Setting up Cloudformation for Obsidian using Terraform

obsidian.tf

resource "aws_acm_certificate" "aigee_org" {
  domain_name       = "aigee.org"
  subject_alternative_names = ["notes.aigee.org"]
  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "aigee_org" {
  for_each = {
    for dvo in aws_acm_certificate.aigee_org.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  allow_overwrite = true
  name            = each.value.name
  records         = [each.value.record]
  ttl             = 60
  type            = each.value.type
  zone_id         = module.aigee-org.zone_id
}

resource "aws_acm_certificate_validation" "aigee_org" {
  certificate_arn         = aws_acm_certificate.aigee_org.arn
  validation_record_fqdns = [for record in aws_route53_record.aigee_org : record.fqdn]
}

resource "aws_cloudfront_distribution" "aigee_org" {
  enabled = true
  aliases = ["notes.aigee.org"]
  is_ipv6_enabled = true

  origin {
    origin_id = "Obsidian"
    domain_name = "publish.obsidian.md"
    
    custom_origin_config {
      http_port = 80
      https_port = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols = ["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2"]
    }
    custom_header {
      name = "x-obsidian-custom-domain"
      value = "notes.aigee.org"
    }
  }

  default_cache_behavior {
    allowed_methods = ["GET", "HEAD"]
    cached_methods = ["GET", "HEAD"]
    target_origin_id = "Obsidian"
    viewer_protocol_policy = "redirect-to-https"
    forwarded_values {
      query_string = true

      cookies {
        forward = "none"
      }
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn = aws_acm_certificate.aigee_org.arn
    ssl_support_method = "sni-only"
  }
}

resource "aws_route53_record" "notes-aigee-org" {
  zone_id = module.aigee-org.zone_id
  name    = "notes.aigee.org"
  type    = "A"
  alias {
    name = aws_cloudfront_distribution.aigee_org.domain_name
    zone_id = aws_cloudfront_distribution.aigee_org.hosted_zone_id
    evaluate_target_health = false
  }
}