rvn-cloudfront / Latest version: 1.9.0
See CloudFront CDN module reference for the full module page.
AWS account & region
string
required
AWS account.
- Immutable after creation
string
required
Region. CloudFront is global. Access logs go to CloudWatch Logs in us-east-1 by default; this region is used for the optional S3 logging bucket.
- Default:
us-east-1 - Immutable after creation
Distribution
string
required
Name slug. Name prefix for the distribution comment, origin access control, and logging bucket.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[a-zA-Z][a-zA-Z0-9-]{0,62}$— 1-63 letters, numbers, or hyphens. Start with a letter.
boolean
Ravion-managed domains. On: Ravion issues the certificate and attaches it to the distribution. Off: bring your own ACM certificate and aliases. An existing distribution keeps its setting; to switch, create a new one and move DNS to it.
- Default:
false
string_array
Custom domains. Ravion issues the certificate and attaches it once you add the provided DNS records at your DNS provider.
- Shown when:
{"ravion_managed_domains":true}
string_array
Domain aliases. Custom domain names like app.example.com. Leave empty to use the default cloudfront.net domain. Aliases must match the domain host rules on the origin load balancer when it routes by host.
- Default:
[] - Shown when:
{"ravion_managed_domains":false}
$ref:rvn-acm-certificate
ACM certificate. Certificate for the domain aliases. Required when aliases are set. CloudFront requires the certificate to be issued in us-east-1.
- Shown when:
{"ravion_managed_domains":false}
certificate to null.
Mapped inputs for certificate: set these keys alongside certificate, not inside it, when supplying existing infrastructure instead of a module reference.
string
ACM certificate ARN. Certificate ARN from the selected ACM certificate module. Must be in us-east-1.
- Default:
<<ref.stack.output.certificate_arn>>
Origin
string
required
Origin source. Choose an existing ECS module, standalone ALB module, private S3 bucket, or custom origin domain name.
- Default:
ecs_web_service - Allowed values:
ecs_web_service(ECS web service),ecs_cluster(ECS cluster),alb(Application Load Balancer),s3_bucket(S3 bucket),custom(Custom domain)
$ref:rvn-ecs-web
ECS web service. ECS web service whose load balancer becomes the origin. The service must be on rvn-ecs-web 0.8.0 or later so its stack exposes the load balancer DNS name.
- Shown when:
{"origin_source":"ecs_web_service"}
ecs_web_service to null.
Mapped inputs for ecs_web_service: set these keys alongside ecs_web_service, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
Service load balancer DNS name. Load balancer DNS name from the selected ECS web service, used as the origin domain. If this is empty, update the service to rvn-ecs-web 0.8.0 or later and apply its stack, then re-select the service.
- Default:
<<ref.stack.output.load_balancer_dns_name>>
string
Service load balancer ARN. Load balancer ARN from the selected ECS web service, used to create the CloudFront VPC origin when private origin is enabled. If this is empty, update the service to rvn-ecs-web 0.8.0 or later and apply its stack, then re-select the service.
- Default:
<<ref.stack.output.load_balancer_arn>>
$ref:rvn-aws-alb
Application Load Balancer. Existing standalone ALB whose DNS name becomes the origin. The ALB must be internal when private origin is enabled.
- Shown when:
{"origin_source":"alb"}
alb to null.
Mapped inputs for alb: set these keys alongside alb, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
ALB DNS name. DNS name from the selected standalone ALB module, used as the origin domain.
- Default:
<<ref.stack.output.alb_dns_name>>
string
ALB ARN. ARN from the selected standalone ALB module, used to create the CloudFront VPC origin when private origin is enabled.
- Default:
<<ref.stack.output.alb_arn>>
boolean
Private origin (VPC origin). Connect to the ECS web service’s load balancer or standalone ALB through a CloudFront VPC origin instead of over the public internet. Use when the load balancer is internal.
- Default:
false - Shown when:
{"origin_source":["ecs_web_service","alb"]}
string
required
VPC origin domain name. Host name CloudFront uses as the origin domain and Host header. With HTTPS to the origin, it must be covered by the load balancer’s TLS certificate and match the ECS service’s or standalone ALB’s host-based listener rule. No public DNS record is required.
- Shown when:
{"origin_vpc_enabled":true}
$ref:rvn-ecs-cluster
ECS cluster. ECS cluster whose public ALB becomes the origin. Listener rules on the ALB keep routing requests to the right services.
- Shown when:
{"origin_source":"ecs_cluster"}
ecs_cluster to null.
Mapped inputs for ecs_cluster: set these keys alongside ecs_cluster, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
Cluster public ALB DNS name. Public ALB DNS name from the selected ECS cluster, used as the origin domain. If this is empty, the selected cluster has no public ALB or has not applied its stack.
- Default:
<<ref.stack.output.public_alb_dns_name>>
string
required
Origin domain name. Domain name CloudFront connects to for the primary origin.
- Shown when:
{"origin_source":"custom"}
$ref:rvn-s3
S3 bucket. Private S3 bucket to serve through CloudFront Origin Access Control. After this CloudFront stack applies, add its distribution ARN to the S3 bucket’s CloudFront OAC read policy template.
- Shown when:
{"origin_source":"s3_bucket"}
s3_bucket to null.
Mapped inputs for s3_bucket: set these keys alongside s3_bucket, not inside it, when supplying existing infrastructure instead of a module reference.
string
required
S3 bucket regional domain name. Regional S3 bucket domain name from the selected S3 bucket module.
- Default:
<<ref.stack.output.bucket_regional_domain_name>>
string
required
Origin protocol policy. How CloudFront connects to the origin. HTTPS only requires the origin load balancer to serve a certificate valid for the forwarded host.
- Default:
https-only - Allowed values:
https-only(HTTPS only),http-only(HTTP only),match-viewer(Match viewer) - Shown when:
{"origin_source":["ecs_web_service","ecs_cluster","alb","custom"]}
object_array
Origin custom headers. Headers CloudFront adds to every request sent to the primary origin. Use them for origin authentication or routing.
- Default:
[] - Shown when:
{"origin_source":["ecs_web_service","ecs_cluster","alb","custom"]}
number
Origin connection timeout (seconds). How long CloudFront waits to open a connection to the primary origin before retrying or failing. The worst-case connect time is this timeout times the connection attempts.
- Default:
10 - Min:
1 - Max:
10
number
Origin connection attempts. Total tries CloudFront makes to connect to the primary origin before returning an error.
- Default:
3 - Min:
1 - Max:
3
number
Origin response timeout (seconds). How long CloudFront waits for the primary origin to respond. Values above 60 need a CloudFront quota increase.
- Default:
30 - Min:
1 - Max:
180 - Shown when:
{"origin_source":["ecs_web_service","ecs_cluster","alb","custom"]}
number
Origin keep-alive timeout (seconds). How long CloudFront keeps an idle connection to the primary origin open. Values above 60 need a CloudFront quota increase.
- Default:
5 - Min:
1 - Max:
180 - Shown when:
{"origin_source":["ecs_web_service","ecs_cluster","alb","custom"]}
object_array
Additional origins. Optional extra origins that custom cache behaviors can route paths to. Each origin needs a unique ID.
- Default:
[]
Edge redirects
object_array
Redirect rules. Optional URL-pattern redirects handled by a CloudFront Function at viewer request time.
- Default:
[]
Default cache behavior
string
required
Viewer protocol policy. How viewers connect to CloudFront.
- Default:
redirect-to-https - Allowed values:
redirect-to-https(Redirect to HTTPS),https-only(HTTPS only),allow-all(Allow all)
string
required
Allowed methods. Methods forwarded to the origin; only GET and HEAD responses are cached.
- Default:
all - Allowed values:
all(All methods),read_options(Read and OPTIONS),read(Read only)
string
required
Cache policy. Controls edge caching for the default behavior. The recommended option respects your app’s Cache-Control headers and includes query strings in the cache key.
- Default:
4cc15a8a-d715-48a4-82b8-cc0b614638fe - Allowed values:
4cc15a8a-d715-48a4-82b8-cc0b614638fe(UseOriginCacheControlHeaders-QueryStrings (recommended)),83da9c7e-98b4-4e11-a168-04f0df8e2c65(UseOriginCacheControlHeaders),4135ea2d-6df8-44a3-9df3-4b5a84be39ad(CachingDisabled),658327ea-f89d-4fab-a63d-7e88639e58f6(CachingOptimized),custom(Custom policy ID)
string
required
Custom cache policy ID. ID of a cache policy from your AWS account.
- Pattern:
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$— Invalid CloudFront policy ID. Use the 36-character policy ID, not the name or ARN. - Shown when:
{"cache_policy":"custom"}
string
required
Origin request policy. Controls what CloudFront forwards to the origin. Use None for private S3 origins so CloudFront can sign OAC requests without forwarding the viewer Host header.
- Default:
33f36d7e-f396-46d9-90e0-52428a34d9dc - Allowed values:
none(None),216adef6-5c7f-47e4-b989-5492eafa07d3(AllViewer),b689b0a8-53d0-40ab-baf2-68738e2966ac(AllViewerExceptHostHeader),33f36d7e-f396-46d9-90e0-52428a34d9dc(AllViewerAndCloudFrontHeaders-2022-06 (recommended)),59781a5b-3903-41f3-afcb-af62929ccde1(CORS-CustomOrigin),88a5eaf4-2fd4-4709-b370-b4c650ea3fcf(CORS-S3Origin),custom(Custom policy ID)
string
required
Custom origin request policy ID. ID of an origin request policy from your AWS account.
- Pattern:
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$— Invalid CloudFront policy ID. Use the 36-character policy ID, not the name or ARN. - Shown when:
{"origin_request_policy":"custom"}
object_array
Custom cache behaviors. Optional path-based behaviors evaluated before the default behavior, such as caching /assets/* or routing /api/* to another origin.
- Default:
[]
Signed URLs
boolean
Require signed URLs. Require signed URLs or signed cookies for the default cache behavior. Unsigned requests receive 403 responses from CloudFront.
- Default:
false
string_array
required
Trusted key group IDs. Existing CloudFront key group IDs whose public keys are trusted for signed URLs or signed cookies. Add at least one key group before enabling Require signed URLs on the default behavior or any custom cache behavior.
- Default:
[] - Pattern:
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$— Invalid CloudFront key group ID. Use the 36-character key group ID from CloudFront key management, not the public key ID. - Shown when:
{"signed_urls_enabled":true}
string
Response headers policy. Optional headers CloudFront adds to responses, such as security headers or CORS. Leave empty to add none.
- Allowed values:
67f7725c-6f97-4210-82d7-5512b31e9d03(SecurityHeadersPolicy),60669652-455b-4ae9-85a4-c4c02393f86c(SimpleCORS),5cc3b908-e619-4b99-88e5-2cf7f45965bd(CORS-With-Preflight),e61eb60c-9c35-4d20-a928-2b84e02af89c(CORS-and-SecurityHeadersPolicy),eaab4381-ed33-4a86-88ca-d9558dc6cd63(CORS-with-preflight-and-SecurityHeadersPolicy),custom(Custom policy ID)
string
required
Custom response headers policy ID. ID of a response headers policy from your AWS account.
- Pattern:
^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$— Invalid CloudFront policy ID. Use the 36-character policy ID, not the name or ARN. - Shown when:
{"response_headers_policy":"custom"}
Distribution settings
string
Static IPs. AWS approval required. Uses all edge locations and IPv4 only.
- Default:
disabled - Allowed values:
disabled(Disabled),create(Create a static IP list),existing(Use an existing static IP list)
number
required
Static IP count. AWS charges $0.005 per IP/hour, plus normal CloudFront usage. Changing the count replaces the IPs.
- Default:
3 - Allowed values:
3(3 IPs - apex DNS (about $11/month)), `21` (21 IPs - allowlisting (about $77/month)) - Shown when:
{"anycast_ip_list_mode":"create"}
string
required
Static IP list ID. Reuse a list in this AWS account to share its IPs and cost across sites.
- Shown when:
{"anycast_ip_list_mode":"existing"}
string
Price class. You can reduce edge locations for some cost savings if it becomes an issue.
- Default:
PriceClass_All - Allowed values:
PriceClass_All(All edge locations),PriceClass_200(Most edge locations),PriceClass_100(US, Canada, Europe) - Shown when:
{"anycast_ip_list_mode":"disabled"}
string
HTTP version.
- Default:
http2and3 - Allowed values:
http2and3(HTTP/2 and HTTP/3),http2(HTTP/2),http1.1(HTTP/1.1)
string
WAF web ACL ARN. Optional WAFv2 web ACL to associate with the distribution. Must be a global (CloudFront) web ACL.
string
Geo restriction.
- Default:
none - Allowed values:
none(None),whitelist(Whitelist),blacklist(Blacklist)
string_array
Geo restriction country codes.
- Default:
[] - Shown when:
{"geo_restriction_type":["whitelist","blacklist"]}
Monitoring
boolean
Additional metrics. Enable
CacheHitRate, OriginLatency, and 401/403/404/502/503/504 error rate charts. Adds a flat CloudWatch cost of about $2.40/month per distribution.- Default:
false
Access logging
boolean
CloudFront access logging. Enable CloudFront access logging. Logs are delivered to CloudWatch Logs by default and can be viewed in Ravion.
- Default:
true
string
Logging destination. Where CloudFront delivers access logs.
- Default:
cloudwatch - Allowed values:
cloudwatch(CloudWatch Logs),s3(S3 bucket) - Shown when:
{"logging_enabled":true}
number
Logging retention days. Days to retain CloudFront access logs in CloudWatch Logs or the automatically created S3 logging bucket. Defaults to 365 days to satisfy SOC 2 one-year log retention.
- Default:
365 - Min:
1 - Shown when:
{"logging_enabled":true}
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
boolean
Include default plan policies. Turn off to plan with only the policies below instead of the default read-only policies. Requires at least one policy below.
- Default:
true
string_array
Terraform plan IAM policies. IAM managed policy ARNs for the Terraform plan runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
boolean
Include default apply policies. Turn off to apply and destroy with only the policies below instead of AdministratorAccess. Requires at least one policy below.
- Default:
true
string_array
Terraform apply IAM policies. IAM managed policy ARNs for the Terraform apply runner role. Without default policies, allow s3:CreateBucket, s3:PutObject, s3:GetObject, and s3:ListBucket on the ravion-terraform-plans-<AWS account number> bucket in this account.
- Default:
[]
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.