fix: Avoid phantom resource changes in the plan

[jwadolowski]

what

1. Zero all *_ttl params when custom cache policy is specified (TTLs included in the policy take precedence)
2. Use TLSv1 minimum viewer policy for alias-less distribution

why

Certain parameter combinations may lead to phantom changes in the plan. This PR aligns some arguments with AWS's default values that aren't explicitly stated in the documentation.

#
# Slightly modified version of examples/complete/main.tf
#

provider "aws" {
  region = var.region
}

resource "aws_cloudfront_cache_policy" "default" {
  name        = "DefaultCachePolicy"
  default_ttl = 180
  max_ttl     = 3600
  min_ttl     = 1

  parameters_in_cache_key_and_forwarded_to_origin {
    cookies_config {
      cookie_behavior = "none"
    }

    headers_config {
      header_behavior = "none"
    }

    query_strings_config {
      query_string_behavior = "none"
    }
  }
}

module "cdn" {
  # source = "../../"
  source  = "cloudposse/cloudfront-cdn/aws"
  version = "1.2.0"

  aliases            = var.aliases
  origin_domain_name = var.origin_domain_name
  parent_zone_name   = var.parent_zone_name
  logging_enabled    = false

  cache_policy_id = aws_cloudfront_cache_policy.default.id

  context = module.this.context
}

No matter how many times you apply the above, the plan always produces the following (the min_ttl does not show up, as it's set to 0 by default):

Terraform will perform the following actions:

  # module.cdn.aws_cloudfront_distribution.default[0] will be updated in-place
  ~ resource "aws_cloudfront_distribution" "default" {
        id                              = "E1NE1WD4E24L7"
        tags                            = {
            "Name"      = "eg-test-cdn"
            "Namespace" = "eg"
            "Stage"     = "test"
        }
        # (23 unchanged attributes hidden)

      ~ default_cache_behavior {
          ~ default_ttl                = 0 -> 60
          ~ max_ttl                    = 0 -> 31536000
            # (14 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }

      ~ viewer_certificate {
          ~ minimum_protocol_version       = "TLSv1" -> "TLSv1.2_2021"
            # (4 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

When a local module is referenced (source = "../../"), then the subsequent apply works as expected:

No changes. Your infrastructure matches the configuration.

references

[mihaiplesa]

@hans-d @RoseSecurity can someone start the tests please? Thanks.

[milldr]

/terratest

[milldr]

adding no-release. Will release with another follow up PR: #140

[github-actions]

These changes were released in v1.3.0.