Terraform AWS CloudFront
CloudFront distributions with origins, origin access control, TLS certificates, cache behaviors, WAF association, logging, geo restrictions, and HTTPS only content delivery.
Quick start
module "cloudfront" {
source = "awswellarchitected.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "pcidss.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "iso27001.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "soc2.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "nistcsf.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "hipaa.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "nis2.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}module "cloudfront" {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
# ... your arguments here
}This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.
Migration from upstream
Already using terraform-aws-modules? Change only the source URL:
module "cloudfront" {
source = "terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
}module "cloudfront" {
source = "soc2.compliance.tf/terraform-aws-modules/cloudfront/aws"
version = "~> 6.7"
}Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.
Reversibility
No lock-in. Switch back by reverting the source URL:
module "cloudfront" {
source = "terraform-aws-modules/cloudfront/aws"
}Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.
Controls enforced
Up to 9 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.
Mapped compliance frameworks
| Clause | Controls from this module |
|---|---|
| Data protection | |
| Detection | |
| Infrastructure protection |
| Clause | Controls from this module |
|---|---|
| 1.2.8: Network security controls (NSCs) are configured and maintained. | |
| 1.3.1: Network access to and from the cardholder data environment is restricted. | |
| 1.3.2: Network access to and from the cardholder data environment is restricted. | |
| 1.4.2: Network connections between trusted and untrusted networks are controlled. | |
| 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks | |
| 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. | |
| 10.3.1: Audit logs are protected from destruction and unauthorized modifications. | |
| 10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. | |
| 5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. | |
| 6.4.1: Public-facing web applications are protected against attacks. | |
| 6.4.2: For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks | |
| A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. | |
| A1.2.3: Processes or mechanisms are implemented for reporting and addressing suspected or confirmed security incidents and vulnerabilities |
| Clause | Controls from this module |
|---|---|
| A.8.11 Data masking | |
| A.8.15 Logging | |
| A.8.16 Monitoring activities | |
| A.8.24 Use of cryptography |
| Clause | Controls from this module |
|---|---|
| A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives | |
| CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives | |
| PI1.2 System inputs are measured and recorded completely, accurately, and timely to meet the entity's processing integrity commitments and system requirements | |
| PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements |
| Clause | Controls from this module |
|---|---|
| PR.DS-02 | |
| PR.PS-04 |
| Clause | Controls from this module |
|---|---|
| 164.308(a)(1)(ii)(D): Administrative Safeguards |
| Clause | Controls from this module |
|---|---|
| 3 Incident handling |
| Clause | Controls from this module |
|---|---|
| ACSC-EE-ML2-7.7: Multi-factor authentication ML2 |
Framework coverage
Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.
| Control | PCI DSS v4.0 | SOC 2 | HIPAA Omnibus Rule 2013 |
|---|---|---|---|
| CloudFront distributions should have a default root object configured | Not active | Not active | Not active |
| CloudFront distributions should require encryption in transit | Not active | Enforced | Not active |
| CloudFront distributions should have field level encryption enabled | Not active | Enforced | Not active |
| CloudFront distributions should have geo restriction enabled | Not active | Not active | Not active |
| CloudFront distributions access logs should be enabled | Enforced | Enforced | Enforced |
| CloudFront distributions should use SNI to serve HTTPS requests | Not active | Not active | Not active |
| CloudFront distributions should use custom SSL/TLS certificates | Not active | Not active | Not active |
| CloudFront distributions should use the recommended TLS security policy | Not active | Enforced | Not active |
| CloudFront distributions should have AWS WAF enabled | Enforced | Not active | Not active |
9 controls enforced with a source URL change.