Deploy secure, cost-effective static websites using CloudFront, S3, ACM and Route 53.

With support for using Gandi LiveDNS.

• terraform-aws-static-website
  • Components
  • Prerequisites
  • Feature Overview
  • Examples
  • Configuration Overiew
    • CloudFront
      • Logging
      • Cache Behavior
      • Lambda Function Associations
      • CloudFront Function Association
      • Geographic Restrictions
      • Security Policy
      • Field Level Encryption
      • Price Class
      • Dedicated IP for SSL
    • S3
      • Versioning
      • Access Control
      • Server Side Encryption
  • Requirements
  • Providers
  • Resources
  • Inputs
  • Outputs

• AWS Account and Access Key
  • More details at Terraform AWS Provider and Create AWS Access Key
• Download terraform version >= 1.46

• Quickly and easily configure a secure static website.
  • Minimal inputs required to get started
  • Highly configurable S3 and CloudFront distributions to allow for customization.
  • Input validation to reduce errors.
  • Additional input validation and output boolean that can be evaluated by your deployment framework or policy enforcement tools such as Sentinel.
• Security by default
  • Private encrypted buckets with managed access for CloudFront via Origin Access Control.
    • Amazon S3 SSE managed keys by default and the ability to use your own KMS keys
  • Default viewer protocol redirects to HTTPS
  • Module defaults to TLSv1.2 and allows TLS protocol v1+ only.
• Cost conscious defaults
  • S3 Bucket keys enabled by default which will reduce costs when using a KMS key.
  • Option for customers of Gandi to use their DNS service, which is provided at no extra cost.
  • Static asset bucket has versioning on by default which, when used effectively, can reduce CloudFront cache invalidation costs.
  • CloudFront Price Class set to 100 by default.

Example directories include a minimal configuration in main.tf. The README.md file for each example shows a more detailed configuration example.

There are a number of input variables that determine the behavior of the CloudFront distribtution. Please see the Input section of this document or the Example directories for more details.

CloudFront Standard Logging is enabled by default to a separate logging bucket.

The option is provided to disable standard logging and/or enable real-time logging by providing a real-time logging configuration ARN to the input variable realtime_log_config_arn

The default cache behavior of the CloudFront distribution is managed by a CloudFront Cache Policy. The cache policy can be modified in a number of ways. Please look at the Input variables that start with cloudfront_cache for descriptions, options and defaults.

Pass a list of Lambda functions via the Input variable: cloudfront_cache_behavior_lambda_function_associations

Pass a list of CloudFront Functions via the Input variable cloudfront_cache_behavior_function_associations

Manage Geo restrictions, disabled by default, with the cloudfront_geo_restriction_type and cloudfront_geo_restriction_locations Input variables.

Choose Security Policy with the cloudfront_viewer_security_policy Input variable.

Pass the ID of a Field Level Encryption Configuration via the Input variable cloudfront_field_level_encryption_id to enable Field Level Encryption for the CloudFront distribution.

Select an appropriate Price Class with the cloudfront_price_class Input variable.

⚠️ Warning ⚠️ This option is not required for most use-cases and is relatively 💵 expensive 💵

Ability to select the "Dedicated IP Custom SSL" feature with cloudfront_viewer_ssl_support_method

Enable versioning for static assets (enabled by default) or CloudFront log buckets (disabled by default).

Access to private static assets bucket granted to CloudFront via Origin Access Control

• Default policy allows s3:GetObject, s3:GetObjectVersion and s3:ListBucket to static asset bucket.
• Create and pass Custom Bucket IAM Policy to customize CloudFront access to S3.

• Bucket Keys enabled by default
• Server Side Encryption using either S3 managed keys (default) or with AWS Key Management Service.
  • To use your own KMS key
    • Update one or more of the Input variables: bucket_website_sse_algo and bucket_cloudfront_logs_sse_algo
    • Then update one or more of the Input variables: bucket_website_sse_kms_key_id and bucket_cloudfront_logs_kms_key_id

[
  "GET",
  "HEAD"
]

[
  "GET",
  "HEAD"
]

list(object({
    name  = string
    value = string
  }))