Skip to content

Commit a356e15

Browse files
posquit0posquit0
committed
feat(vpc-origin): add a new module
1 parent ecc91c3 commit a356e15

File tree

10 files changed

+420
-1
lines changed

10 files changed

+420
-1
lines changed

‎.github/labeler.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,8 @@
2828
- changed-files:
2929
- any-glob-to-any-file:
3030
- modules/response-headers-policy/**/*
31+
32+
":floppy_disk: vpc-origin":
33+
- changed-files:
34+
- any-glob-to-any-file:
35+
- modules/vpc-origin/**/*

‎.github/labels.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,6 @@
5858
- color: "fbca04"
5959
description: "This issue or pull request is related to response-headers-policy module."
6060
name: ":floppy_disk: response-headers-policy"
61+
- color: "fbca04"
62+
description: "This issue or pull request is related to vpc-origin module."
63+
name: ":floppy_disk: vpc-origin"

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ Terraform module which creates CloudFront related resources on AWS.
1212
- [origin-access-control](./modules/origin-access-control)
1313
- [origin-request-policy](./modules/origin-request-policy)
1414
- [response-headers-policy](./modules/response-headers-policy)
15+
- [vpc-origin](./modules/vpc-origin)
1516

1617

1718
## Target AWS Services
@@ -22,6 +23,10 @@ Terraform Modules from [this package](https://github.com/tedilabs/terraform-aws-
2223
- Distribution
2324
- Key-value Store
2425
- Real-time Log Configuration (Comming soon!)
26+
- Origins
27+
- Custom Origin
28+
- S3 Origin
29+
- VPC Origin
2530
- Origin Access
2631
- Origin Access Control
2732
- Policies
@@ -47,4 +52,4 @@ Like this project? Follow the repository on [GitHub](https://github.com/tedilabs
4752

4853
Provided under the terms of the [Apache License](LICENSE).
4954

50-
Copyright © 2022-2025, [Byungjin Park](https://www.posquit0.com).
55+
Copyright © 2022-2025, [Byungjin Park](https://www.posquit0.com).

‎modules/vpc-origin/README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# vpc-origin
2+
3+
This module creates following resources.
4+
5+
- `aws_cloudfront_vpc_origin`
6+
7+
<!-- BEGIN_TF_DOCS -->
8+
## Requirements
9+
10+
| Name | Version |
11+
|------|---------|
12+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.12 |
13+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.20 |
14+
15+
## Providers
16+
17+
| Name | Version |
18+
|------|---------|
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.24.0 |
20+
21+
## Modules
22+
23+
| Name | Source | Version |
24+
|------|--------|---------|
25+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.12.0 |
26+
| <a name="module_share"></a> [share](#module\_share) | tedilabs/organization/aws//modules/ram-share | ~> 0.5.0 |
27+
28+
## Resources
29+
30+
| Name | Type |
31+
|------|------|
32+
| [aws_cloudfront_vpc_origin.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_vpc_origin) | resource |
33+
34+
## Inputs
35+
36+
| Name | Description | Type | Default | Required |
37+
|------|-------------|------|---------|:--------:|
38+
| <a name="input_endpoint"></a> [endpoint](#input\_endpoint) | (Required) The ARN of the VPC origin endpoint to associate with the CloudFront VPC Origin. The VPC origin endpoint must be an Application Load Balancer (ALB), Network Load Balancer (NLB), or EC2 instance in the same AWS Region as the CloudFront distribution. | `string` | n/a | yes |
39+
| <a name="input_name"></a> [name](#input\_name) | (Required) The name of the CloudFront VPC Origin. | `string` | n/a | yes |
40+
| <a name="input_http_port"></a> [http\_port](#input\_http\_port) | (Optional) The HTTP port for the CloudFront VPC origin endpoint configuration. Defaults to `80`. | `number` | `80` | no |
41+
| <a name="input_https_port"></a> [https\_port](#input\_https\_port) | (Optional) The HTTPS port for the CloudFront VPC origin endpoint configuration. Defaults to `443`. | `number` | `443` | no |
42+
| <a name="input_module_tags_enabled"></a> [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
43+
| <a name="input_protocol_policy"></a> [protocol\_policy](#input\_protocol\_policy) | (Optional) The origin protocol policy for the CloudFront VPC origin endpoint configuration. The origin protocol policy determines the protocol (HTTP or HTTPS) that you want CloudFront to use when connecting to the origin. Valid values are `HTTP_ONLY`, `HTTPS_ONLY` or `MATCH_VIEWER`. Defaults to `MATCH_VIEWER`. | `string` | `"MATCH_VIEWER"` | no |
44+
| <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | (Optional) A configurations of Resource Group for this module. `resource_group` as defined below.<br/> (Optional) `enabled` - Whether to create Resource Group to find and group AWS resources which are created by this module. Defaults to `true`.<br/> (Optional) `name` - The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. If not provided, a name will be generated using the module name and instance name.<br/> (Optional) `description` - The description of Resource Group. Defaults to `Managed by Terraform.`. | <pre>object({<br/> enabled = optional(bool, true)<br/> name = optional(string, "")<br/> description = optional(string, "Managed by Terraform.")<br/> })</pre> | `{}` | no |
45+
| <a name="input_shares"></a> [shares](#input\_shares) | (Optional) A list of resource shares via RAM (Resource Access Manager). | <pre>list(object({<br/> name = optional(string)<br/><br/> permissions = optional(set(string), ["AWSRAMDefaultPermissionCloudfrontVpcOrigin"])<br/><br/> external_principals_allowed = optional(bool, false)<br/> principals = optional(set(string), [])<br/><br/> tags = optional(map(string), {})<br/> }))</pre> | `[]` | no |
46+
| <a name="input_ssl_security_policy"></a> [ssl\_security\_policy](#input\_ssl\_security\_policy) | (Optional) The minimum SSL protocol that CloudFront uses with the origin. Valid values are `SSLv3`, `TLSv1`, `TLSv1.1` or `TLSv1.2`. Defaults to `TLSv1.2`. | `string` | `"TLSv1.2"` | no |
47+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
48+
49+
## Outputs
50+
51+
| Name | Description |
52+
|------|-------------|
53+
| <a name="output_arn"></a> [arn](#output\_arn) | The ARN of the CloudFront VPC Origin. |
54+
| <a name="output_endpoint"></a> [endpoint](#output\_endpoint) | The ARN of the CloudFront VPC Origin endpoint. |
55+
| <a name="output_etag"></a> [etag](#output\_etag) | The ETag of the CloudFront VPC Origin. |
56+
| <a name="output_http_port"></a> [http\_port](#output\_http\_port) | The HTTP port of the CloudFront VPC Origin. |
57+
| <a name="output_https_port"></a> [https\_port](#output\_https\_port) | The HTTPS port of the CloudFront VPC Origin. |
58+
| <a name="output_id"></a> [id](#output\_id) | The ID of the CloudFront VPC Origin. |
59+
| <a name="output_name"></a> [name](#output\_name) | The name of the CloudFront VPC Origin. |
60+
| <a name="output_protocol_policy"></a> [protocol\_policy](#output\_protocol\_policy) | The origin protocol policy applied to the CloudFront VPC Origin. |
61+
| <a name="output_resource_group"></a> [resource\_group](#output\_resource\_group) | The resource group created to manage resources in this module. |
62+
| <a name="output_sharing"></a> [sharing](#output\_sharing) | The configuration for sharing of the Cloudfront VPC Origin.<br/> `status` - An indication of whether the VPC Origin is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`.<br/> `shares` - The list of resource shares via RAM (Resource Access Manager). |
63+
| <a name="output_ssl_security_policy"></a> [ssl\_security\_policy](#output\_ssl\_security\_policy) | The minimum SSL protocol that CloudFront uses with the origin. |
64+
<!-- END_TF_DOCS -->

‎modules/vpc-origin/main.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
locals {
2+
metadata = {
3+
package = "terraform-aws-cloudfront"
4+
version = trimspace(file("${path.module}/../../VERSION"))
5+
module = basename(path.module)
6+
name = var.name
7+
}
8+
module_tags = var.module_tags_enabled ? {
9+
"module.terraform.io/package" = local.metadata.package
10+
"module.terraform.io/version" = local.metadata.version
11+
"module.terraform.io/name" = local.metadata.module
12+
"module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13+
"module.terraform.io/instance" = local.metadata.name
14+
} : {}
15+
}
16+
17+
locals {
18+
protocol_policy = {
19+
"HTTP_ONLY" = "http-only"
20+
"HTTPS_ONLY" = "https-only"
21+
"MATCH_VIEWER" = "match-viewer"
22+
}
23+
ssl_security_policy = {
24+
"SSLv3" = ["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"]
25+
"TLSv1" = ["TLSv1", "TLSv1.1", "TLSv1.2"]
26+
"TLSv1.1" = ["TLSv1.1", "TLSv1.2"]
27+
"TLSv1.2" = ["TLSv1.2"]
28+
}
29+
}
30+
31+
32+
###################################################
33+
# VPC Origin for CloudFront Distribution
34+
###################################################
35+
36+
resource "aws_cloudfront_vpc_origin" "this" {
37+
vpc_origin_endpoint_config {
38+
name = var.name
39+
arn = var.endpoint
40+
41+
origin_protocol_policy = local.protocol_policy[var.protocol_policy]
42+
http_port = (contains(["HTTP_ONLY", "MATCH_VIEWER"], var.protocol_policy)
43+
? var.http_port
44+
: null
45+
)
46+
https_port = (contains(["HTTPS_ONLY", "MATCH_VIEWER"], var.protocol_policy)
47+
? var.https_port
48+
: null
49+
)
50+
51+
origin_ssl_protocols {
52+
items = local.ssl_security_policy[var.ssl_security_policy]
53+
quantity = length(local.ssl_security_policy[var.ssl_security_policy])
54+
}
55+
}
56+
57+
tags = merge(
58+
{
59+
"Name" = local.metadata.name
60+
},
61+
local.module_tags,
62+
var.tags,
63+
)
64+
}

‎modules/vpc-origin/outputs.tf‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
output "id" {
2+
description = "The ID of the CloudFront VPC Origin."
3+
value = aws_cloudfront_vpc_origin.this.id
4+
}
5+
6+
output "arn" {
7+
description = "The ARN of the CloudFront VPC Origin."
8+
value = aws_cloudfront_vpc_origin.this.arn
9+
}
10+
11+
output "etag" {
12+
description = "The ETag of the CloudFront VPC Origin."
13+
value = aws_cloudfront_vpc_origin.this.etag
14+
}
15+
16+
output "name" {
17+
description = "The name of the CloudFront VPC Origin."
18+
value = aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0].name
19+
}
20+
21+
output "endpoint" {
22+
description = "The ARN of the CloudFront VPC Origin endpoint."
23+
value = aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0].arn
24+
}
25+
26+
output "protocol_policy" {
27+
description = "The origin protocol policy applied to the CloudFront VPC Origin."
28+
value = {
29+
for k, v in local.protocol_policy :
30+
v => k
31+
}[aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0].origin_protocol_policy]
32+
}
33+
34+
output "ssl_security_policy" {
35+
description = "The minimum SSL protocol that CloudFront uses with the origin."
36+
value = var.ssl_security_policy
37+
}
38+
39+
output "http_port" {
40+
description = "The HTTP port of the CloudFront VPC Origin."
41+
value = aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0].http_port
42+
}
43+
44+
output "https_port" {
45+
description = "The HTTPS port of the CloudFront VPC Origin."
46+
value = aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0].https_port
47+
}
48+
49+
output "resource_group" {
50+
description = "The resource group created to manage resources in this module."
51+
value = merge(
52+
{
53+
enabled = var.resource_group.enabled && var.module_tags_enabled
54+
},
55+
(var.resource_group.enabled && var.module_tags_enabled
56+
? {
57+
arn = module.resource_group[0].arn
58+
name = module.resource_group[0].name
59+
}
60+
: {}
61+
)
62+
)
63+
}
64+
65+
output "sharing" {
66+
description = <<EOF
67+
The configuration for sharing of the Cloudfront VPC Origin.
68+
`status` - An indication of whether the VPC Origin is shared with other AWS accounts, or was shared with the current account by another AWS account. Sharing is configured through AWS Resource Access Manager (AWS RAM). Values are `NOT_SHARED`, `SHARED_BY_ME` or `SHARED_WITH_ME`.
69+
`shares` - The list of resource shares via RAM (Resource Access Manager).
70+
EOF
71+
value = {
72+
status = length(module.share) > 0 ? "SHARED_BY_ME" : "NOT_SHARED"
73+
shares = module.share
74+
}
75+
}
76+
77+
# output "debug" {
78+
# value = merge({
79+
# for k, v in aws_cloudfront_vpc_origin.this :
80+
# k => v
81+
# if !contains(["id", "arn", "etag", "origin_protocol_policy", "tags", "tags_all", "timeouts"], k)
82+
# }, {
83+
# vpc_origin_endpoint_config = {
84+
# for k, v in aws_cloudfront_vpc_origin.this.vpc_origin_endpoint_config[0] :
85+
# k => v
86+
# if !contains(["name", "arn", "origin_protocol_policy", "http_port", "https_port", "origin_ssl_protocols"], k)
87+
# }
88+
# })
89+
# }

‎modules/vpc-origin/ram-shares.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
locals {
2+
ram_share_name_prefix = join(".", [
3+
"cloudfront",
4+
"vpc-origin",
5+
replace(var.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
6+
])
7+
}
8+
9+
10+
###################################################
11+
# Resource Sharing by RAM (Resource Access Manager)
12+
###################################################
13+
14+
module "share" {
15+
source = "tedilabs/organization/aws//modules/ram-share"
16+
version = "~> 0.5.0"
17+
18+
for_each = {
19+
for share in var.shares :
20+
share.name => share
21+
}
22+
23+
name = "${local.ram_share_name_prefix}.${each.key}"
24+
25+
resources = {
26+
(var.name) = aws_cloudfront_vpc_origin.this.arn
27+
}
28+
permissions = each.value.permissions
29+
30+
external_principals_allowed = each.value.external_principals_allowed
31+
principals = each.value.principals
32+
33+
resource_group = {
34+
enabled = false
35+
}
36+
module_tags_enabled = false
37+
38+
tags = merge(
39+
local.module_tags,
40+
var.tags,
41+
each.value.tags,
42+
)
43+
}

‎modules/vpc-origin/resource-group.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
locals {
2+
resource_group_name = (var.resource_group.name != ""
3+
? var.resource_group.name
4+
: join(".", [
5+
local.metadata.package,
6+
local.metadata.module,
7+
replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8+
])
9+
)
10+
}
11+
12+
13+
module "resource_group" {
14+
source = "tedilabs/misc/aws//modules/resource-group"
15+
version = "~> 0.12.0"
16+
17+
count = (var.resource_group.enabled && var.module_tags_enabled) ? 1 : 0
18+
19+
name = local.resource_group_name
20+
description = var.resource_group.description
21+
22+
query = {
23+
resource_tags = local.module_tags
24+
}
25+
26+
module_tags_enabled = false
27+
tags = merge(
28+
local.module_tags,
29+
var.tags,
30+
)
31+
}

0 commit comments

Comments
 (0)