IaC Bazaar
AWSStatic-verified

CloudFront Site (S3 + ACM + Route53)

Complete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records.

terraformAWS#aws

Compare CDN & Edge Delivery across clouds →

Part of: AWS Production Landing Zone

aws-cloudfront-siteterraform v1.7

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan tests (mocked: validation rules · outputs)

Provenance

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-06-28 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o aws-cloudfront-site-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/aws-cloudfront-site/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle aws-cloudfront-site-1.0.0.sigstore.json \
  aws-cloudfront-site-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "89eda210ff78ea70d1cc4f3b5629b55e4450d2b8159282d1390db9ea0e092177  aws-cloudfront-site-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "cloudfront_site" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-cloudfront-site/aws"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Professional, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

aws-cloudfront-site

Complete HTTPS site/CDN: CloudFront distribution, OAC-locked S3 origin, ACM cert, and Route53 alias records. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

Secure defaults:

  • Origin bucket is private (full public-access block), encrypted, versioned, and readable only by this distribution (Origin Access Control, SigV4, AWS:SourceArn condition) — plus a non-TLS deny policy
  • ACM certificate issued in us-east-1 with fully automated Route 53 DNS validation (the classic cross-region footgun, handled)
  • HTTPS enforced (redirect-to-https), TLS 1.2 (2021 policy) minimum, HTTP/2 + HTTP/3, compression on
  • Security response headers (HSTS 2y, nosniff, SAMEORIGIN, strict referrer) attached by default
  • A + AAAA alias records created for the apex/primary domain and every SAN

Requirements

  • Terraform or OpenTofu >= 1.6
  • AWS provider >= 6.0, < 7.0, two configurations (default + aws.us_east_1)
  • A registered domain with a Route 53 public hosted zone you control

License

Commercial — IaC Bazaar EULA. © IaC Bazaar. Original work (not derived from a third-party module).

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

  • Dual provider requirement
  • Inputs
  • Outputs
  • Notes

Related modules

AkamaiEdge & DNS

Akamai Ion Delivery Property

End-to-end Ion CDN property: origin, edge hostname, caching/performance rule tree, CP code, and staging/production activation.

$59.00v1.0.0
Azure✓ live-tested

Azure Front Door (Std/Premium) + WAF

Global entry point: Front Door profile, endpoints, origin groups, custom domains with managed TLS and WAF policy.

$59.00v1.0.0