Static Website Hosting on AWS with Terraform

resource "aws_cloudfront_distribution" "static-website-distribution" {
  enabled = true
  default_root_object = "index.html"
  aliases = [ "saeedafzal.click" ]

  origin {
    # origion_id must unique its is internal to used by cloudfront for cachesing and other purposes
    # origin_id tell which caching statergy to on which origin
    # we associate origin id to each origin source
    origin_id = local.static-website-origin-id
    domain_name = var.static-website-dns
    origin_access_control_id = aws_cloudfront_origin_access_control.static-website-oac.id

    s3_origin_config {
       # Leave empty we are using OAC (origin access control) it is obsolet used with OAI (origin access identity)
      origin_access_identity = ""
    }
  }

  default_cache_behavior {
    #   allow only GET &  HEAD methods from user
    allowed_methods = [ "GET", "HEAD" ]
    #   cloudfront cache only GET and HEAD content, If someone requests the same file again, CloudFront serves it fast from cache.
    cached_methods = [ "GET", "HEAD" ]
    #   If someone types http://example.com, they get redirected to https://example.com.
    viewer_protocol_policy = "redirect-to-https"
    #   It tells CloudFront which backend (origin) this behavior is for.
    #   in the above origin section we associated local.static-website-origin-id to the static s3 resouce, there can be mulitple origins and each origion must have unique id
    target_origin_id = local.static-website-origin-id

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    #   locations = [ "PK" ]
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = false
    acm_certificate_arn = var.domain_acm_certificate
    ssl_support_method = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

}

resource "aws_route53_record" "cloudfront_alias" {
    zone_id = data.aws_route53_zone.domain-hosted-zone.zone_id
    name    = "saeedafzal.click"
    type    = "A"

    alias {
        name                   = var.cloudfront-domain-name
        zone_id                = var.cloudfront-hosted-zone-id
        evaluate_target_health = false
    }

    }

#           Create certificate
resource "aws_acm_certificate" "web-domain-certificate" {
 domain_name = var.domain_name
 validation_method = "DNS"
 lifecycle{
    create_before_destroy = true
 } 
}


#           Add recoed in hosted zone to validate you own the domain

resource "aws_route53_record" "web-domain-record" {
  zone_id = var.domain_id
  
  for_each = {
    for dvo in aws_acm_certificate.web-domain-certificate.domain_validation_options : dvo.domain_name => {
        name = dvo.resource_record_name
        type = dvo.resource_record_type
        record = dvo.resource_record_value
    }
  }

  name = each.value.name
  type = each.value.type
  records = [ each.value.record ]
  ttl = 60
}


#           Tells aws to validate the domain record

resource "aws_acm_certificate_validation" "web-domain-validation" {
  certificate_arn = aws_acm_certificate.web-domain-certificate.arn
  validation_record_fqdns = [ for record in aws_route53_record.web-domain-record : record.fqdn ]
}