Task: The infrastructure for a video streaming site that distribute video content globally. Accomplish this using the following resources: AWS CloudFront origin access control, AWS CloudFront distribution, AWS Route53 zone, and AWS S3 record. Add any necessary resources.

Specification:
have one "aws_cloudfront_origin_access_control" resource
    with "name" argument
    with "origin_access_control_origin_type" with value "s3"
    with "signing_behavior" argument
    with "signing_protocol" argument
have one "aws_cloudfront_distribution" resource
    with "origin.domain_name" argument linking to "aws_s3_bucket" resource
    with "origin.origin_access_control_id" argument linking to "aws_cloudfront_origin_access_control" resource
    with "origin.origin_id" argument
    with "default_cache_behavior.allowed_methods" argument with value ["GET", "HEAD"]
    with "default_cache_behavior.cached_methods" argument with value ["GET", "HEAD"]
    with "default_cache_behavior.target_origin_id" argument having the same value as "origin.origin_id" argument
    with "default_cache_behavior.viewer_protocol_policy" argument with value "allow-all"
    with "restrictions.geo_restriction.restriction_type" argument
    with "restrictions.geo_restriction.locations" argument
    with "viewer_certificate.cloudfront_default_certificate" argument
have one "aws_s3_bucket" resource
have one "aws_route53_zone" resource
    with "name" argument
have one "aws_route53_record" resource
    with "type" argument
    with "name" argument
    with "zone_id" argument linking to "aws_route53_zone" resource
    with "alias.name" argument linking to "aws_cloudfront_distribution" resource
    with "alias.zone_id" argument linking to "aws_cloudfront_distribution" resource
    with "alias.evaluate_target_health" argument

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "video_content" {
  bucket_prefix = "video-content-"
}

locals {
  s3_origin_id = "s3_video_content_origin"
}

resource "aws_cloudfront_origin_access_control" "netflix_cf" {
  name                              = "netflix_cf"
  origin_access_control_origin_type = "s3"
  signing_behavior                  = "always"
  signing_protocol                  = "sigv4"
}

resource "aws_cloudfront_distribution" "my_distribution" {
  origin {
    domain_name              = aws_s3_bucket.video_content.bucket_regional_domain_name
    origin_access_control_id = aws_cloudfront_origin_access_control.netflix_cf.id
    origin_id                = local.s3_origin_id
  }

  enabled             = true
  default_root_object = "index.html"

  default_cache_behavior {
    allowed_methods  = ["GET", "HEAD"]
    cached_methods   = ["GET", "HEAD"]
    target_origin_id = local.s3_origin_id

    forwarded_values {
      query_string = false

      cookies {
        forward = "none"
      }
    }

    viewer_protocol_policy = "allow-all"
  }

  restrictions {
    geo_restriction {
      restriction_type = "whitelist"
      locations        = ["US", "CA", "GB", "DE"]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}

# Route53
resource "aws_route53_zone" "my_zone" {
  name = "my-test-cloudfront.com"
}

resource "aws_route53_record" "cdn_ipv4" {
  type    = "A"
  name    = "cdn"
  zone_id = aws_route53_zone.my_zone.zone_id

  alias {
    name                   = aws_cloudfront_distribution.my_distribution.domain_name
    zone_id                = aws_cloudfront_distribution.my_distribution.hosted_zone_id
    evaluate_target_health = true
  }
}

Validation policy (checks.rego):
package netflix_middle

import data.set
import rego.v1

bucket_valid(bucket) := true

access_control_valid(access_control) if {
	access_control.expressions.name
	access_control.expressions.origin_access_control_origin_type.constant_value == "s3"
	access_control.expressions.signing_behavior
	access_control.expressions.signing_protocol
}

distribution_valid(distribution, access_control, bucket) if {
	some origin in distribution.expressions.origin
	bucket.address in origin.domain_name.references
	access_control.address in origin.origin_access_control_id.references

	some cache_behavior in distribution.expressions.default_cache_behavior
	{method | method := cache_behavior.allowed_methods.constant_value[_]} == {"GET", "HEAD"}
	{method | method := cache_behavior.cached_methods.constant_value[_]} == {"GET", "HEAD"}
	cache_behavior.viewer_protocol_policy.constant_value == "allow-all"

	origin.origin_id == cache_behavior.target_origin_id

	some restrictions in distribution.expressions.restrictions
	some restriction in restrictions.geo_restriction
	restriction.restriction_type
	restriction.locations
}

zone_valid(zone) if {
	zone.expressions.name
}

record_valid(record, zone, distribution) if {
	record.expressions.type
	record.expressions.name
	zone.address in record.expressions.zone_id.references

	some alias in record.expressions.alias
	distribution.address in alias.name.references
	distribution.address in alias.zone_id.references
	alias.evaluate_target_health
}

default valid := false

valid if {
	resources := input.configuration.root_module.resources

	some bucket in resources
	bucket.type == "aws_s3_bucket"

	some access_control in resources
	access_control.type == "aws_cloudfront_origin_access_control"

	some distribution in resources
	distribution.type == "aws_cloudfront_distribution"

	some zone in resources
	zone.type == "aws_route53_zone"

	some record in resources
	record.type == "aws_route53_record"

	bucket_valid(bucket)
	access_control_valid(access_control)
	distribution_valid(distribution, access_control, bucket)
	zone_valid(zone)
	record_valid(record, zone, distribution)
}