/ home / community / community.aws / 4.3.0 / module / cloudfront_response_headers_policy

community.aws.cloudfront_response_headers_policy (4.3.0) — module

Create, update and delete response headers policies to be used in a Cloudfront distribution

| "added in version" 3.2.0 of community.aws"

Authors: Stefan Horning (@stefanhorning)

Install collection

Install with ansible-galaxy collection install community.aws:==4.3.0

Add to requirements.yml

  collections:
    - name: community.aws
      version: 4.3.0

Description

Create, update and delete response headers policies to be used in a Cloudfront distribution for inserting custom headers

See docs at U(https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudfront.html#CloudFront.Client.create_response_headers_policy)

Requirements

python >= 2.6
boto

Usage examples

Scanned by Steampunk Spotter

- name: Creationg a Cloudfront header policy using all predefined header features and a custom header for demonstration
  community.aws.cloudfront_response_headers_policy:
    name: my-header-policy
    comment: My header policy for all the headers
    cors_config:
      access_control_allow_origins:
        items:
          - 'https://foo.com/bar'
          - 'https://bar.com/foo'
      access_control_allow_headers:
        items:
          - 'X-Session-Id'
      access_control_allow_methods:
        items:
          - GET
          - OPTIONS
          - HEAD
      access_control_allow_credentials: true
      access_control_expose_headers:
        items:
          - 'X-Session-Id'
      access_control_max_age_sec: 1800
      origin_override: true
    security_headers_config:
      xss_protection:
        protection: true
        report_uri: 'https://my.report-uri.com/foo/bar'
        override: true
      frame_options:
        frame_option: 'SAMEORIGIN'
        override: true
      referrer_policy:
        referrer_policy: 'same-origin'
        override: true
      content_security_policy:
        content_security_policy: "frame-ancestors 'none'; report-uri https://my.report-uri.com/r/d/csp/enforce;"
        override: true
      content_type_options:
        override: true
      strict_transport_security:
        include_subdomains: true
        preload: true
        access_control_max_age_sec: 63072000
        override: true
    custom_headers_config:
      items:
        - { header: 'X-Test-Header', value: 'Foo', override: true }
    state: present

Scanned by Steampunk Spotter

- name: Delete header policy
  community.aws.cloudfront_response_headers_policy:
    name: my-header-policy
    state: absent

Inputs

name:
description: Name of the policy
required: true
type: str

state:
choices:
- present
- absent
default: present
description: Decides if the named policy should be absent or present
type: str

region:
aliases:
- aws_region
- ec2_region
description:
- The AWS region to use. If not specified then the value of the AWS_REGION or EC2_REGION
environment variable, if any, is used. See U(http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region)
type: str

comment:
description: Description of the policy
required: false
type: str

ec2_url:
aliases:
- aws_endpoint_url
- endpoint_url
description:
- Url to use to connect to EC2 or your Eucalyptus cloud (by default the module will
use EC2 endpoints). Ignored for modules where region is required. Must be specified
for all other modules if region is not used. If not set then the value of the EC2_URL
environment variable, if any, is used.
type: str

profile:
aliases:
- aws_profile
description:
- Uses a boto profile. Only works with boto >= 2.24.0.
- Using I(profile) will override I(aws_access_key), I(aws_secret_key) and I(security_token)
and support for passing them at the same time as I(profile) has been deprecated.
- I(aws_access_key), I(aws_secret_key) and I(security_token) will be made mutually
exclusive with I(profile) after 2022-06-01.
type: str

aws_config:
description:
- A dictionary to modify the botocore configuration.
- Parameters can be found at U(https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html#botocore.config.Config).
- Only the 'user_agent' key is used for boto modules. See U(http://boto.cloudhackers.com/en/latest/boto_config_tut.html#boto)
for more boto configuration.
type: dict

cors_config:
default: {}
description: CORS header config block
required: false
type: dict

aws_ca_bundle:
description:
- The location of a CA Bundle to use when validating SSL certificates.
- Only used for boto3 based modules.
- 'Note: The CA Bundle is read ''module'' side and may need to be explicitly copied
from the controller if not run locally.'
type: path

aws_access_key:
aliases:
- ec2_access_key
- access_key
description:
- AWS access key. If not set then the value of the AWS_ACCESS_KEY_ID, AWS_ACCESS_KEY
or EC2_ACCESS_KEY environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(aws_access_key) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str

aws_secret_key:
aliases:
- ec2_secret_key
- secret_key
description:
- AWS secret key. If not set then the value of the AWS_SECRET_ACCESS_KEY, AWS_SECRET_KEY,
or EC2_SECRET_KEY environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(aws_secret_key) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str

security_token:
aliases:
- aws_security_token
- access_token
description:
- AWS STS security token. If not set then the value of the AWS_SECURITY_TOKEN or EC2_SECURITY_TOKEN
environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(security_token) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str

validate_certs:
default: true
description:
- When set to "no", SSL certificates will not be validated for boto versions >= 2.6.0.
type: bool

custom_headers_config:
default: {}
description: Custom headers config block. Define your own list of headers and values
as a list
required: false
type: dict

security_headers_config:
default: {}
description: Security headers config block. For headers suchs as XSS-Protection, Content-Security-Policy
or Strict-Transport-Security
required: false
type: dict

debug_botocore_endpoint_logs:
default: 'no'
description:
- Use a botocore.endpoint logger to parse the unique (rather than total) "resource:action"
API calls made during a task, outputing the set to the resource_actions key in the
task results. Use the aws_resource_action callback to output to total list made
during a playbook. The ANSIBLE_DEBUG_BOTOCORE_LOGS environment variable may also
be used.
type: bool

Outputs

response_headers_policy:
  contains:
    id:
      description: ID of the policy
      returned: always
      sample: 10a45b52-630e-4b7c-77c6-205f06df0462
      type: str
    last_modified_time:
      description: Timestamp of last modification of policy
      returned: always
      sample: '2022-02-04T13:23:27.304000+00:00'
      type: str
    response_headers_policy_config:
      contains:
        name:
          description: Name of the policy
          returned: always
          sample: my-header-policy
          type: str
      description: The response headers config dict containing all the headers configured
      returned: always
      type: complex
  description: The policy's information
  returned: success
  type: complex