resource "aws_cloudfront_response_headers_policy" "pass" {
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_5 policy only.

  security_headers_config {
    strict_transport_security {
      override                   = true
      access_control_max_age_sec = 365 * 24 * 60 * 60
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_not_configured" {
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_5 policy only.

  security_headers_config {
    dummy_settings_block {
      override = true
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_override" {
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_5 policy only.

  security_headers_config {
    strict_transport_security {
      access_control_max_age_sec = 365 * 24 * 60 * 60
    }
  }
}

resource "aws_cloudfront_response_headers_policy" "fail_on_access_control_max_age_sec" {
  # checkov:skip=ORCD_AWS_6:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_7:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_8:This resource is designed for the ORCD_AWS_5 policy only.
  # checkov:skip=ORCD_AWS_9:This resource is designed for the ORCD_AWS_5 policy only.

  security_headers_config {
    strict_transport_security {
      override                   = true
      access_control_max_age_sec = 60 * 60
    }
  }
}