mirror of
https://github.com/Hestia-Homes/Model.git
synced 2026-06-08 11:17:27 +00:00
144 lines
No EOL
3.2 KiB
HCL
144 lines
No EOL
3.2 KiB
HCL
############################################
|
|
# CloudFront Distribution
|
|
############################################
|
|
|
|
resource "aws_cloudfront_distribution" "this" {
|
|
|
|
##########################################
|
|
# Origins
|
|
##########################################
|
|
|
|
dynamic "origin" {
|
|
for_each = { for o in var.origins : o.origin_id => o }
|
|
|
|
content {
|
|
domain_name = origin.value.origin_domain_name
|
|
origin_id = origin.value.origin_id
|
|
|
|
######################################
|
|
# S3 Origin
|
|
######################################
|
|
dynamic "s3_origin_config" {
|
|
for_each = origin.value.origin_type == "s3" ? [1] : []
|
|
|
|
content {
|
|
origin_access_identity =
|
|
aws_cloudfront_origin_access_identity.oai[origin.key]
|
|
.cloudfront_access_identity_path
|
|
}
|
|
}
|
|
|
|
######################################
|
|
# API Gateway Origin
|
|
######################################
|
|
dynamic "custom_origin_config" {
|
|
for_each = origin.value.origin_type == "api" ? [1] : []
|
|
|
|
content {
|
|
http_port = 80
|
|
https_port = 443
|
|
origin_protocol_policy = "https-only"
|
|
origin_ssl_protocols = ["TLSv1.2"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
enabled = true
|
|
aliases = var.aliases
|
|
|
|
##########################################
|
|
# Default Cache Behavior
|
|
##########################################
|
|
|
|
default_cache_behavior {
|
|
target_origin_id = var.origins[0].origin_id
|
|
|
|
viewer_protocol_policy = "redirect-to-https"
|
|
|
|
allowed_methods = [
|
|
"GET",
|
|
"HEAD"
|
|
]
|
|
|
|
cached_methods = [
|
|
"GET",
|
|
"HEAD"
|
|
]
|
|
|
|
forwarded_values {
|
|
query_string = true
|
|
headers = ["*"]
|
|
|
|
cookies {
|
|
forward = "all"
|
|
}
|
|
}
|
|
|
|
compress = true
|
|
min_ttl = 0
|
|
default_ttl = 3600
|
|
max_ttl = 86400
|
|
}
|
|
|
|
price_class = "PriceClass_All"
|
|
|
|
##########################################
|
|
# Geo Restrictions
|
|
##########################################
|
|
|
|
restrictions {
|
|
geo_restriction {
|
|
restriction_type = "none"
|
|
}
|
|
}
|
|
|
|
##########################################
|
|
# SSL Certificate
|
|
##########################################
|
|
|
|
viewer_certificate {
|
|
cloudfront_default_certificate = true
|
|
}
|
|
}
|
|
|
|
############################################
|
|
# Origin Access Identities (S3 only)
|
|
############################################
|
|
|
|
resource "aws_cloudfront_origin_access_identity" "oai" {
|
|
for_each = {
|
|
for o in var.origins : o.origin_id => o
|
|
if o.origin_type == "s3"
|
|
}
|
|
|
|
comment = "OAI for ${each.key}"
|
|
}
|
|
|
|
############################################
|
|
# S3 Bucket Policy (S3 only)
|
|
############################################
|
|
|
|
resource "aws_s3_bucket_policy" "bucket_policy" {
|
|
for_each = {
|
|
for o in var.origins : o.origin_id => o
|
|
if o.origin_type == "s3"
|
|
}
|
|
|
|
bucket = each.value.bucket_id
|
|
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Principal = {
|
|
AWS = aws_cloudfront_origin_access_identity.oai[each.key]
|
|
.iam_arn
|
|
}
|
|
Action = "s3:GetObject"
|
|
Resource = "${each.value.bucket_arn}/*"
|
|
}
|
|
]
|
|
})
|
|
} |