Task: The infrastructure for a video streaming site that distribute video content globally. Accomplish this using AWS CloudFront and AWS S3.

Specification:
have one "aws_cloudfront_origin_access_control" resource
    with "name" argument
    with "origin_access_control_origin_type" with value "s3"
    with "signing_behavior" argument
    with "signing_protocol" argument
have one "aws_cloudfront_distribution" resource
  with "origin.domain_name" argument linking to "aws_s3_bucket" resource
  with "origin.origin_access_control_id" argument linking to "aws_cloudfront_origin_access_control" resource
  with "origin.origin_id" argument
  with "default_cache_behavior.allowed_methods" argument with value ["GET", "HEAD"]
  with "default_cache_behavior.cached_methods" argument with value ["GET", "HEAD"]
  with "default_cache_behavior.target_origin_id" argument having the same value as "origin.origin_id" argument
  with "default_cache_behavior.viewer_protocol_policy" argument with value "allow-all"
  with "restrictions.geo_restriction.restriction_type" argument
  with "restrictions.geo_restriction.locations" argument
  with "viewer_certificate.cloudfront_default_certificate" argument
have one "aws_s3_bucket" resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "video_content" {
  bucket_prefix = "video-content-"
}

resource "aws_s3_object" "put_website" {
  bucket = aws_s3_bucket.video_content.bucket
  key = "index.html"
  source = "./supplement/index.html"
  content_type = "text/html"
}

resource "aws_s3_object" "put_website_css" {
  bucket = aws_s3_bucket.video_content.bucket
  key = "css/style.css"
  source = "./supplement/css/style.css"
  content_type = "text/css"
}

resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.video_content.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudfront.amazonaws.com"
        }
        Action = "s3:GetObject"
        Resource = "${aws_s3_bucket.video_content.arn}/*"
        Condition = {
          StringEquals = {
            "AWS:SourceArn" = aws_cloudfront_distribution.my_distribution.arn
          }
        }
      }
    ]
  })
}


locals {
  s3_origin_id = "s3_video_content_origin"
}

resource "aws_cloudfront_origin_access_control" "s3_oac" {
  name                              = "s3-oac"
  description                       = "aws access control policy"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "my_distribution" {
  origin {
    domain_name              = aws_s3_bucket.video_content.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.s3_oac.id
    origin_id                = local.s3_origin_id
  }

  enabled             = true
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = local.s3_origin_id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "allow-all"
  }

  price_class = "PriceClass_200"

  restrictions {
    geo_restriction {
      restriction_type = "whitelist"
      locations        = ["US", "CA", "GB", "DE"]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

# Route53
resource "aws_route53_zone" "my_zone" {
  name = "my-test-cloudfront.com"
}

resource "aws_route53_record" "cdn_ipv4" {
  type    = "A"
  name    = "cdn"
  zone_id = aws_route53_zone.my_zone.zone_id

  alias {
    name                   = aws_cloudfront_distribution.my_distribution.domain_name
    zone_id                = aws_cloudfront_distribution.my_distribution.hosted_zone_id
    evaluate_target_health = true
  }
}

Validation policy (checks.rego):
package netflix_high

import rego.v1

bucket_valid(bucket) := true

distribution_valid(distribution, bucket) if {
        some origin in distribution.expressions.origin
        bucket.address in origin.domain_name.references

        some cache_behavior in distribution.expressions.default_cache_behavior
        {method | method := cache_behavior.allowed_methods.constant_value[_]} == {"GET", "HEAD"}
        {method | method := cache_behavior.cached_methods.constant_value[_]} == {"GET", "HEAD"}
        cache_behavior.viewer_protocol_policy.constant_value == "allow-all"

        origin.origin_id == cache_behavior.target_origin_id

        some restrictions in distribution.expressions.restrictions
        some restriction in restrictions.geo_restriction
        restriction.restriction_type
        restriction.locations
}

default valid := false

valid if {
        resources := input.configuration.root_module.resources

        some bucket in resources
        bucket.type == "aws_s3_bucket"

        some distribution in resources
        distribution.type == "aws_cloudfront_distribution"

        bucket_valid(bucket)
        distribution_valid(distribution, bucket)
}