resource "aws_cloudfront_response_headers_policy" "pass" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_9 policy only.

  security_headers_config {
    referrer_policy {
      override        = true
      referrer_policy = "same-origin"
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_not_configured" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_9 policy only.

  security_headers_config {
    dummy_settings_block {
      override = true
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_override" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_9 policy only.

  security_headers_config {
    referrer_policy {
      referrer_policy = "strict-origin-when-cross-origin"
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_referrer_policy" {
  # checkov:skip=ORCD_AWS_5:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_9 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_9 policy only.

  security_headers_config {
    referrer_policy {
      override        = true
      referrer_policy = "unsafe-url"
    }
  }
}