{% set config = merged_configs.get('aws_cloudfront_distribution', {}) %}
{% set comments = compliance_comments.get('aws_cloudfront_distribution', []) %}
# ------------------------------------------------------------------------------
# CloudFront Distribution
# ------------------------------------------------------------------------------
{% for comment in comments %}
# {{ comment }}
{% endfor %}

resource "aws_cloudfront_distribution" "this" {
  enabled             = {{ config.get('enabled', true) | lower }}
  is_ipv6_enabled     = {{ config.get('is_ipv6_enabled', true) | lower }}
  comment             = "{{ config.get('comment', project_id ~ ' distribution') }}"
  default_root_object = "{{ config.get('default_root_object', 'index.html') }}"
  price_class         = "{{ config.get('price_class', 'PriceClass_100') }}"
  web_acl_id          = {{ config.get('web_acl_id', 'null') }}

  origin {
    domain_name = "{{ config.get('origin_domain_name', project_id ~ '.s3.amazonaws.com') }}"
    origin_id   = "{{ config.get('origin_id', 'S3-' ~ project_id) }}"

    {% if config.get('origin_access_control_id') %}
    origin_access_control_id = "{{ config.origin_access_control_id }}"
    {% endif %}
  }

  default_cache_behavior {
    allowed_methods        = {{ config.get('allowed_methods', '["GET", "HEAD"]') }}
    cached_methods         = {{ config.get('cached_methods', '["GET", "HEAD"]') }}
    target_origin_id       = "{{ config.get('origin_id', 'S3-' ~ project_id) }}"
    viewer_protocol_policy = "{{ config.get('viewer_protocol_policy', 'redirect-to-https') }}"
    compress               = {{ config.get('compress', true) | lower }}

    forwarded_values {
      query_string = {{ config.get('forward_query_string', false) | lower }}
      cookies {
        forward = "{{ config.get('forward_cookies', 'none') }}"
      }
    }

    min_ttl     = {{ config.get('min_ttl', 0) }}
    default_ttl = {{ config.get('default_ttl', 86400) }}
    max_ttl     = {{ config.get('max_ttl', 31536000) }}
  }

  # TLS configuration
  viewer_certificate {
    {% if config.get('acm_certificate_arn') %}
    acm_certificate_arn      = "{{ config.acm_certificate_arn }}"
    ssl_support_method       = "{{ config.get('ssl_support_method', 'sni-only') }}"
    minimum_protocol_version = "{{ config.get('minimum_protocol_version', 'TLSv1.2_2021') }}"
    {% else %}
    cloudfront_default_certificate = true
    minimum_protocol_version       = "{{ config.get('minimum_protocol_version', 'TLSv1.2_2021') }}"
    {% endif %}
  }

  restrictions {
    geo_restriction {
      restriction_type = "{{ config.get('geo_restriction_type', 'none') }}"
    }
  }

  {% if config.get('logging_bucket') %}
  logging_config {
    include_cookies = {{ config.get('logging_include_cookies', false) | lower }}
    bucket          = "{{ config.logging_bucket }}"
    prefix          = "{{ config.get('logging_prefix', 'cloudfront/') }}"
  }
  {% endif %}

  tags = {
    Name      = "{{ project_id }}-cdn"
    ManagedBy = "complyform"
  }
}
