resource "aws_cloudfront_distribution" "s3_distribution" {
  comment = "Some comment"

  default_cache_behavior {
    allowed_methods = ["GET", "HEAD", "OPTIONS"]
    cache_policy_id = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
    target_origin_id = "local.s3_origin_id"
  }
  default_root_object = "index.html"
  enabled = true
  is_ipv6_enabled = true

  origin {
    domain_name = "aws_s3_bucket.primary.bucket_regional_domain_name"
    origin_id = "myS3Origin"

    s3_origin_config {
      origin_access_identity = "aws_cloudfront_origin_access_identity.default.cloudfront_access_identity_path"
    }
  }

  restrictions {

    geo_restriction {
      locations = ["US", "CA", "GB", "DE"]
      restriction_type = "whitelist"
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
  }
}