{"id":21213976,"url":"https://github.com/cruxstack/terraform-aws-cloudfront-middleware-at-edge","last_synced_at":"2026-05-09T01:37:44.562Z","repository":{"id":181233453,"uuid":"666447790","full_name":"cruxstack/terraform-aws-cloudfront-middleware-at-edge","owner":"cruxstack","description":"Terraform Module to deploy customizable CloudFront auth-at-edge and url-rewriter middlewares via Lambda@Edge","archived":false,"fork":false,"pushed_at":"2025-08-09T14:38:00.000Z","size":321,"stargazers_count":2,"open_issues_count":11,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-08T13:47:16.869Z","etag":null,"topics":["authentication","authorization","aws","cloudfront","cloudposse","cognito","lambda-at-edge","middleware","opa","open-policy-agent","sweetops","terraform","terraform-module","typescript","url-rewrite","url-rewriter"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/cruxstack/cloudfront-middleware-at-edge/aws/latest","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cruxstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-14T14:40:38.000Z","updated_at":"2025-08-09T14:37:30.000Z","dependencies_parsed_at":"2024-11-20T21:40:02.779Z","dependency_job_id":null,"html_url":"https://github.com/cruxstack/terraform-aws-cloudfront-middleware-at-edge","commit_stats":null,"previous_names":["sgtoj/terraform-aws-cloudfront-middleware-at-edge","cruxstack/terraform-aws-cloudfront-middleware-at-edge"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/cruxstack/terraform-aws-cloudfront-middleware-at-edge","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cloudfront-middleware-at-edge","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cloudfront-middleware-at-edge/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cloudfront-middleware-at-edge/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cloudfront-middleware-at-edge/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cruxstack","download_url":"https://codeload.github.com/cruxstack/terraform-aws-cloudfront-middleware-at-edge/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cruxstack%2Fterraform-aws-cloudfront-middleware-at-edge/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32799243,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"ssl_error","status_checked_at":"2026-05-08T08:22:45.650Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentication","authorization","aws","cloudfront","cloudposse","cognito","lambda-at-edge","middleware","opa","open-policy-agent","sweetops","terraform","terraform-module","typescript","url-rewrite","url-rewriter"],"created_at":"2024-11-20T21:25:18.302Z","updated_at":"2026-05-09T01:37:44.545Z","avatar_url":"https://github.com/cruxstack.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform Module: CloudFront Middleware-at-Edge\n\nThis Terraform module deploys customizable and reusable Lambda@Edge functions\nthat provide middleware for AWS CloudFront.\n\n## Middlewares\n\n- **`auth-at-edge`**: Also known as `cognito-at-edge`, this feature provides\n  authentication and authorization to restrict access to a site hosted on\n  CloudFront. Users can _optionally_ customize the authorization rules via an\n  Open Policy Agent (OPA) policy.\n- **`url-rewriter`**: This feature rewrites the URLs of requests. Users can\n  define URL rewrite rules via an Open Policy Agent (OPA) policy.\n\n## Usage\n\n```hcl\nmodule \"cloudfront_middleware_at_edge\" {\n  source  = \"cruxstack/cloudfront-middleware-at-edge/aws\"\n  version = \"x.x.x\"\n\n  auth_service_config = {\n    enabled                   = true\n    cognito_idp_arn           = \"arn:aws:cognito-idp:us-east-1:123456789012:userpool/us-east-1_TESTPOOL\"\n    cognito_idp_domain        = \"test.auth.us-east-1.amazoncognito.com\"\n    cognito_idp_client_id     = \"your-client-id\"\n    cognito_idp_client_secret = \"your-client-secret\"\n    cognito_idp_client_scopes = [\"openid\", \"email\", \"profile\"]\n\n    cognito_idp_jwks = {\n      keys = [\n        { \"alg\": \"RS256\", \"e\": \"AQAB\", \"kid\": \"...\", \"kty\": \"RSA\", \"n\": \"...\", \"use\": \"sig\" },\n        { \"alg\": \"RS256\", \"e\": \"AQAB\", \"kid\": \"...\", \"kty\": \"RSA\", \"n\": \"...\", \"use\": \"sig\" },\n      ]\n    }\n  }\n\n  urlrewrite_service_config = {\n    enabled    = true\n    policy_content = \u003c\u003c-EOF\n      package urlrewriter\n      result := []\n    EOF\n  }\n}\n```\n\n## Inputs\n\nIn addition to the variables documented below, this module includes several\nother optional variables (e.g., `name`, `tags`, etc.) provided by the\n`cloudposse/label/null` module. Please refer to its [documentation](https://registry.terraform.io/modules/cloudposse/label/null/latest)\nfor more details on these variables.\n\n| Name                      | Description                                                               |  Type  | Default | Required |\n|---------------------------|---------------------------------------------------------------------------|:------:|:-------:|:--------:|\n| auth_service_config       | Configuration details for the authentication service. More details below. | object |  `{}`   |    no    |\n| urlrewrite_service_config | Configuration details for the URL rewrite service, More details below.    | object |  `{}`   |    no    |\n| aws_account_id            | The AWS account ID that the module will be deployed in                    | string |  `\"\"`   |    no    |\n| aws_region_name           | The AWS region name where the module will be deployed                     | string |  `\"\"`   |    no    |\n\n### `auth_service_config`\n\n| Property                  | Description                                    | Type                                 | Default  | Required |\n|---------------------------|------------------------------------------------|--------------------------------------|----------|----------|\n| enabled                   | Enable the authentication service              | bool                                 | `true`   | no       |\n| log_level                 | Logging level                                  | string                               | `\"info\"` | no       |\n| aws_region                | AWS region for the service                     | string                               | `null`   | no       |\n| cognito_idp_arn           | ARN of the Cognito Identity Provider           | string                               | n/a      | yes      |\n| cognito_idp_domain        | Domain of the Cognito Identity Provider        | string                               | n/a      | yes      |\n| cognito_idp_jwks          | JWKS of the Cognito Identity Provider          | object({ keys = list(map(string)) }) | n/a      | yes      |\n| cognito_idp_client_id     | Client ID of the Cognito Identity Provider     | string                               | n/a      | yes      |\n| cognito_idp_client_secret | Client secret of the Cognito Identity Provider | string                               | n/a      | yes      |\n| cognito_idp_client_scopes | Client scopes of the Cognito Identity Provider | list(string)                         | n/a      | yes      |\n| opa_policy_content        | Content of the OPA policy                      | string                               | `null`   | no       |\n| opa_policy_data           | Data for the OPA policy                        | map(string)                          | `{}`     | no       |\n\n### `urlrewrite_service_config`\n\n| Property       | Description                       | Type   | Default                               | Required |\n|----------------|-----------------------------------|--------|---------------------------------------|----------|\n| enabled        | Enable the URL rewrite service    | bool   | `false`                               | no       |\n| log_level      | Logging level                     | string | `\"info\"`                              | no       |\n| aws_region     | AWS region for the service        | string | `null`                                | no       |\n| policy_content | Content of the URL rewrite policy | string | `\"package urlrewriter\\nresult := []\"` | no       |\n\n## Outputs\n\n| Name                | Description                                                               |\n|---------------------|---------------------------------------------------------------------------|\n| auth_services       | Details of the created AWS Lambda functions for each of the auth services |\n| auth_routes         | Route configurations for the auth services                                |\n| urlrewrite_services | Details of the created AWS Lambda function for the URL rewrite service    |\n\n## Contributing\n\nWe welcome contributions to this project. For information on setting up a\ndevelopment environment and how to make a contribution, see [CONTRIBUTING](./CONTRIBUTING.md)\ndocumentation.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Fterraform-aws-cloudfront-middleware-at-edge","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcruxstack%2Fterraform-aws-cloudfront-middleware-at-edge","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcruxstack%2Fterraform-aws-cloudfront-middleware-at-edge/lists"}