Jon Chery
c80060878a
EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci---
cloudfront — CloudFront distribution
Module kind: primitive | Version: 1.0.0
A CloudFront distribution with an S3 origin via Origin Access Control (OAC). The distribution serves the bucket's static content from the global edge network with HTTPS redirection by default. An optional WAF web ACL can be associated to filter traffic before it reaches the origin.
Resources
| Resource | Type | Purpose |
|---|---|---|
oac |
aws_cloudfront_origin_access_control |
Origin Access Control signing the S3 origin |
distribution |
aws_cloudfront_distribution |
The CloudFront distribution with an S3 origin via OAC |
Inputs
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
bucket_regional_domain_name |
string | yes | — | The S3 bucket regional domain name (ref to s3 origin) |
price_class |
string | no | PriceClass_100 |
CloudFront price class |
viewer_protocol_policy |
string | no | redirect-to-https |
Viewer protocol policy |
default_ttl |
number | no | 3600 | Default TTL in seconds |
max_ttl |
number | no | 86400 | Max TTL in seconds |
waf_web_acl_arn |
string | no | — | WAF web ACL ARN to associate (ref to waf) |
region |
string | yes | — | AWS region (CloudFront is global but the provider region is used for the OAC) |
Outputs
| Name | Type | Description |
|---|---|---|
distribution_arn |
arn | The CloudFront distribution ARN |
distribution_domain_name |
string | The CloudFront distribution domain name (e.g. d111111abcdef8.cloudfront.net) |
oac_id |
string | The Origin Access Control ID |
Usage
{
"id": "cloudfront",
"type": "aws:cloudfront:distribution",
"module": "cloudfront@1.0.0",
"inputs": {
"bucket_regional_domain_name": "ref:s3.bucket_regional_domain_name",
"price_class": "PriceClass_100",
"viewer_protocol_policy": "redirect-to-https",
"default_ttl": 3600,
"max_ttl": 86400,
"waf_web_acl_arn": "ref:waf.web_acl_arn",
"region": "us-east-1"
}
}
The bucket_regional_domain_name and waf_web_acl_arn inputs are
typically wired as ref: expressions from the s3 and waf primitives
inside a module composition (see modules/l2/static-assets).
Compliance extension points
- TLS/HTTPS — viewer protocol policy defaults to
redirect-to-https; a custom ACM certificate +viewer_certificateblock can pin TLS to a customer domain (SOC2 CC6.1, GDPR Art.32). - Geo restriction — the
restrictions.geo_restrictionblock can whitelist/blacklist countries for data-residency compliance (GDPR Art.44, SOC2 CC6.1). - Logging — CloudFront access logs to an S3 bucket for auditability (SOC2 CC7.2, DORA audit trail).
- Field-level encryption — add field-level encryption for PII fields in POST bodies (GDPR Art.32).
Examples
Validated example contracts are in examples/. The platform-test
pipeline validates them against schemas/contract.schema.json.
Simple
A minimal deployment:
environment: dev
id: cdn
infrastructure:
cloudfront:
inputs:
bucket_regional_domain_name: my-bucket.s3.us-east-1.amazonaws.com
region: us-east-1
version: 1.0.0
name: cloudfront
Complex
A production deployment with optional inputs:
environment: dev
id: cdn
infrastructure:
cloudfront:
inputs:
bucket_regional_domain_name: my-bucket.s3.us-east-1.amazonaws.com
default_ttl: 3600
max_ttl: 86400
price_class: PriceClass_100
region: us-east-1
viewer_protocol_policy: redirect-to-https
waf_web_acl_arn: arn:aws:wafv2:us-east-1:000000000000:webacl/my-waf
version: 1.0.0
name: cloudfront
Versioning
1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.