Project: KICS (Provisioning / Security & Compliance)
File: 1bc367f6-901d-4870-ad0c-71d79762ef52.md

title: CDN Configuration Is Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1bc367f6-901d-4870-ad0c-71d79762ef52 Query name: CDN Configuration Is Missing Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Best Practices URL: Content Delivery Network (CDN) service is used within an AWS account to secure and accelerate the delivery of websites. The use of a CDN can provide a layer of security between your origin content and the destination.<br> ```tf title="Positive test num. 1 - tf file" hl_lines="11 61" resource "awscloudfrontdistribution" "positive1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = false isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } priceclass = "PriceClass200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfrontdefaultcertificate = true } } resource "awscloudfrontdistribution" "positive2" { enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } priceclass = "PriceClass200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfrontdefaultcertificate = true } } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudfrontdistribution" "negative1" { origin { domainname = awss3bucket.b.bucketregionaldomainname originid = local.s3origin_id s3originconfig { originaccessidentity = "origin-access-identity/cloudfront/ABCDEFG1234567" } } enabled = true isipv6enabled = true comment = "Some comment" defaultrootobject = "index.html" logging_config { include_cookies = false bucket = "mylogs.s3.amazonaws.com" prefix = "myprefix" } aliases = ["mysite.example.com", "yoursite.example.com"] defaultcachebehavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] targetoriginid = local.s3originid forwarded_values { query_string = false cookies { forward = "none" } } viewerprotocolpolicy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } priceclass = "PriceClass200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfrontdefaultcertificate = true } } ```