terraform-aws-arc-cloudfront

Module: sourcefuse/arc-cloudfront/aws

Registry: https://registry.terraform.io/modules/sourcefuse/arc-cloudfront/aws

Category: Networking / CDN

Source: https://github.com/sourcefuse/terraform-aws-arc-cloudfront

Tip

🤖 New: Use this module with AI assistants via the ARC IaC MCP Server — search, scaffold, and security-scan ARC modules from natural language. Quick setup ↓

Overview

SourceFuse AWS Reference Architecture (ARC) Terraform module for managing Cloudfront

For more information about this repository and its usage, please see Terraform AWS ARC CloudFront Usage Guide.

Usage

Important Note: When using custom ACM certificates (acm_details.domain_name is set), the certificate must be created in the us-east-1 region as required by CloudFront. If you're deploying in a different region, you'll need to configure a provider alias for us-east-1.

What It Does

• S3 and custom HTTP/HTTPS origins
• Custom cache and origin request policies
• ACM certificate creation (must be in us-east-1)
• Route53 alias records
• Lambda@Edge and CloudFront Functions
• Origin groups for failover
• WAF web ACL association
• Geo-restriction support

For more information about this repository and its usage, please see Terraform AWS CLOUDFRONT Usage Guide.

Quickstart

module "tags" {
  source  = "sourcefuse/arc-tags/aws"
  version = "1.2.3"

  environment = "dev"
  project     = "test"

  extra_tags = {
    RepoName = "terraform-aws-refarch-cloudfront"
  }
}

module "cloudfront" {
  source = "sourcefuse/arc-cloudfront/aws"
  #version = "4.0.6" --> Pin the right version
  providers = {
    aws.acm = aws.acm // Certificate has to be created in us-east-1 region
  }

  origins = [{
    origin_type   = "custom",
    origin_id     = "cloudfront-arc",
    domain_name   = "tst.wpengine.com",
    bucket_name   = "",
    create_bucket = false,
    custom_origin_config = {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "match-viewer"
      origin_ssl_protocols   = ["TLSv1"]
    }

    }
  ]

  namespace              = "test"
  description            = "This is a test Cloudfront distribution"
  route53_root_domain    = "sfrefarch.com" // Used to fetch the Hosted Zone
  create_route53_records = var.create_route53_records
  aliases                = ["cf.sfrefarch.com", "www.cf.sfrefarch.com", "test.sfrefarch.com", "*.sfrefarch.com", "test1.sfrefarch.com"]
  enable_logging         = var.enable_logging // Create a new S3 bucket for storing Cloudfront logs

  default_cache_behavior = {
    origin_id              = "cloudfront-arc",
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = false
    viewer_protocol_policy = "redirect-to-https"

    use_aws_managed_cache_policy          = true
    cache_policy_name                     = "CachingOptimized"
    use_aws_managed_origin_request_policy = true
    origin_request_policy_name            = "CORS-S3Origin" // It can be custom or aws managed policy name , if custom origin_request_policies variable key should match
    lambda_function_association = [{
      event_type   = "viewer-request"
      lambda_arn   = aws_lambda_function.this.qualified_arn
      include_body = true
    }]

  }

  cache_behaviors = [
    {
      origin_id              = "cloudfront-arc",
      path_pattern           = "/content/immutable/*"
      allowed_methods        = ["GET", "HEAD"]
      cached_methods         = ["GET", "HEAD"]
      compress               = false
      viewer_protocol_policy = "redirect-to-https"

      use_aws_managed_cache_policy          = false
      cache_policy_name                     = "cache-policy-1" // Note: This has to match cache_polices mentioned below
      use_aws_managed_origin_request_policy = false
      origin_request_policy_name            = "origin-req-policy-1" // Note: This has to match origin_request_policies mentioned below

      function_association = [
        {
          event_type   = "viewer-request"
          function_arn = aws_cloudfront_function.this.arn
        }
      ]
    }
  ]

  viewer_certificate = {
    cloudfront_default_certificate = false // false :  It will create ACM certificate with details provided in acm_details
    minimum_protocol_version       = "TLSv1.2_2018"
    ssl_support_method             = "sni-only"
  }

  acm_details = {
    domain_name               = "*.sfrefarch.com",
    subject_alternative_names = ["www.cf.sfrefarch.com"]
  }

  cache_policies = {
    "cache-policy-1" = {
      default_ttl = 86400,
      max_ttl     = 31536000,
      min_ttl     = 0,
      cookies_config = {
        cookie_behavior = "none",
        items           = []
      },
      headers_config = {
        header_behavior = "whitelist",
        items           = ["Authorization", "Origin", "Accept", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Referer"]
      },
      query_string_behavior = {
        header_behavior = "none",
        items           = []
      },
      query_strings_config = {
        query_string_behavior = "none",
        items                 = []
      }
  } }


  origin_request_policies = {
    "origin-req-policy-1" = {
      cookies_config = {
        cookie_behavior = "none",
        items           = []
      },
      headers_config = {
        header_behavior = "whitelist",
        items = ["Accept", "Accept-Charset", "Accept-Datetime", "Accept-Language",
          "Access-Control-Request-Method", "Access-Control-Request-Headers", "CloudFront-Forwarded-Proto", "CloudFront-Is-Android-Viewer",
        "CloudFront-Is-Desktop-Viewer", "CloudFront-Is-IOS-Viewer"]
      },
      query_strings_config = {
        query_string_behavior = "none",
        items                 = []
      }
  } }

  custom_error_responses = [{
    error_caching_min_ttl = 10,
    error_code            = "404", // should be unique
    response_code         = "404",
    response_page_path    = "/custom_404.html"
  }]

  # Origin Groups for Disaster Recovery
  origin_groups = [{
    origin_id = "failover-group"
    failover_criteria = {
      status_codes = [403, 404, 500, 502, 503, 504]
    }
    members = [
      {
        origin_id = "primary-origin"
      },
      {
        origin_id = "secondary-origin"
      }
    ]
  }]

  s3_kms_details = {
    s3_bucket_encryption_type = "SSE-S3", //Encryption for S3 bucket , options : `SSE-S3` , `SSE-KMS`
    kms_key_administrators    = [],
    kms_key_users             = [], // Note :- Add users/roles who wanted to read/write to S3 bucket
    kms_key_arn               = null
  }

  tags = module.tags.tags

}

Required Inputs

Name	Type	Description
aliases	list(string)	FQDNs for the distribution
description	string	Distribution description
default_cache_behavior	object	Default cache behavior config
origins	list(object)	List of origins
## Key Outputs

Name	Description
cloudfront_id	CloudFront distribution ID
cloudfront_domain_name	CloudFront domain name
acm_certificate_arn	ACM certificate ARN
## Full Variable & Output Reference

The complete inputs/outputs reference is auto-generated below.

Requirements

Name	Version
terraform	>= 1.5, < 2.0.0
aws	>= 6.5.0, < 7.0.0

Providers

Name	Version
aws	4.67.0
aws.acm	4.67.0

Modules

Name	Source	Version
kms	sourcefuse/arc-kms/aws	1.0.11
s3_bucket	sourcefuse/arc-s3/aws	0.0.7
s3_bucket_logs	sourcefuse/arc-s3/aws	0.0.7

Resources

Name	Type
aws_acm_certificate.this	resource
aws_acm_certificate_validation.this	resource
aws_cloudfront_cache_policy.this	resource
aws_cloudfront_distribution.this	resource
aws_cloudfront_origin_access_control.s3	resource
aws_cloudfront_origin_request_policy.this	resource
aws_cloudfront_response_headers_policy.this	resource
aws_route53_record.root_domain	resource
aws_route53_record.this	resource
aws_s3_bucket_policy.cdn_bucket_policy	resource
aws_caller_identity.this	data source
aws_route53_zone.this	data source

Inputs

Name	Description	Type	Default	Required
acm_details	Details required for creating certificate eg. { domain_name = "test.com" subject_alternative_names = ["www.test.com"] }	object({ domain_name = optional(string, null) subject_alternative_names = optional(list(string), []) })	{ "domain_name": null, "subject_alternative_names": [] }	no
aliases	Fully qualified domain name for site being hosted	list(string)	n/a	yes
cache_behaviors	Set the cache behaviors for the distribution , Note:- You cannot use an origin request policy in a cache behavior without a cache policy.	list(object({ origin_id = string // should be same as what is given in origins path_pattern = string allowed_methods = list(string) cached_methods = list(string) response_headers_policy_name = optional(string, null) use_aws_managed_response_headers_policy = optional(bool, false) function_association = optional(list(object({ // Specific event to trigger this function. Valid values: viewer-request or viewer-response. event_type = string, function_arn = string }))) lambda_function_association = optional(list(object({ // A config block that triggers a lambda function with specific actions (maximum 4). event_type = string, lambda_arn = string, include_body = bool // When set to true it exposes the request body to the lambda function. }))) use_aws_managed_cache_policy = bool, cache_policy_name = string, // It can be custom or aws managed policy name , if custom cache_policies variable key should match use_aws_managed_origin_request_policy = optional(bool), origin_request_policy_name = optional(string), // It can be custom or aws managed policy name , if custom origin_request_policies variable key should match compress = bool, viewer_protocol_policy = string }))	[]	no
cache_policies	Cache policies, eg. { "cache-policy-1" = { default_ttl = 86400, max_ttl = 31536000, min_ttl = 0, cookies_config = { cookie_behavior = "none", items = [] }, headers_config = { header_behavior = "whitelist", items = ["Authorization", "Origin", "Accept", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Referer"] }, query_string_behavior = { header_behavior = "none", items = [] }, query_strings_config = { query_string_behavior = "none", items = [] } } }	map(object( { default_ttl = number, max_ttl = number, min_ttl = number, cookies_config = object({ cookie_behavior = string items = list(string) }), headers_config = object({ header_behavior = string items = list(string) }), query_strings_config = object({ query_string_behavior = string items = list(string) }) } ))	{}	no
create_route53_records	made optional route53	bool	false	no
custom_error_responses	One or more custom error response elements	list(object({ error_caching_min_ttl = optional(number), error_code = string, response_code = optional(string), response_page_path = optional(string) // eg: /custom_404.html }))	[]	no
default_cache_behavior	Default cache behavior for the distribution	object({ origin_id = string // should be same as what is given in origins allowed_methods = list(string) cached_methods = list(string) response_headers_policy_name = optional(string, null) use_aws_managed_response_headers_policy = optional(bool, false) function_association = optional(list(object({ // A config block that triggers a lambda function with specific actions (maximum 4). event_type = string, // Specific event to trigger this function. Valid values: viewer-request or viewer-response. function_arn = string }))) lambda_function_association = optional(list(object({ // A config block that triggers a lambda function with specific actions (maximum 4). event_type = string, lambda_arn = string, include_body = bool // When set to true it exposes the request body to the lambda function. }))) use_aws_managed_cache_policy = bool, cache_policy_name = string, // It can be custom or aws managed policy name , if custom cache_policies variable key should match use_aws_managed_origin_request_policy = optional(bool), origin_request_policy_name = optional(string), // It can be custom or aws managed policy name , if custom origin_request_policies variable key should match compress = bool viewer_protocol_policy = optional(string, "redirect-to-https") })	n/a	yes
default_root_object	Object that you want CloudFront to return (for example, index.html) when an end user requests the root URL.	string	"index.html"	no
description	CloudFron destribution description	string	n/a	yes
geo_restriction	Geographic restriction	object({ restriction_type = optional(string, "blacklist") locations = optional(list(string), ["KP", "RU"]) })	{ "locations": [], "restriction_type": "none" }	no
logging_config	CloudFront logging configuration	object({ enabled = optional(bool, false) bucket = optional(string) })	{ "bucket": null, "enabled": false }	no
origin_groups	List of Origin Groups for failover support	list(object({ origin_id = string failover_criteria = object({ status_codes = list(number) }) members = list(object({ origin_id = string })) }))	[]	no
origin_request_policies	Origin request policies, eg. { "origin-req-policy" = { cookies_config = { cookie_behavior = "none", items = [] }, headers_config = { header_behavior = "whitelist", items = ["Accept", "Accept-Charset", "Accept-Datetime", "Accept-Language", "Access-Control-Request-Method", "Access-Control-Request-Headers", "CloudFront-Forwarded-Proto", "CloudFront-Is-Android-Viewer", "CloudFront-Is-Desktop-Viewer", "CloudFront-Is-IOS-Viewer"] }, query_strings_config = { query_string_behavior = "none", items = [] } } }	map(object({ cookies_config = object({ cookie_behavior = string items = list(string) }), headers_config = object({ header_behavior = string items = list(string) }), query_strings_config = object({ query_string_behavior = string items = list(string) }) }))	{}	no
origins	List of Origins for Cloudfront	list(object({ origin_type = string // S3 or custom origin origin_id = string origin_path = optional(string) domain_name = string // required of origin is custom and if S3 bukcet is created outside the module bucket_name = optional(string) // required of origin is S3 create_bucket = bool // required of origin is S3 connection_attempts = optional(number, 3) connection_timeout = optional(number, 10) cors_configuration = optional(any) // cors for S3 primary_origin = optional(bool, true) // used in origin groups to identify primary origin manage_bucket_policy = optional(bool, true) // whether to manage bucket policy for S3 origin origin_shield = optional(object({ enabled = bool origin_shield_region = string }), { enabled = false origin_shield_region = null }) custom_origin_config = optional(object({ http_port = number https_port = number origin_protocol_policy = string origin_ssl_protocols = list(string) origin_keepalive_timeout = optional(number, 5) origin_read_timeout = optional(number, 30) })) }))	[]	no
price_class	Price class for this distribution. One of PriceClass_All, PriceClass_200, PriceClass_100.	string	"PriceClass_All"	no
response_headers_policy	Header policies, eg. { "response-header-policy-1" = { default_ttl = 86400, max_ttl = 31536000, min_ttl = 0, cookies_config = { cookie_behavior = "none", items = [] }, headers_config = { header_behavior = "whitelist", items = ["Authorization", "Origin", "Accept", "Access-Control-Request-Method", "Access-Control-Request-Headers", "Referer"] }, query_string_behavior = { header_behavior = "none", items = [] }, query_strings_config = { query_string_behavior = "none", items = [] } } }	map(object( { name = string comment = optional(string, "") cors_config = optional(object({ access_control_allow_credentials = bool access_control_allow_headers = object({ items = list(string) }) access_control_allow_methods = object({ items = list(string) }) access_control_allow_origins = object({ items = list(string) }) access_control_expose_headers = object({ items = list(string) }) access_control_max_age_sec = number origin_override = bool })), server_timing_headers_config = optional(object({ enabled = bool sampling_rate = number }), { enabled = false sampling_rate = 0 }), remove_headers_config = optional(object({ items = list(string) })) custom_headers_config = optional(object({ items = list(object({ header = string override = bool value = string })) }), null) security_headers_config = optional(object({ content_type_options = object({ override = bool }) frame_options = object({ frame_option = string override = bool }) referrer_policy = object({ referrer_policy = string override = bool }) xss_protection = object({ mode_block = bool protection = bool override = bool report_uri = string }) strict_transport_security = object({ access_control_max_age_sec = string include_subdomains = bool preload = bool override = bool }) content_security_policy = object({ content_security_policy = string override = bool }) })) } ))	{}	no
retain_on_delete	Disables the distribution instead of deleting it when destroying the resource through Terraform. If this is set, the distribution needs to be deleted manually afterwards.	bool	false	no
route53_record_ttl	TTL for Route53 record	string	60	no
route53_root_domain	Domain to add to route 53 as alias to distribution	string	null	no
s3_kms_details	KMS details for S3 encryption	object({ s3_bucket_encryption_type = string, //Encryption for S3 bucket , options : SSE-S3 - AES256 , SSE-KMS - aws:kms kms_key_administrators = optional(list(string)), // "Environment where deploying,List of AWS arns that will have permissions to use kms key" kms_key_users = optional(list(string)), // "Environment where deploying,List of AWS arns that will have permissions to use kms key" kms_key_arn = optional(string) // In case if we need to use CMK created else where, set as null if not used })	{ "kms_key_administrators": [], "kms_key_arn": null, "kms_key_users": [], "s3_bucket_encryption_type": "SSE-S3" }	no
tags	Tags for AWS resources	map(string)	{}	no
viewer_certificate	The SSL configuration for this distribution	object({ cloudfront_default_certificate = bool, minimum_protocol_version = string, ssl_support_method = string })	{ "cloudfront_default_certificate": false, "minimum_protocol_version": "TLSv1.2_2018", "ssl_support_method": "sni-only" }	no
web_acl_id	Unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF (WAFv2), use the ACL ARN, for example aws_wafv2_web_acl.example.arn.	string	null	no

Outputs

Name	Description
acm_certificate_arn	Certificate ARN
cloudfront_arn	CloudFront ARN
cloudfront_domain_name	CloudFront Domain name
cloudfront_hosted_zone_id	CloudFront Hosted zone ID
cloudfront_id	CloudFront ID
logging_s3_bucket	Logging bucket name
origin_s3_bucket	Origin bucket name

Development

Prerequisites

• terraform
• terraform-docs
• pre-commit

Configurations

• Configure pre-commit hooks

pre-commit install

Git commits

while Contributing or doing git commit please specify the breaking change in your commit message whether its major,minor or patch

For Example

git commit -m "your commit message #major"

By specifying this , it will bump the version and if you dont specify this in your commit message then by default it will consider patch and will bump that accordingly

Tests

• Tests are available in test directory
• Configure the dependencies

cd test
go mod init github.com/sourcefuse/terraform-aws-refarch-cloudfront
go get github.com/gruntwork-io/terratest/modules/terraform

• Now execute the test

cd test/
go test

AI Assistant Integration (ARC IaC MCP)

The ARC IaC MCP Server is a hosted Model Context Protocol service that lets AI assistants browse, search, scaffold, compare, and security-scan any of the SourceFuse ARC Terraform modules — directly from natural language.

What you can do with it:

• Discover — search and filter modules by keyword or AWS resource type.
• Understand — get inputs, outputs, and resources for any module without leaving your editor.
• Scaffold — generate production-ready, multi-file Terraform with cross-module wiring already done.
• Secure — scan generated or existing HCL for misconfigurations before it hits a PR.
• Compare — diff modules side-by-side to make informed architectural decisions.

Setup (one minute)

The MCP endpoint is https://arc-iac-mcp.sourcef.us/mcp. Pick your client:

Claude Code CLI:

claude mcp add arc-iac --transport http https://arc-iac-mcp.sourcef.us/mcp

Claude Desktop — edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "arc-iac": {
      "url": "https://arc-iac-mcp.sourcef.us/mcp"
    }
  }
}

Cursor / Windsurf / Kiro — add the same block to .cursor/mcp.json (or the equivalent for your client).

Example prompts to try

• "List all ARC modules sorted by downloads"
• "What inputs does arc-ecs require?"
• "Scaffold a production-ready arc-db Aurora setup with Secrets Manager"
• "Compare arc-eks and arc-ecs for running 10 microservices"
• "Scan this Terraform before I raise a PR: <paste HCL>"

See the ARC IaC MCP repo for the full tool reference, troubleshooting tips, and local-development instructions.

Contributing

See CONTRIBUTING.md for commit conventions and development setup.

Authors

This project is authored by: - SourceFuse ARC Team