Skip to content

CloudFront

S3 buckets host files and Amazon CloudFront serves them.

CloudFront to S3

CloudFront to S3

Byks guides

GitHub actions

Terraform configuration

Each entry in the cloudfront_distributions map provisions one CloudFront distribution, with an S3 bucket created by default. The map key becomes the distribution's subdomain, for example kattehotell becomes kattehotell.test.bymoslo.net.

main.tf
module "application" {
  source = "git@github.com:BYM-IKT/terraform-byks-module.git?ref=v12"
  # ...

  cloudfront_distributions = {
    kattehotell = {
      # options go here
    }
  }
}

Options

Option Type Default Description
default_s3_origin_type string "static_site" Either static_site or private_storage. Sets the access policy on the default S3 origin. Use private_storage to access objects in a private S3 bucket. See Secure Access to S3 Buckets.
default_s3_origin_bucket_name string null Name of an existing S3 bucket to use as the default origin, instead of creating one. Required when default_s3_origin_type is private_storage, since no bucket gets created automatically in that case.
default_s3_origin_bucket_arn string null ARN of the existing S3 bucket. Set together with default_s3_origin_bucket_name. Required when default_s3_origin_type is private_storage.
default_s3_origin_domain string null Domain name of the existing S3 bucket. Set together with default_s3_origin_bucket_name. Required when default_s3_origin_type is private_storage.
default_s3_origin_extra_policy string null Extra IAM policy statement, as JSON, added to the default S3 bucket's policy.
compress bool true Compress objects when a viewer supports it.
custom_error_responses list(any) SPA fallback for 403 Custom responses for origin errors. Defaults to returning /index.html with a 200 status for 403 errors, for single-page app client-side routing.
evaluate_target_health bool false Enable target health evaluation on the Route53 alias record.
use_s3_bucket_regional_domain_name bool true Use the S3 bucket's regional domain name as the origin, instead of the global one. Only applies to the automatically created bucket.
force_destroy_s3 bool true Let Terraform delete the S3 bucket even if it still contains objects. Only applies to the automatically created bucket, so only relevant when default_s3_origin_type is static_site.
ordered_cache_behaviour any [] Extra cache behaviors, for routing specific path patterns to a different origin.
cache_policy_id string null Custom CloudFront cache policy ID, instead of the default Managed-CachingOptimized policy.
enable_waf bool false Attach a WAF web ACL to the distribution. Has no effect unless web_acl_arn is also set.
web_acl_arn string "" ARN of the WAF web ACL to attach directly. Required for enable_waf to have any effect, including tag-based association through waf_tag.
waf_tag map(string) { "WAF-PROTECT" = "True" } Tag applied to the distribution when enable_waf is true and web_acl_arn is set. A centrally managed WAF policy uses it to associate a shared web ACL automatically.
override_s3_bucket_name string null Custom name for the created S3 bucket, instead of the generated default. Only applies to the automatically created bucket.
override_default_origin_name string null Custom origin ID, instead of the generated default <key>-s3.
additional_domains list(object) [] Extra domains that route to the same distribution. See Extra domain object and Adding more domains.
override_primary_domain object null Replace the generated primary domain with a custom one. See Primary domain object.
additional_s3_origins list(object) [] Extra S3 origins for the distribution. See Extra S3 origin object.
default_lambda_function_association map(object) {} Lambda@Edge functions to associate with the default cache behavior. See Lambda function association object.
lambda_edge_auth object { enabled = false } Lambda@Edge authentication. See Lambda@Edge auth object.

Extra domain object

Used in additional_domains.

Option Type Default Description
domain_name string required Domain to route to this distribution.
zone_name string required Route53 hosted zone the DNS record is created in.
create_dns_record bool true Set to false if the DNS record already exists outside Route53.

Primary domain object

Used in override_primary_domain. Same shape as the Extra domain object: domain_name, zone_name, and create_dns_record.

Extra S3 origin object

Used in additional_s3_origins.

Option Type Default Description
origin_type string required Origin type, static_site or private_storage.
origin_id string required Identifier for the origin, referenced from ordered_cache_behaviour.
origin_path string null Path CloudFront appends to origin requests.
s3_bucket_arn string required ARN of the S3 bucket.
s3_bucket_name string required Name of the S3 bucket.
connection_attempts number null Number of times CloudFront tries to connect to the origin.
connection_timeout number null Seconds CloudFront waits for a connection to the origin.
domain_name string required Domain name of the S3 bucket.
custom_header list(object) null Extra headers sent to the origin. Each entry has name and value.
origin_shield object null Origin Shield configuration. Has enabled and origin_shield_region.

Lambda function association object

Used in default_lambda_function_association. The map key is an arbitrary identifier for the association.

Option Type Default Description
event_type string required CloudFront event that triggers the function, for example viewer-request.
lambda_arn string required ARN of the Lambda function version.
include_body bool false Include the request body when triggering the function.

Lambda@Edge auth object

Used in lambda_edge_auth.

Warning

Not in use in production. Cold starts in Lambda@Edge caused issues, and the feature needs testing again before production use.

Option Type Default Description
enabled bool false Turn on Lambda@Edge authentication for the distribution.
function_name string null Name of the Lambda function.
runtime string "python3.12" Lambda runtime.
ssm_policy_arn string null IAM policy ARN granting access to the required SSM parameters.
secrets_policy_arn string null IAM policy ARN granting access to the required Secrets Manager secrets.
event_type string "viewer-request" CloudFront event that triggers the function.
include_body bool false Include the request body when triggering the function.

Resources