Skip to content

Commit 31bf858

Browse files
posquit0posquit0
authored
Support security headers for response-headers-policy module (#6)
1 parent c62aace commit 31bf858

File tree

11 files changed

+300
-43
lines changed

11 files changed

+300
-43
lines changed

‎examples/cloudfront-policies/main.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,4 +90,45 @@ module "response_headers_policy" {
9090
enabled = true
9191
sampling_rate = 50.0
9292
}
93+
94+
## Security Headers
95+
content_security_policy_header = {
96+
enabled = true
97+
override = true
98+
value = "default-src https:"
99+
}
100+
content_type_options_header = {
101+
enabled = true
102+
override = true
103+
}
104+
frame_options_header = {
105+
enabled = true
106+
override = true
107+
value = "SAMEORIGIN"
108+
}
109+
referrer_policy_header = {
110+
enabled = true
111+
override = true
112+
value = "strict-origin-when-cross-origin"
113+
}
114+
strict_transport_security_header = {
115+
enabled = true
116+
override = true
117+
118+
filtering_enabled = true
119+
block = true
120+
report = ""
121+
122+
max_age = 60 * 60 * 24 * 365
123+
include_subdomains = true
124+
preload = false
125+
}
126+
xss_protection_header = {
127+
enabled = true
128+
override = true
129+
130+
filtering_enabled = true
131+
block = true
132+
report = ""
133+
}
93134
}

‎modules/cache-policy/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ No modules.
3333
| Name | Description | Type | Default | Required |
3434
|------|-------------|------|---------|:--------:|
3535
| <a name="input_name"></a> [name](#input\_name) | (Required) A unique name to identify the CloudFront Cache Policy. | `string` | n/a | yes |
36-
| <a name="input_cache_keys_in_cookies"></a> [cache\_keys\_in\_cookies](#input\_cache\_keys\_in\_cookies) | (Optional) A configuraiton for specifying which cookies to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_cookies` as defined below.<br> (Required) `behavior` - Determine whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of cookie names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
37-
| <a name="input_cache_keys_in_headers"></a> [cache\_keys\_in\_headers](#input\_cache\_keys\_in\_headers) | (Optional) A configuraiton for specifying which headers to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_headers` as defined below.<br> (Required) `behavior` - Determine whether any headers in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`. Defaults to `NONE`.<br> (Optional) `items` - A list of header names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
38-
| <a name="input_cache_keys_in_query_strings"></a> [cache\_keys\_in\_query\_strings](#input\_cache\_keys\_in\_query\_strings) | (Optional) A configuraiton for specifying which query strings to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_query_strings` as defined below.<br> (Required) `behavior` - Determine whether any query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of query string names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
36+
| <a name="input_cache_keys_in_cookies"></a> [cache\_keys\_in\_cookies](#input\_cache\_keys\_in\_cookies) | (Optional) A configuration for specifying which cookies to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_cookies` as defined below.<br> (Required) `behavior` - Determine whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of cookie names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
37+
| <a name="input_cache_keys_in_headers"></a> [cache\_keys\_in\_headers](#input\_cache\_keys\_in\_headers) | (Optional) A configuration for specifying which headers to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_headers` as defined below.<br> (Required) `behavior` - Determine whether any headers in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`. Defaults to `NONE`.<br> (Optional) `items` - A list of header names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
38+
| <a name="input_cache_keys_in_query_strings"></a> [cache\_keys\_in\_query\_strings](#input\_cache\_keys\_in\_query\_strings) | (Optional) A configuration for specifying which query strings to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_query_strings` as defined below.<br> (Required) `behavior` - Determine whether any query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of query string names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
3939
| <a name="input_default_ttl"></a> [default\_ttl](#input\_default\_ttl) | (Optional) The default time to live in seconds. The amount of time is that you want objects to stay in the CloudFront cache before another request to the origin to see if the object has been updated. Defaults to `86400` (one day). | `number` | `86400` | no |
4040
| <a name="input_description"></a> [description](#input\_description) | (Optional) The description of the cache policy. | `string` | `"Managed by Terraform."` | no |
4141
| <a name="input_max_ttl"></a> [max\_ttl](#input\_max\_ttl) | (Optional) The maximum time to live in seconds. The amount of time is that you want objects to stay in the CloudFront cache before another request to the origin to see if the object has been updated. Defaults to `31536000` (one year). | `number` | `31536000` | no |
@@ -46,9 +46,9 @@ No modules.
4646

4747
| Name | Description |
4848
|------|-------------|
49-
| <a name="output_cache_keys_in_cookies"></a> [cache\_keys\_in\_cookies](#output\_cache\_keys\_in\_cookies) | A configuraiton for specifying which cookies to use as cache key in viewer requests. |
50-
| <a name="output_cache_keys_in_headers"></a> [cache\_keys\_in\_headers](#output\_cache\_keys\_in\_headers) | A configuraiton for specifying which headers to use as cache key in viewer requests. |
51-
| <a name="output_cache_keys_in_query_strings"></a> [cache\_keys\_in\_query\_strings](#output\_cache\_keys\_in\_query\_strings) | A configuraiton for specifying which query strings to use as cache key in viewer requests. |
49+
| <a name="output_cache_keys_in_cookies"></a> [cache\_keys\_in\_cookies](#output\_cache\_keys\_in\_cookies) | A configuration for specifying which cookies to use as cache key in viewer requests. |
50+
| <a name="output_cache_keys_in_headers"></a> [cache\_keys\_in\_headers](#output\_cache\_keys\_in\_headers) | A configuration for specifying which headers to use as cache key in viewer requests. |
51+
| <a name="output_cache_keys_in_query_strings"></a> [cache\_keys\_in\_query\_strings](#output\_cache\_keys\_in\_query\_strings) | A configuration for specifying which query strings to use as cache key in viewer requests. |
5252
| <a name="output_default_ttl"></a> [default\_ttl](#output\_default\_ttl) | The default time to live in seconds. |
5353
| <a name="output_description"></a> [description](#output\_description) | The description of the cache policy. |
5454
| <a name="output_etag"></a> [etag](#output\_etag) | The current version of the cache policy. |

‎modules/cache-policy/outputs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ output "supported_compression_formats" {
3939
}
4040

4141
output "cache_keys_in_cookies" {
42-
description = "A configuraiton for specifying which cookies to use as cache key in viewer requests."
42+
description = "A configuration for specifying which cookies to use as cache key in viewer requests."
4343
value = {
4444
behavior = {
4545
for k, v in local.behaviors :
@@ -50,7 +50,7 @@ output "cache_keys_in_cookies" {
5050
}
5151

5252
output "cache_keys_in_headers" {
53-
description = "A configuraiton for specifying which headers to use as cache key in viewer requests."
53+
description = "A configuration for specifying which headers to use as cache key in viewer requests."
5454
value = {
5555
behavior = {
5656
for k, v in local.behaviors :
@@ -61,7 +61,7 @@ output "cache_keys_in_headers" {
6161
}
6262

6363
output "cache_keys_in_query_strings" {
64-
description = "A configuraiton for specifying which query strings to use as cache key in viewer requests."
64+
description = "A configuration for specifying which query strings to use as cache key in viewer requests."
6565
value = {
6666
behavior = {
6767
for k, v in local.behaviors :

‎modules/cache-policy/variables.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ variable "supported_compression_formats" {
4848

4949
variable "cache_keys_in_cookies" {
5050
description = <<EOF
51-
(Optional) A configuraiton for specifying which cookies to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_cookies` as defined below.
51+
(Optional) A configuration for specifying which cookies to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_cookies` as defined below.
5252
(Required) `behavior` - Determine whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.
5353
(Optional) `items` - A list of cookie names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`.
5454
EOF
@@ -67,7 +67,7 @@ variable "cache_keys_in_cookies" {
6767

6868
variable "cache_keys_in_headers" {
6969
description = <<EOF
70-
(Optional) A configuraiton for specifying which headers to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_headers` as defined below.
70+
(Optional) A configuration for specifying which headers to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_headers` as defined below.
7171
(Required) `behavior` - Determine whether any headers in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`. Defaults to `NONE`.
7272
(Optional) `items` - A list of header names. It only takes effect when `behavior` is `WHITELIST`.
7373
EOF
@@ -86,7 +86,7 @@ variable "cache_keys_in_headers" {
8686

8787
variable "cache_keys_in_query_strings" {
8888
description = <<EOF
89-
(Optional) A configuraiton for specifying which query strings to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_query_strings` as defined below.
89+
(Optional) A configuration for specifying which query strings to use as cache key in viewer requests. The values in the cache key are automatically forwarded in requests to the origin. `cache_keys_in_query_strings` as defined below.
9090
(Required) `behavior` - Determine whether any query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `NONE`, `WHITELIST`, `BLACKLIST`, `ALL`. Defaults to `NONE`.
9191
(Optional) `items` - A list of query string names. It only takes effect when `behavior` is `WHITELIST` or `BLACKLIST`.
9292
EOF

‎modules/origin-request-policy/README.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,19 +34,19 @@ No modules.
3434
|------|-------------|------|---------|:--------:|
3535
| <a name="input_name"></a> [name](#input\_name) | (Required) A unique name to identify the CloudFront Origin Request Policy. | `string` | n/a | yes |
3636
| <a name="input_description"></a> [description](#input\_description) | (Optional) The description of the origin request policy. | `string` | `"Managed by Terraform."` | no |
37-
| <a name="input_forwarding_cookies"></a> [forwarding\_cookies](#input\_forwarding\_cookies) | (Optional) A configuraiton for specifying which cookies in viewer requests to be forwarded in the origin requests. `forwarding_cookies` as defined below.<br> (Required) `behavior` - Determine whether any cookies in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of cookie names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
38-
| <a name="input_forwarding_headers"></a> [forwarding\_headers](#input\_forwarding\_headers) | (Optional) A configuraiton for specifying which headers in viewer requests to be forwarded in the origin requests. `forwarding_headers` as defined below.<br> (Required) `behavior` - Determine whether any headers in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL_VIEWER` and `ALL_VIEWER_AND_CLOUDFRONT_WHITELIST`. Defaults to `NONE`.<br> (Optional) `items` - A list of header names. It only takes effect when `behavior` is `WHITELIST` or `ALL_VIEWER_AND_CLOUDFRONT_WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
39-
| <a name="input_forwarding_query_strings"></a> [forwarding\_query\_strings](#input\_forwarding\_query\_strings) | (Optional) A configuraiton for specifying which query strings in viewer requests to be forwarded in the origin requests. `forwarding_query_strings` as defined below.<br> (Required) `behavior` - Determine whether any query strings in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of query string names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
37+
| <a name="input_forwarding_cookies"></a> [forwarding\_cookies](#input\_forwarding\_cookies) | (Optional) A configuration for specifying which cookies in viewer requests to be forwarded in the origin requests. `forwarding_cookies` as defined below.<br> (Required) `behavior` - Determine whether any cookies in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of cookie names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
38+
| <a name="input_forwarding_headers"></a> [forwarding\_headers](#input\_forwarding\_headers) | (Optional) A configuration for specifying which headers in viewer requests to be forwarded in the origin requests. `forwarding_headers` as defined below.<br> (Required) `behavior` - Determine whether any headers in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL_VIEWER` and `ALL_VIEWER_AND_CLOUDFRONT_WHITELIST`. Defaults to `NONE`.<br> (Optional) `items` - A list of header names. It only takes effect when `behavior` is `WHITELIST` or `ALL_VIEWER_AND_CLOUDFRONT_WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
39+
| <a name="input_forwarding_query_strings"></a> [forwarding\_query\_strings](#input\_forwarding\_query\_strings) | (Optional) A configuration for specifying which query strings in viewer requests to be forwarded in the origin requests. `forwarding_query_strings` as defined below.<br> (Required) `behavior` - Determine whether any query strings in viewer requests are forwarded in the origin requests. Valid values are `NONE`, `WHITELIST`, `ALL`. Defaults to `NONE`.<br> (Optional) `items` - A list of query string names. It only takes effect when `behavior` is `WHITELIST`. | <pre>object({<br> behavior = optional(string, "NONE")<br> items = optional(set(string), [])<br> })</pre> | `{}` | no |
4040

4141
## Outputs
4242

4343
| Name | Description |
4444
|------|-------------|
4545
| <a name="output_description"></a> [description](#output\_description) | The description of the origin request policy. |
4646
| <a name="output_etag"></a> [etag](#output\_etag) | The current version of the origin request policy. |
47-
| <a name="output_forwarding_cookies"></a> [forwarding\_cookies](#output\_forwarding\_cookies) | A configuraiton for specifying which cookies to be forwarded in the origin requests. |
48-
| <a name="output_forwarding_headers"></a> [forwarding\_headers](#output\_forwarding\_headers) | A configuraiton for specifying which headers to be forwarded in the origin requests. |
49-
| <a name="output_forwarding_query_strings"></a> [forwarding\_query\_strings](#output\_forwarding\_query\_strings) | A configuraiton for specifying which query strings to be forwarded in the origin requests. |
47+
| <a name="output_forwarding_cookies"></a> [forwarding\_cookies](#output\_forwarding\_cookies) | A configuration for specifying which cookies to be forwarded in the origin requests. |
48+
| <a name="output_forwarding_headers"></a> [forwarding\_headers](#output\_forwarding\_headers) | A configuration for specifying which headers to be forwarded in the origin requests. |
49+
| <a name="output_forwarding_query_strings"></a> [forwarding\_query\_strings](#output\_forwarding\_query\_strings) | A configuration for specifying which query strings to be forwarded in the origin requests. |
5050
| <a name="output_id"></a> [id](#output\_id) | The identifier for the CloudFront origin request policy. |
5151
| <a name="output_name"></a> [name](#output\_name) | The name of the CloudFront origin request policy. |
5252
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/origin-request-policy/outputs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ output "description" {
1919
}
2020

2121
output "forwarding_cookies" {
22-
description = "A configuraiton for specifying which cookies to be forwarded in the origin requests."
22+
description = "A configuration for specifying which cookies to be forwarded in the origin requests."
2323
value = {
2424
behavior = {
2525
for k, v in local.behaviors :
@@ -30,7 +30,7 @@ output "forwarding_cookies" {
3030
}
3131

3232
output "forwarding_headers" {
33-
description = "A configuraiton for specifying which headers to be forwarded in the origin requests."
33+
description = "A configuration for specifying which headers to be forwarded in the origin requests."
3434
value = {
3535
behavior = {
3636
for k, v in local.behaviors :
@@ -41,7 +41,7 @@ output "forwarding_headers" {
4141
}
4242

4343
output "forwarding_query_strings" {
44-
description = "A configuraiton for specifying which query strings to be forwarded in the origin requests."
44+
description = "A configuration for specifying which query strings to be forwarded in the origin requests."
4545
value = {
4646
behavior = {
4747
for k, v in local.behaviors :

0 commit comments

Comments
 (0)