AWS CloudFront Distribution with S3 Origin

Description

Act as an AWS CDN architect. Generate Terraform configuration for a CloudFront distribution serving static assets from S3.

## Input Parameters
- **Domain**: [DOMAIN]
- **S3 Bucket Name**: [BUCKET_NAME]
- **Price Class**: [PRICE_CLASS] (PriceClass_100 / PriceClass_200 / PriceClass_All)
- **SPA Routing**: [IS_SPA] (true/false — single page app with client routing)
- **API Origin**: [API_ORIGIN] (optional backend API URL for /api/* paths)

## Terraform Resources
1. **S3 Bucket** with:
   - Versioning enabled
   - Server-side encryption (SSE-S3)
   - Block all public access
   - Lifecycle rules for old versions
2. **CloudFront Origin Access Control (OAC)** — not legacy OAI.
3. **S3 Bucket Policy** allowing only CloudFront OAC access.
4. **CloudFront Distribution**:
   - Default cache behavior with managed cache policy (CachingOptimized)
   - Custom error responses for SPA (403/404 → /index.html with 200)
   - /api/* behavior routing to API origin (if provided) with no caching
   - /static/* behavior with aggressive caching (1 year, immutable)
   - Security headers via response headers policy
   - Logging to separate S3 bucket
   - Web ACL attachment for WAF
   - HTTP/3 enabled
5. **ACM Certificate** in us-east-1 with DNS validation.
6. **Route 53 record** (A and AAAA alias to CloudFront).
7. **Lambda@Edge** function for:
   - Security headers (CSP, HSTS, X-Frame-Options)
   - URL rewriting for clean paths
   - A/B testing via cookies
8. **CloudFront Function** for redirects (www → apex).

## Output Format
Return organized Terraform files. Include invalidation command for deployments and a cache debugging guide.

Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.5 Pro, Llama 4.

Usage Instructions

Tags

Compatible AI Models

Version History

Related Prompts