Task: An AWS CloudFront distribution resource with an origin argument block with the following arguments (1) a domain_name argument linking to the S3 backet domain name; (2) an origin_access_control_id argument linking to a CloudFront origin access control resource; (3) an origin_id argument with value "s3_video_content_origin", a default_cache_behavior argument with the following arguments (a) an allowed_methods argument with values ["GET", "HEAD"]; (b) a cached_methods with values ["GET", "HEAD"]; (c) a target_origin_id argument with value "s3_video_content_origin" (same as origin_id in the origin argument block); (d) a viewer_protocol_policy argument with value "allow-all"; (4) a price_class argument with value "PriceClass_200"; (5) a restrictions argument block with a geo_restriction argument block with a restriction_type argument of value "whitelist" and locations argument with values ["US", "CA", "GB", "DE"]; (6) a viewer_certificate argument block with cloudfront_default_certificate set to true. An AWS Route53 zone resource with a name argument of value "netflix.com". Two AWS Route53 record resources linking to the Route53 hosted zone. A CloudFront origin access control resource with (1) a name argument; (2) an origin_access_control_origin_type argument of value "s3"; (3) a signing_behavior argument of value "always"; (4) a signing_protocol argument of value "sigv4".

Specification:
have one "aws_cloudfront_origin_access_control" resource
    with "name" argument
    with "origin_access_control_origin_type" with value "s3"
    with "signing_behavior" argument with value "always"
    with "signing_protocol" argument with value "sigv4"

have one "aws_cloudfront_distribution" resource
    with "origin.domain_name" argument linking to "aws_s3_bucket" resource
    with "origin.origin_access_control_id" argument linking to "aws_cloudfront_origin_access_control" resource
    with "origin.origin_id" argument with value x
    with "default_cache_behavior.allowed_methods" argument with value ["GET", "HEAD"]
    with "default_cache_behavior.cached_methods" argument with value ["GET", "HEAD"]
    with "default_cache_behavior.target_origin_id" argument with value x
    with "default_cache_behavior.viewer_protocol_policy" argument with value "allow-all"
    with "price_class" argument with value "PriceClass_200"
    with "restrictions.geo_restriction.restriction_type" argument with value "whitelist"
    with "restrictions.geo_restriction.locations" argument with value ["US", "CA", "GB", "DE"]
    with "viewer_certificate.cloudfront_default_certificate" argument with value true

have one "aws_s3_bucket" resource

have one "aws_route53_zone" resource
    with "name" argument with value "netflix.com"

have one "aws_route53_record" resource
    with "type" argument with value "A"
    with "name" argument with value "cdn"
    with "zone_id" argument linking to "aws_route53_zone" resource

    with "alias.name" argument linking to "aws_cloudfront_distribution" resource
    with "alias.zone_id" argument linking to "aws_cloudfront_distribution" resource
    with "alias.evaluate_target_health" argument with value true

have one "aws_route53_record" resource
    with "type" argument with value "AAAA"
    with "name" argument with value "cdn"
    with "zone_id" argument linking to "aws_route53_zone" resource

    with "alias.name" argument linking to "aws_cloudfront_distribution" resource
    with "alias.zone_id" argument linking to "aws_cloudfront_distribution" resource
    with "alias.evaluate_target_health" argument with value true

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}


provider "aws" {
  region  = "us-east-1"
}

resource "aws_s3_bucket" "website_content" {
  bucket_prefix = "website-content-"
}

resource "aws_s3_object" "put_website" {
  bucket = aws_s3_bucket.website_content.bucket
  key = "index.html"
  source = "./supplement/index.html"
  content_type = "text/html"
}

resource "aws_s3_object" "put_website_css" {
  bucket = aws_s3_bucket.website_content.bucket
  key = "css/style.css"
  source = "./supplement/css/style.css"
  content_type = "text/css"
}

resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.website_content.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudfront.amazonaws.com"
        }
        Action = "s3:GetObject"
        Resource = "${aws_s3_bucket.website_content.arn}/*"
        Condition = {
          StringEquals = {
            "AWS:SourceArn" = aws_cloudfront_distribution.my_distribution.arn
          }
        }
      }
    ]
  })
}


locals {
  s3_origin_id = "s3_website_origin"
}

resource "aws_cloudfront_origin_access_control" "s3_oac" {
  name                              = "s3-oac"
  description                       = "aws access control policy"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "my_distribution" {
  origin {
    domain_name              = aws_s3_bucket.website_content.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.s3_oac.id
    origin_id                = local.s3_origin_id
  }

  enabled             = true
  is_ipv6_enabled     = true
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = local.s3_origin_id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "allow-all"
    min_ttl                = 0
    default_ttl            = 3600
    max_ttl                = 86400
  }

  price_class = "PriceClass_200"

  restrictions {
    geo_restriction {
      restriction_type = "whitelist"
      locations        = ["US", "CA", "GB", "DE"]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

# Route53
resource "aws_route53_zone" "my_zone" {
  name = "my-test-cloudfront.com"
}

resource "aws_route53_record" "cdn_ipv4" {
  type    = "A"
  name    = "cdn"
  zone_id = aws_route53_zone.my_zone.zone_id

  alias {
    name                   = aws_cloudfront_distribution.my_distribution.domain_name
    zone_id                = aws_cloudfront_distribution.my_distribution.hosted_zone_id
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "cdn_ipv6" {
  type    = "AAAA" # ipv6 is enabled
  name    = "cdn"
  zone_id = aws_route53_zone.my_zone.zone_id

  alias {
    name                   = aws_cloudfront_distribution.my_distribution.domain_name
    zone_id                = aws_cloudfront_distribution.my_distribution.hosted_zone_id
    evaluate_target_health = true
  }
}

Validation policy (checks.rego):
package netflix

import data.set
import rego.v1

bucket_valid(bucket) := true

access_control_valid(access_control) if {
	access_control.expressions.name
	access_control.expressions.origin_access_control_origin_type.constant_value == "s3"
	access_control.expressions.signing_behavior.constant_value == "always"
	access_control.expressions.signing_protocol.constant_value == "sigv4"
}

distribution_valid(distribution, access_control, bucket) if {
	some origin in distribution.expressions.origin
	bucket.address in origin.domain_name.references
	access_control.address in origin.origin_access_control_id.references

	some cache_behavior in distribution.expressions.default_cache_behavior
	{method | method := cache_behavior.allowed_methods.constant_value[_]} == {"GET", "HEAD"}
	{method | method := cache_behavior.cached_methods.constant_value[_]} == {"GET", "HEAD"}
	cache_behavior.viewer_protocol_policy.constant_value == "allow-all"

	origin.origin_id == cache_behavior.target_origin_id

	distribution.expressions.price_class.constant_value == "PriceClass_200"

	some restrictions in distribution.expressions.restrictions
	some restriction in restrictions.geo_restriction
	restriction.restriction_type.constant_value == "whitelist"
	{location | location := restriction.locations.constant_value[_]} == {"US", "CA", "GB", "DE"}
}

zone_valid(zone) if {
	zone.expressions.name
}

record_valid(record, type, zone, distribution) if {
	record.expressions.type.constant_value == type
	record.expressions.name.constant_value == "cdn"
	zone.address in record.expressions.zone_id.references

	some alias in record.expressions.alias
	distribution.address in alias.name.references
	distribution.address in alias.zone_id.references
	alias.evaluate_target_health.constant_value == true
}

default valid := false

valid if {
	resources := input.configuration.root_module.resources

	some bucket in resources
	bucket.type == "aws_s3_bucket"

	some access_control in resources
	access_control.type == "aws_cloudfront_origin_access_control"

	some distribution in resources
	distribution.type == "aws_cloudfront_distribution"

	some zone in resources
	zone.type == "aws_route53_zone"

	some record_ipv4 in resources
	record_ipv4.type == "aws_route53_record"

	some record_ipv6 in resources
	record_ipv6.type == "aws_route53_record"

	bucket_valid(bucket)
	access_control_valid(access_control)
	distribution_valid(distribution, access_control, bucket)
	zone_valid(zone)
	record_valid(record_ipv4, "A", zone, distribution)
	record_valid(record_ipv6, "AAAA", zone, distribution)
}