fix: only create origin_shield block when explicitly enabled

Christopher Russell · Christopher Russell · commit 8fbb0acdf06a · 2025-08-12T08:52:19.000+10:00
Previously the dynamic block was created whenever origin_shield config
existed, even with enabled=false. Now only creates the block when
enabled=true, preventing unnecessary resource updates.
diff --git a/main.tf b/main.tf
@@ -119,7 +119,7 @@ resource "aws_cloudfront_distribution" "this" {
       }
 
       dynamic "origin_shield" {
-        for_each = length(keys(lookup(origin.value, "origin_shield", {}))) == 0 ? [] : [lookup(origin.value, "origin_shield", {})]
+        for_each = lookup(lookup(origin.value, "origin_shield", {}), "enabled", false) ? [lookup(origin.value, "origin_shield", {})] : []
 
         content {
           enabled              = origin_shield.value.enabled

Original file line number	Diff line number	Diff line change
`@@ -119,7 +119,7 @@ resource "aws_cloudfront_distribution" "this" {`
`119`	`119`	`}`
`120`	`120`
`121`	`121`	`dynamic "origin_shield" {`
`122`		`- for_each = length(keys(lookup(origin.value, "origin_shield", {}))) == 0 ? [] : [lookup(origin.value, "origin_shield", {})]`
	`122`	`+ for_each = lookup(lookup(origin.value, "origin_shield", {}), "enabled", false) ? [lookup(origin.value, "origin_shield", {})] : []`
`123`	`123`
`124`	`124`	`content {`
`125`	`125`	`enabled = origin_shield.value.enabled`