AWS CloudFront Terraform module

Upstream version 6.7.0

2 controls from NIST Cybersecurity Framework v2.0 requirements

Terraform Module Source

nistcsf.compliance.tf/terraform-aws-modules/cloudfront/aws

Compliance Inputs Outputs Resources Diff (0)README

41 unique

Name	Type	Default	Description
Required · needed to use this module
default_cache_behavior	object({...})	—	The default cache behavior for this distribution
Enforced · locked by active controls
logging_configcloudfront_distribution_logging_enabled	object({...})	null	The logging configuration that controls how logs are written to your distribution (maximum one)
viewer_certificatecloudfront_distribution_use_custom_ssl_certificate	object({...})	{}	The SSL configuration for this distribution
Optional
aliases	list(string)	null	Extra CNAMEs (alternate domain names), if any, for this distribution
anycast_ip_list_id	string	null	ID of the Anycast static IP list that is associated with the distribution
cache_policies	map({...})	null	Map of CloudFront cache policies
cache_tag_config	object({...})	null	Cache tag configuration block for cache tag extraction from origin responses (maximum one). See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/invalidation-by-tags.html) for more information about cache tags
cloudfront_functions	map({...})	null	Map of CloudFront Function configurations. Key is used as default function name if 'name' not specified
comment	string	null	Any comments you want to include about the distribution
connection_function_association_id	string	null	Identifier of the connection function to associate with the distribution
connection_function_code	string	null	The code of the CloudFront connection function
connection_function_config	object({...})	null	Configuration block for the CloudFront connection function
connection_function_name	string	null	The name of the CloudFront connection function
connection_function_publish	bool	null	Whether to publish the function to the LIVE stage after creation or update. Defaults to false
continuous_deployment_policy_id	string	null	Identifier of a continuous deployment policy. This argument should only be set on a production distribution
create	bool	true	Controls if resources should be created (affects nearly all resources)
create_connection_function	bool	false	Controls whether to create a CloudFront connection function
create_monitoring_subscription	bool	false	If enabled, the resource for monitoring subscription will created
custom_error_response	list({...})	null	One or more custom error response elements
default_root_object	string	null	The object that you want CloudFront to return (for example, index.html) when an end user requests the root URL
enable_v2_logging	bool	false	Whether to enable v2 logging for the CloudFront distribution
enabled	bool	true	Whether the distribution is enabled to accept end user requests for content
http_version	string	"http2"	The maximum HTTP version to support on the distribution. Allowed values are http1.1, http2, http2and3, and http3. The default is http2
is_ipv6_enabled	bool	true	Whether the IPv6 is enabled for the distribution
ordered_cache_behavior	list({...})	[]	An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0
origin	map({...})	{}	One or more origins for this distribution (multiples allowed)
origin_access_control	map({...})	{...}	Map of CloudFront origin access control
origin_group	map({...})	null	One or more origin_group for this distribution (multiples allowed)
origin_request_policies	map({...})	null	Map of CloudFront origin request policies
price_class	string	null	The price class for this distribution. One of `PriceClass_All`, `PriceClass_200`, `PriceClass_100`
realtime_metrics_subscription_status	string	"Enabled"	A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`
response_headers_policies	map({...})	null	Map of CloudFront response headers policies with their configurations
restrictions	object({...})	{...}	The restrictions configuration for this distribution
retain_on_delete	bool	null	Disables the distribution instead of deleting it when destroying the resource through Terraform. If this is set, the distribution needs to be deleted manually afterwards
staging	bool	null	Whether the distribution is a staging distribution
tags	map(string)	{}	A map of tags to add to all resources
v2_logging	object({...})	null	Configuration block for v2 logging destination
viewer_mtls_config	object({...})	null	The viewer mTLS configuration for this distribution
vpc_origin	map({...})	null	Map of CloudFront VPC origins
wait_for_deployment	bool	null	If enabled, the resource will wait for the distribution status to change from InProgress to Deployed. Setting this to false will skip the process
web_acl_id	string	null	If you're using AWS WAF to filter CloudFront requests, the Id of the AWS WAF web ACL that is associated with the distribution. The WAF Web ACL must exist in the WAF Global (CloudFront) region and the credentials configuring this argument must have waf:GetWebACL permissions assigned. If using WAFv2, provide the ARN of the web ACL