diff --git a/examples/response-headers/main.tf b/examples/response-headers/main.tf index 0f50cba..3f940c6 100644 --- a/examples/response-headers/main.tf +++ b/examples/response-headers/main.tf @@ -2,14 +2,6 @@ module "custom_resp_headers" { source = "../../modules/response-headers" name = "custom-response-headers" - strict_transport_security_header = { - enabled = true - override = true - - max_age = 31536000 - include_subdomains = true - preload = true - } custom_headers = [ { @@ -23,3 +15,13 @@ module "custom_resp_headers" { sampling_rate = 100 } } + +module "override_default" { + source = "../../modules/response-headers" + + name = "override-default-response-headers" + + xss_protection_header = { + enabled = false + } +} diff --git a/examples/response-headers/versions.tf b/examples/response-headers/versions.tf index 6e208d5..78c4eb5 100644 --- a/examples/response-headers/versions.tf +++ b/examples/response-headers/versions.tf @@ -2,6 +2,7 @@ terraform { required_version = ">= 1.3" required_providers { + # tflint-ignore: terraform_unused_required_providers aws = { source = "hashicorp/aws" version = "~> 5.38" diff --git a/modules/response-headers/README.md b/modules/response-headers/README.md index 7aeb91e..3ba5347 100644 --- a/modules/response-headers/README.md +++ b/modules/response-headers/README.md @@ -27,17 +27,17 @@ No modules. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [content\_security\_policy\_header](#input\_content\_security\_policy\_header) | A configuration for `Content-Security-Policy` header in HTTP responses sent from CloudFront. The HTTP `Content-Security-Policy` response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks. `content_security_policy_header` as defined below.
`enabled` - Whether to enable `Content-Security-Policy` response header. Defaults to `false`.
`override` - Whether CloudFront overrides the `Content-Security-Policy` response header with the header received from the origin. Defaults to `true`.
`value` - The value for the `Content-Security-Policy` HTTP response header. The `Content-Security-Policy` header value is limited to 1783 characters. | 
object({
    enabled  = optional(bool, false)
    override = optional(bool, true)
    value    = optional(string, "")
  })
| `{}` | no | -| [content\_type\_options\_header](#input\_content\_type\_options\_header) | A configuration for `X-Content-Type-Options` header in HTTP responses sent from CloudFront. The `X-Content-Type-Options` response HTTP header is a marker used by the server to indicate that the MIME types advertised in the `Content-Type` headers should be followed and not be changed. The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately configured. `content_type_options_header` as defined below.
`enabled` - Whether to enable `X-Content-Type-Options` response header. When this setting is `true`, CloudFront adds the `X-Content-Type-Options: nosniff` header to response. (Blocks a request if the request destination is of type style and the MIME type is not text/css, or of type script and the MIME type is not a JavaScript MIME type.) Defaults to `false`.
`override` - Whether CloudFront overrides the `X-Content-Type-Options` response header with the header received from the origin. Defaults to `true`. | 
object({
    enabled  = optional(bool, false)
    override = optional(bool, true)
  })
| `{}` | no | +| [content\_type\_options\_header](#input\_content\_type\_options\_header) | A configuration for `X-Content-Type-Options` header in HTTP responses sent from CloudFront. The `X-Content-Type-Options` response HTTP header is a marker used by the server to indicate that the MIME types advertised in the `Content-Type` headers should be followed and not be changed. The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately configured. `content_type_options_header` as defined below.
`enabled` - Whether to enable `X-Content-Type-Options` response header. When this setting is `true`, CloudFront adds the `X-Content-Type-Options: nosniff` header to response. (Blocks a request if the request destination is of type style and the MIME type is not text/css, or of type script and the MIME type is not a JavaScript MIME type.) Defaults to `false`.
`override` - Whether CloudFront overrides the `X-Content-Type-Options` response header with the header received from the origin. Defaults to `true`. | 
object({
    enabled  = optional(bool, true)
    override = optional(bool, true)
  })
| `{}` | no | | [cors](#input\_cors) | A configuration for a set of HTTP response headers for CORS(Cross-Origin Resource Sharing). `cors` as defined below.
`enabled` - Whether to enable CORS configuration for the response headers policy .
`override` - Whether CloudFront override the response from the origin which contains one of the CORS headers specified in this policy. Defaults to `true`.
`access_control_allow_credentials` - Whether CloudFront adds the `Access-Control-Allow-Credentials` header in responses to CORS requests. When enabled, CloudFront adds the `Access-Control-Allow-Credentials: true` header in responses to CORS requests. Otherwise, CloudFront doesn't add this header to responses. Defaults to `false`.
`access_control_allow_headers` - A set of HTTP header names for CloudFront to include as values for the `Access-Control-Allow-Headers` HTTP response header in responses to CORS preflight requests. Defaults to `["*"]` (All headers).
`access_control_allow_methods` - A set of HTTP methods for CloudFront to include as values for the `Access-Control-Allow-Methods` header in responses to CORS preflight requests. Valid values are `GET`, `DELETE`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT`, or `ALL`). Defaults to `ALL` (All methods).
`access_control_allow_origins` - A set of the origins that CloudFront can use as values in the `Access-Control-Allow-Origin` response header. Use `*` value to allow CORS requests from all origins. Defaults to `["*"]` (All origins).
`access_control_expose_headers` - A set of HTTP header names for CloudFront to include as values for the `Access-Control-Expose-Headers` header in responses to CORS requests. Defaults to `[]` (None).
`access_control_max_age` - The number of seconds for CloudFront to use as the value for the `Access-Control-Max-Age` header in responses to CORS preflight requests. | 
object({
    enabled  = optional(bool, false)
    override = optional(bool, true)

    access_control_allow_credentials = optional(bool, false)
    access_control_allow_headers     = optional(set(string), ["*"])
    access_control_allow_methods     = optional(set(string), ["ALL"])
    access_control_allow_origins     = optional(set(string), ["*"])
    access_control_expose_headers    = optional(set(string), [])
    access_control_max_age           = optional(number, 600)
  })
| `{}` | no | | [custom\_headers](#input\_custom\_headers) | A configuration for specifying the custom HTTP headers in HTTP responses sent from CloudFront. Each item of `custom_headers` as defined below.
`name` - The HTTP response header name.
`value` - The value for the HTTP response header. If a header value is not provided, CloudFront adds the empty header (with no value) to the response.
`override` - Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here. | 
list(object({
    name     = string
    value    = string
    override = optional(bool, false)
  }))
| `[]` | no | | [description](#input\_description) | A comment to describe the response headers policy. | `string` | `"Managed by Terraform."` | no | -| [frame\_options\_header](#input\_frame\_options\_header) | A configuration for `X-Frame-Options` header in HTTP responses sent from CloudFront. The `X-Frame-Options` HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a ``, `