...
  default_cache_behavior = {
    target_origin_id       = "webapp"
    viewer_protocol_policy = "redirect-to-https"

    allowed_methods = ["GET", "HEAD", "OPTIONS"]
    cached_methods  = ["GET", "HEAD"]
    compress        = true

    cache_policy_id          = aws_cloudfront_cache_policy.default.id
    origin_request_policy_id = aws_cloudfront_origin_request_policy.default.id
  }
...

Error: error updating CloudFront Distribution (xxx): InvalidArgument: The parameter ForwardedValues cannot be used when a cache policy is associated to the cache behavior.
        status code: 400, request id: 764d6b38-ee58-4e88-bd1a-49d112cc6f7f

Before you submit an issue, please perform the following first:

1. Remove the local `.terraform` directory (! ONLY if state is stored remotely, which hopefully you are following that best practice!): `rm -rf .terraform/`
2. Re-initialize the project root to pull down modules: `terraform init`
3. Re-attempt your terraform plan or apply and check if the issue still persists

    │ Error: Invalid index
    │ 
    │   on .terraform/modules/cdn/main.tf line 252, in resource "aws_cloudfront_distribution" "this":
    │  252:       error_code = custom_error_response.value["error_code"]
    │     ├────────────────
    │     │ custom_error_response.value is 86400
    │ 
    │ This value does not have any indices.
    ╵
    ╷
    │ Error: Invalid index
    │ 
    │   on .terraform/modules/cdn/main.tf line 252, in resource "aws_cloudfront_distribution" "this":
    │  252:       error_code = custom_error_response.value["error_code"]
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ This value does not have any indices.
    ╵
    ╷
    │ Error: Invalid index
    │ 
    │   on .terraform/modules/cdn/main.tf line 252, in resource "aws_cloudfront_distribution" "this":
    │  252:       error_code = custom_error_response.value["error_code"]
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ This value does not have any indices.
    ╵
    ╷
    │ Error: Invalid index
    │ 
    │   on .terraform/modules/cdn/main.tf line 252, in resource "aws_cloudfront_distribution" "this":
    │  252:       error_code = custom_error_response.value["error_code"]
    │     ├────────────────
    │     │ custom_error_response.value is "wtf.html"
    │ 
    │ This value does not have any indices.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 254, in resource "aws_cloudfront_distribution" "this":
    │  254:       response_code         = lookup(custom_error_response.value, "response_code", null)
    │     ├────────────────
    │     │ custom_error_response.value is 86400
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 254, in resource "aws_cloudfront_distribution" "this":
    │  254:       response_code         = lookup(custom_error_response.value, "response_code", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 254, in resource "aws_cloudfront_distribution" "this":
    │  254:       response_code         = lookup(custom_error_response.value, "response_code", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 254, in resource "aws_cloudfront_distribution" "this":
    │  254:       response_code         = lookup(custom_error_response.value, "response_code", null)
    │     ├────────────────
    │     │ custom_error_response.value is "wtf.html"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 255, in resource "aws_cloudfront_distribution" "this":
    │  255:       response_page_path    = lookup(custom_error_response.value, "response_page_path", null)
    │     ├────────────────
    │     │ custom_error_response.value is 86400
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 255, in resource "aws_cloudfront_distribution" "this":
    │  255:       response_page_path    = lookup(custom_error_response.value, "response_page_path", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 255, in resource "aws_cloudfront_distribution" "this":
    │  255:       response_page_path    = lookup(custom_error_response.value, "response_page_path", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 255, in resource "aws_cloudfront_distribution" "this":
    │  255:       response_page_path    = lookup(custom_error_response.value, "response_page_path", null)
    │     ├────────────────
    │     │ custom_error_response.value is "wtf.html"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 256, in resource "aws_cloudfront_distribution" "this":
    │  256:       error_caching_min_ttl = lookup(custom_error_response.value, "error_caching_min_ttl", null)
    │     ├────────────────
    │     │ custom_error_response.value is 86400
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 256, in resource "aws_cloudfront_distribution" "this":
    │  256:       error_caching_min_ttl = lookup(custom_error_response.value, "error_caching_min_ttl", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 256, in resource "aws_cloudfront_distribution" "this":
    │  256:       error_caching_min_ttl = lookup(custom_error_response.value, "error_caching_min_ttl", null)
    │     ├────────────────
    │     │ custom_error_response.value is "404"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.
    ╵
    ╷
    │ Error: Invalid function argument
    │ 
    │   on .terraform/modules/cdn/main.tf line 256, in resource "aws_cloudfront_distribution" "this":
    │  256:       error_caching_min_ttl = lookup(custom_error_response.value, "error_caching_min_ttl", null)
    │     ├────────────────
    │     │ custom_error_response.value is "wtf.html"
    │ 
    │ Invalid value for "inputMap" parameter: lookup() requires a map as the first argument.

Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.


------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_s3_bucket.bucket will be created
  + resource "aws_s3_bucket" "bucket" {
      + acceleration_status         = (known after apply)
      + acl                         = "private"
      + arn                         = (known after apply)
      + bucket                      = (known after apply)
      + bucket_domain_name          = (known after apply)
      + bucket_regional_domain_name = (known after apply)
      + force_destroy               = false
      + hosted_zone_id              = (known after apply)
      + id                          = (known after apply)
      + region                      = (known after apply)
      + request_payer               = (known after apply)
      + website_domain              = (known after apply)
      + website_endpoint            = (known after apply)

      + versioning {
          + enabled    = (known after apply)
          + mfa_delete = (known after apply)
        }
    }

  # module.demo.aws_cloudfront_distribution.this[0] will be created
  + resource "aws_cloudfront_distribution" "this" {
      + arn                            = (known after apply)
      + caller_reference               = (known after apply)
      + comment                        = "For demo purposes"
      + domain_name                    = (known after apply)
      + enabled                        = true
      + etag                           = (known after apply)
      + hosted_zone_id                 = (known after apply)
      + http_version                   = "http2"
      + id                             = (known after apply)
      + in_progress_validation_batches = (known after apply)
      + is_ipv6_enabled                = true
      + last_modified_time             = (known after apply)
      + price_class                    = "PriceClass_All"
      + retain_on_delete               = false
      + status                         = (known after apply)
      + trusted_signers                = (known after apply)
      + wait_for_deployment            = true

      + default_cache_behavior {
          + allowed_methods        = [
              + "GET",
              + "HEAD",
              + "OPTIONS",
            ]
          + cached_methods         = [
              + "GET",
              + "HEAD",
            ]
          + compress               = true
          + default_ttl            = 86400
          + max_ttl                = 31536000
          + min_ttl                = 0
          + target_origin_id       = "demo"
          + viewer_protocol_policy = "allow-all"

          + forwarded_values {
              + query_string            = true
              + query_string_cache_keys = []

              + cookies {
                  + forward = "none"
                }
            }
        }

      + origin {
          + domain_name = (known after apply)
          + origin_id   = (known after apply)
          + origin_path = (known after apply)

          + custom_header {
              + name  = (known after apply)
              + value = (known after apply)
            }

          + custom_origin_config {
              + http_port                = (known after apply)
              + https_port               = (known after apply)
              + origin_keepalive_timeout = (known after apply)
              + origin_protocol_policy   = (known after apply)
              + origin_read_timeout      = (known after apply)
              + origin_ssl_protocols     = (known after apply)
            }

          + s3_origin_config {
              + origin_access_identity = (known after apply)
            }
        }

      + restrictions {
          + geo_restriction {
              + restriction_type = "none"
            }
        }

      + viewer_certificate {
          + minimum_protocol_version = "TLSv1"
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.

Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.


------------------------------------------------------------------------

Error: Unsupported attribute

  on .terraform/modules/staging-cdn/outputs.tf line 23, in output "this_cloudfront_distribution_trusted_signers":
  23:   value       = element(concat(aws_cloudfront_distribution.this.*.trusted_signers, list("")), 0)

This object does not have an attribute named "trusted_signers".

  allowed_methods = ["GET", "HEAD", "OPTIONS"]
  cached_methods  = ["GET", "HEAD", "OPTIONS"]
  compress        = true
  query_string    = true
  forwarded_values = {
    query_string = false,
    headers      = ["Origin", "Access-Control-Request-Headers", "Access-Control-Request-Method"]
  }
}

terraform plan
╷
│ Error: Unsupported argument
│
│   on main.tf line 22, in module "cloudfront":
│   22:   aliases = ["${local.subdomain}.${local.domain_name}"]
│
│ An argument named "aliases" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 24, in module "cloudfront":
│   24:   comment             = "My awesome CloudFront"
│
│ An argument named "comment" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 25, in module "cloudfront":
│   25:   enabled             = true
│
│ An argument named "enabled" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 26, in module "cloudfront":
│   26:   is_ipv6_enabled     = true
│
│ An argument named "is_ipv6_enabled" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 27, in module "cloudfront":
│   27:   price_class         = "PriceClass_All"
│
│ An argument named "price_class" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 28, in module "cloudfront":
│   28:   retain_on_delete    = false
│
│ An argument named "retain_on_delete" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 29, in module "cloudfront":
│   29:   wait_for_deployment = false
│
│ An argument named "wait_for_deployment" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 33, in module "cloudfront":
│   33:   create_monitoring_subscription = true
│
│ An argument named "create_monitoring_subscription" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 35, in module "cloudfront":
│   35:   create_origin_access_identity = true
│
│ An argument named "create_origin_access_identity" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 36, in module "cloudfront":
│   36:   origin_access_identities = {
│
│ An argument named "origin_access_identities" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 40, in module "cloudfront":
│   40:   logging_config = {
│
│ An argument named "logging_config" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 45, in module "cloudfront":
│   45:   origin = {
│
│ An argument named "origin" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 81, in module "cloudfront":
│   81:   origin_group = {
│
│ An argument named "origin_group" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 89, in module "cloudfront":
│   89:   default_cache_behavior = {
│
│ An argument named "default_cache_behavior" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 114, in module "cloudfront":
│  114:   ordered_cache_behavior = [
│
│ An argument named "ordered_cache_behavior" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 138, in module "cloudfront":
│  138:   viewer_certificate = {
│
│ An argument named "viewer_certificate" is not expected here.
╵
╷
│ Error: Unsupported argument
│
│   on main.tf line 143, in module "cloudfront":
│  143:   geo_restriction = {
│
│ An argument named "geo_restriction" is not expected here.
╵

module "cdn" {
  default_cache_behavior = {
    ...
    cache_policy_id = data.aws_cloudfront_origin_request_policy.custom_request_policy.id
  }
}

data "aws_cloudfront_origin_request_policy" "custom_request_policy" {
  name = "Custom-CacheBasedOnVersionQueryString"
}

data "aws_cloudfront_cache_policy" "managed_cors_s3origin" {
  name = "Managed-CORS-S3Origin"
}

╷
│ Error: Invalid index
│ 
│   on .terraform/modules/aws_cloudfront.cloudfront/main.tf line 252, in resource "aws_cloudfront_distribution" "this":
│  252:       error_code = custom_error_response.value["error_code"]
│     ├────────────────
│     │ custom_error_response.value is object with no attributes
│ 
│ The given key does not identify an element in this collection value.
╵
Operation failed: failed running terraform plan (exit 1)

default_cache_behavior = {
    target_origin_id       = "s3_one"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods = ["GET", "HEAD", "OPTIONS"]
    cached_methods  = ["GET", "HEAD"]
    use_forwarded_values = false
    cache_policy_id = "****"
    origin_request_policy_id = "*****"
    function_association = [
        {
        event_type   = "viewer-request",
        function_arn =  "<arn>"
        },
        {
        event_type   =  "viewer-response", 
        function_arn = "<arn>"
        }
      ]
  }

default_cache_behavior = {
    path_pattern           = "*"
    target_origin_id       = "alb"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods = ["GET", "HEAD", "OPTIONS","PUT", "POST", "PATCH", "DELETE"]
    cached_methods = ["GET", "HEAD"]
    compress = false
    headers = ["*"]
    cookies = {
      forward = "all"
    }
  }

    another_s3 = {
      path_pattern           = "/another/*"
      target_origin_id       = "s3_one"
      viewer_protocol_policy = "redirect-to-https"
      allowed_methods = ["GET", "HEAD", "OPTIONS"]
      cached_methods  = ["GET", "HEAD"]
      compress        = true
      query_string    = true
    }

  origin = {
    "main" = {
     //new prop here
    custom_headers = {
      "Access-Control-Allow-Origin": "*"
    }
    // rest of config not relevant
      domain_name = "somedomain"
      s3_origin_config = {
        origin_access_identity = "s3_bucket_one"
      }
    }
  }

Terraform v1.2.2

provider registry.terraform.io/hashicorp/aws v4.21.0
provider registry.terraform.io/hashicorp/random v3.3.2

# TERRAFORM
terraform {
  required_version = "~> 1.2.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
  }
}
provider "aws" {
  region              = "eu-central-1"
}
provider "aws" {
  alias               = "US_EAST_1"
  region              = "us-east-1"
}

# BUCKET
resource "aws_s3_bucket" "this" {
  bucket = "docs2.your-company.com"
}
resource "aws_s3_bucket_acl" "this" {
  bucket = aws_s3_bucket.this.id
  acl = "private"
}
resource "aws_s3_bucket_public_access_block" "this" {
  bucket = aws_s3_bucket.this.id
  block_public_acls       = true
  block_public_policy     = true
  restrict_public_buckets = true
  ignore_public_acls      = true
}
resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration {
    status = "Disabled"
  }
}
resource "aws_s3_bucket_website_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  index_document {
    suffix = "index.html"
  }
  error_document {
    key = "404.html"
  }
}
resource "aws_s3_bucket_policy" "this" {
  bucket = aws_s3_bucket.this.id
  policy = data.aws_iam_policy_document.this.json
}
data "aws_iam_policy_document" "this" {
  # Disable any access to bucket using HTTP, not sure if this is relevant for a private bucket but it was flagged by SonarQube: https://sonarcloud.io/project/security_hotspots?id=xg_eifu_ops&hotspots=AYG4-ut0G0qLjbzwOwoR
  statement {
    sid = "DisablePlainHTTP"
    effect = "Deny"
    principals {
      type        = "AWS"
      identifiers = ["*"]
    }
    actions = [
      "s3:*",
    ]
    resources = [
      "${aws_s3_bucket.this.arn}",
      "${aws_s3_bucket.this.arn}/*",
    ]
    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values = [
        "false",
      ]
    }
  }

  statement {
    sid = "RestrictAccessToCloudfront"
    effect = "Allow"
    principals {
      type        = "AWS"
      identifiers = [module.cf.cloudfront_origin_access_identity_iam_arns[0]]
    }
    actions = [
      "s3:GetObject",
    ]
    resources = [
      "${aws_s3_bucket.this.arn}/*",
    ]
  }
}


# CF KEYS
resource "aws_cloudfront_key_group" "this" {
  name    = "cfkg-yourcompany-com"
  comment = "cfkg-yourcompany-com"
  items   = [aws_cloudfront_public_key.this.id]
}
resource "aws_cloudfront_public_key" "this" {
  name        = "cfpk-yourcompany-com"
  comment     = "cfpk-yourcompany-com"
  encoded_key = <<EOF
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtv+gdr1BoxtTekNmENFi
f6jvjJZIaTU7aiBUDZhqToPgbfk/HfRm07tNDMck6spyfpLpI025OBV4njMk2/pJ
ZIyYs2wJeeelIVccMDshdTeZUiImEOkQrRNdlkn2lTwkjO6/WZX+BkxLZdqtJ9YK
ccII1N71EJuatIms/qx5WOKqWWPVJGni/qz5tR8unzWlwXmkSdQzDI/a9++1eY4F
hiTAG0UNPL74Aer3CGrb+xKomemsS/CGvKbwQQjc0FHVE9pBaDmchw2HB8Vb51Xi
s1uUUbl9YOotvY4EFqfS9o4vv93zKgWPt5HDcCEvds6dqGyaDcUwKJYq8IBhlKp6
pQIDAQAB
-----END PUBLIC KEY-----  
EOF
}

# CF
module "cf" {
  source  = "terraform-aws-modules/cloudfront/aws"
  version = "~> 2.9.3"

  aliases = ["docs2.your-company.com"]

  comment             = "docs2.your-company.com"
  enabled             = true
  price_class         = "PriceClass_All"
  retain_on_delete    = false
  is_ipv6_enabled     = true
  wait_for_deployment = true

  default_root_object = "index.html"

  create_origin_access_identity = true

  origin_access_identities = {
    s3_bucket_one = "docs2.your-company.com"
  }

  origin = {
    s3_origin_config = {
      domain_name            = aws_s3_bucket.this.bucket_domain_name
      origin_access_identity = "s3_bucket_one" # key in `origin_access_identities`
    }
  }

  default_cache_behavior = {
    target_origin_id       = "s3_origin_config"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    use_forwarded_values   = false
    trusted_key_groups     = [aws_cloudfront_key_group.this.id]

    # These IDs are copied from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html
    cache_policy_id            = "658327ea-f89d-4fab-a63d-7e88639e58f6"
    origin_request_policy_id   = "88a5eaf4-2fd4-4709-b370-b4c650ea3fcf"
    response_headers_policy_id = "eaab4381-ed33-4a86-88ca-d9558dc6cd63"
  }

  custom_error_response = [
    {
      error_code            = "403"
      error_caching_min_ttl = "0"
      response_page_path    = "/index.html"
      response_code         = "200"
    },
    {
      error_code            = "404"
      error_caching_min_ttl = "0"
      response_page_path    = "/index.html"
      response_code         = "200"
    }
  ]

  viewer_certificate = {
    acm_certificate_arn      = data.aws_acm_certificate.issued.arn
    minimum_protocol_version = "TLSv1.2_2021"
    ssl_support_method       = "sni-only"
  }
}

data "aws_acm_certificate" "issued" {
  domain   = "docs2.your-company.com"
  statuses = ["ISSUED"]
  provider = aws.US_EAST_1
}

╷
│ Error: CloudFrontOriginAccessIdentityInUse: The CloudFront origin access identity is still being used.
│       status code: 409, request id: xxxxxxxx-853a-480d-xxxx-5fa5c26b9ab4
│
│
╵

│ Error: Unsupported attribute
│
│   on outputs.tf line 19, in output "cloudfront_distribution_domain_name":
│   19:   value = module.cdn[*].cloudfront_distribution_arn
│
│ This object does not have an attribute named "cloudfront_distribution_arn".

  default_cache_behavior = {
    target_origin_id           = "default"
    viewer_protocol_policy     = "https-only"


    allowed_methods = ["GET", "HEAD"]
    cached_methods  = ["GET", "HEAD"]
    compress        = true
    query_string    = true

    cache_policy_id            = "658327ea-f89d-4fab-a63d-7e88639e58f6"
    origin_request_policy_id   = "acba4595-bd28-49b8-b9fe-13317c0390fa"
    # This is id for SecurityHeadersPolicy copied from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html
    response_headers_policy_id = "67f7725c-6f97-4210-82d7-5512b31e9d03"
  }

  - origin {
      - domain_name = "slbwa.execute-api.eu-central-1.amazonaws.com" -> null
      - origin_id   = "api_pr" -> null

      - custom_origin_config {
          - http_port                = 80 -> null
          - https_port               = 443 -> null
          - origin_keepalive_timeout = 5 -> null
          - origin_protocol_policy   = "https-only" -> null
          - origin_read_timeout      = 30 -> null
          - origin_ssl_protocols     = [
              - "TLSv1.2",
            ] -> null
        }
    }
  + origin {
      + domain_name = "slbwa.execute-api.eu-central-1.amazonaws.com"
      + origin_id   = "api_pr"

      + custom_origin_config {
          + http_port                = 80
          + https_port               = 443
          + origin_keepalive_timeout = 5
          + origin_protocol_policy   = "https-only"
          + origin_read_timeout      = 30
          + origin_ssl_protocols     = [
              + "TLSv1.2",
            ]
        }
    }
  - origin {
      - domain_name = "t0pmutn.execute-api.eu-central-1.amazonaws.com" -> null
      - origin_id   = "api_br" -> null

      - custom_origin_config {
          - http_port                = 80 -> null
          - https_port               = 443 -> null
          - origin_keepalive_timeout = 5 -> null
          - origin_protocol_policy   = "https-only" -> null
          - origin_read_timeout      = 30 -> null
          - origin_ssl_protocols     = [
              - "TLSv1.2",
            ] -> null
        }
    }
  + origin {
      + domain_name = "t0pmu.execute-api.eu-central-1.amazonaws.com"
      + origin_id   = "api_br"

      + custom_origin_config {
          + http_port                = 80
          + https_port               = 443
          + origin_keepalive_timeout = 5
          + origin_protocol_policy   = "https-only"
          + origin_read_timeout      = 30
          + origin_ssl_protocols     = [
              + "TLSv1.2",
            ]
        }
    }

  - origin {
      - domain_name = "slbwa.execute-api.eu-central-1.amazonaws.com" -> null
      - origin_id   = "api_pr" -> null

      - custom_origin_config {
          - http_port                = 80 -> null
          - https_port               = 443 -> null
          - origin_keepalive_timeout = 5 -> null
          - origin_protocol_policy   = "https-only" -> null
          - origin_read_timeout      = 30 -> null
          - origin_ssl_protocols     = [
              - "TLSv1.2",
            ] -> null
        }
    }
  + origin {
      + domain_name = "slbwa.execute-api.eu-central-1.amazonaws.com"
      + origin_id   = "api_pr"

      + custom_origin_config {
          + http_port                = 80
          + https_port               = 443
          + origin_keepalive_timeout = 5
          + origin_protocol_policy   = "https-only"
          + origin_read_timeout      = 30
          + origin_ssl_protocols     = [
              + "TLSv1.2",
            ]
        }
    }
  - origin {
      - domain_name = "t0pmutn.execute-api.eu-central-1.amazonaws.com" -> null
      - origin_id   = "api_br" -> null

      - custom_origin_config {
          - http_port                = 80 -> null
          - https_port               = 443 -> null
          - origin_keepalive_timeout = 5 -> null
          - origin_protocol_policy   = "https-only" -> null
          - origin_read_timeout      = 30 -> null
          - origin_ssl_protocols     = [
              - "TLSv1.2",
            ] -> null
        }
    }
  + origin {
      + domain_name = "t0pmu.execute-api.eu-central-1.amazonaws.com"
      + origin_id   = "api_br"

      + custom_origin_config {
          + http_port                = 80
          + https_port               = 443
          + origin_keepalive_timeout = 5
          + origin_protocol_policy   = "https-only"
          + origin_read_timeout      = 30
          + origin_ssl_protocols     = [
              + "TLSv1.2",
            ]
        }
    }

ordered_cache_behavior = [
    {
      path_pattern           = "/cdn/*"
      target_origin_id       = "s3"
      viewer_protocol_policy = "allow-all"

      allowed_methods = ["GET", "HEAD", "OPTIONS", "PUT", "POST", "PATCH", "DELETE"]
      headers = ["Access-Control-Request-Headers", "Access-Control-Request-Method", "Origin"]
      trusted_signers = ["self"]
    },
    {
      path_pattern = "lib/requirejs.php*"
      target_origin_id = "alb"
      viewer_protocol_policy = "allow-all"

      allowed_methods = ["GET", "HEAD"]
      headers = ["Host"]
      query_string = true
    },
]

    query_string = false
    },
    {
      path_pattern = "lib/requirejs.php*"
      target_origin_id = "alb"
      viewer_protocol_policy = "allow-all"

      allowed_methods = ["GET", "HEAD"]
      headers = ["Host"]
      trusted_signers = []
      query_string = true
    },

+ provider registry.terraform.io/hashicorp/archive v2.2.0
+ provider registry.terraform.io/hashicorp/aws v4.39.0
+ provider registry.terraform.io/hashicorp/cloudinit v2.2.0
+ provider registry.terraform.io/hashicorp/external v2.2.3
+ provider registry.terraform.io/hashicorp/local v2.2.3
+ provider registry.terraform.io/hashicorp/null v3.2.0
+ provider registry.terraform.io/hashicorp/random v3.4.3

terragrunt plan

╷
│ Error: Invalid value for input variable
│ 
│   on variables.tf line 1:
│    1: variable "cloudfronts" {
│ 
│ Unsuitable value for var.cloudfronts set using the TF_VAR_cloudfronts
│ environment variable: cannot find a common base type for all elements.
╵

use_forwarded_values = true
query_string = true

# provider "aws" {
#   region = "us-east-1" # CloudFront expects ACM resources in us-east-1 region only
#
#   # Make it faster by skipping something
#   skip_metadata_api_check     = true
#   skip_region_validation      = true
#   skip_credentials_validation = true
#
#   # skip_requesting_account_id should be disabled to generate valid ARN in apigatewayv2_api_execution_arn
#   skip_requesting_account_id = false
# }

locals {
  domain_name = "example.com"
  subdomain   = "cdn"
}

module "cloudfront" {
    source  = "terraform-aws-modules/cloudfront/aws"

  aliases = ["${local.subdomain}.${local.domain_name}"]

  comment             = "My awesome CloudFront"
  enabled             = true
  http_version        = "http2and3"
  is_ipv6_enabled     = true
  price_class         = "PriceClass_All"
  retain_on_delete    = false
  wait_for_deployment = false

  # When you enable additional metrics for a distribution, CloudFront sends up to 8 metrics to CloudWatch in the US East (N. Virginia) Region.
  # This rate is charged only once per month, per metric (up to 8 metrics per distribution).
  create_monitoring_subscription = true

  create_origin_access_identity = true
  origin_access_identities = {
    s3_bucket_one = "My awesome CloudFront can access"
  }

  create_origin_access_control = true
  origin_access_control = {
    s3_oac = {
      description      = "CloudFront access to S3"
      origin_type      = "s3"
      signing_behavior = "always"
      signing_protocol = "sigv4"
    }
  }

#   logging_config = {
#     bucket = module.log_bucket.s3_bucket_bucket_domain_name
#     prefix = "cloudfront"
#   }

  origin = {
    appsync = {
      domain_name = "appsync.${local.domain_name}"
      custom_origin_config = {
        http_port              = 80
        https_port             = 443
        origin_protocol_policy = "match-viewer"
        origin_ssl_protocols   = ["TLSv1", "TLSv1.1", "TLSv1.2"]
      }

      custom_header = [
        {
          name  = "X-Forwarded-Scheme"
          value = "https"
        },
        {
          name  = "X-Frame-Options"
          value = "SAMEORIGIN"
        }
      ]

      origin_shield = {
        enabled              = true
        origin_shield_region = "us-east-1"
      }
    }

    s3_one = { # with origin access identity (legacy)
      domain_name = module.s3_one.s3_bucket_bucket_regional_domain_name
      s3_origin_config = {
        origin_access_identity = "s3_bucket_one" # key in `origin_access_identities`
        # cloudfront_access_identity_path = "origin-access-identity/cloudfront/E5IGQAA1QO48Z" # external OAI resource
      }
    }

    s3_oac = { # with origin access control settings (recommended)
      domain_name           = module.s3_one.s3_bucket_bucket_regional_domain_name
      origin_access_control = "s3_oac" # key in `origin_access_control`
      #      origin_access_control_id = "E345SXM82MIOSU" # external OAС resource
    }
  }

  origin_group = {
    group_one = {
      failover_status_codes      = [403, 404, 500, 502]
      primary_member_origin_id   = "appsync"
      secondary_member_origin_id = "s3_one"
    }
  }

  default_cache_behavior = {
    target_origin_id       = "appsync"
    viewer_protocol_policy = "allow-all"
    allowed_methods        = ["GET", "HEAD", "OPTIONS"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    query_string           = true

    # This is id for SecurityHeadersPolicy copied from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html
    response_headers_policy_id = "67f7725c-6f97-4210-82d7-5512b31e9d03"

    lambda_function_association = {

      # Valid keys: viewer-request, origin-request, viewer-response, origin-response
      viewer-request = {
        lambda_arn   = module.lambda_function.lambda_function_qualified_arn
        include_body = true
      }

      origin-request = {
        lambda_arn = module.lambda_function.lambda_function_qualified_arn
      }
    }
  }

  ordered_cache_behavior = [
    {
      path_pattern           = "/static/*"
      target_origin_id       = "s3_one"
      viewer_protocol_policy = "redirect-to-https"

      allowed_methods = ["GET", "HEAD", "OPTIONS"]
      cached_methods  = ["GET", "HEAD"]
      compress        = true
      query_string    = true

      function_association = {
        # Valid keys: viewer-request, viewer-response
        viewer-request = {
          function_arn = aws_cloudfront_function.example.arn
        }

        viewer-response = {
          function_arn = aws_cloudfront_function.example.arn
        }
      }
    }
  ]

#   viewer_certificate = {
#     acm_certificate_arn = module.acm.acm_certificate_arn
#     ssl_support_method  = "sni-only"
#   }

  custom_error_response = [{
    error_code         = 404
    response_code      = 404
    response_page_path = "/errors/404.html"
    }, {
    error_code         = 403
    response_code      = 403
    response_page_path = "/errors/403.html"
  }]

  geo_restriction = {
    restriction_type = "whitelist"
    locations        = ["NO", "UA", "US", "GB"]
  }

}

######
# ACM
######

# data "aws_route53_zone" "this" {
#   name = local.domain_name
# }

# module "acm" {
#   source  = "terraform-aws-modules/acm/aws"
#   version = "~> 4.0"
#
#   domain_name               = local.domain_name
#   zone_id                   = data.aws_route53_zone.this.id
#   subject_alternative_names = ["${local.subdomain}.${local.domain_name}"]
# }

#############
# S3 buckets
#############

data "aws_canonical_user_id" "current" {}
data "aws_cloudfront_log_delivery_canonical_user_id" "cloudfront" {}

module "s3_one" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.0"

  bucket        = "s3-one-${random_pet.this.id}"
  force_destroy = true
}

module "log_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = "~> 3.0"

  bucket = "logs-${random_pet.this.id}"
  acl    = null
#   grant = [{
#     type       = "CanonicalUser"
#     permission = "FULL_CONTROL"
#     id         = data.aws_canonical_user_id.current.id
#     }, {
#     type       = "CanonicalUser"
#     permission = "FULL_CONTROL"
#     id         = data.aws_cloudfront_log_delivery_canonical_user_id.cloudfront.id
#     # Ref. https://github.com/terraform-providers/terraform-provider-aws/issues/12512
#     # Ref. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html
#   }]
  force_destroy = true
}

#############################################
# Using packaged function from Lambda module
#############################################

locals {
  package_url = "https://raw.githubusercontent.com/terraform-aws-modules/terraform-aws-lambda/master/examples/fixtures/python3.8-zip/existing_package.zip"
  downloaded  = "downloaded_package_${md5(local.package_url)}.zip"
}

resource "null_resource" "download_package" {
  triggers = {
    downloaded = local.downloaded
  }

  provisioner "local-exec" {
    command = "curl -L -o ${local.downloaded} ${local.package_url}"
  }
}

module "lambda_function" {
  source  = "terraform-aws-modules/lambda/aws"
  version = "~> 4.0"

  function_name = "${random_pet.this.id}-lambda"
  description   = "My awesome lambda function"
  handler       = "index.lambda_handler"
  runtime       = "python3.8"

  publish        = true
  lambda_at_edge = true

  create_package         = false
  local_existing_package = local.downloaded

  # @todo: Missing CloudFront as allowed_triggers?

  #    allowed_triggers = {
  #      AllowExecutionFromAPIGateway = {
  #        service = "apigateway"
  #        arn     = module.api_gateway.apigatewayv2_api_execution_arn
  #      }
  #    }
}

##########
# Route53
##########

# module "records" {
#   source  = "terraform-aws-modules/route53/aws//modules/records"
#   version = "~> 2.0"
#
#   zone_id = data.aws_route53_zone.this.zone_id
#
#   records = [
#     {
#       name = local.subdomain
#       type = "A"
#       alias = {
#         name    = module.cloudfront.cloudfront_distribution_domain_name
#         zone_id = module.cloudfront.cloudfront_distribution_hosted_zone_id
#       }
#     },
#   ]
# }

data "aws_iam_policy_document" "s3_policy" {
  # Origin Access Identities
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${module.s3_one.s3_bucket_arn}/static/*"]

    principals {
      type        = "AWS"
      identifiers = module.cloudfront.cloudfront_origin_access_identity_iam_arns
    }
  }

  # Origin Access Controls
  statement {
    actions   = ["s3:GetObject"]
    resources = ["${module.s3_one.s3_bucket_arn}/static/*"]

    principals {
      type        = "Service"
      identifiers = ["cloudfront.amazonaws.com"]
    }

    condition {
      test     = "StringEquals"
      variable = "aws:SourceArn"
      values   = [module.cloudfront.cloudfront_distribution_arn]
    }
  }
}

resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = module.s3_one.s3_bucket_id
  policy = data.aws_iam_policy_document.s3_policy.json
}

########
# Extra
########

resource "random_pet" "this" {
  length = 2
}

resource "aws_cloudfront_function" "example" {
  name    = "example-${random_pet.this.id}"
  runtime = "cloudfront-js-1.0"
  code    = file("example-function.js")
}

│ Error: error creating S3 bucket ACL for logs-innocent-corgi: AccessControlListNotSupported: The bucket does not allow ACLs
│ 	status code: 400, request id: NJ7835E8980SRGS7, host id: vzPOcfFLVpvQyOaOUV6dZ5HKTVBA8eqNzuEXAZqlDoo0YUwz0x8ZLPn18PllCGiLA8wb9yTr+wQ=
│
│   with module.log_bucket.aws_s3_bucket_acl.this[0],
│   on .terraform/modules/log_bucket/main.tf line 41, in resource "aws_s3_bucket_acl" "this":
│   41: resource "aws_s3_bucket_acl" "this" {
│
╵
╷
│ Error: updating CloudFront Distribution (E41UCPXDJBANV): InvalidLambdaFunctionAssociation: The function must be in region 'us-east-1'. ARN: arn:aws:lambda:ap-northeast-1:183154346239:function:innocent-corgi-lambda:1
│ 	status code: 400, request id: 2b01c748-ff21-4d8b-a4a2-bd3a016a8b84
│
│   with module.cloudfront.aws_cloudfront_distribution.this[0],
│   on .terraform/modules/cloudfront/main.tf line 27, in resource "aws_cloudfront_distribution" "this":
│   27: resource "aws_cloudfront_distribution" "this" {

lambda_function_association = [{
          event_type = "origin-request"
          lambda_arn = var.geo-restrictions-lambda
          include_body = false
      }]

module "cdn" {

source = "terraform-aws-modules/cloudfront/aws" 

......

default_cache_behavior = {
      target_origin_id       = "platform"
      viewer_protocol_policy = "redirect-to-https"

      allowed_methods = ["GET", "HEAD", "OPTIONS",  "PUT", "POST", "PATCH", "DELETE"]
      cached_methods  = ["GET", "HEAD"]
      compress        = true
      query_string    = true

      cache_policy_id = aws_cloudfront_cache_policy.georegion.id
      origin_request_policy_id= aws_cloudfront_origin_request_policy.forward-all.id
 
      lambda_function_association = [{
          event_type = "origin-request"
          lambda_arn = var.geo-restrictions-lambda
          include_body = false
      }]
  }

default_cache_behavior {
            # (12 unchanged attributes hidden)

          + forwarded_values {
              + headers                 = (known after apply)
              + query_string            = true
              + query_string_cache_keys = []

              + cookies {
                  + forward           = "none"
                  + whitelisted_names = (known after apply)
                }
            }

          + lambda_function_association {
              + event_type   = "origin-request"
              + include_body = false
              + lambda_arn   = "xxxxxxxxxxx"
       }
}

  + lambda_function_association {
              + event_type   = "0"
              + include_body = false
              + lambda_arn   = "XXXXXXXX"

module.cdn.aws_cloudfront_distribution.this[0]: Modifying... [id=E2XF1KSLDDCHS1]

Error: error updating CloudFront Distribution (E2XF1KSLDDCHS1): MalformedXML: 1 validation error detected: Value '0' at 'distributionConfig.defaultCacheBehavior.lambdaFunctionAssociations.items.1.member.eventType' failed to satisfy constraint: Member must satisfy enum value set: [origin-response, origin-request, viewer-request, viewer-response]
        status code: 400, request id: 79c93e7b-99ba-4667-9db5-f3097b8f41b8

  on .terraform/modules/cdn/main.tf line 11, in resource "aws_cloudfront_distribution" "this":
  11: resource "aws_cloudfront_distribution" "this" {


Releasing state lock. This may take a few moments...

origin {
  domain_name = aws_lb.ginger-app-qa-lb.dns_name
  origin_id   = aws_lb.ginger-app-qa-lb.dns_name
}

allowed_methods = ["GET", "HEAD", "OPTIONS"]
cached_methods  = ["GET", "HEAD"]
compress        = true
query_string    = true

create_origin_access_control = true
origin_access_controls = {
    s3_bucket_one = {
      name                              = "example"
      description                       = "Example Policy"
      origin_access_control_origin_type = "s3"
      signing_behavior                  = "always"
      signing_protocol                  = "sigv4"
    }
 }

origin = {
    mymaps = {
      domain_name = "my-bucket.s3.amazonaws.com"
      origin_id = "my.domain.net"
      s3_origin_config = {
        origin_access_identity = "s3_bucket_one"
      }
    }
  }

      + origin {
          + connection_attempts = 3
          + connection_timeout  = 10
          + domain_name         = "my-bucket.s3.amazonaws.com"
          + origin_id           = "my.domain.net""

          + s3_origin_config {
              + origin_access_identity = (known after apply)
            }
        }

origin = {
    mymaps = {
      domain_name = "my-bucket.s3.amazonaws.com"
      origin_id = "my.domain.net"
      s3_origin_config = {
        origin_access_identity = "s3_bucket_one"
      }
    }
  }

module.cdn.aws_cloudfront_distribution.this[0]: Creating...
╷
│ Error: creating CloudFront Distribution: NoSuchOrigin: One or more of your origins or origin groups do not exist.
│ 	status code: 404, request id: d3018742-2a26-XXXd-9a8e-55084810773e
│ 
│   with module.cdn.aws_cloudfront_distribution.this[0],
│   on .terraform/modules/cdn/main.tf line 27, in resource "aws_cloudfront_distribution" "this":
│   27: resource "aws_cloudfront_distribution" "this" {
│ 
╵

allowed_methods = ["GET", "HEAD", "OPTIONS"]
cached_methods  = ["GET", "HEAD"]
query_string    = true

min_ttl                = 0
default_ttl            = 86400
max_ttl                = 31536000
compress               = true

cache_policy_id        = aws_cloudfront_cache_policy.S3RedirectCachePolicy.id

lambda_function_association = {
  origin-request = {
    lambda_arn = module.lambda_edge.lambda_function_qualified_arn
  }
}

# parameter ForwardedValues cannot be used when a cache policy is associated to the cache behavior
/*forwarded_values = {} 
}*/

  default_cache_behavior = {
    target_origin_id       = "sales"
    viewer_protocol_policy = "allow-all"

    allowed_methods = ["GET", "HEAD", "OPTIONS"]
    cached_methods  = ["GET", "HEAD"]
    compress        = true
    query_string    = true
    
    forwarded_values = {
        query_string = false
        headers      = ["*"]
        cookies = {
          forward = "none"
        }
      }
  }

module.cdn.aws_cloudfront_distribution.this[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "this" {
        id                             = "E1VH9JE6Z65KNX"
        tags                           = {}
        # (19 unchanged attributes hidden)

      ~ default_cache_behavior {
            # (11 unchanged attributes hidden)

          ~ forwarded_values {
              ~ headers                 = [
                  - "*",
                ]
                # (2 unchanged attributes hidden)

                # (1 unchanged block hidden)
            }
        }





        # (6 unchanged blocks hidden)
    }