pangea-aws 0.1.0

data/lib/pangea/resources/aws_cloudfront_cache_policy/resource.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudfront_cache_policy/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      def aws_cloudfront_cache_policy(name, attributes = {})
+        cache_policy_attrs = Types::CloudFrontCachePolicyAttributes.new(attributes)
+        
+        resource(:aws_cloudfront_cache_policy, name) do
+          name cache_policy_attrs.name
+          comment cache_policy_attrs.comment if cache_policy_attrs.comment.present?
+          default_ttl cache_policy_attrs.default_ttl
+          max_ttl cache_policy_attrs.max_ttl
+          min_ttl cache_policy_attrs.min_ttl
+          
+          parameters_in_cache_key_and_forwarded_to_origin do
+            enable_accept_encoding_brotli cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:enable_accept_encoding_brotli)
+            enable_accept_encoding_gzip cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:enable_accept_encoding_gzip)
+            
+            headers_config do
+              header_behavior cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:headers_config)[:header_behavior]
+              if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:headers_config)[:headers]
+                headers do
+                  items cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:headers_config)[:headers][:items] if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:headers_config)[:headers][:items]
+                end
+              end
+            end
+            
+            query_strings_config do
+              query_string_behavior cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:query_strings_config)[:query_string_behavior]
+              if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:query_strings_config)[:query_strings]
+                query_strings do
+                  items cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:query_strings_config)[:query_strings][:items] if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:query_strings_config)[:query_strings][:items]
+                end
+              end
+            end
+            
+            cookies_config do
+              cookie_behavior cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:cookies_config)[:cookie_behavior]
+              if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:cookies_config)[:cookies]
+                cookies do
+                  items cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:cookies_config)[:cookies][:items] if cache_policy_attrs.parameters_in_cache_key_and_forwarded_to_origin&.dig(:cookies_config)[:cookies][:items]
+                end
+              end
+            end
+          end
+        end
+        
+        ResourceReference.new(
+          type: 'aws_cloudfront_cache_policy',
+          name: name,
+          resource_attributes: cache_policy_attrs.to_h,
+          outputs: {
+            id: "${aws_cloudfront_cache_policy.#{name}.id}",
+            etag: "${aws_cloudfront_cache_policy.#{name}.etag}"
+          },
+          computed: {}
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_cache_policy/types.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      class CloudFrontCachePolicyAttributes < Pangea::Resources::BaseAttributes
+        transform_keys(&:to_sym)
+        
+        attribute? :name, Resources::Types::String.optional
+        attribute :comment, Resources::Types::String.default('')
+        attribute :default_ttl, Resources::Types::Integer.constrained(gteq: 0).default(86400)
+        attribute :max_ttl, Resources::Types::Integer.constrained(gteq: 0).default(31536000)
+        attribute :min_ttl, Resources::Types::Integer.constrained(gteq: 0).default(0)
+        attribute? :parameters_in_cache_key_and_forwarded_to_origin, Resources::Types::Hash.schema(
+          enable_accept_encoding_brotli: Resources::Types::Bool.default(false),
+          enable_accept_encoding_gzip: Resources::Types::Bool.default(false),
+          headers_config: Resources::Types::Hash.schema(
+            header_behavior: Resources::Types::String.constrained(included_in: ['none', 'whitelist']).default('none'),
+            headers?: Resources::Types::Hash.schema(
+              items?: Resources::Types::Array.of(Resources::Types::String).optional
+            ).lax.optional
+          ).default({ header_behavior: 'none' }),
+          query_strings_config: Resources::Types::Hash.schema(
+            query_string_behavior: Resources::Types::String.constrained(included_in: ['none', 'whitelist', 'allExcept', 'all']).default('none'),
+            query_strings?: Resources::Types::Hash.schema(
+              items?: Resources::Types::Array.of(Resources::Types::String).optional
+            ).lax.optional
+          ).default({ query_string_behavior: 'none' }),
+          cookies_config: Resources::Types::Hash.schema(
+            cookie_behavior: Resources::Types::String.constrained(included_in: ['none', 'whitelist', 'allExcept', 'all']).default('none'),
+            cookies?: Resources::Types::Hash.schema(
+              items?: Resources::Types::Array.of(Resources::Types::String).optional
+            ).lax.optional
+          ).default({ cookie_behavior: 'none' })
+        )
+      end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_distribution/builders/cache_behavior_builder.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module CloudFrontDistribution
+        # Builds cache behavior configuration blocks for CloudFront distributions
+        module CacheBehaviorBuilder
+          module_function
+
+          def build_default_cache_behavior(context, behavior)
+            context.default_cache_behavior do
+              apply_cache_behavior_attributes(context, behavior)
+              build_function_associations(context, behavior[:function_association])
+              build_lambda_associations(context, behavior[:lambda_function_association])
+            end
+          end
+
+          def build_ordered_cache_behaviors(context, behaviors)
+            behaviors.each { |behavior| build_ordered_cache_behavior(context, behavior) }
+          end
+
+          def build_ordered_cache_behavior(context, behavior)
+            context.ordered_cache_behavior do
+              context.path_pattern behavior[:path_pattern]
+              apply_cache_behavior_attributes(context, behavior)
+              build_function_associations(context, behavior[:function_association])
+              build_lambda_associations(context, behavior[:lambda_function_association])
+            end
+          end
+
+          def apply_cache_behavior_attributes(context, behavior)
+            context.target_origin_id behavior[:target_origin_id]
+            context.viewer_protocol_policy behavior[:viewer_protocol_policy]
+            context.allowed_methods behavior[:allowed_methods] if behavior[:allowed_methods]
+            context.cached_methods behavior[:cached_methods] if behavior[:cached_methods]
+            context.cache_policy_id behavior[:cache_policy_id] if behavior[:cache_policy_id]
+            context.origin_request_policy_id behavior[:origin_request_policy_id] if behavior[:origin_request_policy_id]
+            context.response_headers_policy_id behavior[:response_headers_policy_id] if behavior[:response_headers_policy_id]
+            context.realtime_log_config_arn behavior[:realtime_log_config_arn] if behavior[:realtime_log_config_arn]
+            context.smooth_streaming behavior[:smooth_streaming] if behavior[:smooth_streaming]
+            context.trusted_signers behavior[:trusted_signers] if behavior[:trusted_signers]&.any?
+            context.trusted_key_groups behavior[:trusted_key_groups] if behavior[:trusted_key_groups]&.any?
+            context.compress behavior[:compress] if behavior.key?(:compress)
+            context.field_level_encryption_id behavior[:field_level_encryption_id] if behavior[:field_level_encryption_id]
+          end
+
+          def build_function_associations(context, associations)
+            return unless associations&.any?
+
+            associations.each do |func_assoc|
+              context.function_association do
+                context.event_type func_assoc[:event_type]
+                context.function_arn func_assoc[:function_arn]
+              end
+            end
+          end
+
+          def build_lambda_associations(context, associations)
+            return unless associations&.any?
+
+            associations.each do |lambda_assoc|
+              context.lambda_function_association do
+                context.event_type lambda_assoc[:event_type]
+                context.lambda_arn lambda_assoc[:lambda_arn]
+                context.include_body lambda_assoc[:include_body] if lambda_assoc.key?(:include_body)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_distribution/builders/origin_builder.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module CloudFrontDistribution
+        # Builds origin configuration blocks for CloudFront distributions
+        module OriginBuilder
+          module_function
+
+          def build_origins(context, origins)
+            origins.each { |origin_config| build_origin(context, origin_config) }
+          end
+
+          def build_origin(context, origin_config)
+            context.origin do
+              context.domain_name origin_config[:domain_name]
+              context.origin_id origin_config[:origin_id]
+              context.origin_path origin_config[:origin_path] if origin_config[:origin_path]
+              context.connection_attempts origin_config[:connection_attempts] if origin_config[:connection_attempts]
+              context.connection_timeout origin_config[:connection_timeout] if origin_config[:connection_timeout]
+
+              build_s3_origin_config(context, origin_config[:s3_origin_config]) if origin_config[:s3_origin_config]
+              build_custom_origin_config(context, origin_config[:custom_origin_config]) if origin_config[:custom_origin_config]
+              build_origin_shield(context, origin_config[:origin_shield]) if origin_config[:origin_shield]
+              build_custom_headers(context, origin_config[:custom_header]) if origin_config[:custom_header]
+            end
+          end
+
+          def build_s3_origin_config(context, s3_config)
+            context.s3_origin_config do
+              context.origin_access_identity s3_config[:origin_access_identity] if s3_config[:origin_access_identity]
+              context.origin_access_control_id s3_config[:origin_access_control_id] if s3_config[:origin_access_control_id]
+            end
+          end
+
+          def build_custom_origin_config(context, custom_config)
+            context.custom_origin_config do
+              context.http_port custom_config[:http_port]
+              context.https_port custom_config[:https_port]
+              context.origin_protocol_policy custom_config[:origin_protocol_policy]
+              context.origin_ssl_protocols custom_config[:origin_ssl_protocols] if custom_config[:origin_ssl_protocols]
+              context.origin_keepalive_timeout custom_config[:origin_keepalive_timeout] if custom_config[:origin_keepalive_timeout]
+              context.origin_read_timeout custom_config[:origin_read_timeout] if custom_config[:origin_read_timeout]
+            end
+          end
+
+          def build_origin_shield(context, shield_config)
+            context.origin_shield do
+              context.enabled shield_config[:enabled]
+              context.origin_shield_region shield_config[:origin_shield_region] if shield_config[:origin_shield_region]
+            end
+          end
+
+          def build_custom_headers(context, headers)
+            return unless headers&.any?
+            headers.each do |header|
+              context.custom_header do
+                context.name header[:name]
+                context.value header[:value]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_distribution/builders/reference_builder.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module CloudFrontDistribution
+        # Builds resource references for CloudFront distributions
+        module ReferenceBuilder
+          TERRAFORM_OUTPUTS = %i[id arn domain_name hosted_zone_id etag status trusted_signers trusted_key_groups].freeze
+
+          COMPUTED_PROPERTIES = %i[
+            total_origins_count total_behaviors_count has_custom_ssl? uses_cloudfront_ssl?
+            has_custom_domain? has_geographic_restrictions? has_custom_error_pages?
+            has_origin_shield? has_lambda_at_edge? has_cloudfront_functions? supports_http2?
+            ipv6_enabled? estimated_cost_tier s3_origins_count custom_origins_count
+            primary_domain security_profile
+          ].freeze
+
+          module_function
+
+          def build_reference(name, distribution_attrs)
+            ref = ResourceReference.new(
+              type: 'aws_cloudfront_distribution',
+              name: name,
+              resource_attributes: distribution_attrs.to_h,
+              outputs: build_outputs(name)
+            )
+
+            add_computed_properties(ref, distribution_attrs)
+            ref
+          end
+
+          def build_outputs(name)
+            TERRAFORM_OUTPUTS.each_with_object({}) do |output, hash|
+              hash[output] = "${aws_cloudfront_distribution.#{name}.#{output}}"
+            end
+          end
+
+          def add_computed_properties(ref, distribution_attrs)
+            COMPUTED_PROPERTIES.each do |prop|
+              ref.define_singleton_method(prop) { distribution_attrs.public_send(prop) }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_distribution/builders/settings_builder.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module CloudFrontDistribution
+        # Builds distribution settings blocks for CloudFront distributions
+        module SettingsBuilder
+          module_function
+
+          def build_basic_settings(context, attrs)
+            context.comment attrs.comment
+            context.default_root_object attrs.default_root_object if attrs.default_root_object
+            context.enabled attrs.enabled
+            context.http_version attrs.http_version
+            context.is_ipv6_enabled attrs.is_ipv6_enabled
+            context.price_class attrs.price_class
+            context.aliases attrs.aliases if attrs.aliases.any?
+            context.web_acl_id attrs.web_acl_id if attrs.web_acl_id
+            context.retain_on_delete attrs.retain_on_delete
+            context.wait_for_deployment attrs.wait_for_deployment
+          end
+
+          def build_custom_error_responses(context, error_responses)
+            error_responses.each do |error_response|
+              context.custom_error_response do
+                context.error_code error_response[:error_code]
+                context.response_code error_response[:response_code] if error_response[:response_code]
+                context.response_page_path error_response[:response_page_path] if error_response[:response_page_path]
+                context.error_caching_min_ttl error_response[:error_caching_min_ttl] if error_response[:error_caching_min_ttl]
+              end
+            end
+          end
+
+          def build_restrictions(context, restrictions)
+            return unless restrictions
+
+            geo = restrictions[:geo_restriction]
+            return unless geo
+
+            context.restrictions do
+              context.geo_restriction do
+                context.restriction_type geo[:restriction_type]
+                context.locations geo[:locations] if geo[:locations]&.any?
+              end
+            end
+          end
+
+          def build_viewer_certificate(context, cert)
+            context.viewer_certificate do
+              context.acm_certificate_arn cert[:acm_certificate_arn] if cert[:acm_certificate_arn]
+              context.iam_certificate_id cert[:iam_certificate_id] if cert[:iam_certificate_id]
+              context.cloudfront_default_certificate cert[:cloudfront_default_certificate] if cert.key?(:cloudfront_default_certificate)
+              context.ssl_support_method cert[:ssl_support_method] if cert[:ssl_support_method]
+              context.minimum_protocol_version cert[:minimum_protocol_version] if cert[:minimum_protocol_version]
+            end
+          end
+
+          def build_tags(context, tags)
+            return unless tags&.any?
+
+            context.tags do
+              tags.each { |key, value| context.public_send(key, value) }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudfront_distribution/resource.rb

@@ -0,0 +1,208 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudfront_distribution/types'
+require 'pangea/resource_registry'
+require_relative 'builders/origin_builder'
+require_relative 'builders/cache_behavior_builder'
+require_relative 'builders/settings_builder'
+require_relative 'builders/reference_builder'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudFront Distribution with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudFront distribution attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_cloudfront_distribution(name, attributes = {})
+        distribution_attrs = Types::CloudFrontDistributionAttributes.new(attributes)
+
+        resource(:aws_cloudfront_distribution, name) do
+          # Origins (array of hashes)
+          origin build_cf_origins(distribution_attrs.origin)
+
+          # Default cache behavior (single hash)
+          default_cache_behavior build_cf_cache_behavior(distribution_attrs.default_cache_behavior)
+
+          # Ordered cache behaviors (array of hashes)
+          if distribution_attrs.ordered_cache_behavior.any?
+            ordered_cache_behavior distribution_attrs.ordered_cache_behavior.map { |b|
+              build_cf_ordered_cache_behavior(b)
+            }
+          end
+
+          # Basic settings
+          comment distribution_attrs.comment
+          default_root_object distribution_attrs.default_root_object if distribution_attrs.default_root_object
+          enabled distribution_attrs.enabled
+          http_version distribution_attrs.http_version
+          is_ipv6_enabled distribution_attrs.is_ipv6_enabled
+          price_class distribution_attrs.price_class
+          aliases distribution_attrs.aliases if distribution_attrs.aliases.any?
+          web_acl_id distribution_attrs.web_acl_id if distribution_attrs.web_acl_id
+          retain_on_delete distribution_attrs.retain_on_delete
+          wait_for_deployment distribution_attrs.wait_for_deployment
+
+          # Custom error responses (array of hashes)
+          if distribution_attrs.custom_error_response.any?
+            custom_error_response distribution_attrs.custom_error_response.map { |er|
+              build_cf_custom_error_response(er)
+            }
+          end
+
+          # Restrictions
+          if distribution_attrs.restrictions
+            restrictions build_cf_restrictions(distribution_attrs.restrictions)
+          end
+
+          # Viewer certificate
+          if distribution_attrs.viewer_certificate
+            viewer_certificate build_cf_viewer_certificate(distribution_attrs.viewer_certificate)
+          end
+
+          # Tags
+          tags distribution_attrs.tags if distribution_attrs.tags&.any?
+        end
+
+        CloudFrontDistribution::ReferenceBuilder.build_reference(name, distribution_attrs)
+      end
+
+      private
+
+      def build_cf_origins(origins)
+        origins.map { |origin_config| build_cf_origin(origin_config) }
+      end
+
+      def build_cf_origin(origin_config)
+        origin_hash = {
+          domain_name: origin_config[:domain_name],
+          origin_id: origin_config[:origin_id]
+        }
+        origin_hash[:origin_path] = origin_config[:origin_path] if origin_config[:origin_path]
+        origin_hash[:connection_attempts] = origin_config[:connection_attempts] if origin_config[:connection_attempts]
+        origin_hash[:connection_timeout] = origin_config[:connection_timeout] if origin_config[:connection_timeout]
+
+        if origin_config[:s3_origin_config]
+          s3_cfg = origin_config[:s3_origin_config]
+          s3_hash = {}
+          s3_hash[:origin_access_identity] = s3_cfg[:origin_access_identity] if s3_cfg[:origin_access_identity]
+          s3_hash[:origin_access_control_id] = s3_cfg[:origin_access_control_id] if s3_cfg[:origin_access_control_id]
+          origin_hash[:s3_origin_config] = s3_hash
+        end
+
+        if origin_config[:custom_origin_config]
+          custom_cfg = origin_config[:custom_origin_config]
+          custom_hash = {}
+          custom_hash[:http_port] = custom_cfg[:http_port] if custom_cfg[:http_port]
+          custom_hash[:https_port] = custom_cfg[:https_port] if custom_cfg[:https_port]
+          custom_hash[:origin_protocol_policy] = custom_cfg[:origin_protocol_policy] if custom_cfg[:origin_protocol_policy]
+          custom_hash[:origin_ssl_protocols] = custom_cfg[:origin_ssl_protocols] if custom_cfg[:origin_ssl_protocols]
+          custom_hash[:origin_keepalive_timeout] = custom_cfg[:origin_keepalive_timeout] if custom_cfg[:origin_keepalive_timeout]
+          custom_hash[:origin_read_timeout] = custom_cfg[:origin_read_timeout] if custom_cfg[:origin_read_timeout]
+          origin_hash[:custom_origin_config] = custom_hash
+        end
+
+        if origin_config[:origin_shield]
+          shield = origin_config[:origin_shield]
+          shield_hash = { enabled: shield[:enabled] }
+          shield_hash[:origin_shield_region] = shield[:origin_shield_region] if shield[:origin_shield_region]
+          origin_hash[:origin_shield] = shield_hash
+        end
+
+        if origin_config[:custom_header]&.any?
+          origin_hash[:custom_header] = origin_config[:custom_header].map { |h|
+            { name: h[:name], value: h[:value] }
+          }
+        end
+
+        origin_hash
+      end
+
+      def build_cf_cache_behavior(behavior)
+        bh = {
+          target_origin_id: behavior[:target_origin_id],
+          viewer_protocol_policy: behavior[:viewer_protocol_policy]
+        }
+        bh[:allowed_methods] = behavior[:allowed_methods] if behavior[:allowed_methods]
+        bh[:cached_methods] = behavior[:cached_methods] if behavior[:cached_methods]
+        bh[:cache_policy_id] = behavior[:cache_policy_id] if behavior[:cache_policy_id]
+        bh[:origin_request_policy_id] = behavior[:origin_request_policy_id] if behavior[:origin_request_policy_id]
+        bh[:response_headers_policy_id] = behavior[:response_headers_policy_id] if behavior[:response_headers_policy_id]
+        bh[:realtime_log_config_arn] = behavior[:realtime_log_config_arn] if behavior[:realtime_log_config_arn]
+        bh[:smooth_streaming] = behavior[:smooth_streaming] if behavior[:smooth_streaming]
+        bh[:trusted_signers] = behavior[:trusted_signers] if behavior[:trusted_signers]&.any?
+        bh[:trusted_key_groups] = behavior[:trusted_key_groups] if behavior[:trusted_key_groups]&.any?
+        bh[:compress] = behavior[:compress] if behavior.key?(:compress)
+        bh[:field_level_encryption_id] = behavior[:field_level_encryption_id] if behavior[:field_level_encryption_id]
+
+        if behavior[:function_association]&.any?
+          bh[:function_association] = behavior[:function_association].map { |fa|
+            { event_type: fa[:event_type], function_arn: fa[:function_arn] }
+          }
+        end
+
+        if behavior[:lambda_function_association]&.any?
+          bh[:lambda_function_association] = behavior[:lambda_function_association].map { |la|
+            lh = { event_type: la[:event_type], lambda_arn: la[:lambda_arn] }
+            lh[:include_body] = la[:include_body] if la.key?(:include_body)
+            lh
+          }
+        end
+
+        bh
+      end
+
+      def build_cf_ordered_cache_behavior(behavior)
+        bh = build_cf_cache_behavior(behavior)
+        bh[:path_pattern] = behavior[:path_pattern]
+        bh
+      end
+
+      def build_cf_custom_error_response(error_response)
+        er = { error_code: error_response[:error_code] }
+        er[:response_code] = error_response[:response_code] if error_response[:response_code]
+        er[:response_page_path] = error_response[:response_page_path] if error_response[:response_page_path]
+        er[:error_caching_min_ttl] = error_response[:error_caching_min_ttl] if error_response[:error_caching_min_ttl]
+        er
+      end
+
+      def build_cf_restrictions(restrictions)
+        return unless restrictions
+
+        geo = restrictions[:geo_restriction]
+        return unless geo
+
+        rh = { geo_restriction: { restriction_type: geo[:restriction_type] } }
+        rh[:geo_restriction][:locations] = geo[:locations] if geo[:locations]&.any?
+        rh
+      end
+
+      def build_cf_viewer_certificate(cert)
+        vc = {}
+        vc[:acm_certificate_arn] = cert[:acm_certificate_arn] if cert[:acm_certificate_arn]
+        vc[:iam_certificate_id] = cert[:iam_certificate_id] if cert[:iam_certificate_id]
+        vc[:cloudfront_default_certificate] = cert[:cloudfront_default_certificate] if cert.key?(:cloudfront_default_certificate)
+        vc[:ssl_support_method] = cert[:ssl_support_method] if cert[:ssl_support_method]
+        vc[:minimum_protocol_version] = cert[:minimum_protocol_version] if cert[:minimum_protocol_version]
+        vc
+      end
+    end
+  end
+end