migrate to new origin acess policy and switch to new free tier (#12)

Author: cob16

modules/static_website/cloudfront.tf

@@ -1,16 +1,14 @@
 resource "aws_cloudfront_distribution" "www_distribution" {
   provider = aws.us_east_1
 
-  price_class = "PriceClass_100"
+  price_class = "PriceClass_All"
+  web_acl_id  =  null //aws will create and manage this automaticly
 
   // origin is where CloudFront gets its content from.
   origin {
-    domain_name = aws_s3_bucket.website.bucket_regional_domain_name
-    origin_id   = var.website_name
-
-    s3_origin_config {
-      origin_access_identity = aws_cloudfront_origin_access_identity.origin_access_identity.cloudfront_access_identity_path
-    }
+    domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
+    origin_id                = var.website_name
+    origin_access_control_id = aws_cloudfront_origin_access_control.www.id
   }
 
   enabled             = true
@@ -23,18 +21,11 @@ resource "aws_cloudfront_distribution" "www_distribution" {
     compress               = true
     allowed_methods        = ["GET", "HEAD"]
     cached_methods         = ["GET", "HEAD"]
+
     // This needs to match the `origin_id` above.
     target_origin_id = var.website_name
-    min_ttl          = 0
-    default_ttl      = 86400
-    max_ttl          = 31536000
 
-    forwarded_values {
-      query_string = false
-      cookies {
-        forward = "none"
-      }
-    }
+    cache_policy_id = data.aws_cloudfront_cache_policy.caching_optimized.id
   }
 
   aliases = [var.website_name, "www.${var.website_name}"]
@@ -65,5 +56,21 @@ resource "aws_cloudfront_distribution" "www_distribution" {
     response_code         = 404
     response_page_path    = "/404.html"
   }
+
+  lifecycle {
+    ignore_changes = [web_acl_id] //aws will create and manage this automaticly
+  }
+}
+
+data "aws_cloudfront_cache_policy" "caching_optimized" {
+  //https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+  name = "Managed-CachingOptimized"
 }
 
+resource "aws_cloudfront_origin_access_control" "www" {
+  name                              = var.website_name
+  description                       = "Access ${var.website_name} bucket"
+  origin_access_control_origin_type = "s3"
+  signing_behavior                  = "always"
+  signing_protocol                  = "sigv4"
+}

modules/static_website/s3.tf

@@ -20,21 +20,25 @@ resource "aws_s3_bucket_policy" "public_read_for_get_bucket_objects" {
 data "aws_iam_policy_document" "public_read_for_get_bucket_objects" {
   version = "2008-10-17"
   statement {
-    sid    = "PublicReadForGetBucketObjects"
+    sid    = "AllowCloudFrontServicePrincipalReadOnly"
     effect = "Allow"
     principals {
-      identifiers = [aws_cloudfront_origin_access_identity.origin_access_identity.iam_arn]
-      type        = "AWS"
+      identifiers = ["cloudfront.amazonaws.com"]
+      type        = "Service"
     }
     actions = [
       "s3:GetObject"
     ]
     resources = [
       "${aws_s3_bucket.website.arn}/*"
     ]
-  }
-}
+    condition {
+      test     = "StringEquals"
+      variable = "AWS:SourceArn"
 
-resource "aws_cloudfront_origin_access_identity" "origin_access_identity" {
-  comment = var.prefix
+      values = [
+        aws_cloudfront_distribution.www_distribution.arn
+      ]
+    }
+  }
 }