-
Notifications
You must be signed in to change notification settings - Fork 3
/
main.tf
124 lines (99 loc) · 2.92 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
provider "aws" {
version = "~> 2.0"
alias = "virginia"
region = "us-east-1"
}
/* ======= Steps ======= */
/* 1. Create bucket for storing static website files */
resource "aws_s3_bucket" "bucket" {
bucket = var.bucket_name
acl = "public-read"
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PublicReadGetObject",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::${var.bucket_name}/*"
}
]
}
POLICY
website {
index_document = var.index_document
error_document = var.error_document
}
tags = var.tags
}
/* 2. Provision ACM certificate to verify domains */
resource "aws_acm_certificate" "cert" {
provider = aws.virginia
domain_name = var.domain_name
validation_method = "DNS"
lifecycle {
create_before_destroy = true
}
tags = var.tags
}
/* 3. Provision ACM validation record via cloudflare */
resource "cloudflare_record" "acm" {
depends_on = [aws_acm_certificate.cert]
zone_id = var.cloudflare_zone_id
name = aws_acm_certificate.cert.domain_validation_options.0.resource_record_name
value = aws_acm_certificate.cert.domain_validation_options.0.resource_record_value
type = aws_acm_certificate.cert.domain_validation_options.0.resource_record_type
}
/* 3. ACM Validation after adding DNS record */
resource "aws_acm_certificate_validation" "cert" {
provider = aws.virginia
depends_on = [aws_acm_certificate.cert]
certificate_arn = aws_acm_certificate.cert.arn
}
/* 4. Provision cloudfront distribution infront of S3 bucket */
resource "aws_cloudfront_distribution" "dist" {
depends_on = [aws_s3_bucket.bucket, aws_acm_certificate_validation.cert]
origin {
domain_name = aws_s3_bucket.bucket.website_endpoint
origin_id = "S3-${var.bucket_name}"
}
enabled = true
is_ipv6_enabled = true
default_root_object = var.index_document
aliases = [var.domain_name]
restrictions {
geo_restriction {
restriction_type = "none"
}
}
default_cache_behavior {
allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
cached_methods = ["GET", "HEAD"]
target_origin_id = "S3-${var.bucket_name}"
forwarded_values {
query_string = false
cookies {
forward = "none"
}
}
viewer_protocol_policy = "allow-all"
min_ttl = 0
default_ttl = 3600
max_ttl = 86400
}
viewer_certificate {
acm_certificate_arn = aws_acm_certificate_validation.cert.certificate_arn
ssl_support_method = "sni-only"
}
tags = var.tags
}
/* 5. Add CNAME record to Cloudflare DNS which points to the newly created cloudfront distribution */
resource "cloudflare_record" "cname" {
depends_on = [aws_cloudfront_distribution.dist]
zone_id = var.cloudflare_zone_id
name = var.domain_name
value = aws_cloudfront_distribution.dist.domain_name
type = "CNAME"
}