Erweiterte Header für AWS CloudFront konfigurieren

# terraform/advanced-headers.tf
resource "aws_cloudfront_response_headers_policy" "advanced" {
  name    = "advanced-security-headers"
  comment = "Erweiterte Security Headers"

  custom_headers_config {
    # Prozess-Isolation (Spectre-Schutz)
    items {
      header   = "Origin-Agent-Cluster"
      value    = "?1"
      override = true
    }

    # DNS-Prefetch deaktivieren (Privacy)
    items {
      header   = "X-DNS-Prefetch-Control"
      value    = "off"
      override = true
    }

    # Cross-Domain-Policies blockieren
    items {
      header   = "X-Permitted-Cross-Domain-Policies"
      value    = "none"
      override = true
    }

    # Cross-Origin Opener Policy
    items {
      header   = "Cross-Origin-Opener-Policy"
      value    = "same-origin"
      override = true
    }

    # Cross-Origin Resource Policy
    items {
      header   = "Cross-Origin-Resource-Policy"
      value    = "same-origin"
      override = true
    }
  }
}

# Policy an Distribution anhängen
resource "aws_cloudfront_distribution" "main" {
  default_cache_behavior {
    response_headers_policy_id = aws_cloudfront_response_headers_policy.advanced.id
    # ... weitere Konfiguration
  }
}

// CloudFront Function — Erweiterte Header dynamisch
// Event: Viewer Response
function handler(event) {
  var response = event.response;
  var headers = response.headers;

  // Erweiterte Security Headers setzen
  headers['origin-agent-cluster'] = {
    value: '?1'
  };
  headers['x-dns-prefetch-control'] = {
    value: 'off'
  };
  headers['x-permitted-cross-domain-policies'] = {
    value: 'none'
  };
  headers['cross-origin-opener-policy'] = {
    value: 'same-origin'
  };
  headers['cross-origin-resource-policy'] = {
    value: 'same-origin'
  };

  return response;
}