Compatibility

This module requires Terraform 0.13.1 or later. Older Terraform versions are not supported.

Introduction

This module will build a website that is protected by an OpenId-compatible authentication provider. It will provision a private S3 bucket, Cloudfront, and deploy a customized Lambda function using Lambda@Edge.

Currently support Google Apps (G Suite), Microsoft Azure AD, GitHub, OKTA, Auth0, Centrify.

Based on

Widen

This project uses the nodejs code for the Lambda function. Their repository includes a build.js script that interactively prompts for configuration items (client_id, client_secret, etc.) and builds the lambda zip file.

terraform-cloudfront-auth

We use too the existant terraform module as a base.

Requirements

Name	Version
terraform	>= 0.13.1
aws	>= 3.63
local	~> 2.0
null	~> 3.0

Providers

Name	Version
aws	>= 3.63
null	~> 3.0

Modules

No modules.

Resources

Name	Type
aws_cloudfront_distribution.this	resource
aws_cloudfront_origin_access_identity.this	resource
aws_cloudfront_response_headers_policy.this	resource
aws_iam_policy.lambda_log_access	resource
aws_iam_role.lambda_role	resource
aws_iam_role_policy_attachment.lambda_log_access	resource
aws_lambda_function.this	resource
aws_route53_record.default	resource
aws_s3_bucket.this	resource
aws_s3_bucket_notification.this	resource
aws_s3_bucket_policy.this	resource
aws_s3_bucket_public_access_block.this	resource
null_resource.build_lambda	resource
null_resource.copy_lambda_artifact	resource
null_resource.lambda_clean_files	resource
aws_caller_identity.current	data source
aws_iam_policy_document.lambda_assume_role	data source
aws_iam_policy_document.lambda_log_access	data source
aws_iam_policy_document.s3_bucket_policy	data source
aws_region.current	data source
aws_route53_zone.default	data source
null_data_source.lambda_artifact_sync	data source

Inputs

Name	Description	Type	Default	Required
acl	(Optional) ACL	string	"private"	no
acm_certificate_arn	(Optional) ARN of Certificate	string	""	no
auth_vendor	(Required) The vendor to use for authorization (google, microsoft, github, okta, auth0, centrify)	string	n/a	yes
authz	(Optional) The authorization method (google, microsoft only). Mirosoft: (1) Azure AD Login (default) (2) JSON Username Lookup Google: (1) Hosted Domain - verify email's domain matches that of the given hosted domain (2) HTTP Email Lookup - verify email exists in JSON array located at given HTTP endpoint (3) Google Groups Lookup - verify email exists in one of given Google Groups	string	"1"	no
block_public_acls	(Optional) Whether Amazon S3 should block public ACLs for this bucket.	bool	true	no
block_public_policy	(Optional) Whether Amazon S3 should block public bucket policies for this bucket.	bool	true	no
client_id	(Required) The authorization client id	string	n/a	yes
client_secret	(Required) The authorization client secret	string	n/a	yes
cloudfront_aliases	(Optional) List of cloudfront_aliases	list(string)	[ "" ]	no
cloudfront_allowed_methods	(Optional) List of allowed methods (e.g. GET, PUT, POST, DELETE, HEAD) for AWS CloudFront	list(string)	[ "GET", "HEAD" ]	no
cloudfront_cached_methods	(Optional) List of cached methods (e.g. GET, PUT, POST, DELETE, HEAD)	list(string)	[ "GET", "HEAD" ]	no
cloudfront_comment	(Optional) Cloudfront comments	string	""	no
cloudfront_compress	(Optional) Compress content for web requests that include Accept-Encoding: gzip in the request header	bool	false	no
cloudfront_custom_error_response	(Optional) List of one or more custom error response element maps	list(object({ error_caching_min_ttl = number error_code = number response_code = number response_page_path = string }))	[]	no
cloudfront_custom_origins	(Optional) One or more custom origins for this distribution (multiples allowed). See documentation for configuration options description https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#origin-arguments	any	[]	no
cloudfront_default_ttl	(Optional) Default amount of time (in seconds) that an object is in a CloudFront cache	number	86400	no
cloudfront_forward_cookies	(Optional) Specifies whether you want CloudFront to forward all or no cookies to the origin. Can be 'all' or 'none'	string	"none"	no
cloudfront_forward_header_values	(Optional) A list of whitelisted header values to forward to the origin	list(string)	[]	no
cloudfront_forward_query_string	(Optional) Forward query strings to the origin that is associated with this cache behavior	bool	false	no
cloudfront_index_document	(Optional) Amazon S3 returns this index document when requests are made to the root domain or any of the subfolders	string	"index.html"	no
cloudfront_max_ttl	(Optional) Maximum amount of time (in seconds) that an object is in a CloudFront cache	number	31536000	no
cloudfront_min_ttl	(Optional) Minimum amount of time that you want objects to stay in CloudFront caches	number	0	no
cloudfront_minimum_protocol_version	(Optional) Cloudfront TLS minimum protocol version	string	"TLSv1.2_2021"	no
cloudfront_ordered_cache_behavior	(Optional) - An ordered list of cache behaviors resource for this distribution. List from top to bottom in order of precedence. The topmost cache behavior will have precedence 0.	any	[]	no
cloudfront_origin_group	(Optional) One or more origin_group for this distribution (multiples allowed).	any	{}	no
cloudfront_price_class	(Optional) Price class for this distribution: PriceClass_All, PriceClass_200, PriceClass_100	string	"PriceClass_All"	no
cloudfront_response_headers_policy	(Optional) Provides a CloudFront response headers policy resource. A response headers policy contains information about a set of HTTP response headers and their values. After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution. When it’s attached to a cache behavior, CloudFront adds the headers in the policy to every response that it sends for requests that match the cache behavior.	any	{}	no
cloudfront_response_headers_policy_id	(Optional) The identifier for a response headers policy. If response_headers_policy is true the name of policy is used.	string	null	no
cloudfront_trusted_signers	(Optional) The AWS accounts, if any, that you want to allow to create signed URLs for private content. 'self' is acceptable.	list(string)	[]	no
cloudfront_viewer_protocol_policy	(Optional) allow-all, redirect-to-https	string	"redirect-to-https"	no
force_destroy	(Optional) Delete all objects in bucket on destroy	bool	false	no
github_organization	(Optional) The GitHub organization. Required for GitHub auth vendor only	string	null	no
hd	(Optional) The hosted domain (google only)	string	null	no
ignore_public_acls	(Optional) Whether Amazon S3 should ignore public ACLs for this bucket.	bool	true	no
lambda_notifications	(Optional) Map of S3 bucket notifications to Lambda function	any	{}	no
lifecycle_rule	(Optional) List of maps containing configuration of object lifecycle management.	any	[]	no
name	(Required) Name of resources	string	n/a	yes
policy	(Optional) A valid bucket policy JSON document	string	""	no
redirect_uri	(Required) The redirect uri	string	n/a	yes
replication_configuration	(Optional) Map containing cross-region bucket replication configuration.	any	{}	no
restrict_public_buckets	(Optional) Whether Amazon S3 should restrict public bucket policies for this bucket.	bool	true	no
route53_enabled	(Optional) Set to false to prevent the module from creating any resources	bool	false	no
route53_evaluate_target_health	(Optional) Set to true if you want Route 53 to determine whether to respond to DNS queries	bool	"false"	no
route53_parent_zone_id	(Optional) ID of the hosted zone to contain this record (or specify parent_zone_name)	string	""	no
route53_parent_zone_name	(Optional) Name of the hosted zone to contain this record (or specify parent_zone_id)	string	""	no
s3_cors_rule	(Optional) List of maps containing rules for Cross-Origin Resource Sharing.	any	[]	no
session_duration	(Optional) Session duration in hours	number	1	no
sns_notifications	(Optional) Map of S3 bucket notifications to SNS topic	any	{}	no
sqs_notifications	(Optional) Map of S3 bucket notifications to SQS queue	any	{}	no
tags	(Optional) Additional Tags	map(string)	{}	no
versioning	(Optional) Map containing versioning configuration.	map(string)	{}	no
website	(Optional) Map containing static web-site hosting or redirect configuration.	map(string)	{ "error_document": "index.html", "index_document": "index.html" }	no

Outputs

Name	Description
bucket_arn	The ARN of the S3 Bucket project.
bucket_domain_name	S3 Bucket Domain Name
bucket_name	S3 Bucket Name
cloudfront_arn	The ARN (Amazon Resource Name) for the distribution.
cloudfront_id	The identifier for the cloudfront distribution