Skip to content

Commit 8977173

Browse files
posquit0posquit0
authored
Add origin-access-control module (#24)
1 parent a9479ec commit 8977173

File tree

8 files changed

+177
-0
lines changed

8 files changed

+177
-0
lines changed

‎.github/labeler.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
- modules/distribution/**/*
44
":floppy_disk: cache-policy":
55
- modules/cache-policy/**/*
6+
":floppy_disk: origin-access-control":
7+
- modules/origin-access-control/**/*
68
":floppy_disk: origin-request-policy":
79
- modules/origin-request-policy/**/*
810
":floppy_disk: response-headers-policy":

‎.github/labels.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@
4646
- color: "fbca04"
4747
description: "This issue or pull request is related to cache-policy module."
4848
name: ":floppy_disk: cache-policy"
49+
- color: "fbca04"
50+
description: "This issue or pull request is related to origin-access-control module."
51+
name: ":floppy_disk: origin-access-control"
4952
- color: "fbca04"
5053
description: "This issue or pull request is related to origin-request-policy module."
5154
name: ":floppy_disk: origin-request-policy"

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ Terraform module which creates CloudFront related resources on AWS.
88

99
- [cache-policy](./modules/cache-policy)
1010
- [distribution](./modules/distribution)
11+
- [origin-access-control](./modules/origin-access-control)
1112
- [origin-request-policy](./modules/origin-request-policy)
1213
- [response-headers-policy](./modules/response-headers-policy)
1314

@@ -19,6 +20,8 @@ Terraform Modules from [this package](https://github.com/tedilabs/terraform-aws-
1920
- **AWS CloudFront**
2021
- Distribution
2122
- Real-time Log Configuration (Comming soon!)
23+
- Origin Access
24+
- Origin Access Control
2225
- Policies
2326
- Cache Policy
2427
- Origin Request Policy

‎modules/origin-access-control/README.md

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# origin-access-control
2+
3+
This module creates following resources.
4+
5+
- `aws_cloudfront_origin_access_control`
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Requirements
9+
10+
| Name | Version |
11+
|------|---------|
12+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6 |
13+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.19 |
14+
15+
## Providers
16+
17+
| Name | Version |
18+
|------|---------|
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.26.0 |
20+
21+
## Modules
22+
23+
No modules.
24+
25+
## Resources
26+
27+
| Name | Type |
28+
|------|------|
29+
| [aws_cloudfront_origin_access_control.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control) | resource |
30+
31+
## Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_name"></a> [name](#input\_name) | (Required) A name to identify the origin access control. | `string` | n/a | yes |
36+
| <a name="input_description"></a> [description](#input\_description) | (Optional) A description of the origin access control. | `string` | `"Managed by Terraform."` | no |
37+
| <a name="input_origin_type"></a> [origin\_type](#input\_origin\_type) | (Optional) The type of origin that this origin access control is for. Valid values are `S3` and `MEDIASTORE`. Defaults to `S3`. | `string` | `"S3"` | no |
38+
| <a name="input_signing_behavior"></a> [signing\_behavior](#input\_signing\_behavior) | (Optional) Specify which requests CloudFront signs (adds authentication information to). Valid values are `ALWAYS`, `NEVER`, `NO_OVERRIDE`. Defaults to `ALWAYS`.<br> `ALWAYS` - CloudFront signs all origin requests, overwriting the `Authorization` header from the viewer request if one exists.<br> `NEVER` - CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.<br> `NO_OVERRIDE` - If the viewer request doesn't contain the `Authorization` header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. | `string` | `"ALWAYS"` | no |
39+
40+
## Outputs
41+
42+
| Name | Description |
43+
|------|-------------|
44+
| <a name="output_description"></a> [description](#output\_description) | The description of the origin access control. |
45+
| <a name="output_etag"></a> [etag](#output\_etag) | The current version of the origin access control. |
46+
| <a name="output_id"></a> [id](#output\_id) | The ID of the origin access control. |
47+
| <a name="output_name"></a> [name](#output\_name) | The name of the CloudFront origin access control. |
48+
| <a name="output_origin_type"></a> [origin\_type](#output\_origin\_type) | The type of origin that this origin access control is for. |
49+
| <a name="output_signing_behavior"></a> [signing\_behavior](#output\_signing\_behavior) | Specify which requests CloudFront signs (adds authentication information to). |
50+
| <a name="output_signing_protocol"></a> [signing\_protocol](#output\_signing\_protocol) | The signing protocol of the origin access control. |
51+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/origin-access-control/main.tf

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
locals {
2+
metadata = {
3+
package = "terraform-aws-cloudfront"
4+
version = trimspace(file("${path.module}/../../VERSION"))
5+
module = basename(path.module)
6+
name = var.name
7+
}
8+
}
9+
10+
locals {
11+
signing_behaviors = {
12+
"ALWAYS" = "always"
13+
"NEVER" = "never"
14+
"NO_OVERRIDE" = "no-override"
15+
}
16+
}
17+
18+
19+
###################################################
20+
# Origin Access Control for CloudFront Distribution
21+
###################################################
22+
23+
resource "aws_cloudfront_origin_access_control" "this" {
24+
name = var.name
25+
description = var.description
26+
27+
origin_access_control_origin_type = lower(var.origin_type)
28+
signing_behavior = local.signing_behaviors[var.signing_behavior]
29+
signing_protocol = "sigv4"
30+
}

‎modules/origin-access-control/outputs.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
output "id" {
2+
description = "The ID of the origin access control."
3+
value = aws_cloudfront_origin_access_control.this.id
4+
}
5+
6+
output "etag" {
7+
description = "The current version of the origin access control."
8+
value = aws_cloudfront_origin_access_control.this.etag
9+
}
10+
11+
output "name" {
12+
description = "The name of the CloudFront origin access control."
13+
value = aws_cloudfront_origin_access_control.this.name
14+
}
15+
16+
output "description" {
17+
description = "The description of the origin access control."
18+
value = aws_cloudfront_origin_access_control.this.description
19+
}
20+
21+
output "origin_type" {
22+
description = "The type of origin that this origin access control is for."
23+
value = upper(aws_cloudfront_origin_access_control.this.origin_access_control_origin_type)
24+
}
25+
26+
output "signing_behavior" {
27+
description = "Specify which requests CloudFront signs (adds authentication information to)."
28+
value = {
29+
for k, v in local.signing_behaviors :
30+
v => k
31+
}[aws_cloudfront_origin_access_control.this.signing_behavior]
32+
}
33+
34+
output "signing_protocol" {
35+
description = "The signing protocol of the origin access control."
36+
value = upper(aws_cloudfront_origin_access_control.this.signing_protocol)
37+
}

‎modules/origin-access-control/variables.tf

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
variable "name" {
2+
description = "(Required) A name to identify the origin access control."
3+
type = string
4+
nullable = false
5+
}
6+
7+
variable "description" {
8+
description = "(Optional) A description of the origin access control."
9+
type = string
10+
default = "Managed by Terraform."
11+
nullable = false
12+
}
13+
14+
variable "origin_type" {
15+
description = "(Optional) The type of origin that this origin access control is for. Valid values are `S3` and `MEDIASTORE`. Defaults to `S3`."
16+
type = string
17+
default = "S3"
18+
nullable = false
19+
20+
validation {
21+
condition = contains(["S3", "MEDIASTORE"], var.origin_type)
22+
error_message = "Valid values for `origin_type` are `S3` and `MEDIASTORE`."
23+
}
24+
}
25+
26+
variable "signing_behavior" {
27+
description = <<EOF
28+
(Optional) Specify which requests CloudFront signs (adds authentication information to). Valid values are `ALWAYS`, `NEVER`, `NO_OVERRIDE`. Defaults to `ALWAYS`.
29+
`ALWAYS` - CloudFront signs all origin requests, overwriting the `Authorization` header from the viewer request if one exists.
30+
`NEVER` - CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
31+
`NO_OVERRIDE` - If the viewer request doesn't contain the `Authorization` header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request.
32+
EOF
33+
type = string
34+
default = "ALWAYS"
35+
nullable = false
36+
37+
validation {
38+
condition = contains(["ALWAYS", "NEVER", "NO_OVERRIDE"], var.signing_behavior)
39+
error_message = "Valid values for `signing_behavior` are `ALWAYS`, `NEVER` and `NO_OVERRIDE`."
40+
}
41+
}

‎modules/origin-access-control/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.6"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.19"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)