resource "aws_cloudfront_origin_access_control" "this" {
  count = var.enabled ? 1 : 0
  name                              = local.oac_name
  origin_access_control_origin_type = local.oac_origin_type
  signing_behavior                  = local.oac_signing_behavior
  signing_protocol                  = local.oac_signing_protocol
}

resource "aws_cloudfront_distribution" "this" {
  count = var.enabled ? 1 : 0
  origin {
    origin_id                = "s3-origin"
    domain_name              = var.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.this[0].id
    s3_origin_config {
      origin_access_identity = ""
    }
  }

  enabled     = true
  price_class = var.price_class
  default_cache_behavior {
    viewer_protocol_policy = var.viewer_protocol_policy
    target_origin_id       = "s3-origin"
    min_ttl                = 0
    default_ttl            = var.default_ttl
    max_ttl                = var.max_ttl
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }

  web_acl_id = var.waf_web_acl_arn
}