AWS CDN for Kubernetes Ingresses

terraform {
   required_providers {
      ...
      aws = {
         source                = "hashicorp/aws"
         version               = "5.70.0"
         configuration_aliases = [aws.global]
      }
      ...
   }
}

module "ingress_1" {
   source = "${var.pf_module_source}kube_ingress${var.pf_module_ref}"

   namespace    = local.namespace
   name         = "example1"
   domains      = ["example.com"]
   
    ...
   
   # CDN mode MUST be enabled if you want to use a
   # CDN in front of an ingress
   cdn_mode_enabled = true
}

module "ingress_2" {
   source = "../kube_ingress"

   namespace    = local.namespace
   name         = "example2"
   domains      = ["example.com"]

   ...
   
   cdn_mode_enabled = true
   ingress_configs  = [{
      path_prefix = "/test"
      
      ...
      
      # You can configure CDN behavior on a per-ingress basis
      # See the kube_ingress documentation for more information
      cdn = {
         default_cache_behavior = {
            headers_in_cache_key = ["Authorization"]
         }
      }
   }]

}

module "cdn" {
   source = "${var.pf_module_source}kube_aws_cdn${var.pf_module_ref}"
   
   # Since the CDN operates globally, you must use the global
   # provider as follows:
   providers = {
     aws.global = aws.global
   }

   name               = "example"
   
   # Concatenate the CDN configs provided by each
   # ingress module and pass them to the CDN module
   origin_configs = concat(
     module.ingress_1.cdn_origin_configs,
     module.ingress_2.cdn_origin_configs
   )
}

list(object({
    origin_id            = optional(string)          # A globally unique identifier for this origin (will be automatically computed if not provided)
    origin_domain        = string                    # The domain name of the ingress origin
    domains              = list(string)              # The domains for this ingress
    path_prefix          = optional(string, "/")     # Only traffic with this HTTP path prefix will be routed to the indicated origin
    extra_origin_headers = optional(map(string), {}) # Headers sent from the CDN to the origin

    # The default behavior of the CDN before routing requests to this ingress
    default_cache_behavior = optional(object({
      caching_enabled      = optional(bool, true)                                                                 # Whether the CDN should cache responses from the origin (overrides all other caching settings)
      allowed_methods      = optional(list(string), ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]) # What HTTP methods are allowed
      cached_methods       = optional(list(string), ["GET", "HEAD"])                                              # What HTTP methods will be cached
      min_ttl              = optional(number, 0)                                                                  # Minimum cache time
      default_ttl          = optional(number, 86400)                                                              # Default cache time
      max_ttl              = optional(number, 31536000)                                                           # Maximum cache time
      cookies_in_cache_key = optional(list(string), ["*"])                                                        # Which cookies will be included in the cache key (Providing "*" means ALL cookies)
      headers_in_cache_key = optional(list(string), [                                                             # Which headers will be included in the cache key
        "Authorization",
        "Origin",
        "x-http-method-override",
        "x-http-method",
        "x-method-override",
        "x-forwarded-host",
        "x-host",
        "x-original-url",
        "x-rewrite-url",
        "forwarded"
      ])
      query_strings_in_cache_key  = optional(list(string), ["*"])         # Which query strings will be included in the cache key (Providing "*" means ALL query strings)
      cookies_not_forwarded       = optional(list(string), [])            # Which cookies will NOT be forwarded to the ingress from the CDN
      headers_not_forwarded       = optional(list(string), [])            # Which headers will NOT be forwarded to the ingress from CDN
      query_strings_not_forwarded = optional(list(string), [])            # Which query strings will NOT be forwarded to the ingress from the CDN
      compression_enabled         = optional(bool, true)                  # Whether the CDN performs compression on your assets
      viewer_protocol_policy      = optional(string, "redirect-to-https") # What should happen based on the client protocol (HTTP vs HTTPS)
    }))

    # Similar to default_cache_behavior but allows you to specific specific rules for certain path patterns
    # The keys for this map are the path patterns (e.g., "*.jpg")
    # Path patterns will automatically be prefixed with the path_prefix value, so it can be omitted
    path_match_behavior = optional(map(object({
      caching_enabled      = optional(bool, true) # Whether the CDN should cache responses from the origin (overrides all other caching settings)
      allowed_methods      = optional(list(string), ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"])
      cached_methods       = optional(list(string), ["GET", "HEAD"])
      min_ttl              = optional(number, 0)
      default_ttl          = optional(number, 86400)
      max_ttl              = optional(number, 31536000)
      cookies_in_cache_key = optional(list(string), ["*"])
      headers_in_cache_key = optional(list(string), [
        "Authorization",
        "Origin",
        "x-http-method-override",
        "x-http-method",
        "x-method-override",
        "x-forwarded-host",
        "x-host",
        "x-original-url",
        "x-rewrite-url",
        "forwarded"
      ])
      query_strings_in_cache_key  = optional(list(string), ["*"])
      cookies_not_forwarded       = optional(list(string), [])
      headers_not_forwarded       = optional(list(string), [])
      query_strings_not_forwarded = optional(list(string), [])
      compression_enabled         = optional(bool, true)
      viewer_protocol_policy      = optional(string, "redirect-to-https")
    })), {})
  }))

[
  "Content-Length"
]

[
  "GET",
  "HEAD"
]

list(object({
    source    = string                # A regex string for matching the entire request url (^https://domain.com(/.*)?$)
    target    = string                # The redirect target (can use numbered capture groups from the source - https://domain2.com/$1)
    permanent = optional(bool, false) # If true will issue a 301 redirect; otherwise, will use 302
  }))