SaaS Manager for Amazon CloudFront

[lbertorello]

Description

Hi,
AWS announces CloudFront SaaS Manager, a new Amazon CloudFront feature designed to efficiently manage content delivery across multiple websites for Software-as-a-Service (SaaS) providers, web development platforms, and companies with multiple brands/websites.

More information:

• Announcement
• Blog post
• Developer Guide

Affected Resource(s) or Data Source(s)

• aws_cloudfront_multitenant_distribution (New resource: aws_cloudfront_multitenant_distribution #45535)
• New resource aws_cloudfront_distribution_tenant (New resource: r/aws_cloudfront_distribution_tenant: Added new distribution tenant resource as part of Cloudfront's SaaS Manager feature #45088)
• New resource aws_cloudfront_connection_group (New resource: r/aws_cloudfront_connection_group: Added new connection group resource as part of Cloudfront's SaaS Manager feature with Terraform Framework #44885)

Potential Terraform Configuration

References

• https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/cloudfront#CreateDistributionInput
• https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/cloudfront#CreateDistributionTenantInput

Requires #42425.

Would you like to implement the enhancement?

No

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[rshayman]

There also needs to be another resource: aws_cloudfront_connection_group

References:

• https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/cloudfront#CreateConnectionGroupInput

[heindrickdumdum0217]

Do we have plan with this feature?
We have to use this feature with Terraform.

[stylianosom]

Any update on this?

[ran-azrad-sp]

Like others here, I'm also looking forward to native support for the aws_cloudfront_distribution_tenant resource.

In the meantime, I've created a workaround using a null_resource with local-exec provisioners. This solution handles both the create and destroy lifecycles, including the necessary logic to disable the tenant and wait for the operation to complete before deletion.

Prerequisites: This workaround requires the AWS CLI and jq to be installed on the machine running Terraform.

Here is the code for anyone who needs a temporary solution. I've created it as a self-contained module for easier use.

main.tf

resource "null_resource" "cloudfront_tenant" {
triggers = {
distribution_id = var.cloudfront_distribution_id
tenant_name = var.tenant_name
tenant_domain = var.tenant_domain
certificate_arn = var.certificate_arn
}

provisioner "local-exec" {
when = "create"
command = <<-EOT
echo "Creating tenant '${self.triggers.tenant_name}'..."
aws cloudfront create-distribution-tenant
--distribution-id ${self.triggers.distribution_id}
--name ${self.triggers.tenant_name}
--domains Domain=${self.triggers.tenant_domain}
--enabled
--customizations '{"Certificate": {"Arn": "${self.triggers.certificate_arn}"}}'
EOT
}

provisioner "local-exec" {
when = "destroy"
command = <<-EOT
echo "Fetching status for tenant at domain '${self.triggers.tenant_domain}'..."
TENANT_INFO=$(aws cloudfront get-distribution-tenant-by-domain
--domain ${self.triggers.tenant_domain})

if [ -z "$TENANT_INFO" ]; then
echo "Tenant not found. Nothing to delete."
exit 0
fi

TENANT_ID=$(echo "$TENANT_INFO" | jq -r '.DistributionTenant.Id')
ETAG=$(echo "$TENANT_INFO" | jq -r '.ETag')
IS_ENABLED=$(echo "$TENANT_INFO" | jq -r '.DistributionTenant.Enabled')

if [ "$IS_ENABLED" = "true" ]; then
echo "Tenant is enabled. Sending disable command..."
aws cloudfront update-distribution-tenant
--id "$TENANT_ID"
--if-match "$ETAG"
--no-enabled
else
echo "Tenant is already disabled. Proceeding to delete."
fi

echo "Waiting for operation to complete..."
TIMEOUT=600
INTERVAL=20
SECONDS_WAITED=0

while true; do
LATEST_INFO=$(aws cloudfront get-distribution-tenant-by-domain
--domain ${self.triggers.tenant_domain})

CURRENT_STATUS=$(echo "$LATEST_INFO" | jq -r '.DistributionTenant.Status')

echo "Current status: $CURRENT_STATUS. Waiting..."

if [ "$CURRENT_STATUS" != "InProgress" ]; then
echo "Operation finished with status: $CURRENT_STATUS."
ETAG=$(echo "$LATEST_INFO" | jq -r '.ETag')
break
fi

if [ $SECONDS_WAITED -ge $TIMEOUT ]; then
echo "Error: Timed out after $TIMEOUT seconds."
exit 1
fi

sleep $INTERVAL
SECONDS_WAITED=$((SECONDS_WAITED + INTERVAL))
done

echo "Deleting tenant '$TENANT_ID'..."
aws cloudfront delete-distribution-tenant
--id "$TENANT_ID"
--if-match "$ETAG"

echo "Tenant deletion command sent successfully."
EOT
}
}