the custom origin listens on" 68 | default = "443" 69 | } 70 | 71 | variable "origin_protocol_policy" { 72 | description = "(Required) - The origin protocol policy to apply to your origin. One of http-only, https-only, or match-viewer" 73 | default = "match-viewer" 74 | } 75 | 76 | variable "origin_ssl_protocols" { 77 | description = "(Required) - The SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS" 78 | type = list(string) 79 | default = ["TLSv1", "TLSv1.1", "TLSv1.2"] 80 | } 81 | 82 | variable "origin_keepalive_timeout" { 83 | description = "(Optional) The Custom KeepAlive timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase." 84 | default = "60" 85 | } 86 | 87 | variable "origin_read_timeout" { 88 | description = "(Optional) The Custom Read timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase." 89 | default = "60" 90 | } 91 | 92 | variable "compress" { 93 | description = "(Optional) Whether you want CloudFront to automatically compress content for web requests that include Accept-Encoding: gzip in the request header (default: false)" 94 | default = "false" 95 | } 96 | 97 | variable "is_ipv6_enabled" { 98 | default = "true" 99 | description = "State of CloudFront IPv6" 100 | } 101 | 102 | variable "default_root_object" { 103 | default = "index.html" 104 | description = "Object that CloudFront return when requests the root URL" 105 | } 106 | 107 | variable "comment" { 108 | default = "Managed by Terraform" 109 | description = "Comment for the origin access identity" 110 | } 111 | 112 | variable "logging_enabled" { 113 | type = bool 114 | default = true 115 | description = "When true, access logs will be sent to a newly created S3 bucket or bucket specified by log_bucket_fqdn" 116 | } 117 | 118 | variable "log_include_cookies" { 119 | default = "false" 120 | description = "Include cookies in access logs" 121 | } 122 | 123 | variable "log_prefix" { 124 | default = "" 125 | description = "Path of logs in S3 bucket" 126 | } 127 | 128 | variable "log_standard_transition_days" { 129 | description = "Number of days to persist in the standard storage tier before moving to the glacier tier" 130 | default = "30" 131 | } 132 | 133 | variable "log_glacier_transition_days" { 134 | description = "Number of days after which to move the data to the glacier storage tier" 135 | default = "60" 136 | } 137 | 138 | variable "log_expiration_days" { 139 | description = "Number of days after which to expunge the objects" 140 | default = "90" 141 | } 142 | 143 | variable "forward_query_string" { 144 | default = "false" 145 | description = "Forward query strings to the origin that is associated with this cache behavior" 146 | } 147 | 148 | variable "forward_headers" { 149 | description = "Specifies the Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers." 150 | type = list(string) 151 | default = [] 152 | } 153 | 154 | variable "forward_cookies" { 155 | description = "Specifies whether you want CloudFront to forward cookies to the origin. Valid options are all, none or whitelist" 156 | default = "whitelist" 157 | } 158 | 159 | variable "forward_cookies_whitelisted_names" { 160 | type = list(string) 161 | description = "List of forwarded cookie names" 162 | default = [] 163 | } 164 | 165 | variable "price_class" { 166 | default = "PriceClass_100" 167 | description = "Price class for this distribution: `PriceClass_All`, `PriceClass_200`, `PriceClass_100`" 168 | } 169 | 170 | variable "viewer_minimum_protocol_version" { 171 | description = "(Optional) The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections." 172 | default = "TLSv1" 173 | } 174 | 175 | variable "viewer_protocol_policy" { 176 | description = "allow-all, redirect-to-https" 177 | default = "redirect-to-https" 178 | } 179 | 180 | variable "allowed_methods" { 181 | type = list(string) 182 | default = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] 183 | description = "List of allowed methods (e.g. ` GET, PUT, POST, DELETE, HEAD`) for AWS CloudFront" 184 | } 185 | 186 | variable "cached_methods" { 187 | type = list(string) 188 | default = ["GET", "HEAD"] 189 | description = "List of cached methods (e.g. ` GET, PUT, POST, DELETE, HEAD`)" 190 | } 191 | 192 | variable "default_ttl" { 193 | default = "60" 194 | description = "Default amount of time (in seconds) that an object is in a CloudFront cache" 195 | } 196 | 197 | variable "min_ttl" { 198 | default = "0" 199 | description = "Minimum amount of time that you want objects to stay in CloudFront caches" 200 | } 201 | 202 | variable "max_ttl" { 203 | default = "31536000" 204 | description = "Maximum amount of time (in seconds) that an object is in a CloudFront cache" 205 | } 206 | 207 | variable "geo_restriction_type" { 208 | # e.g. "whitelist" 209 | default = "none" 210 | description = "Method that use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`" 211 | } 212 | 213 | variable "geo_restriction_locations" { 214 | type = list(string) 215 | 216 | # e.g. ["US", "CA", "GB", "DE"] 217 | default = [] 218 | description = "List of country codes for which CloudFront either to distribute content (whitelist) or not distribute your content (blacklist)" 219 | } 220 | 221 | variable "parent_zone_id" { 222 | default = "" 223 | description = " ID of the hosted zone to contain this record (or specify `parent_zone_name`)" 224 | } 225 | 226 | variable "parent_zone_name" { 227 | default = "" 228 | description = "Name of the hosted zone to contain this record (or specify `parent_zone_id`)" 229 | } 230 | 231 | variable "ordered_cache" { 232 | type = list(object({ 233 | target_origin_id = string 234 | path_pattern = string 235 | 236 | allowed_methods = list(string) 237 | cached_methods = list(string) 238 | compress = bool 239 | 240 | viewer_protocol_policy = string 241 | min_ttl = number 242 | default_ttl = number 243 | max_ttl = number 244 | 245 | forward_query_string = bool 246 | forward_header_values = list(string) 247 | forward_cookies = string 248 | 249 | lambda_function_association = list(object({ 250 | event_type = string 251 | include_body = bool 252 | lambda_arn = string 253 | })) 254 | })) 255 | default = [] 256 | description = <`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/s3/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/complete/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/wordpress/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /examples/multi-origin/context.tf: -------------------------------------------------------------------------------- 1 | # 2 | # ONLY EDIT THIS FILE IN github.com/cloudposse/terraform-null-label 3 | # All other instances of this file should be a copy of that one 4 | # 5 | # 6 | # Copy this file from https://github.com/cloudposse/terraform-null-label/blob/master/exports/context.tf 7 | # and then place it in your Terraform module to automatically get 8 | # Cloud Posse's standard configuration inputs suitable for passing 9 | # to Cloud Posse modules. 10 | # 11 | # curl -sL https://raw.githubusercontent.com/cloudposse/terraform-null-label/master/exports/context.tf -o context.tf 12 | # 13 | # Modules should access the whole context as `module.this.context` 14 | # to get the input variables with nulls for defaults, 15 | # for example `context = module.this.context`, 16 | # and access individual variables as `module.this.`, 17 | # with final values filled in. 18 | # 19 | # For example, when using defaults, `module.this.context.delimiter` 20 | # will be null, and `module.this.delimiter` will be `-` (hyphen). 21 | # 22 | 23 | module "this" { 24 | source = "cloudposse/label/null" 25 | version = "0.25.0" # requires Terraform >= 0.13.0 26 | 27 | enabled = var.enabled 28 | namespace = var.namespace 29 | tenant = var.tenant 30 | environment = var.environment 31 | stage = var.stage 32 | name = var.name 33 | delimiter = var.delimiter 34 | attributes = var.attributes 35 | tags = var.tags 36 | additional_tag_map = var.additional_tag_map 37 | label_order = var.label_order 38 | regex_replace_chars = var.regex_replace_chars 39 | id_length_limit = var.id_length_limit 40 | label_key_case = var.label_key_case 41 | label_value_case = var.label_value_case 42 | descriptor_formats = var.descriptor_formats 43 | labels_as_tags = var.labels_as_tags 44 | 45 | context = var.context 46 | } 47 | 48 | # Copy contents of cloudposse/terraform-null-label/variables.tf here 49 | 50 | variable "context" { 51 | type = any 52 | default = { 53 | enabled = true 54 | namespace = null 55 | tenant = null 56 | environment = null 57 | stage = null 58 | name = null 59 | delimiter = null 60 | attributes = [] 61 | tags = {} 62 | additional_tag_map = {} 63 | regex_replace_chars = null 64 | label_order = [] 65 | id_length_limit = null 66 | label_key_case = null 67 | label_value_case = null 68 | descriptor_formats = {} 69 | # Note: we have to use [] instead of null for unset lists due to 70 | # https://github.com/hashicorp/terraform/issues/28137 71 | # which was not fixed until Terraform 1.0.0, 72 | # but we want the default to be all the labels in `label_order` 73 | # and we want users to be able to prevent all tag generation 74 | # by setting `labels_as_tags` to `[]`, so we need 75 | # a different sentinel to indicate "default" 76 | labels_as_tags = ["unset"] 77 | } 78 | description = <<-EOT 79 | Single object for setting entire context at once. 80 | See description of individual variables for details. 81 | Leave string and numeric variables as `null` to use default value. 82 | Individual variable settings (non-null) override settings in context object, 83 | except for attributes, tags, and additional_tag_map, which are merged. 84 | EOT 85 | 86 | validation { 87 | condition = lookup(var.context, "label_key_case", null) == null ? true : contains(["lower", "title", "upper"], var.context["label_key_case"]) 88 | error_message = "Allowed values: `lower`, `title`, `upper`." 89 | } 90 | 91 | validation { 92 | condition = lookup(var.context, "label_value_case", null) == null ? true : contains(["lower", "title", "upper", "none"], var.context["label_value_case"]) 93 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 94 | } 95 | } 96 | 97 | variable "enabled" { 98 | type = bool 99 | default = null 100 | description = "Set to false to prevent the module from creating any resources" 101 | } 102 | 103 | variable "namespace" { 104 | type = string 105 | default = null 106 | description = "ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique" 107 | } 108 | 109 | variable "tenant" { 110 | type = string 111 | default = null 112 | description = "ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for" 113 | } 114 | 115 | variable "environment" { 116 | type = string 117 | default = null 118 | description = "ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'" 119 | } 120 | 121 | variable "stage" { 122 | type = string 123 | default = null 124 | description = "ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'" 125 | } 126 | 127 | variable "name" { 128 | type = string 129 | default = null 130 | description = <<-EOT 131 | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. 132 | This is the only ID element not also included as a `tag`. 133 | The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. 134 | EOT 135 | } 136 | 137 | variable "delimiter" { 138 | type = string 139 | default = null 140 | description = <<-EOT 141 | Delimiter to be used between ID elements. 142 | Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. 143 | EOT 144 | } 145 | 146 | variable "attributes" { 147 | type = list(string) 148 | default = [] 149 | description = <<-EOT 150 | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, 151 | in the order they appear in the list. New attributes are appended to the 152 | end of the list. The elements of the list are joined by the `delimiter` 153 | and treated as a single ID element. 154 | EOT 155 | } 156 | 157 | variable "labels_as_tags" { 158 | type = set(string) 159 | default = ["default"] 160 | description = <<-EOT 161 | Set of labels (ID elements) to include as tags in the `tags` output. 162 | Default is to include all labels. 163 | Tags with empty values will not be included in the `tags` output. 164 | Set to `[]` to suppress all generated tags. 165 | **Notes:** 166 | The value of the `name` tag, if included, will be the `id`, not the `name`. 167 | Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be 168 | changed in later chained modules. Attempts to change it will be silently ignored. 169 | EOT 170 | } 171 | 172 | variable "tags" { 173 | type = map(string) 174 | default = {} 175 | description = <<-EOT 176 | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). 177 | Neither the tag keys nor the tag values will be modified by this module. 178 | EOT 179 | } 180 | 181 | variable "additional_tag_map" { 182 | type = map(string) 183 | default = {} 184 | description = <<-EOT 185 | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. 186 | This is for some rare cases where resources want additional configuration of tags 187 | and therefore take a list of maps with tag key, value, and additional configuration. 188 | EOT 189 | } 190 | 191 | variable "label_order" { 192 | type = list(string) 193 | default = null 194 | description = <<-EOT 195 | The order in which the labels (ID elements) appear in the `id`. 196 | Defaults to ["namespace", "environment", "stage", "name", "attributes"]. 197 | You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. 198 | EOT 199 | } 200 | 201 | variable "regex_replace_chars" { 202 | type = string 203 | default = null 204 | description = <<-EOT 205 | Terraform regular expression (regex) string. 206 | Characters matching the regex will be removed from the ID elements. 207 | If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. 208 | EOT 209 | } 210 | 211 | variable "id_length_limit" { 212 | type = number 213 | default = null 214 | description = <<-EOT 215 | Limit `id` to this many characters (minimum 6). 216 | Set to `0` for unlimited length. 217 | Set to `null` for keep the existing setting, which defaults to `0`. 218 | Does not affect `id_full`. 219 | EOT 220 | validation { 221 | condition = var.id_length_limit == null ? true : var.id_length_limit >= 6 || var.id_length_limit == 0 222 | error_message = "The id_length_limit must be >= 6 if supplied (not null), or 0 for unlimited length." 223 | } 224 | } 225 | 226 | variable "label_key_case" { 227 | type = string 228 | default = null 229 | description = <<-EOT 230 | Controls the letter case of the `tags` keys (label names) for tags generated by this module. 231 | Does not affect keys of tags passed in via the `tags` input. 232 | Possible values: `lower`, `title`, `upper`. 233 | Default value: `title`. 234 | EOT 235 | 236 | validation { 237 | condition = var.label_key_case == null ? true : contains(["lower", "title", "upper"], var.label_key_case) 238 | error_message = "Allowed values: `lower`, `title`, `upper`." 239 | } 240 | } 241 | 242 | variable "label_value_case" { 243 | type = string 244 | default = null 245 | description = <<-EOT 246 | Controls the letter case of ID elements (labels) as included in `id`, 247 | set as tag values, and output by this module individually. 248 | Does not affect values of tags passed in via the `tags` input. 249 | Possible values: `lower`, `title`, `upper` and `none` (no transformation). 250 | Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. 251 | Default value: `lower`. 252 | EOT 253 | 254 | validation { 255 | condition = var.label_value_case == null ? true : contains(["lower", "title", "upper", "none"], var.label_value_case) 256 | error_message = "Allowed values: `lower`, `title`, `upper`, `none`." 257 | } 258 | } 259 | 260 | variable "descriptor_formats" { 261 | type = any 262 | default = {} 263 | description = <<-EOT 264 | Describe additional descriptors to be output in the `descriptors` output map. 265 | Map of maps. Keys are names of descriptors. Values are maps of the form 266 | `{ 267 | format = string 268 | labels = list(string) 269 | }` 270 | (Type is `any` so the map values can later be enhanced to provide additional options.) 271 | `format` is a Terraform format string to be passed to the `format()` function. 272 | `labels` is a list of labels, in order, to pass to `format()` function. 273 | Label values will be normalized before being passed to `format()` so they will be 274 | identical to how they appear in `id`. 275 | Default is `{}` (`descriptors` output will be empty). 276 | EOT 277 | } 278 | 279 | #### End of copy of cloudposse/terraform-null-label/variables.tf 280 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "{}" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2017-2020 Cloud Posse, LLC 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | module "origin_label" { 2 | source = "cloudposse/label/null" 3 | version = "0.25.0" 4 | 5 | attributes = ["origin"] 6 | 7 | context = module.this.context 8 | } 9 | 10 | resource "aws_cloudfront_origin_access_identity" "default" { 11 | count = module.this.enabled && var.origin_access_identity_enabled ? 1 : 0 12 | 13 | comment = module.origin_label.id 14 | } 15 | 16 | module "logs" { 17 | source = "cloudposse/s3-log-storage/aws" 18 | version = "1.4.4" 19 | 20 | enabled = module.this.enabled && var.logging_enabled && length(var.log_bucket_fqdn) == 0 21 | attributes = compact(concat(module.this.attributes, ["origin", "logs"])) 22 | allow_ssl_requests_only = true 23 | lifecycle_prefix = var.log_prefix 24 | s3_object_ownership = "BucketOwnerPreferred" 25 | standard_transition_days = var.log_standard_transition_days 26 | glacier_transition_days = var.log_glacier_transition_days 27 | expiration_days = var.log_expiration_days 28 | force_destroy = var.log_force_destroy 29 | 30 | # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html 31 | acl = null 32 | grants = [ 33 | { 34 | # Canonical ID for the awslogsdelivery account 35 | id = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0" 36 | permissions = ["FULL_CONTROL"] 37 | type = "CanonicalUser" 38 | uri = null 39 | }, 40 | ] 41 | 42 | context = module.this.context 43 | } 44 | 45 | resource "aws_cloudfront_distribution" "default" { 46 | #bridgecrew:skip=BC_AWS_GENERAL_27:Skipping `Ensure CloudFront distribution has WAF enabled` because AWS WAF is indeed configurable and is managed via `var.web_acl_id`. 47 | count = module.this.enabled ? 1 : 0 48 | 49 | enabled = var.distribution_enabled 50 | is_ipv6_enabled = var.is_ipv6_enabled 51 | http_version = var.http_version 52 | comment = var.comment 53 | default_root_object = var.default_root_object 54 | price_class = var.price_class 55 | 56 | dynamic "logging_config" { 57 | for_each = var.logging_enabled ? ["true"] : [] 58 | content { 59 | include_cookies = var.log_include_cookies 60 | bucket = length(var.log_bucket_fqdn) > 0 ? var.log_bucket_fqdn : module.logs.bucket_domain_name 61 | prefix = var.log_prefix 62 | } 63 | } 64 | 65 | aliases = var.aliases 66 | 67 | dynamic "custom_error_response" { 68 | for_each = var.custom_error_response 69 | content { 70 | error_caching_min_ttl = custom_error_response.value.error_caching_min_ttl 71 | error_code = custom_error_response.value.error_code 72 | response_code = custom_error_response.value.response_code 73 | response_page_path = custom_error_response.value.response_page_path 74 | } 75 | } 76 | 77 | origin { 78 | domain_name = var.origin_domain_name 79 | origin_id = module.this.id 80 | origin_path = var.origin_path 81 | origin_access_control_id = var.origin_type == "s3" ? var.origin_access_control_id : null 82 | 83 | dynamic "custom_origin_config" { 84 | for_each = var.origin_type == "custom" ? [1] : [] 85 | content { 86 | http_port = var.origin_http_port 87 | https_port = var.origin_https_port 88 | origin_protocol_policy = var.origin_protocol_policy 89 | origin_ssl_protocols = var.origin_ssl_protocols 90 | origin_keepalive_timeout = var.origin_keepalive_timeout 91 | origin_read_timeout = var.origin_read_timeout 92 | } 93 | } 94 | 95 | dynamic "s3_origin_config" { 96 | # Makes sense only if OAC wasn't specified 97 | for_each = var.origin_type == "s3" && var.origin_access_control_id == null ? ( 98 | var.s3_origin_config == null ? 99 | [{ origin_access_identity = aws_cloudfront_origin_access_identity.default[0].cloudfront_access_identity_path }] : 100 | [var.s3_origin_config] 101 | ) : [] 102 | content { 103 | origin_access_identity = s3_origin_config.value.origin_access_identity 104 | } 105 | } 106 | 107 | dynamic "origin_shield" { 108 | for_each = var.origin_shield != null ? ["true"] : [] 109 | content { 110 | enabled = var.origin_shield.enabled 111 | origin_shield_region = var.origin_shield.region 112 | } 113 | } 114 | 115 | dynamic "custom_header" { 116 | for_each = var.custom_header 117 | content { 118 | name = custom_header.value.name 119 | value = custom_header.value.value 120 | } 121 | } 122 | } 123 | 124 | dynamic "origin" { 125 | for_each = var.custom_origins 126 | content { 127 | domain_name = origin.value.domain_name 128 | origin_id = origin.value.origin_id 129 | origin_path = origin.value.origin_path 130 | origin_access_control_id = origin.value.origin_access_control_id 131 | 132 | dynamic "custom_header" { 133 | for_each = origin.value.custom_headers 134 | content { 135 | name = custom_header.value["name"] 136 | value = custom_header.value["value"] 137 | } 138 | } 139 | 140 | dynamic "custom_origin_config" { 141 | for_each = origin.value.custom_origin_config == null ? [] : [true] 142 | content { 143 | http_port = origin.value.custom_origin_config.http_port 144 | https_port = origin.value.custom_origin_config.https_port 145 | origin_protocol_policy = origin.value.custom_origin_config.origin_protocol_policy 146 | origin_ssl_protocols = origin.value.custom_origin_config.origin_ssl_protocols 147 | origin_keepalive_timeout = origin.value.custom_origin_config.origin_keepalive_timeout 148 | origin_read_timeout = origin.value.custom_origin_config.origin_read_timeout 149 | } 150 | } 151 | 152 | dynamic "s3_origin_config" { 153 | for_each = origin.value.s3_origin_config == null ? [] : [true] 154 | content { 155 | origin_access_identity = origin.value.s3_origin_config.origin_access_identity 156 | } 157 | } 158 | 159 | dynamic "origin_shield" { 160 | for_each = origin.value.origin_shield != null ? [origin.value.origin_shield] : [] 161 | content { 162 | enabled = origin_shield.value.enabled 163 | origin_shield_region = origin_shield.value.region 164 | } 165 | } 166 | } 167 | } 168 | 169 | viewer_certificate { 170 | acm_certificate_arn = var.acm_certificate_arn 171 | ssl_support_method = var.acm_certificate_arn == "" ? null : "sni-only" 172 | minimum_protocol_version = length(var.aliases) == 0 ? "TLSv1" : var.viewer_minimum_protocol_version 173 | cloudfront_default_certificate = var.acm_certificate_arn == "" ? true : false 174 | } 175 | 176 | default_cache_behavior { 177 | allowed_methods = var.allowed_methods 178 | cached_methods = var.cached_methods 179 | cache_policy_id = var.cache_policy_id 180 | origin_request_policy_id = var.origin_request_policy_id 181 | target_origin_id = module.this.id 182 | compress = var.compress 183 | response_headers_policy_id = var.response_headers_policy_id 184 | 185 | dynamic "grpc_config" { 186 | for_each = var.grpc_config != null ? [var.grpc_config] : [] 187 | content { 188 | enabled = grpc_config.value.enabled 189 | } 190 | } 191 | 192 | dynamic "forwarded_values" { 193 | # If a cache policy or origin request policy is specified, we cannot include a `forwarded_values` block at all in the API request 194 | for_each = try(coalesce(var.cache_policy_id), null) == null && try(coalesce(var.origin_request_policy_id), null) == null ? [true] : [] 195 | content { 196 | headers = var.forward_headers 197 | 198 | query_string = var.forward_query_string 199 | 200 | cookies { 201 | forward = var.forward_cookies 202 | whitelisted_names = var.forward_cookies == "whitelist" ? var.forward_cookies_whitelisted_names : null 203 | } 204 | } 205 | } 206 | 207 | realtime_log_config_arn = var.realtime_log_config_arn 208 | 209 | dynamic "lambda_function_association" { 210 | for_each = var.lambda_function_association 211 | content { 212 | event_type = lambda_function_association.value.event_type 213 | include_body = lambda_function_association.value.include_body 214 | lambda_arn = lambda_function_association.value.lambda_arn 215 | } 216 | } 217 | 218 | dynamic "function_association" { 219 | for_each = var.function_association 220 | content { 221 | event_type = function_association.value.event_type 222 | function_arn = function_association.value.function_arn 223 | } 224 | } 225 | 226 | viewer_protocol_policy = var.viewer_protocol_policy 227 | # Only set TTL values when no cache policy is specified 228 | default_ttl = try(coalesce(var.cache_policy_id), null) == null ? var.default_ttl : 0 229 | min_ttl = try(coalesce(var.cache_policy_id), null) == null ? var.min_ttl : 0 230 | max_ttl = try(coalesce(var.cache_policy_id), null) == null ? var.max_ttl : 0 231 | } 232 | 233 | dynamic "ordered_cache_behavior" { 234 | for_each = var.ordered_cache 235 | 236 | content { 237 | path_pattern = ordered_cache_behavior.value.path_pattern 238 | 239 | allowed_methods = ordered_cache_behavior.value.allowed_methods 240 | cached_methods = ordered_cache_behavior.value.cached_methods 241 | cache_policy_id = ordered_cache_behavior.value.cache_policy_id 242 | origin_request_policy_id = ordered_cache_behavior.value.origin_request_policy_id 243 | target_origin_id = ordered_cache_behavior.value.target_origin_id == "" ? module.this.id : ordered_cache_behavior.value.target_origin_id 244 | compress = ordered_cache_behavior.value.compress 245 | response_headers_policy_id = ordered_cache_behavior.value.response_headers_policy_id 246 | trusted_signers = var.trusted_signers 247 | 248 | dynamic "grpc_config" { 249 | for_each = ordered_cache_behavior.value.grpc_config != null ? [ordered_cache_behavior.value.grpc_config] : [] 250 | content { 251 | enabled = grpc_config.value.enabled 252 | } 253 | } 254 | 255 | dynamic "forwarded_values" { 256 | # If a cache policy or origin request policy is specified, we cannot include a `forwarded_values` block at all in the API request 257 | for_each = try(coalesce(ordered_cache_behavior.value.cache_policy_id), null) == null && try(coalesce(ordered_cache_behavior.value.origin_request_policy_id), null) == null ? [true] : [] 258 | content { 259 | query_string = ordered_cache_behavior.value.forward_query_string 260 | headers = ordered_cache_behavior.value.forward_header_values 261 | 262 | cookies { 263 | forward = ordered_cache_behavior.value.forward_cookies 264 | whitelisted_names = ordered_cache_behavior.value.forward_cookies == "whitelist" ? ordered_cache_behavior.value.forward_cookies_whitelisted_names : null 265 | } 266 | } 267 | } 268 | 269 | viewer_protocol_policy = ordered_cache_behavior.value.viewer_protocol_policy 270 | # Only set TTL values when no cache policy is specified 271 | default_ttl = try(coalesce(ordered_cache_behavior.value.cache_policy_id), null) == null ? ordered_cache_behavior.value.default_ttl : 0 272 | min_ttl = try(coalesce(ordered_cache_behavior.value.cache_policy_id), null) == null ? ordered_cache_behavior.value.min_ttl : 0 273 | max_ttl = try(coalesce(ordered_cache_behavior.value.cache_policy_id), null) == null ? ordered_cache_behavior.value.max_ttl : 0 274 | 275 | dynamic "lambda_function_association" { 276 | for_each = ordered_cache_behavior.value.lambda_function_association 277 | content { 278 | event_type = lambda_function_association.value.event_type 279 | include_body = lambda_function_association.value.include_body 280 | lambda_arn = lambda_function_association.value.lambda_arn 281 | } 282 | } 283 | 284 | dynamic "function_association" { 285 | for_each = ordered_cache_behavior.value.function_association 286 | content { 287 | event_type = function_association.value.event_type 288 | function_arn = function_association.value.function_arn 289 | } 290 | } 291 | } 292 | } 293 | 294 | web_acl_id = var.web_acl_id 295 | 296 | restrictions { 297 | geo_restriction { 298 | restriction_type = var.geo_restriction_type 299 | locations = var.geo_restriction_locations 300 | } 301 | } 302 | 303 | tags = module.this.tags 304 | 305 | depends_on = [module.logs] 306 | } 307 | 308 | module "dns" { 309 | source = "cloudposse/route53-alias/aws" 310 | version = "0.13.0" 311 | 312 | enabled = (module.this.enabled && var.dns_aliases_enabled) ? true : false 313 | aliases = var.aliases 314 | parent_zone_id = var.parent_zone_id 315 | parent_zone_name = var.parent_zone_name 316 | target_dns_name = try(aws_cloudfront_distribution.default[0].domain_name, "") 317 | target_zone_id = try(aws_cloudfront_distribution.default[0].hosted_zone_id, "") 318 | ipv6_enabled = var.is_ipv6_enabled 319 | 320 | context = module.this.context 321 | } 322 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "distribution_enabled" { 2 | type = bool 3 | default = true 4 | description = "Set to `true` if you want CloudFront to begin processing requests as soon as the distribution is created, or to false if you do not want CloudFront to begin processing requests after the distribution is created." 5 | } 6 | 7 | variable "dns_aliases_enabled" { 8 | type = bool 9 | default = true 10 | description = "Set to false to prevent dns records for aliases from being created" 11 | } 12 | 13 | variable "acm_certificate_arn" { 14 | type = string 15 | description = "Existing ACM Certificate ARN" 16 | default = "" 17 | } 18 | 19 | variable "aliases" { 20 | type = list(string) 21 | default = [] 22 | description = "List of aliases. CAUTION! Names MUSTN'T contain trailing `.`" 23 | } 24 | 25 | variable "custom_error_response" { 26 | # http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html#custom-error-pages-procedure 27 | # https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#custom-error-response-arguments 28 | type = list(object({ 29 | error_caching_min_ttl = optional(string, null) 30 | error_code = string 31 | response_code = optional(string, null) 32 | response_page_path = optional(string, null) 33 | })) 34 | 35 | description = "List of one or more custom error response element maps" 36 | default = [] 37 | } 38 | 39 | variable "custom_header" { 40 | type = list(object({ 41 | name = string 42 | value = string 43 | })) 44 | 45 | description = "List of one or more custom headers passed to the origin" 46 | default = [] 47 | } 48 | 49 | variable "web_acl_id" { 50 | type = string 51 | description = "ID of the AWS WAF web ACL that is associated with the distribution" 52 | default = "" 53 | } 54 | 55 | variable "origin_domain_name" { 56 | type = string 57 | description = "The DNS domain name of your custom origin (e.g. website)" 58 | default = "" 59 | } 60 | 61 | variable "origin_path" { 62 | # http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath 63 | type = string 64 | description = "An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin. It must begin with a /. Do not add a / at the end of the path." 65 | default = "" 66 | } 67 | 68 | variable "origin_access_control_id" { 69 | # https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html 70 | type = string 71 | description = "CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3." 72 | default = null 73 | } 74 | 75 | variable "origin_http_port" { 76 | type = number 77 | description = "The HTTP port the custom origin listens on" 78 | default = "80" 79 | } 80 | 81 | variable "origin_https_port" { 82 | type = number 83 | description = "The HTTPS port the custom origin listens on" 84 | default = 443 85 | } 86 | 87 | variable "origin_protocol_policy" { 88 | type = string 89 | description = "The origin protocol policy to apply to your origin. One of http-only, https-only, or match-viewer" 90 | default = "match-viewer" 91 | } 92 | 93 | variable "origin_shield" { 94 | type = object({ 95 | enabled = optional(bool, false) 96 | region = optional(string, null) 97 | }) 98 | description = "The CloudFront Origin Shield settings" 99 | default = null 100 | } 101 | 102 | variable "origin_ssl_protocols" { 103 | description = "The SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS" 104 | type = list(string) 105 | default = ["TLSv1", "TLSv1.1", "TLSv1.2"] 106 | } 107 | 108 | variable "origin_keepalive_timeout" { 109 | type = number 110 | description = "The Custom KeepAlive timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase." 111 | default = 5 112 | } 113 | 114 | variable "origin_read_timeout" { 115 | type = number 116 | description = "The Custom Read timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase." 117 | default = 30 118 | } 119 | 120 | variable "compress" { 121 | type = bool 122 | description = "Whether you want CloudFront to automatically compress content for web requests that include Accept-Encoding: gzip in the request header (default: false)" 123 | default = false 124 | } 125 | 126 | variable "is_ipv6_enabled" { 127 | type = bool 128 | default = true 129 | description = "State of CloudFront IPv6" 130 | } 131 | 132 | variable "default_root_object" { 133 | type = string 134 | default = "index.html" 135 | description = "Object that CloudFront return when requests the root URL" 136 | } 137 | 138 | variable "comment" { 139 | type = string 140 | default = "Managed by Terraform" 141 | description = "Comment for the origin access identity" 142 | } 143 | 144 | variable "origin_access_identity_enabled" { 145 | type = bool 146 | default = true 147 | description = "When true, creates origin access identity resource" 148 | } 149 | 150 | variable "logging_enabled" { 151 | type = bool 152 | default = true 153 | description = "When true, access logs will be sent to a newly created s3 bucket" 154 | } 155 | 156 | variable "log_include_cookies" { 157 | type = bool 158 | default = false 159 | description = "Include cookies in access logs" 160 | } 161 | 162 | variable "log_prefix" { 163 | type = string 164 | default = "" 165 | description = "Path of logs in S3 bucket" 166 | } 167 | 168 | variable "log_bucket_fqdn" { 169 | type = string 170 | default = "" 171 | description = "Optional fqdn of logging bucket, if not supplied a bucket will be generated." 172 | } 173 | 174 | variable "log_force_destroy" { 175 | type = bool 176 | description = "Applies to log bucket created by this module only. If true, all objects will be deleted from the bucket on destroy, so that the bucket can be destroyed without error. These objects are not recoverable." 177 | default = false 178 | } 179 | 180 | variable "log_standard_transition_days" { 181 | type = number 182 | description = "Number of days to persist in the standard storage tier before moving to the glacier tier" 183 | default = 30 184 | } 185 | 186 | variable "log_glacier_transition_days" { 187 | type = number 188 | description = "Number of days after which to move the data to the glacier storage tier" 189 | default = 60 190 | } 191 | 192 | variable "log_expiration_days" { 193 | type = number 194 | description = "Number of days after which to expunge the objects" 195 | default = 90 196 | } 197 | 198 | variable "forward_query_string" { 199 | type = bool 200 | default = false 201 | description = "Forward query strings to the origin that is associated with this cache behavior" 202 | } 203 | 204 | variable "forward_headers" { 205 | description = "Specifies the Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers." 206 | type = list(string) 207 | default = [] 208 | } 209 | 210 | variable "forward_cookies" { 211 | type = string 212 | description = "Specifies whether you want CloudFront to forward cookies to the origin. Valid options are all, none or whitelist" 213 | default = "none" 214 | } 215 | 216 | variable "forward_cookies_whitelisted_names" { 217 | type = list(string) 218 | description = "List of forwarded cookie names" 219 | default = [] 220 | } 221 | 222 | variable "price_class" { 223 | type = string 224 | default = "PriceClass_100" 225 | description = "Price class for this distribution: `PriceClass_All`, `PriceClass_200`, `PriceClass_100`" 226 | } 227 | 228 | variable "viewer_minimum_protocol_version" { 229 | type = string 230 | description = "The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. This is ignored if the default CloudFront certificate is used." 231 | default = "TLSv1.2_2021" 232 | } 233 | 234 | variable "viewer_protocol_policy" { 235 | type = string 236 | description = "allow-all, redirect-to-https" 237 | default = "redirect-to-https" 238 | } 239 | 240 | variable "allowed_methods" { 241 | type = list(string) 242 | default = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] 243 | description = "List of allowed methods (e.g. ` GET, PUT, POST, DELETE, HEAD`) for AWS CloudFront" 244 | } 245 | 246 | variable "cached_methods" { 247 | type = list(string) 248 | default = ["GET", "HEAD"] 249 | description = "List of cached methods (e.g. ` GET, PUT, POST, DELETE, HEAD`)" 250 | } 251 | 252 | variable "cache_policy_id" { 253 | type = string 254 | default = null 255 | description = "ID of the cache policy attached to the cache behavior" 256 | } 257 | 258 | variable "origin_request_policy_id" { 259 | type = string 260 | default = null 261 | description = "ID of the origin request policy attached to the cache behavior" 262 | } 263 | 264 | variable "response_headers_policy_id" { 265 | type = string 266 | description = "The identifier for a response headers policy" 267 | default = "" 268 | } 269 | 270 | variable "default_ttl" { 271 | type = number 272 | default = 60 273 | description = "Default amount of time (in seconds) that an object is in a CloudFront cache" 274 | } 275 | 276 | variable "min_ttl" { 277 | type = number 278 | default = 0 279 | description = "Minimum amount of time that you want objects to stay in CloudFront caches" 280 | } 281 | 282 | variable "max_ttl" { 283 | type = number 284 | default = 31536000 285 | description = "Maximum amount of time (in seconds) that an object is in a CloudFront cache" 286 | } 287 | 288 | variable "geo_restriction_type" { 289 | # e.g. "whitelist" 290 | type = string 291 | default = "none" 292 | description = "Method that use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`" 293 | } 294 | 295 | variable "geo_restriction_locations" { 296 | type = list(string) 297 | 298 | # e.g. ["US", "CA", "GB", "DE"] 299 | default = [] 300 | description = "List of country codes for which CloudFront either to distribute content (whitelist) or not distribute your content (blacklist)" 301 | } 302 | 303 | variable "parent_zone_id" { 304 | type = string 305 | default = "" 306 | description = "ID of the hosted zone to contain this record (or specify `parent_zone_name`)" 307 | } 308 | 309 | variable "parent_zone_name" { 310 | type = string 311 | default = "" 312 | description = "Name of the hosted zone to contain this record (or specify `parent_zone_id`)" 313 | } 314 | 315 | variable "ordered_cache" { 316 | type = list(object({ 317 | target_origin_id = string 318 | path_pattern = string 319 | 320 | allowed_methods = optional(list(string), ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]) 321 | cached_methods = optional(list(string), ["GET", "HEAD"]) 322 | cache_policy_id = optional(string, null) 323 | origin_request_policy_id = optional(string, null) 324 | compress = optional(bool, false) 325 | 326 | viewer_protocol_policy = optional(string, "redirect-to-https") 327 | min_ttl = optional(number, 0) 328 | default_ttl = optional(number, 60) 329 | max_ttl = optional(number, 31536000) 330 | 331 | forward_query_string = optional(bool, false) 332 | forward_header_values = optional(list(string), []) 333 | forward_cookies = optional(string, "none") 334 | forward_cookies_whitelisted_names = optional(list(string), []) 335 | 336 | response_headers_policy_id = optional(string, "") 337 | 338 | grpc_config = optional(object({ 339 | enabled = bool 340 | }), { enabled = false }) 341 | 342 | lambda_function_association = optional(list(object({ 343 | event_type = string 344 | include_body = optional(bool, false) 345 | lambda_arn = string 346 | })), []) 347 | 348 | function_association = optional(list(object({ 349 | event_type = string 350 | function_arn = string 351 | })), []) 352 | })) 353 | default = [] 354 | description = < 4 | Project Banner
5 | 6 | 7 |

Latest ReleaseLast UpdatedSlack CommunityGet Support 8 | 9 |

10 | 11 | 12 | 32 | 33 | Terraform Module that implements a CloudFront Distribution (CDN) for a custom origin (e.g. website) and [ships logs to a bucket](https://github.com/cloudposse/terraform-aws-log-storage). 34 | 35 | If you need to accelerate an S3 bucket, we suggest using [`terraform-aws-cloudfront-s3-cdn`](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn) instead. 36 | 37 | 38 | > [!TIP] 39 | > #### 👽 Use Atmos with Terraform 40 | > Cloud Posse uses [`atmos`](https://atmos.tools) to easily orchestrate multiple environments using Terraform.
41 | > Works with [Github Actions](https://atmos.tools/integrations/github-actions/), [Atlantis](https://atmos.tools/integrations/atlantis), or [Spacelift](https://atmos.tools/integrations/spacelift). 42 | > 43 | >
44 | > Watch demo of using Atmos with Terraform 45 | >
46 | > Example of running atmos to manage infrastructure from our Quick Start tutorial. 47 | > 48 | 49 | 50 | 51 | 52 | 53 | ## Usage 54 | 55 | For a complete example, see [examples/complete](examples/complete). 56 | 57 | For automated tests of the complete example using [bats](https://github.com/bats-core/bats-core) 58 | and [Terratest](https://github.com/gruntwork-io/terratest) (which tests and deploys the example on AWS), see [test](test). 59 | 60 | ```hcl 61 | module "cdn" { 62 | source = "cloudposse/cloudfront-cdn/aws" 63 | # Cloud Posse recommends pinning every module to a specific version 64 | # version = "x.x.x" 65 | namespace = "eg" 66 | stage = "prod" 67 | name = "app" 68 | aliases = ["www.example.net"] 69 | origin_domain_name = "origin.example.com" 70 | parent_zone_name = "example.net" 71 | } 72 | ``` 73 | 74 | 75 | Complete example of setting up CloudFront Distribution with Cache Behaviors for a WordPress site: [`examples/wordpress`](examples/wordpress) 76 | 77 | 78 | ### Generating ACM Certificate 79 | 80 | Use the AWS cli to [request new ACM certifiates](http://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request.html) (requires email validation) 81 | ``` 82 | aws acm request-certificate --domain-name example.com --subject-alternative-names a.example.com b.example.com *.c.example.com 83 | ``` 84 | 85 | > [!IMPORTANT] 86 | > In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation 87 | > and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version 88 | > you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic 89 | > approach for updating versions to avoid unexpected changes. 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | ## Requirements 100 | 101 | | Name | Version | 102 | |------|---------| 103 | | [terraform](#requirement\_terraform) | >= 1.0 | 104 | | [aws](#requirement\_aws) | >= 4.9.0 | 105 | | [local](#requirement\_local) | >= 1.2 | 106 | 107 | ## Providers 108 | 109 | | Name | Version | 110 | |------|---------| 111 | | [aws](#provider\_aws) | >= 4.9.0 | 112 | 113 | ## Modules 114 | 115 | | Name | Source | Version | 116 | |------|--------|---------| 117 | | [dns](#module\_dns) | cloudposse/route53-alias/aws | 0.13.0 | 118 | | [logs](#module\_logs) | cloudposse/s3-log-storage/aws | 1.4.4 | 119 | | [origin\_label](#module\_origin\_label) | cloudposse/label/null | 0.25.0 | 120 | | [this](#module\_this) | cloudposse/label/null | 0.25.0 | 121 | 122 | ## Resources 123 | 124 | | Name | Type | 125 | |------|------| 126 | | [aws_cloudfront_distribution.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution) | resource | 127 | | [aws_cloudfront_origin_access_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_identity) | resource | 128 | 129 | ## Inputs 130 | 131 | | Name | Description | Type | Default | Required | 132 | |------|-------------|------|---------|:--------:| 133 | | [acm\_certificate\_arn](#input\_acm\_certificate\_arn) | Existing ACM Certificate ARN | `string` | `""` | no | 134 | | [additional\_tag\_map](#input\_additional\_tag\_map) | Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration. | `map(string)` | `{}` | no | 135 | | [aliases](#input\_aliases) | List of aliases. CAUTION! Names MUSTN'T contain trailing `.` | `list(string)` | `[]` | no | 136 | | [allowed\_methods](#input\_allowed\_methods) | List of allowed methods (e.g. ` GET, PUT, POST, DELETE, HEAD`) for AWS CloudFront | `list(string)` | 
[
  "DELETE",
  "GET",
  "HEAD",
  "OPTIONS",
  "PATCH",
  "POST",
  "PUT"
]
| no | 137 | | [attributes](#input\_attributes) | ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the `delimiter`
and treated as a single ID element. | `list(string)` | `[]` | no | 138 | | [cache\_policy\_id](#input\_cache\_policy\_id) | ID of the cache policy attached to the cache behavior | `string` | `null` | no | 139 | | [cached\_methods](#input\_cached\_methods) | List of cached methods (e.g. ` GET, PUT, POST, DELETE, HEAD`) | `list(string)` | 
[
  "GET",
  "HEAD"
]
| no | 140 | | [comment](#input\_comment) | Comment for the origin access identity | `string` | `"Managed by Terraform"` | no | 141 | | [compress](#input\_compress) | Whether you want CloudFront to automatically compress content for web requests that include Accept-Encoding: gzip in the request header (default: false) | `bool` | `false` | no | 142 | | [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | 
{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
| no | 143 | | [custom\_error\_response](#input\_custom\_error\_response) | List of one or more custom error response element maps | 
list(object({
    error_caching_min_ttl = optional(string, null)
    error_code            = string
    response_code         = optional(string, null)
    response_page_path    = optional(string, null)
  }))
| `[]` | no | 144 | | [custom\_header](#input\_custom\_header) | List of one or more custom headers passed to the origin | 
list(object({
    name  = string
    value = string
  }))
| `[]` | no | 145 | | [custom\_origins](#input\_custom\_origins) | One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments | 
list(object({
    domain_name              = string
    origin_id                = string
    origin_path              = optional(string, "")
    origin_access_control_id = optional(string, null)
    custom_headers = optional(list(object({
      name  = string
      value = string
    })), [])
    custom_origin_config = optional(object({
      http_port                = optional(number, 80)
      https_port               = optional(number, 443)
      origin_protocol_policy   = optional(string, "match-viewer")
      origin_ssl_protocols     = optional(list(string), ["TLSv1", "TLSv1.1", "TLSv1.2"])
      origin_keepalive_timeout = optional(number, 5)
      origin_read_timeout      = optional(number, 30)
    }), null)
    s3_origin_config = optional(object({
      origin_access_identity = string
    }), null)
    origin_shield = optional(object({
      enabled = optional(bool, false)
      region  = optional(string, null)
    }), null)
  }))
| `[]` | no | 146 | | [default\_root\_object](#input\_default\_root\_object) | Object that CloudFront return when requests the root URL | `string` | `"index.html"` | no | 147 | | [default\_ttl](#input\_default\_ttl) | Default amount of time (in seconds) that an object is in a CloudFront cache | `number` | `60` | no | 148 | | [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no | 149 | | [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no | 150 | | [distribution\_enabled](#input\_distribution\_enabled) | Set to `true` if you want CloudFront to begin processing requests as soon as the distribution is created, or to false if you do not want CloudFront to begin processing requests after the distribution is created. | `bool` | `true` | no | 151 | | [dns\_aliases\_enabled](#input\_dns\_aliases\_enabled) | Set to false to prevent dns records for aliases from being created | `bool` | `true` | no | 152 | | [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no | 153 | | [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no | 154 | | [forward\_cookies](#input\_forward\_cookies) | Specifies whether you want CloudFront to forward cookies to the origin. Valid options are all, none or whitelist | `string` | `"none"` | no | 155 | | [forward\_cookies\_whitelisted\_names](#input\_forward\_cookies\_whitelisted\_names) | List of forwarded cookie names | `list(string)` | `[]` | no | 156 | | [forward\_headers](#input\_forward\_headers) | Specifies the Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers. | `list(string)` | `[]` | no | 157 | | [forward\_query\_string](#input\_forward\_query\_string) | Forward query strings to the origin that is associated with this cache behavior | `bool` | `false` | no | 158 | | [function\_association](#input\_function\_association) | A config block that triggers a CloudFront function with specific actions.
See the [aws\_cloudfront\_distribution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution#function-association)
documentation for more information. | 
list(object({
    event_type   = string
    function_arn = string
  }))
| `[]` | no | 159 | | [geo\_restriction\_locations](#input\_geo\_restriction\_locations) | List of country codes for which CloudFront either to distribute content (whitelist) or not distribute your content (blacklist) | `list(string)` | `[]` | no | 160 | | [geo\_restriction\_type](#input\_geo\_restriction\_type) | Method that use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist` | `string` | `"none"` | no | 161 | | [grpc\_config](#input\_grpc\_config) | The gRPC configuration for the default CloudFront distribution cache behavior | 
object({
    enabled = bool
  })
| 
{
  "enabled": false
}
| no | 162 | | [http\_version](#input\_http\_version) | The maximum HTTP version to support on the distribution. Allowed values are http1.1, http2, http2and3 and http3. | `string` | `"http2"` | no | 163 | | [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no | 164 | | [is\_ipv6\_enabled](#input\_is\_ipv6\_enabled) | State of CloudFront IPv6 | `bool` | `true` | no | 165 | | [label\_key\_case](#input\_label\_key\_case) | Controls the letter case of the `tags` keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper`.
Default value: `title`. | `string` | `null` | no | 166 | | [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no | 167 | | [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the `tags` input.
Possible values: `lower`, `title`, `upper` and `none` (no transformation).
Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.
Default value: `lower`. | `string` | `null` | no | 168 | | [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.
Default is to include all labels.
Tags with empty values will not be included in the `tags` output.
Set to `[]` to suppress all generated tags.
**Notes:**
The value of the `name` tag, if included, will be the `id`, not the `name`.
Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be
changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | 
[
  "default"
]
| no | 169 | | [lambda\_function\_association](#input\_lambda\_function\_association) | A config block that triggers a Lambda@Edge function with specific actions | 
list(object({
    event_type   = string
    include_body = optional(bool, false)
    lambda_arn   = string
  }))
| `[]` | no | 170 | | [log\_bucket\_fqdn](#input\_log\_bucket\_fqdn) | Optional fqdn of logging bucket, if not supplied a bucket will be generated. | `string` | `""` | no | 171 | | [log\_expiration\_days](#input\_log\_expiration\_days) | Number of days after which to expunge the objects | `number` | `90` | no | 172 | | [log\_force\_destroy](#input\_log\_force\_destroy) | Applies to log bucket created by this module only. If true, all objects will be deleted from the bucket on destroy, so that the bucket can be destroyed without error. These objects are not recoverable. | `bool` | `false` | no | 173 | | [log\_glacier\_transition\_days](#input\_log\_glacier\_transition\_days) | Number of days after which to move the data to the glacier storage tier | `number` | `60` | no | 174 | | [log\_include\_cookies](#input\_log\_include\_cookies) | Include cookies in access logs | `bool` | `false` | no | 175 | | [log\_prefix](#input\_log\_prefix) | Path of logs in S3 bucket | `string` | `""` | no | 176 | | [log\_standard\_transition\_days](#input\_log\_standard\_transition\_days) | Number of days to persist in the standard storage tier before moving to the glacier tier | `number` | `30` | no | 177 | | [logging\_enabled](#input\_logging\_enabled) | When true, access logs will be sent to a newly created s3 bucket | `bool` | `true` | no | 178 | | [max\_ttl](#input\_max\_ttl) | Maximum amount of time (in seconds) that an object is in a CloudFront cache | `number` | `31536000` | no | 179 | | [min\_ttl](#input\_min\_ttl) | Minimum amount of time that you want objects to stay in CloudFront caches | `number` | `0` | no | 180 | | [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a `tag`.
The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no | 181 | | [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no | 182 | | [ordered\_cache](#input\_ordered\_cache) | An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.
The fields can be described by the other variables in this file. For example, the field 'lambda\_function\_association' in this object has
a description in var.lambda\_function\_association variable earlier in this file. The only difference is that fields on this object are in ordered caches, whereas the rest
of the vars in this file apply only to the default cache. Put value `""` on field `target_origin_id` to specify default s3 bucket origin. | 
list(object({
    target_origin_id = string
    path_pattern     = string

    allowed_methods          = optional(list(string), ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"])
    cached_methods           = optional(list(string), ["GET", "HEAD"])
    cache_policy_id          = optional(string, null)
    origin_request_policy_id = optional(string, null)
    compress                 = optional(bool, false)

    viewer_protocol_policy = optional(string, "redirect-to-https")
    min_ttl                = optional(number, 0)
    default_ttl            = optional(number, 60)
    max_ttl                = optional(number, 31536000)

    forward_query_string              = optional(bool, false)
    forward_header_values             = optional(list(string), [])
    forward_cookies                   = optional(string, "none")
    forward_cookies_whitelisted_names = optional(list(string), [])

    response_headers_policy_id = optional(string, "")

    grpc_config = optional(object({
      enabled = bool
    }), { enabled = false })

    lambda_function_association = optional(list(object({
      event_type   = string
      include_body = optional(bool, false)
      lambda_arn   = string
    })), [])

    function_association = optional(list(object({
      event_type   = string
      function_arn = string
    })), [])
  }))
| `[]` | no | 183 | | [origin\_access\_control\_id](#input\_origin\_access\_control\_id) | CloudFront provides two ways to send authenticated requests to an Amazon S3 origin: origin access control (OAC) and origin access identity (OAI). OAC helps you secure your origins, such as for Amazon S3. | `string` | `null` | no | 184 | | [origin\_access\_identity\_enabled](#input\_origin\_access\_identity\_enabled) | When true, creates origin access identity resource | `bool` | `true` | no | 185 | | [origin\_domain\_name](#input\_origin\_domain\_name) | The DNS domain name of your custom origin (e.g. website) | `string` | `""` | no | 186 | | [origin\_http\_port](#input\_origin\_http\_port) | The HTTP port the custom origin listens on | `number` | `"80"` | no | 187 | | [origin\_https\_port](#input\_origin\_https\_port) | The HTTPS port the custom origin listens on | `number` | `443` | no | 188 | | [origin\_keepalive\_timeout](#input\_origin\_keepalive\_timeout) | The Custom KeepAlive timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase. | `number` | `5` | no | 189 | | [origin\_path](#input\_origin\_path) | An optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin. It must begin with a /. Do not add a / at the end of the path. | `string` | `""` | no | 190 | | [origin\_protocol\_policy](#input\_origin\_protocol\_policy) | The origin protocol policy to apply to your origin. One of http-only, https-only, or match-viewer | `string` | `"match-viewer"` | no | 191 | | [origin\_read\_timeout](#input\_origin\_read\_timeout) | The Custom Read timeout, in seconds. By default, AWS enforces a limit of 60. But you can request an increase. | `number` | `30` | no | 192 | | [origin\_request\_policy\_id](#input\_origin\_request\_policy\_id) | ID of the origin request policy attached to the cache behavior | `string` | `null` | no | 193 | | [origin\_shield](#input\_origin\_shield) | The CloudFront Origin Shield settings | 
object({
    enabled = optional(bool, false)
    region  = optional(string, null)
  })
| `null` | no | 194 | | [origin\_ssl\_protocols](#input\_origin\_ssl\_protocols) | The SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS | `list(string)` | 
[
  "TLSv1",
  "TLSv1.1",
  "TLSv1.2"
]
| no | 195 | | [origin\_type](#input\_origin\_type) | The type of origin configuration to use. Valid values are 'custom' or 's3'. | `string` | `"custom"` | no | 196 | | [parent\_zone\_id](#input\_parent\_zone\_id) | ID of the hosted zone to contain this record (or specify `parent_zone_name`) | `string` | `""` | no | 197 | | [parent\_zone\_name](#input\_parent\_zone\_name) | Name of the hosted zone to contain this record (or specify `parent_zone_id`) | `string` | `""` | no | 198 | | [price\_class](#input\_price\_class) | Price class for this distribution: `PriceClass_All`, `PriceClass_200`, `PriceClass_100` | `string` | `"PriceClass_100"` | no | 199 | | [realtime\_log\_config\_arn](#input\_realtime\_log\_config\_arn) | The ARN of the real-time log configuration that is attached to this cache behavior | `string` | `null` | no | 200 | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | 201 | | [response\_headers\_policy\_id](#input\_response\_headers\_policy\_id) | The identifier for a response headers policy | `string` | `""` | no | 202 | | [s3\_origin\_config](#input\_s3\_origin\_config) | Optional configuration for an S3 origin. | 
object({
    origin_access_identity = string
  })
| `null` | no | 203 | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | 204 | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | 205 | | [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no | 206 | | [trusted\_signers](#input\_trusted\_signers) | List of AWS account IDs (or self) that you want to allow to create signed URLs for private content | `list(string)` | `[]` | no | 207 | | [viewer\_minimum\_protocol\_version](#input\_viewer\_minimum\_protocol\_version) | The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. This is ignored if the default CloudFront certificate is used. | `string` | `"TLSv1.2_2021"` | no | 208 | | [viewer\_protocol\_policy](#input\_viewer\_protocol\_policy) | allow-all, redirect-to-https | `string` | `"redirect-to-https"` | no | 209 | | [web\_acl\_id](#input\_web\_acl\_id) | ID of the AWS WAF web ACL that is associated with the distribution | `string` | `""` | no | 210 | 211 | ## Outputs 212 | 213 | | Name | Description | 214 | |------|-------------| 215 | | [cf\_aliases](#output\_cf\_aliases) | Extra CNAMEs of AWS CloudFront | 216 | | [cf\_arn](#output\_cf\_arn) | ARN of CloudFront distribution | 217 | | [cf\_domain\_name](#output\_cf\_domain\_name) | Domain name corresponding to the distribution | 218 | | [cf\_etag](#output\_cf\_etag) | Current version of the distribution's information | 219 | | [cf\_hosted\_zone\_id](#output\_cf\_hosted\_zone\_id) | CloudFront Route 53 Zone ID | 220 | | [cf\_id](#output\_cf\_id) | ID of CloudFront distribution | 221 | | [cf\_origin\_access\_identity](#output\_cf\_origin\_access\_identity) | A shortcut to the full path for the origin access identity to use in CloudFront | 222 | | [cf\_status](#output\_cf\_status) | Current status of the distribution | 223 | | [logs](#output\_logs) | Logs resource | 224 | 225 | 226 | 227 | 228 | 229 | 230 | 231 | 232 | ## Related Projects 233 | 234 | Check out these related projects. 235 | 236 | - [terraform-aws-cloudfront-s3-cdn](https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn) - Terraform module to easily provision CloudFront CDN backed by an S3 origin 237 | - [terraform-aws-s3-log-storage](https://github.com/cloudposse/terraform-aws-s3-log-storage) - This module creates an S3 bucket suitable for receiving logs from other AWS services such as S3, CloudFront, and CloudTrail 238 | - [terraform-aws-cloudtrail](https://github.com/cloudposse/terraform-aws-cloudtrail) - Terraform module to provision an AWS CloudTrail and an encrypted S3 bucket with versioning to store CloudTrail logs 239 | - [terraform-aws-s3-website](https://github.com/cloudposse/terraform-aws-s3-website) - Terraform module to provision S3-backed websites 240 | - [terraform-root-modules/aws/docs](https://github.com/cloudposse/terraform-root-modules/tree/master/aws/docs) - Reference implementation combining `terraform-aws-s3-website` with `terraform-aws-cdn` 241 | 242 | 243 | > [!TIP] 244 | > #### Use Terraform Reference Architectures for AWS 245 | > 246 | > Use Cloud Posse's ready-to-go [terraform architecture blueprints](https://cloudposse.com/reference-architecture/) for AWS to get up and running quickly. 247 | > 248 | > ✅ We build it together with your team.
249 | > ✅ Your team owns everything.
250 | > ✅ 100% Open Source and backed by fanatical support.
251 | > 252 | > Request Quote 253 | >
📚 Learn More 254 | > 255 | >
256 | > 257 | > Cloud Posse is the leading [**DevOps Accelerator**](https://cpco.io/commercial-support?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-cdn&utm_content=commercial_support) for funded startups and enterprises. 258 | > 259 | > *Your team can operate like a pro today.* 260 | > 261 | > Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed. 262 | > #### Day-0: Your Foundation for Success 263 | > - **Reference Architecture.** You'll get everything you need from the ground up built using 100% infrastructure as code. 264 | > - **Deployment Strategy.** Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases. 265 | > - **Site Reliability Engineering.** Gain total visibility into your applications and services with Datadog, ensuring high availability and performance. 266 | > - **Security Baseline.** Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations. 267 | > - **GitOps.** Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions. 268 | > 269 | > Request Quote 270 | > 271 | > #### Day-2: Your Operational Mastery 272 | > - **Training.** Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency. 273 | > - **Support.** Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it. 274 | > - **Troubleshooting.** Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity. 275 | > - **Code Reviews.** Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration. 276 | > - **Bug Fixes.** Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly. 277 | > - **Migration Assistance.** Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value. 278 | > - **Customer Workshops.** Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate. 279 | > 280 | > Request Quote 281 | > 282 |
283 | 284 | ## ✨ Contributing 285 | 286 | This project is under active development, and we encourage contributions from our community. 287 | 288 | 289 | 290 | Many thanks to our outstanding contributors: 291 | 292 | 293 | 294 | 295 | 296 | For 🐛 bug reports & feature requests, please use the [issue tracker](https://github.com/cloudposse/terraform-aws-cloudfront-cdn/issues). 297 | 298 | In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow. 299 | 1. Review our [Code of Conduct](https://github.com/cloudposse/terraform-aws-cloudfront-cdn/?tab=coc-ov-file#code-of-conduct) and [Contributor Guidelines](https://github.com/cloudposse/.github/blob/main/CONTRIBUTING.md). 300 | 2. **Fork** the repo on GitHub 301 | 3. **Clone** the project to your own machine 302 | 4. **Commit** changes to your own branch 303 | 5. **Push** your work back up to your fork 304 | 6. Submit a **Pull Request** so that we can review your changes 305 | 306 | **NOTE:** Be sure to merge the latest changes from "upstream" before making a pull request! 307 | 308 | 309 | ## Running Terraform Tests 310 | 311 | We use [Atmos](https://atmos.tools) to streamline how Terraform tests are run. It centralizes configuration and wraps common test workflows with easy-to-use commands. 312 | 313 | All tests are located in the [`test/`](test) folder. 314 | 315 | Under the hood, tests are powered by Terratest together with our internal [Test Helpers](https://github.com/cloudposse/test-helpers) library, providing robust infrastructure validation. 316 | 317 | Setup dependencies: 318 | - Install Atmos ([installation guide](https://atmos.tools/install/)) 319 | - Install Go [1.24+ or newer](https://go.dev/doc/install) 320 | - Install Terraform or OpenTofu 321 | 322 | To run tests: 323 | 324 | - Run all tests: 325 | ```sh 326 | atmos test run 327 | ``` 328 | - Clean up test artifacts: 329 | ```sh 330 | atmos test clean 331 | ``` 332 | - Explore additional test options: 333 | ```sh 334 | atmos test --help 335 | ``` 336 | The configuration for test commands is centrally managed. To review what's being imported, see the [`atmos.yaml`](https://raw.githubusercontent.com/cloudposse/.github/refs/heads/main/.github/atmos/terraform-module.yaml) file. 337 | 338 | Learn more about our [automated testing in our documentation](https://docs.cloudposse.com/community/contribute/automated-testing/) or implementing [custom commands](https://atmos.tools/core-concepts/custom-commands/) with atmos. 339 | 340 | ### 🌎 Slack Community 341 | 342 | Join our [Open Source Community](https://cpco.io/slack?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-cdn&utm_content=slack) on Slack. It's **FREE** for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally *sweet* infrastructure. 343 | 344 | ### 📰 Newsletter 345 | 346 | Sign up for [our newsletter](https://cpco.io/newsletter?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-cdn&utm_content=newsletter) and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. 347 | Dropped straight into your Inbox every week — and usually a 5-minute read. 348 | 349 | ### 📆 Office Hours 350 | 351 | [Join us every Wednesday via Zoom](https://cloudposse.com/office-hours?utm_source=github&utm_medium=readme&utm_campaign=cloudposse/terraform-aws-cloudfront-cdn&utm_content=office_hours) for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a _live Q&A_ that you can’t find anywhere else. 352 | It's **FREE** for everyone! 353 | ## License 354 | 355 | License 356 | 357 |
358 | Preamble to the Apache License, Version 2.0 359 |
360 |
361 | 362 | Complete license is available in the [`LICENSE`](LICENSE) file. 363 | 364 | ```text 365 | Licensed to the Apache Software Foundation (ASF) under one 366 | or more contributor license agreements. See the NOTICE file 367 | distributed with this work for additional information 368 | regarding copyright ownership. The ASF licenses this file 369 | to you under the Apache License, Version 2.0 (the 370 | "License"); you may not use this file except in compliance 371 | with the License. You may obtain a copy of the License at 372 | 373 | https://www.apache.org/licenses/LICENSE-2.0 374 | 375 | Unless required by applicable law or agreed to in writing, 376 | software distributed under the License is distributed on an 377 | "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 378 | KIND, either express or implied. See the License for the 379 | specific language governing permissions and limitations 380 | under the License. 381 | ``` 382 |
383 | 384 | ## Trademarks 385 | 386 | All other trademarks referenced herein are the property of their respective owners. 387 | 388 | 389 | --- 390 | Copyright © 2017-2025 [Cloud Posse, LLC](https://cpco.io/copyright) 391 | 392 | 393 | README footer 394 | 395 | Beacon 396 | --------------------------------------------------------------------------------