Skip to content

Commit 5896259

Browse files
bryantbiggsbryantbiggs
authored
feat!: Upgrade MSV of AWS provider to 6.20, remove support for origin access identities (#177)
1 parent be6076c commit 5896259

File tree

12 files changed

+1189
-879
lines changed

12 files changed

+1189
-879
lines changed

‎README.md‎

Lines changed: 54 additions & 97 deletions
Large diffs are not rendered by default.

‎docs/UPGRADE-6.0.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
# Upgrade from v5.x to v6.x
2+
3+
If you have any questions regarding this upgrade process, please consult the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-cloudfront/tree/master/examples) directory:
4+
If you find a bug, please open an issue with supporting configuration to reproduce.
5+
6+
## List of backwards incompatible changes
7+
8+
- AWS provider `v6.20` is now minimum supported version
9+
- Support for `aws_cloudfront_origin_access_identity` has been removed in favor of `aws_cloudfront_origin_access_control`
10+
11+
## Additional changes
12+
13+
### Added
14+
15+
- None
16+
17+
### Modified
18+
19+
- Variable definitions now contain detailed `object` types in place of the previously used any type
20+
- `is_ipv6_enabled` now defaults to `true` if not specified
21+
- `default_cache_behavior.compress` and `ordered_cache_behavior.compress` now default to `true`
22+
- `origin.origin_ssl_protocols` now defaults to `["TLSv1.2"]`
23+
- `vpc_origin.origin_ssl_protocols.items` now defaults to `["TLSv1.2"]`
24+
- `vpc_origin_timeouts` is now embedded under `vpc_origin`
25+
- `viewer_certificate.minimum_protocol_version` now defaults to `"TLSv1.2_2025"`
26+
- See the the `Before vs After` examples below for more details on variable type definition changes
27+
28+
### Variable and output changes
29+
30+
1. Removed variables:
31+
32+
- `create_origin_access_identity`
33+
- `origin_access_identities`
34+
- `create_origin_access_control`
35+
- `create_vpc_origin`
36+
- `vpc_origin_timeouts` - use `timeouts` block within `vpc_origin` variable instead
37+
- `create_response_headers_policy`
38+
- `create_cloudfront_function`
39+
40+
2. Renamed variables:
41+
42+
- `create_distribution` -> `create`
43+
44+
3. Added variables:
45+
46+
- `anycast_ip_list_id`
47+
48+
4. Removed outputs:
49+
50+
- `cloudfront_vpc_origin_ids`
51+
- `cloudfront_origin_access_controls_ids`
52+
- `cloudfront_origin_access_identities`
53+
- `cloudfront_origin_access_identity_ids`
54+
- `cloudfront_origin_access_identity_iam_arns`
55+
- `cloudfront_distribution_tags`
56+
57+
5. Renamed outputs:
58+
59+
- None
60+
61+
6. Added outputs:
62+
63+
- `cloudfront_vpc_origins`
64+
65+
## Upgrade Migrations
66+
67+
### Before 5.x Example
68+
69+
```hcl
70+
module "cloudfront" {
71+
source = "terraform-aws-modules/cloudfront/aws/"
72+
version = "~> 5.0"
73+
74+
# Truncated for brevity ...
75+
76+
create_vpc_origin = true
77+
vpc_origin = {
78+
ec2 = {
79+
arn = module.ec2.arn
80+
http_port = 80
81+
https_port = 443
82+
origin_protocol_policy = "http-only"
83+
origin_ssl_protocols = {
84+
items = ["TLSv1.2"]
85+
quantity = 1
86+
}
87+
}
88+
}
89+
90+
vpc_origin_timeouts = {
91+
create = "20m"
92+
update = "20m"
93+
delete = "20m"
94+
}
95+
96+
origin = {
97+
s3 = {
98+
domain_name = module.s3.bucket_regional_domain_name
99+
s3_origin_config = {
100+
origin_access_identity = "s3_bucket_one"
101+
}
102+
103+
custom_header = [
104+
{
105+
name = "X-Forwarded-Scheme"
106+
value = "https"
107+
},
108+
{
109+
name = "X-Frame-Options"
110+
value = "SAMEORIGIN"
111+
}
112+
]
113+
}
114+
}
115+
116+
origin_group = {
117+
group_one = {
118+
failover_status_codes = [403, 404, 500, 502]
119+
primary_member_origin_id = "appsync" # Not shown
120+
secondary_member_origin_id = "s3"
121+
}
122+
}
123+
124+
geo_restriction = {
125+
restriction_type = "whitelist"
126+
locations = ["NO", "UA", "US", "GB"]
127+
}
128+
}
129+
```
130+
131+
### After 6.x Example
132+
133+
```hcl
134+
module "cloudfront" {
135+
source = "terraform-aws-modules/cloudfront/aws/"
136+
version = "~> 6.0"
137+
138+
# Truncated for brevity ...
139+
140+
vpc_origin = {
141+
ec2 = {
142+
arn = module.ec2.arn
143+
http_port = 80
144+
https_port = 443
145+
origin_protocol_policy = "http-only"
146+
origin_ssl_protocols = {
147+
items = ["TLSv1.2"]
148+
quantity = 1
149+
}
150+
151+
timeouts = {
152+
create = "20m"
153+
update = "20m"
154+
delete = "20m"
155+
}
156+
}
157+
}
158+
159+
origin = {
160+
s3 = {
161+
domain_name = module.s3.bucket_regional_domain_name
162+
s3_origin_config = {
163+
origin_access_control_key = "s3_bucket_one"
164+
}
165+
166+
custom_header = {
167+
"X-Forwarded-Scheme" = "https"
168+
"X-Frame-Options" = "SAMEORIGIN"
169+
}
170+
}
171+
}
172+
173+
origin_group = {
174+
group-one = {
175+
failover_criteria = {
176+
status_codes = [403, 404, 500, 502]
177+
}
178+
member = [
179+
{ origin_id = "appsync" }, # Not shown
180+
{ origin_id = "s3" }
181+
]
182+
}
183+
}
184+
185+
restrictions = {
186+
geo_restriction = {
187+
restriction_type = "whitelist"
188+
locations = ["NO", "UA", "US", "GB"]
189+
}
190+
}
191+
}
192+
```
193+
194+
### State Changes
195+
196+
None

‎examples/complete/README.md‎

Lines changed: 11 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,6 @@
11
# Complete CloudFront Distribution
22

3-
Configuration in this directory creates CloudFront distribution which demos such capabilities:
4-
5-
- access logging
6-
- origins and origin groups
7-
- caching behaviours
8-
- Origin Access Identities (with S3 bucket policy)
9-
- Origin Access Control (recommended over OAI)
10-
- Lambda@Edge
11-
- CloudFront Functions
12-
- Response Headers Policies
13-
- ACM certificate
14-
- Route53 record
15-
- VPC Origins
3+
Configuration in this directory creates CloudFront distribution which demonstrates nearly all features supported by this module.
164

175
## Usage
186

@@ -32,17 +20,15 @@ Note that this example may create resources which cost money. Run `terraform des
3220
| Name | Version |
3321
|------|---------|
3422
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
35-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.100 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.20 |
3624
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 2.0 |
37-
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
3825

3926
## Providers
4027

4128
| Name | Version |
4229
|------|---------|
43-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.100 |
30+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.20 |
4431
| <a name="provider_null"></a> [null](#provider\_null) | >= 2.0 |
45-
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
4632

4733
## Modules
4834

@@ -54,16 +40,16 @@ Note that this example may create resources which cost money. Run `terraform des
5440
| <a name="module_lambda_function"></a> [lambda\_function](#module\_lambda\_function) | terraform-aws-modules/lambda/aws | ~> 8.0 |
5541
| <a name="module_log_bucket"></a> [log\_bucket](#module\_log\_bucket) | terraform-aws-modules/s3-bucket/aws | ~> 5.0 |
5642
| <a name="module_records"></a> [records](#module\_records) | terraform-aws-modules/route53/aws//modules/records | ~> 5.0 |
57-
| <a name="module_s3_one"></a> [s3\_one](#module\_s3\_one) | terraform-aws-modules/s3-bucket/aws | ~> 5.0 |
43+
| <a name="module_s3"></a> [s3](#module\_s3) | terraform-aws-modules/s3-bucket/aws | ~> 5.0 |
44+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |
5845

5946
## Resources
6047

6148
| Name | Type |
6249
|------|------|
6350
| [aws_cloudfront_function.example](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_function) | resource |
64-
| [aws_s3_bucket_policy.bucket_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy) | resource |
6551
| [null_resource.download_package](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
66-
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
52+
| [aws_availability_zones.available](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/availability_zones) | data source |
6753
| [aws_canonical_user_id.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/canonical_user_id) | data source |
6854
| [aws_cloudfront_log_delivery_canonical_user_id.cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/cloudfront_log_delivery_canonical_user_id) | data source |
6955
| [aws_iam_policy_document.s3_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -87,8 +73,9 @@ No inputs.
8773
| <a name="output_cloudfront_distribution_last_modified_time"></a> [cloudfront\_distribution\_last\_modified\_time](#output\_cloudfront\_distribution\_last\_modified\_time) | The date and time the distribution was last modified. |
8874
| <a name="output_cloudfront_distribution_status"></a> [cloudfront\_distribution\_status](#output\_cloudfront\_distribution\_status) | The current status of the distribution. Deployed if the distribution's information is fully propagated throughout the Amazon CloudFront system. |
8975
| <a name="output_cloudfront_distribution_trusted_signers"></a> [cloudfront\_distribution\_trusted\_signers](#output\_cloudfront\_distribution\_trusted\_signers) | List of nested attributes for active trusted signers, if the distribution is set up to serve private content with signed URLs |
90-
| <a name="output_cloudfront_origin_access_identities"></a> [cloudfront\_origin\_access\_identities](#output\_cloudfront\_origin\_access\_identities) | The origin access identities created |
91-
| <a name="output_cloudfront_origin_access_identity_iam_arns"></a> [cloudfront\_origin\_access\_identity\_iam\_arns](#output\_cloudfront\_origin\_access\_identity\_iam\_arns) | The IAM arns of the origin access identities created |
92-
| <a name="output_cloudfront_origin_access_identity_ids"></a> [cloudfront\_origin\_access\_identity\_ids](#output\_cloudfront\_origin\_access\_identity\_ids) | The IDS of the origin access identities created |
93-
| <a name="output_cloudfront_vpc_origin_ids"></a> [cloudfront\_vpc\_origin\_ids](#output\_cloudfront\_vpc\_origin\_ids) | The IDS of the VPC origin created |
76+
| <a name="output_cloudfront_functions"></a> [cloudfront\_functions](#output\_cloudfront\_functions) | The CloudFront Functions created |
77+
| <a name="output_cloudfront_monitoring_subscription_id"></a> [cloudfront\_monitoring\_subscription\_id](#output\_cloudfront\_monitoring\_subscription\_id) | The ID of the CloudFront monitoring subscription, which corresponds to the `distribution_id`. |
78+
| <a name="output_cloudfront_origin_access_controls"></a> [cloudfront\_origin\_access\_controls](#output\_cloudfront\_origin\_access\_controls) | The origin access controls created |
79+
| <a name="output_cloudfront_response_headers_policies"></a> [cloudfront\_response\_headers\_policies](#output\_cloudfront\_response\_headers\_policies) | The response headers policies created |
80+
| <a name="output_cloudfront_vpc_origins"></a> [cloudfront\_vpc\_origins](#output\_cloudfront\_vpc\_origins) | The IDS of the VPC origin created |
9481
<!-- END_TF_DOCS -->

0 commit comments

Comments
 (0)