AWS CloudFront Reference

resource "aws_cloudfront_origin_access_control" "this" {
  name                              = "${var.name}-oac"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

data "aws_iam_policy_document" "cloudfront_oac" {
  statement {
    sid    = "AllowCloudFrontServicePrincipal"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }

    actions   = ["s3:GetObject"]
    resources = ["${aws_s3_bucket.origin.arn}/*"]

    condition {
      test     = "StringEquals"
      variable = "AWS:SourceArn"
      # Scope to the specific distribution — not all CloudFront
      values = [aws_cloudfront_distribution.this.arn]
    }
  }
}

resource "aws_cloudfront_cache_policy" "api" {
  name        = "${var.name}-api"
  default_ttl = 0
  max_ttl     = 0
  min_ttl     = 0

  parameters_in_cache_key_and_forwarded_to_origin {
    cookies_config  { cookie_behavior = "none" }
    headers_config  { header_behavior = "none" }
    query_strings_config { query_string_behavior = "none" }
    enable_accept_encoding_gzip   = false
    enable_accept_encoding_brotli = false
  }
}

resource "aws_cloudfront_response_headers_policy" "security" {
  name = "${var.name}-security-headers"

  security_headers_config {
    strict_transport_security {
      access_control_max_age_sec = 31536000
      include_subdomains         = true
      preload                    = true
      override                   = true
    }

    content_type_options {
      override = true  # X-Content-Type-Options: nosniff
    }

    frame_options {
      frame_option = "DENY"
      override     = true
    }

    referrer_policy {
      referrer_policy = "strict-origin-when-cross-origin"
      override        = true
    }

    xss_protection {
      mode_block = true
      protection = true
      override   = true
    }
  }

  custom_headers_config {
    items {
      header   = "Permissions-Policy"
      value    = "camera=(), microphone=(), geolocation=()"
      override = true
    }
  }
}

origin {
  domain_name = aws_lb.this.dns_name
  origin_id   = "alb"

  custom_header {
    name  = "X-CloudFront-Secret"
    value = var.cloudfront_origin_secret  # stored in Secrets Manager, rotated
  }
}

# In your CloudFront distribution
resource "aws_cloudfront_distribution" "this" {
  web_acl_id = var.waf_web_acl_arn  # pass in from WAF module (us-east-1)
  ...
}

resource "aws_lambda_function" "edge" {
  provider  = aws.us_east_1
  publish   = true  # creates a numbered version
  ...
}

# Use qualified_arn (includes version number), NOT arn
lambda_function_association {
  event_type   = "viewer-request"
  lambda_arn   = aws_lambda_function.edge.qualified_arn  # ✅ e.g. arn:...:function:name:3
  include_body = false
}

data "aws_iam_policy_document" "edge_trust" {
  statement {
    principals {
      type = "Service"
      identifiers = [
        "lambda.amazonaws.com",
        "edgelambda.amazonaws.com",  # required — without this, replication fails silently
      ]
    }
    actions = ["sts:AssumeRole"]
  }
}

// index.js — runs at viewer-request, validates JWT in Authorization header
exports.handler = async (event) => {
  const request = event.Records[0].cf.request;
  const headers = request.headers;

  const auth = headers['authorization'] ? headers['authorization'][0].value : null;

  if (!auth || !auth.startsWith('Bearer ')) {
    return {
      status: '401',
      statusDescription: 'Unauthorized',
      headers: {
        'www-authenticate': [{ key: 'WWW-Authenticate', value: 'Bearer' }],
      },
    };
  }

  // validate token here (no network calls — validate signature locally)
  return request;
};

# Must use us-east-1 provider alias
resource "aws_lambda_function" "edge" {
  provider         = aws.us_east_1
  filename         = data.archive_file.edge.output_path
  source_code_hash = data.archive_file.edge.output_base64sha256
  function_name    = "${var.name}-edge-viewer-request"
  role             = aws_iam_role.edge.arn
  handler          = "index.handler"
  runtime          = "nodejs22.x"
  publish          = true  # numbered version required

  depends_on = [aws_cloudwatch_log_group.edge]
}

data "archive_file" "edge" {
  type        = "zip"
  source_file = "${path.module}/functions/index.js"
  output_path = "${path.module}/functions/edge.zip"
}

resource "aws_iam_role" "edge" {
  provider           = aws.us_east_1
  name               = "${var.name}-edge-role"
  assume_role_policy = data.aws_iam_policy_document.edge_trust.json
}

resource "aws_iam_role_policy_attachment" "edge_basic" {
  provider   = aws.us_east_1
  role       = aws_iam_role.edge.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

# CloudWatch log group in us-east-1 — edge logs replicate here
resource "aws_cloudwatch_log_group" "edge" {
  provider          = aws.us_east_1
  name              = "/aws/lambda/us-east-1.${var.name}-edge-viewer-request"
  retention_in_days = 30
}

// Rewrites /product/123 → /product?id=123
function handler(event) {
  var request = event.request;
  var uri = request.uri;

  var match = uri.match(/^\/product\/(\d+)$/);
  if (match) {
    request.uri = '/product';
    request.querystring = { id: { value: match[1] } };
  }

  return request;
}

resource "aws_cloudfront_function" "url_rewrite" {
  name    = "${var.name}-url-rewrite"
  runtime = "cloudfront-js-2.0"
  publish = true
  code    = file("${path.module}/functions/url-rewrite.js")
}

# Associate in cache behavior
function_association {
  event_type   = "viewer-request"
  function_arn = aws_cloudfront_function.url_rewrite.arn
}

resource "aws_cloudfront_distribution" "this" {
  logging_config {
    bucket          = aws_s3_bucket.logs.bucket_domain_name
    prefix          = "cloudfront/${var.name}/"
    include_cookies = false  # enable for debugging, disable for cost
  }
}

resource "aws_cloudfront_realtime_log_config" "this" {
  name          = "${var.name}-realtime"
  sampling_rate = 5  # 1–100 percent of requests

  endpoint {
    stream_type = "Kinesis"
    kinesis_stream_config {
      role_arn   = aws_iam_role.realtime_log.arn
      stream_arn = aws_kinesis_stream.logs.arn
    }
  }

  fields = [
    "timestamp", "c-ip", "sc-status", "cs-method",
    "cs-uri-stem", "time-taken", "x-edge-location",
    "cs-protocol", "cs-bytes", "x-edge-result-type",
    "x-host-header", "cs-user-agent",
  ]
}

s3://logs-bucket/cloudfront/my-distribution/year=2026/month=05/day=22/

CREATE EXTERNAL TABLE cloudfront_logs (
  date DATE, time STRING, x_edge_location STRING,
  sc_bytes BIGINT, cs_method STRING, cs_host STRING,
  cs_uri_stem STRING, sc_status INT, cs_referer STRING,
  cs_user_agent STRING, cs_uri_query STRING
)
PARTITIONED BY (year STRING, month STRING, day STRING)
ROW FORMAT DELIMITED FIELDS TERMINATED BY '\t'
LOCATION 's3://logs-bucket/cloudfront/my-distribution/'
TBLPROPERTIES (
  'projection.enabled' = 'true',
  'projection.year.type' = 'integer', 'projection.year.range' = '2024,2030',
  'projection.month.type' = 'integer', 'projection.month.range' = '1,12', 'projection.month.digits' = '2',
  'projection.day.type' = 'integer', 'projection.day.range' = '1,31', 'projection.day.digits' = '2',
  'storage.location.template' = 's3://logs-bucket/cloudfront/my-distribution/year=${year}/month=${month}/day=${day}/'
);

{
  "Effect": "Allow",
  "Principal": { "Service": "delivery.logs.amazonaws.com" },
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::central-logs-bucket/cloudfront/*",
  "Condition": {
    "StringEquals": { "aws:SourceOrgID": "o-xxxxxxxxxxxx" }
  }
}

CDN account (platform)          Spoke account (app team)
──────────────────────          ─────────────────────────
aws_cloudfront_distribution  →  aws_s3_bucket (origin)
aws_cloudfront_origin_access_control
                                aws_s3_bucket_policy:
                                  Principal: cloudfront.amazonaws.com
                                  Condition: AWS:SourceArn = distribution ARN
                                  (cross-account — account ID in ARN differs)

Security account                App account
────────────────                ──────────────────────────
aws_fms_policy          →       aws_wafv2_web_acl (auto-created by FMS)
  scope: OU=production           aws_cloudfront_distribution
  auto_remediation: true           web_acl_id = (FMS-managed)

{
  "Effect": "Deny",
  "Action": "cloudfront:CreateDistribution",
  "Resource": "*",
  "Condition": {
    "Null": { "cloudfront:WebAclId": "true" }
  }
}

resource "aws_s3_bucket_policy" "central_logs" {
  bucket = aws_s3_bucket.central_logs.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowCloudFrontLogsFromOrg"
        Effect = "Allow"
        Principal = { Service = "delivery.logs.amazonaws.com" }
        Action   = "s3:PutObject"
        Resource = "${aws_s3_bucket.central_logs.arn}/cloudfront/*"
        Condition = {
          StringEquals = { "aws:SourceOrgID" = var.org_id }
        }
      },
      {
        Sid    = "AllowCloudFrontACLCheck"
        Effect = "Allow"
        Principal = { Service = "delivery.logs.amazonaws.com" }
        Action   = "s3:GetBucketAcl"
        Resource = aws_s3_bucket.central_logs.arn
      }
    ]
  })
}