Let’s suppose that I have a variable:

variable "is_cache_disabled" {
  type = bool
}

And I want to change behavior depending on this variable.

Two possible choices are:

resource "aws_cloudfront_distribution" "cloudfront_distribution" {
  ...
  default_cache_behavior {
    some_parameter_1 = some_value1
    some_parameter_2 = some_value2

    default_ttl = 86400
    max_ttl     = 86400
    min_ttl     = 3600
    forwarded_values {
      cookies {
        forward = "none"
      }
      query_string = true
    }
  }
}

and

data "aws_cloudfront_cache_policy" "cache_disabled" {
    name = "Managed-CachingDisabled"
}

resource "aws_cloudfront_distribution" "cloudfront_distribution" {
  ...
  default_cache_behavior {
    some_parameter_1 = some_value1
    some_parameter_2 = some_value2

    cache_policy_id = data.aws_cloudfront_cache_policy.cache_disabled.id
  }
}

As you can see single parameter cache_policy_id should be replaced with internal block forwarded_values and extra TTL keys in default_cache_behavior depending on variable. Probably default_cache_behavior should be dynamic, but I still can’t figure out how to replace multiple keys and internal block using dynamic construction?