CachePolicy

A unique name to identify the cache policy.

The name must only include '-', '_', or alphanumeric characters.

cachePolicyName

A comment to describe the cache policy.

The comment cannot be longer than 128 characters.

comment

Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

cookieBehavior

The default amount of time for objects to stay in the CloudFront cache.

Only used when the origin does not send Cache-Control or Expires headers with the object.

defaultTtl

Whether to normalize and include the `Accept-Encoding` header in the cache key when the `Accept-Encoding` header is 'br'.

enableAcceptEncodingBrotli

Whether to normalize and include the `Accept-Encoding` header in the cache key when the `Accept-Encoding` header is 'gzip'.

enableAcceptEncodingGzip

Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.

headerBehavior

The maximum amount of time for objects to stay in the CloudFront cache.

CloudFront uses this value only when the origin sends Cache-Control or Expires headers with the object.

maxTtl

The minimum amount of time for objects to stay in the CloudFront cache.

minTtl

Determines whether any query strings are included in the cache key and automatically included in requests that CloudFront sends to the origin.

queryStringBehavior

Amazon CloudFront is a global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to your viewers with low latency and high transfer speeds.

CloudFront fronts user provided content and caches it at edge locations across the world.

Here's how you can use this construct:

```ts
const sourceBucket = new s3.Bucket(this, 'Bucket');

const distribution = new cloudfront.CloudFrontWebDistribution(this, 'MyDistribution', {
  originConfigs: [
    {
      s3OriginSource: {
      s3BucketSource: sourceBucket,
      },
      behaviors : [ {isDefaultBehavior: true}],
    },
  ],
});
```

This will create a CloudFront distribution that uses your S3Bucket as its origin.

You can customize the distribution using additional properties from the CloudFrontWebDistributionProps interface.

Adds an IAM policy statement associated with this distribution to an IAM principal's policy.

[disable-awslint:no-grants]

grant

Grant to create invalidations for this bucket to an IAM principal (Role/Group/User).

[disable-awslint:no-grants]

grantCreateInvalidation

CloudFrontWebDistribution

The origin configurations for this distribution.

Behaviors are a part of the origin.

originConfigs

A comment for this distribution in the CloudFront console.

defaultRootObject

enabled

If your distribution should have IPv6 enabled.

enableIpV6

How CloudFront should handle requests that are not successful (eg PageNotFound).

By default, CloudFront does not replace HTTP status codes in the 4xx and 5xx range
with custom error messages. CloudFront does not cache HTTP status codes.

errorConfigurations

Controls the countries in which your content is distributed.

geoRestriction

httpVersion

Optional - if we should enable logging.

You can pass an empty object ({}) to have us auto create a bucket for logging.
Omission of this property indicates no logging is to be enabled.

loggingConfig

The price class for the distribution (this impacts how many locations CloudFront uses for your distribution, and billing).

priceClass

Specifies whether you want viewers to use HTTP or HTTPS to request your objects, whether you're using an alternate domain name with HTTPS, and if so, if you're using AWS Certificate Manager (ACM) or a third-party certificate authority.

viewerCertificate

The default viewer policy for incoming clients.

viewerProtocolPolicy

Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.

To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
`arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`.

To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a`.

webACLId

A CloudFront distribution with associated origin(s) and caching behavior(s).

Adds a new behavior to this distribution for the given pathPattern.

addBehavior

Attach WAF WebACL to this CloudFront distribution.

WebACL must be in the us-east-1 region

attachWebAclId

Return the given named metric for this Distribution.

metric

Metric for the percentage of all viewer requests for which the response's HTTP status code is 401.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric401ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 403.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric403ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 404.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric404ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 4xx.

metric4xxErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 502.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric502ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 503.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric503ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 504.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metric504ErrorRate

Metric for the percentage of all viewer requests for which the response's HTTP status code is 5xx.

metric5xxErrorRate

Metric for the total number of bytes downloaded by viewers for GET, HEAD, and OPTIONS requests.

metricBytesDownloaded

Metric for the total number of bytes that viewers uploaded to your origin with CloudFront, using POST and PUT requests.

metricBytesUploaded

Metric for the percentage of all cacheable requests for which CloudFront served the content from its cache.

HTTP POST and PUT requests, and errors, are not considered cacheable requests.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metricCacheHitRate

Metric for the total time spent from when CloudFront receives a request to when it starts providing a response to the network (not the viewer), for requests that are served from the origin, not the CloudFront cache.

This is also known as first byte latency, or time-to-first-byte.

To obtain this metric, you need to set `publishAdditionalMetrics` to `true`.

metricOriginLatency

Metric for the total number of viewer requests received by CloudFront, for all HTTP methods and for both HTTP and HTTPS requests.

metricRequests

Metric for the percentage of all viewer requests for which the response's HTTP status code is 4xx or 5xx.

metricTotalErrorRate

Distribution

The default behavior for the distribution.

defaultBehavior

Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to.

additionalBehaviors

A certificate to associate with the distribution.

The certificate must be located in N. Virginia (us-east-1).

certificate

Any comments you want to include about the distribution.

The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/).

Alternative domain names for this distribution.

If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name,
you can add an alternate domain name to your distribution. If you attach a certificate to the distribution,
you should add (at least one of) the domain names of the certificate to this list.

When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names.
For more information, see the _Moving an alternate domain name to a different distribution_ section in the README.

domainNames

Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address.

If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses.
This allows viewers to submit a second request, for an IPv4 address for your distribution.

enableIpv6

Enable access logging for the distribution.

enableLogging

How CloudFront should handle requests that are not successful (e.g., PageNotFound).

errorResponses

Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront.

For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI).

The Amazon S3 bucket to store the access logs in.

Make sure to set `objectOwnership` to `s3.ObjectOwnership.OBJECT_WRITER` in your custom bucket.

logBucket

An optional string that you want CloudFront to prefix to the access log filenames for this distribution.

logFilePrefix

Specifies whether you want CloudFront to include cookies in access logs.

logIncludesCookies

The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

CloudFront serves your objects only to browsers or devices that support at
least the SSL version that you specify.

minimumProtocolVersion

The price class that corresponds with the maximum price that you want to pay for CloudFront service.

If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations.
If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location
that has the lowest latency among the edge locations in your price class.

Whether to enable additional CloudWatch metrics.

publishAdditionalMetrics

The SSL method CloudFront will use for your distribution.

Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates
which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present
multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites
(or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.

If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for
using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).

See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/

sslSupportMethod

Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.

To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
`arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`.
To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a`.

webAclId

Function

code

A flag that determines whether to automatically publish the function to the LIVE stage when it’s created.

autoPublish

functionName

The Key Value Store to associate with this function.

In order to associate a Key Value Store, the `runtime` must be
`cloudfront-js-2.0` or newer.

keyValueStore

The runtime environment for the function.

runtime

An Origin Access Control for Lambda Function URLs.

FunctionUrlOriginAccessControl

A description of the origin access control.

description

A name to identify the origin access control, with a maximum length of 64 characters.

originAccessControlName

Specifies which requests CloudFront signs and the signing protocol.

signing

KeyGroup

A list of public keys to add to the key group.

items

keyGroupName

KeyValueStore

keyValueStoreName

The import source for the Key Value Store.

This will populate the initial items in the Key Value Store. The
source data must be in a valid JSON format.

source

An origin access identity is a special CloudFront user that you can associate with Amazon S3 origins, so that you can secure all or just some of your Amazon S3 content.

OriginAccessIdentity

Any comments you want to include about the origin access identity.

OriginRequestPolicy

A comment to describe the origin request policy.

The cookies from viewer requests to include in origin requests.

The HTTP headers to include in origin requests.

These can include headers from viewer requests and additional headers added by CloudFront.

A unique name to identify the origin request policy.

The name must only include '-', '_', or alphanumeric characters.

originRequestPolicyName

The URL query strings from viewer requests to include in origin requests.

PublicKey

The public key that you can use with signed URLs and signed cookies, or with field-level encryption.

The `encodedKey` parameter must include `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines.

encodedKey

publicKeyName

RealtimeLogConfig

Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.

endPoints

A list of fields that are included in each real-time log record.

fields

The sampling rate for this real-time log configuration.

samplingRate

The unique name of this real-time log configuration.

realtimeLogConfigName

ResponseHeadersPolicy

A comment to describe the response headers policy.

A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

corsBehavior

A configuration for a set of custom HTTP response headers.

customHeadersBehavior

A list of HTTP response headers that CloudFront removes from HTTP responses that it sends to viewers.

removeHeaders

A unique name to identify the response headers policy.

responseHeadersPolicyName

A configuration for a set of security-related HTTP response headers.

securityHeadersBehavior

The percentage of responses that you want CloudFront to add the Server-Timing header to.

serverTimingSamplingRate

An Origin Access Control for Amazon S3 origins.

S3OriginAccessControl

VpcOrigin

endpoint

The HTTP port for the CloudFront VPC origin endpoint configuration.

httpPort

The HTTPS port of the CloudFront VPC origin endpoint configuration.

httpsPort

A list that contains allowed SSL/TLS protocols for this distribution.

originSslProtocols

The origin protocol policy for the CloudFront VPC origin endpoint configuration.

protocolPolicy

The name of the CloudFront VPC origin endpoint configuration.

vpcOriginName

An Anycast static IP list.

For more information, see [Request Anycast static IPs to use for allowlisting](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/request-static-ips.html) in the *Amazon CloudFront Developer Guide* .

CfnAnycastIpList

The number of IP addresses in the Anycast static IP list.

ipCount

name

The IP address type for the Anycast static IP list.

ipAddressType

A list of IPAM CIDR configurations that define the IP address ranges, IPAM pools, and associated Anycast IP addresses.

Amazon CloudFront

L2 Constructs14

CachePolicy

CloudFrontWebDistribution

Distribution

Function

FunctionUrlOriginAccessControl

KeyGroup

KeyValueStore

OriginAccessIdentity

OriginRequestPolicy

PublicKey

RealtimeLogConfig

ResponseHeadersPolicy

S3OriginAccessControl

VpcOrigin

L1 Constructs20

CfnAnycastIpList

CfnCachePolicy

CfnCloudFrontOriginAccessIdentity

CfnConnectionFunction

CfnConnectionGroup

CfnContinuousDeploymentPolicy

CfnDistribution

CfnDistributionTenant

CfnFunction

CfnKeyGroup

CfnKeyValueStore

CfnMonitoringSubscription

CfnOriginAccessControl

CfnOriginRequestPolicy

CfnPublicKey

CfnRealtimeLogConfig

CfnResponseHeadersPolicy

CfnStreamingDistribution

CfnTrustStore

CfnVpcOrigin

Get the Amazon CloudFront Cheat Sheet

Quick Facts

Related Links