feat: Improve CDN origin control

[jwadolowski]

what

1. Enable explicit origin type definition - generic backend (default for compatibility reasons) vs S3 bucket
2. Ignore OAC unless S3 origin was specified
3. Add OAI support
4. Make sure origin shield can be specified for non-default origins

why

Currently, the module aims for a backend/cloud/platform-agnostic default origin. All of its details (port, protocol, domain, etc) are placed inside custom_origin_config block. Unfortunately, custom_origin_config presence implies lack of OAC/OAI support.

Here's my use case:

• I manage a CloudFront instance using cloudposse/cloudfront-cdn/aws in AWS account A
• the CF distribution is pointed at an S3 bucket that's deployed to AWS account B (outside of my control)
• the team that manages the B account would like to protect the bucket from unauthorized access by leveraging either Origin Access Identity or Origin Access Control

Technically, the module allows me to assign an S3 bucket URL to origin_domain_name, but I can associate neither OAC (even though origin_access_control_id exists) nor OAI (no such option at the moment, however OAI gets created by the module) with it.

The following code fails upon apply:

resource "aws_cloudfront_origin_access_control" "s3" {
  name                              = "example"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

module "cdn" {
  source    = "cloudposse/cloudfront-cdn/aws"
  version   = "1.2.0"
  namespace = "test"
  
  # ...

  origin_domain_name     = "<MY_BUCKET_NAME>.s3.us-west-2.amazonaws.com"
  origin_protocol_policy = "https-only"
  origin_shield = {
    enabled = true
    region  = "us-west-2"
  }
  origin_access_control_id = aws_cloudfront_origin_access_control.s3.id

  # ...
}

╷
│ Error: updating CloudFront Distribution (XXXXXXXXXXXXXX): operation error CloudFront: UpdateDistribution, https response error StatusCode: 400, RequestID: yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy, IllegalOriginAccessConfiguration: Illegal configuration: The origin type and OAC origin type differ.
│
│   with module.myapp.module.cdn.aws_cloudfront_distribution.default[0],
│   on .terraform/modules/myapp.cdn/main.tf line 45, in resource "aws_cloudfront_distribution" "default":
│   45: resource "aws_cloudfront_distribution" "default" {
│
╵

That's because OAC works only when the origin block doesn't reference the custom_origin_config sub-block inside.

All in all, currently S3 origin silently implies public access to the bucket, which would be an eyebrow-raising requirement.

At first glance, cloudposse/cloudfront-s3-cdn/aws may seem to be a viable alternative (it supports pre-existing S3 buckets), but it's not going to work - behind the scenes it assumes that both the CloudFront distribution and the bucket belong to the same AWS account (which is totally fine, that's just a different use case).

Aside from the above, this PR includes the following improvements:

• OAC makes sense only for S3 origins, therefore its value should be zeroed if that's not the case
• OAI support (both built-in OAI and external one can be used, see examples)
• user can choose between OAI and OAC (when both are specified, OAC takes precedence)
• origin shield can now be configured for any non-default origin
• fixes deprecated map() references

references

[mihaiplesa]

@johncblandii @jamengual can someone start the tests please? Thanks.

[jamengual]

/terratest

[mihaiplesa]

Looks like tests passed.

[milldr]

/terratest

[github-actions]

These changes were released in v1.3.0.