page_title	stackit_cdn_distribution Resource - stackit
subcategory
description	CDN distribution data source schema. ~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide https://registry.terraform.io/providers/stackitcloud/stackit/latest/docs/guides/opting_into_beta_resources for how to opt-in to use beta resources.

stackit_cdn_distribution (Resource)

CDN distribution data source schema.

~> This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide for how to opt-in to use beta resources.

Example Usage

resource "stackit_cdn_distribution" "example_distribution" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  config = {
    backend = {
      type       = "http"
      origin_url = "https://mybackend.onstackit.cloud"
      geofencing = {
        "https://mybackend.onstackit.cloud" = ["DE"]
      }
    }
    regions           = ["EU", "US", "ASIA", "AF", "SA"]
    blocked_countries = ["DE", "AT", "CH"]
    blocked_ips       = ["1.1.1.1"]

    default_cache_duration = "P1DT2H30M"
    monthly_limit_bytes    = 1048576

    optimizer = {
      enabled = true
    }
  }
}

resource "stackit_cdn_distribution" "example_bucket_distribution" {
  project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  config = {
    backend = {
      type       = "bucket"
      bucket_url = "https://my-test.object.storage.eu01.onstackit.cloud"
      region     = "eu01"

      # Credentials are required for bucket backends
      # It is strongly recommended to use variables for secrets
      credentials = {
        access_key_id     = var.bucket_access_key
        secret_access_key = var.bucket_secret_key
      }
    }
    regions           = ["EU", "US"]
    blocked_countries = ["CN", "RU"]
    blocked_ips       = ["1.1.1.1"]

    default_cache_duration = "P1DT2H30M"
    monthly_limit_bytes    = 1048576

    optimizer = {
      enabled = false
    }

    redirects = {
      rules = [
        {
          description          = "test redirect"
          enabled              = true
          rule_match_condition = "ANY"
          status_code          = 302
          target_url           = "https://stackit.de/"
          matchers = [
            {
              values                = ["*/otherPath/"]
              value_match_condition = "ANY"
            }
          ]
        }
      ]
    }

    tls = {
      enable_tls_10 = true
      enable_tls_11 = true
    }
    strip_response_cookies = true
    forward_host_header    = true

    # WAF Configuration
    # 
    # Precedence Hierarchy: Specific Rules > Groups > Collections
    # In this example, the entire "@builtin/crs/request" collection is ENABLED.
    # However, because specific Rule IDs have a higher precedence, the rule 
    # "@builtin/crs/request/942151" is explicitly DISABLED, overriding the collection setting.
    # 
    # To view all available collections, groups, and rules, consult the API documentation:
    # https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
    waf = {
      mode                          = "ENABLED"
      type                          = "PREMIUM"
      paranoia_level                = "L1"
      allowed_http_versions         = ["HTTP/1.0", "HTTP/1.1"]
      allowed_http_methods          = ["GET"]
      allowed_request_content_types = ["text/plain"]

      # Collections
      enabled_rule_collection_ids  = ["@builtin/crs/request"]
      disabled_rule_collection_ids = []
      log_only_rule_collection_ids = ["@builtin/crs/response"]

      # Groups
      enabled_rule_group_ids  = []
      disabled_rule_group_ids = []
      log_only_rule_group_ids = []

      # Specific Rules (Highest Precedence)
      enabled_rule_ids  = ["@builtin/crs/request/913100"]
      disabled_rule_ids = ["@builtin/crs/request/942151"]
      log_only_rule_ids = ["@builtin/crs/response/954120"]
    }
  }
}

Schema

Required

config (Attributes) The distribution configuration (see below for nested schema)
project_id (String) STACKIT project ID associated with the distribution

Read-Only

created_at (String) Time when the distribution was created
distribution_id (String) CDN distribution ID
domains (Attributes List) List of configured domains for the distribution (see below for nested schema)
errors (List of String) List of distribution errors
id (String) Terraform's internal resource identifier. It is structured as "project_id,distribution_id".
status (String) Status of the distribution
updated_at (String) Time when the distribution was last updated

Nested Schema for `config`

Required:

backend (Attributes) The configured backend for the distribution (see below for nested schema)
regions (List of String) The configured regions where content will be hosted

Optional:

blocked_countries (List of String) The configured countries where distribution of content is blocked
blocked_ips (List of String) Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. Note: once a value is set, removing the attribute from your configuration will retain the last known value in state; to clear it explicitly, set it to an empty list.
default_cache_duration (String) Sets the default cache duration for the distribution. The default cache duration is applied when a 'Cache-Control' header is not presented in the origin's response. We use ISO8601 duration format for cache duration (e.g. P1DT2H30M). Note: once a value is set, removing the attribute from your configuration will retain the last known value in state.
forward_host_header (Boolean) Enable this allows the 'Host' header to be passed through to the origin.
monthly_limit_bytes (Number) Sets the monthly limit of bandwidth in bytes that the pullzone is allowed to use. Note: once a value is set, removing the attribute from your configuration will retain the last known value in state.
optimizer (Attributes) Configuration for the Image Optimizer. This is a paid feature that automatically optimizes images to reduce their file size for faster delivery, leading to improved website performance and a better user experience. (see below for nested schema)
redirects (Attributes) A wrapper for a list of redirect rules that allows for redirect settings on a distribution (see below for nested schema)
strip_response_cookies (Boolean) Enable this to prevent origin-level cookies from being forwarded to the end user.
tls (Attributes) Configuration for TLS protocol versions. Note: Enabling older TLS versions (1.0, 1.1) is generally discouraged for security reasons. (see below for nested schema)
waf (Attributes) Configures the Web Application Firewall (WAF) for the distribution. If this block is undefined or removed from your configuration, the WAF mode will default to DISABLED and the type to FREE. All other WAF properties will retain their last known state in the API; if they were never defined, the API will apply its default settings. (see below for nested schema)

Nested Schema for `config.backend`

Required:

type (String) The configured backend type. Possible values are: http, bucket.

Optional:

bucket_url (String) The URL of the bucket (e.g. https://s3.example.com). Required if type is 'bucket'.
credentials (Attributes) The credentials for the bucket. Required if type is 'bucket'. (see below for nested schema)
geofencing (Map of List of String) The configured type http to configure countries where content is allowed. A map of URLs to a list of countries
origin_request_headers (Map of String) The configured type http origin request headers for the backend
origin_url (String) The configured backend type http for the distribution
region (String) The region where the bucket is hosted. Required if type is 'bucket'.

Nested Schema for `config.backend.credentials`

Required:

access_key_id (String, Sensitive) The access key for the bucket. Required if type is 'bucket'.
secret_access_key (String, Sensitive) The access key for the bucket. Required if type is 'bucket'.

Nested Schema for `config.optimizer`

Optional:

enabled (Boolean)

Nested Schema for `config.redirects`

Required:

rules (Attributes List) A list of redirect rules. The order of rules matters for evaluation (see below for nested schema)

Nested Schema for `config.redirects.rules`

Required:

matchers (Attributes List) A list of matchers that define when this rule should apply. At least one matcher is required (see below for nested schema)
status_code (Number) The HTTP status code for the redirect. Must be one of 301, 302, 303, 307, or 308.
target_url (String) The target URL to redirect to. Must be a valid URI

Optional:

description (String) An optional description for the redirect rule
enabled (Boolean) A toggle to enable or disable the redirect rule. Default to true
rule_match_condition (String) Defines how multiple matchers within this rule are combined (ALL, ANY, NONE). Defaults to ANY.

Nested Schema for `config.redirects.rules.matchers`

Required:

values (List of String) A list of glob patterns to match against the request path. At least one value is required. Examples: "/shop/" or "/img/*"

Optional:

value_match_condition (String) Defines how multiple matchers within this rule are combined (ALL, ANY, NONE). Defaults to ANY.

Nested Schema for `config.tls`

Optional:

enable_tls_10 (Boolean) If set to true, the distribution will accept connections using TLS 1.1.
enable_tls_11 (Boolean) If set to true, the distribution will accept connections using TLS 1.0.

Nested Schema for `config.waf`

Optional:

allowed_http_methods (Set of String) Restricts which HTTP methods the distribution accepts. If provided, the set must contain at least one item. Case you removed waf will retain the last known state and if omitted, the API applies the following defaults: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH.
allowed_http_versions (Set of String) Restricts which HTTP protocol versions are accepted. If provided, the set must contain at least one item. If omitted, the API applies the following defaults: HTTP/1.0, HTTP/1.1, HTTP/2, HTTP/2.0.
allowed_request_content_types (Set of String) Restricts which Content-Type headers are accepted in request bodies. If provided, the set must contain at least one item. Case you removed waf will retain the last known state and if omitted, the API applies the following defaults: application/x-www-form-urlencoded, multipart/form-data, multipart/related, text/xml, application/xml, application/soap+xml, application/x-amf, application/json, application/octet-stream, application/csp-report, application/xss-auditor-report, text/plain.
disabled_rule_collection_ids (Set of String) Set of WAF Collection IDs explicitly disabled. Set to an empty set or remove the attribute to clear previously set rules. To view available rule collections, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
disabled_rule_group_ids (Set of String) Set of WAF Rule Group IDs explicitly disabled. Set to an empty set or remove the attribute to clear previously set rules. Precedence hierarchy: Groups override Collections. To view available rule groups, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
disabled_rule_ids (Set of String) Set of WAF rule IDs explicitly disabled. Set to an empty set or remove the attribute to clear previously set rules. Precedence hierarchy: Specific Rules override Groups. For example, an explicitly disabled Rule ID takes precedence over an enabled Group ID. To view available rules, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
enabled_rule_collection_ids (Set of String) Set of WAF Collection IDs explicitly enabled. Set to an empty set to clear previously set rules. When the attribute is omitted, the server-managed set is left untouched (the API may populate defaults when the WAF is enabled). To view available rule collections, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
enabled_rule_group_ids (Set of String) Set of WAF Rule Group IDs explicitly enabled. Set to an empty set to clear previously set rules. When the attribute is omitted, the server-managed set is left untouched (the API may populate defaults when the WAF is enabled). Precedence hierarchy: Groups override Collections. To view available rule groups, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
enabled_rule_ids (Set of String) Set of WAF rule IDs explicitly enabled. Set to an empty set to clear previously set rules. When the attribute is omitted, the server-managed set is left untouched (the API may populate defaults when the WAF is enabled). Precedence hierarchy: Specific Rules override Groups. For example, an explicitly enabled Rule ID takes precedence over a disabled Group ID. To view available rules, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
log_only_rule_collection_ids (Set of String) Set of WAF Collection IDs explicitly marked as Log Only. Set to an empty set or remove the attribute to clear previously set rules. To view available rule collections, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
log_only_rule_group_ids (Set of String) Set of WAF Rule Group IDs explicitly marked as Log Only. Set to an empty set or remove the attribute to clear previously set rules. Precedence hierarchy: Groups override Collections. To view available rule groups, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
log_only_rule_ids (Set of String) Set of WAF rule IDs explicitly marked as Log Only. Set to an empty set or remove the attribute to clear previously set rules. Precedence hierarchy: Specific Rules override Groups. To view available rules, please consult the API documentation: https://docs.api.eu01.stackit.cloud/documentation/cdn/version/v1#tag/WAF/operation/ListWafCollections
mode (String) The operating mode of the WAF. 'ENABLED' actively blocks threats, 'LOG_ONLY' logs matches without blocking, and 'DISABLED' completely turns off inspection. Defaults to 'DISABLED'.
paranoia_level (String) Defines how aggressively the WAF should act on requests. Valid values are 'L1' to 'L4'. Case you removed waf will retain the last known state and if omitted, The API applies the following default 'L1'.
type (String) The tier of the WAF. Valid values are 'FREE' or 'PREMIUM'. Defaults to 'FREE'.

Nested Schema for `domains`

Read-Only:

errors (List of String) List of domain errors
name (String) The name of the domain
status (String) The status of the domain
type (String) The type of the domain. Each distribution has one domain of type "managed", and domains of type "custom" may be additionally created by the user

Import

Import is supported using the following syntax:

In Terraform v1.5.0 and later, the + "" + import + "" + block can be used with the + "" + id + "" + attribute, for example:

# Only use the import statement, if you want to import an existing cdn distribution
import {
  to = stackit_cdn_distribution.import-example
  id = "${var.project_id},${var.distribution_id}"
}

FilesExpand file tree

cdn_distribution.md

Latest commit

History

cdn_distribution.md

File metadata and controls

stackit_cdn_distribution (Resource)

Example Usage

Schema

Required

Read-Only

Nested Schema for config

Nested Schema for config.backend

Nested Schema for config.backend.credentials

Nested Schema for config.optimizer

Nested Schema for config.redirects

Nested Schema for config.redirects.rules

Nested Schema for config.redirects.rules.matchers

Nested Schema for config.tls

Nested Schema for config.waf

Nested Schema for domains

Import

Nested Schema for `config`

Nested Schema for `config.backend`

Nested Schema for `config.backend.credentials`

Nested Schema for `config.optimizer`

Nested Schema for `config.redirects`

Nested Schema for `config.redirects.rules`

Nested Schema for `config.redirects.rules.matchers`

Nested Schema for `config.tls`

Nested Schema for `config.waf`

Nested Schema for `domains`