resource "aws_cloudfront_response_headers_policy" "pass" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_7 policy only.

  security_headers_config {
    content_type_options {
      override = true
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_not_configured" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_7 policy only.

  security_headers_config {
    dummy_settings_block {
      override = true
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_override" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_7 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_7 policy only.

  security_headers_config {
    content_type_options {
      override = false
    }
  }
}