| aws_env_vars_suffix |
Append suffix for Gitlab CI/CD environment variables if needed |
string |
"" |
no |
| cloudfront_price_class |
CloudFront price class |
string |
"PriceClass_100" |
no |
| create_instance_profile |
Create instance profile for EC2 and add ec2.amazonaws.com service trust to the deploy role's assume role policy. Requires enable_deploy_role = true. |
bool |
false |
no |
| custom_headers |
n/a |
object({
headers = optional(map(object({
override = optional(bool, true)
value = string
})))
cors_rules = optional(object({
use = optional(bool, false)
allowed_headers = optional(list(string))
allowed_methods = optional(list(string))
allowed_origins = optional(list(string))
expose_headers = optional(list(string))
max_age_seconds = optional(number)
override = optional(bool, true)
}), null)
frame_options = optional(object({
use = optional(bool, false)
frame_option = string
override = optional(bool, true)
}), null)
referrer_policy = optional(object({
use = optional(bool, false)
referrer_policy = string
override = optional(bool, true)
}), null)
xss_protection = optional(object({
use = optional(bool, false)
mode_block = bool
protection = bool
override = optional(bool, true)
}), null)
content_security_policy = optional(object({
use = optional(bool, false)
policy = string
override = optional(bool, true)
}), null)
strict_transport_security = optional(object({
use = optional(bool, false)
access_control_max_age_sec = string
include_subdomains = bool
preload = bool
override = optional(bool, true)
}), null)
content_type_options = optional(object({
override = optional(bool, true)
}), null)
}) |
null |
no |
| default_ttl |
Default amount of time that you want objects to stay in a CloudFront cache |
number |
3600 |
no |
| deploy_pod_identity_role_arns |
List of IAM role ARNs granted S3 deploy access via bucket policy (for EKS pod identity CI runners). The roles must have matching IAM identity policies granting S3 and CloudFront actions. |
list(string) |
[] |
no |
| domain_zone_id |
The ID of the hosted zone for domain |
string |
n/a |
yes |
| domains |
List of domain aliases. You can also specify wildcard eg.: *.example.com |
list(string) |
n/a |
yes |
| enable_deploy_role |
Toggle IAM role creation for S3 deploy & CloudFront invalidation. Trust policy is assembled from two optional sources: GitLab OIDC web identity (when gitlab_project_ids/gitlab_project_id is set; requires existing aws_iam_openid_connect_provider matching the gitlab domain) and EC2 service trust (when create_instance_profile is true). |
bool |
false |
no |
| enable_deploy_user |
Toggle s3 deploy user creation |
bool |
true |
no |
| encrypt_with_kms |
Enable server side s3 bucket encryption with KMS key |
bool |
false |
no |
| extra_domains |
Map of extra_domains with domain name and zone_id |
map(string) |
{} |
no |
| extra_gitlab_cicd_variables |
List of additional gitlab CI/CD variables |
list(object({
protected = optional(bool, false)
masked = optional(bool, false)
raw = optional(bool, true)
key = string
value = string
})) |
[] |
no |
| functions |
n/a |
object({
viewer_request = optional(string)
viewer_response = optional(string)
}) |
{} |
no |
| gitlab_environment |
GitLab environment name |
string |
"*" |
no |
| gitlab_project_id |
Deprecated: Use gitlab_project_ids instead |
string |
"" |
no |
| gitlab_project_ids |
Integrates with GitLab CI/CD to deploy site and invalidate CloudFront cache |
list(string) |
[] |
no |
| kms_deletion_window_in_days |
The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the KMS key |
number |
30 |
no |
| kms_key_policy |
Additional KSM key policy |
string |
"{}" |
no |
| logs_bucket |
Bucket to store CloudFront logs |
string |
null |
no |
| logs_bucket_domain_name |
n/a |
string |
null |
no |
| max_ttl |
Maximum amount of time that you want objects to stay in a CloudFront cache |
number |
86400 |
no |
| min_ttl |
Minimum amount of time that you want objects to stay in a CloudFront cache |
number |
0 |
no |
| oidc |
List of OIDC providers |
list(object({
application_name = string
application_id = string
client_secret = string
auth_url = string
token_url = string
session_druation = optional(number, 12 * 3600)
})) |
[] |
no |
| oidc_callback_lambda_zip_path |
n/a |
string |
null |
no |
| oidc_edge_lambda_zip_path |
n/a |
string |
null |
no |
| origin_path |
Cloudfront origin path |
string |
"" |
no |
| override_status_code_403 |
Override status code for 403 error |
number |
403 |
no |
| override_status_code_404 |
Override status code for 404 error |
number |
200 |
no |
| proxy_paths |
n/a |
list(object({
origin_domain = string
path_prefix = string
})) |
[] |
no |
| response_header_access_control_allow_credentials |
n/a |
bool |
false |
no |
| response_header_origin_override |
n/a |
bool |
false |
no |
| restriction_type |
Apply for geo restrictions, values: none, whitelist, blacklist |
string |
"none" |
no |
| restrictions_locations |
List of country codes |
list(string) |
null |
no |
| s3_bucket_name |
n/a |
string |
n/a |
yes |
| s3_bucket_policy |
Additional S3 bucket policy |
string |
"{}" |
no |
| s3_cors_rule |
List of maps containing rules for Cross-Origin Resource Sharing. |
list(object({
allowed_headers = optional(list(string))
allowed_methods = optional(list(string))
allowed_origins = optional(list(string))
expose_headers = optional(list(string))
max_age_seconds = optional(number)
})) |
[] |
no |
| tags |
n/a |
map(string) |
{} |
no |
| waf_acl_arn |
WAF ACL ARN |
string |
null |
no |