Component 15

CloudFront Front Door

The public edge for private origins: distribution, certificate, WAF, and logging.

View example ↓Documentation ↗

Status

Available component

Deployment scope

Global edge

Example version constraint

~> 0.1

Review published versions ↗

GitHub ↗Registry ↗

Usage example

Inputs in, outputs out. Illustrative wiring, not a standalone deployment.

Supply one or more VPC origin ids, an ACM certificate in us-east-1 when using aliases, and a log bucket when logging is on. Configure provider requirements and credentials in your root module; check the documentation for all required inputs and version changes.

main.tf

module "frontdoor" {
  source = "pomo-studio/cloudfront-frontdoor/aws"
  version = "~> 0.1"

  name    = "orders"
  aliases = ["orders.example.com"]

  deployments = {
    blue = {
      vpc_origin_id = module.origin_blue.id
      domain_name   = aws_lb.blue.dns_name
      is_default    = true
    }
    green = {
      vpc_origin_id = module.origin_green.id
      domain_name   = aws_lb.green.dns_name
    }
  }
}

Key inputs

name
aliases
acm_certificate_arn
deployments
enable_waf
enable_logging
logging_bucket

Useful outputs

distribution_id
arn
domain_name
hosted_zone_id

What you get

One distribution

Put the public face of the application in one place.

Colour-aware cache

Key the cache on the deployment so promoted responses are fresh.

Bring your own WAF

Attach a web ACL you already manage.

Private Origin
Serve a private backend through CloudFront without exposing it to the internet.
Edge Blue/Green
Shift traffic between two backend deployments at the edge, with canary weighting and cookie pinning.

Built with