Allow optionally using the waf_web_acl_arn to associate an AWS WAF wi…

…th the cloudfront distribution.
7Factor · Jul 10, 2024 · 05f408d · 05f408d
1 parent d348e60
commit 05f408d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/cf.tf b/cf.tf
@@ -9,6 +9,8 @@ resource "aws_cloudfront_distribution" "web_distro" {
   default_root_object = var.default_root_object
   aliases             = var.origins
 
+  web_acl_id = var.waf_web_acl_arn
+
   origin {
     domain_name = aws_s3_bucket.web.bucket_regional_domain_name
     origin_id   = var.s3_origin_id

diff --git a/variables.tf b/variables.tf
@@ -132,3 +132,8 @@ variable "allow_destroy_s3" {
   type        = bool
   default     = false
 }
+
+variable "waf_web_acl_arn" {
+  description = "The ARN of the WAF Web ACL to associate with the cloudfront distribution. If you want to associate a WAF with the distribution you must provide this value. Do not use an AssociateWebACL"
+  default = ""
+}