Skip navigation links

Package software.amazon.awscdk.services.cloudfront

Amazon CloudFront Construct Library

See: Description

Package software.amazon.awscdk.services.cloudfront Description

Amazon CloudFront Construct Library

---

cfn-resources: Stable

cdk-constructs: Stable

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so that content is delivered with the best possible performance.

Distribution API

The Distribution API is currently being built to replace the existing CloudFrontWebDistribution API. The Distribution API is optimized for the most common use cases of CloudFront distributions (e.g., single origin and behavior, few customizations) while still providing the ability for more advanced use cases. The API focuses on simplicity for the common use cases, and convenience methods for creating the behaviors and origins necessary for more complex use cases.

Creating a distribution

CloudFront distributions deliver your content from one or more origins; an origin is the location where you store the original version of your content. Origins can be created from S3 buckets or a custom origin (HTTP server). Constructs to define origins are in the @aws-cdk/aws-cloudfront-origins module.

Each distribution has a default behavior which applies to all requests to that distribution, and routes requests to a primary origin. Additional behaviors may be specified for an origin with a given URL path pattern. Behaviors allow routing with multiple origins, controlling which HTTP methods to support, whether to require users to use HTTPS, and what query strings or cookies to forward to your origin, among other settings.

From an S3 Bucket

An S3 bucket can be added as an origin. If the bucket is configured as a website endpoint, the distribution can use S3 redirects and S3 custom error documents. 

 // Creates a distribution from an S3 bucket.
 Bucket myBucket = new Bucket(this, "myBucket");
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new S3Origin(myBucket)).build())
         .build();

The above will treat the bucket differently based on if IBucket.isWebsite is set or not. If the bucket is configured as a website, the bucket is treated as an HTTP origin, and the built-in S3 redirects and error pages can be used. Otherwise, the bucket is handled as a bucket origin and CloudFront's redirect and error handling will be used. In the latter case, the Origin will create an origin access identity and grant it access to the underlying bucket. This can be used in conjunction with a bucket that is not public to require that your users access your content using CloudFront URLs and not S3 URLs directly.

ELBv2 Load Balancer

An Elastic Load Balancing (ELB) v2 load balancer may be used as an origin. In order for a load balancer to serve as an origin, it must be publicly accessible (internetFacing is true). Both Application and Network load balancers are supported. 

 // Creates a distribution from an ELBv2 load balancer
 Vpc vpc;
 
 // Create an application load balancer in a VPC. 'internetFacing' must be 'true'
 // for CloudFront to access the load balancer and use it as an origin.
 ApplicationLoadBalancer lb = ApplicationLoadBalancer.Builder.create(this, "LB")
         .vpc(vpc)
         .internetFacing(true)
         .build();
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new LoadBalancerV2Origin(lb)).build())
         .build();

From an HTTP endpoint

Origins can also be created from any other HTTP endpoint, given the domain name, and optionally, other origin properties. 

 // Creates a distribution from an HTTP endpoint
 // Creates a distribution from an HTTP endpoint
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new HttpOrigin("www.example.com")).build())
         .build();

Domain Names and Certificates

When you create a distribution, CloudFront assigns a domain name for the distribution, for example: d111111abcdef8.cloudfront.net; this value can be retrieved from distribution.distributionDomainName. CloudFront distributions use a default certificate (*.cloudfront.net) to support HTTPS by default. If you want to use your own domain name, such as www.example.com, you must associate a certificate with your distribution that contains your domain name, and provide one (or more) domain names from the certificate for the distribution.

The certificate must be present in the AWS Certificate Manager (ACM) service in the US East (N. Virginia) region; the certificate may either be created by ACM, or created elsewhere and imported into ACM. When a certificate is used, the distribution will support HTTPS connections from SNI only and a minimum protocol version of TLSv1.2_2021 if the '@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021' feature flag is set, and TLSv1.2_2019 otherwise. 

 // To use your own domain name in a Distribution, you must associate a certificate
 import software.amazon.awscdk.services.certificatemanager.*;
 import software.amazon.awscdk.services.route53.*;
 
 HostedZone hostedZone;
 
 Bucket myBucket;
 
 DnsValidatedCertificate myCertificate = DnsValidatedCertificate.Builder.create(this, "mySiteCert")
         .domainName("www.example.com")
         .hostedZone(hostedZone)
         .build();
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new S3Origin(myBucket)).build())
         .domainNames(List.of("www.example.com"))
         .certificate(myCertificate)
         .build();

However, you can customize the minimum protocol version for the certificate while creating the distribution using minimumProtocolVersion property. 

 // Create a Distribution with a custom domain name and a minimum protocol version.
 Bucket myBucket;
 
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new S3Origin(myBucket)).build())
         .domainNames(List.of("www.example.com"))
         .minimumProtocolVersion(SecurityPolicyProtocol.TLS_V1_2016)
         .build();

Multiple Behaviors & Origins

Each distribution has a default behavior which applies to all requests to that distribution; additional behaviors may be specified for a given URL path pattern. Behaviors allow routing with multiple origins, controlling which HTTP methods to support, whether to require users to use HTTPS, and what query strings or cookies to forward to your origin, among others.

The properties of the default behavior can be adjusted as part of the distribution creation. The following example shows configuring the HTTP methods and viewer protocol policy of the cache. 

 // Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
 Bucket myBucket;
 
 Distribution myWebDistribution = Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(new S3Origin(myBucket))
                 .allowedMethods(AllowedMethods.ALLOW_ALL)
                 .viewerProtocolPolicy(ViewerProtocolPolicy.REDIRECT_TO_HTTPS)
                 .build())
         .build();

Additional behaviors can be specified at creation, or added after the initial creation. Each additional behavior is associated with an origin, and enable customization for a specific set of resources based on a URL path pattern. For example, we can add a behavior to myWebDistribution to override the default viewer protocol policy for all of the images. 

 // Add a behavior to a Distribution after initial creation.
 Bucket myBucket;
 Distribution myWebDistribution;
 
 myWebDistribution.addBehavior("/images/*.jpg", new S3Origin(myBucket), AddBehaviorOptions.builder()
         .viewerProtocolPolicy(ViewerProtocolPolicy.REDIRECT_TO_HTTPS)
         .build());

These behaviors can also be specified at distribution creation time. 

 // Create a Distribution with additional behaviors at creation time.
 Bucket myBucket;
 
 S3Origin bucketOrigin = new S3Origin(myBucket);
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .allowedMethods(AllowedMethods.ALLOW_ALL)
                 .viewerProtocolPolicy(ViewerProtocolPolicy.REDIRECT_TO_HTTPS)
                 .build())
         .additionalBehaviors(Map.of(
                 "/images/*.jpg", BehaviorOptions.builder()
                         .origin(bucketOrigin)
                         .viewerProtocolPolicy(ViewerProtocolPolicy.REDIRECT_TO_HTTPS)
                         .build()))
         .build();

Customizing Cache Keys and TTLs with Cache Policies

You can use a cache policy to improve your cache hit ratio by controlling the values (URL query strings, HTTP headers, and cookies) that are included in the cache key, and/or adjusting how long items remain in the cache via the time-to-live (TTL) settings. CloudFront provides some predefined cache policies, known as managed policies, for common use cases. You can use these managed policies, or you can create your own cache policy that’s specific to your needs. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html for more details. 

 // Using an existing cache policy for a Distribution
 S3Origin bucketOrigin;
 
 Distribution.Builder.create(this, "myDistManagedPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .cachePolicy(CachePolicy.CACHING_OPTIMIZED)
                 .build())
         .build();
 

 // Creating a custom cache policy for a Distribution -- all parameters optional
 S3Origin bucketOrigin;
 
 CachePolicy myCachePolicy = CachePolicy.Builder.create(this, "myCachePolicy")
         .cachePolicyName("MyPolicy")
         .comment("A default policy")
         .defaultTtl(Duration.days(2))
         .minTtl(Duration.minutes(1))
         .maxTtl(Duration.days(10))
         .cookieBehavior(CacheCookieBehavior.all())
         .headerBehavior(CacheHeaderBehavior.allowList("X-CustomHeader"))
         .queryStringBehavior(CacheQueryStringBehavior.denyList("username"))
         .enableAcceptEncodingGzip(true)
         .enableAcceptEncodingBrotli(true)
         .build();
 Distribution.Builder.create(this, "myDistCustomPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .cachePolicy(myCachePolicy)
                 .build())
         .build();

Customizing Origin Requests with Origin Request Policies

When CloudFront makes a request to an origin, the URL path, request body (if present), and a few standard headers are included. Other information from the viewer request, such as URL query strings, HTTP headers, and cookies, is not included in the origin request by default. You can use an origin request policy to control the information that’s included in an origin request. CloudFront provides some predefined origin request policies, known as managed policies, for common use cases. You can use these managed policies, or you can create your own origin request policy that’s specific to your needs. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html for more details. 

 // Using an existing origin request policy for a Distribution
 S3Origin bucketOrigin;
 
 Distribution.Builder.create(this, "myDistManagedPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .originRequestPolicy(OriginRequestPolicy.CORS_S3_ORIGIN)
                 .build())
         .build();
 

 // Creating a custom origin request policy for a Distribution -- all parameters optional
 S3Origin bucketOrigin;
 
 OriginRequestPolicy myOriginRequestPolicy = OriginRequestPolicy.Builder.create(this, "OriginRequestPolicy")
         .originRequestPolicyName("MyPolicy")
         .comment("A default policy")
         .cookieBehavior(OriginRequestCookieBehavior.none())
         .headerBehavior(OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"))
         .queryStringBehavior(OriginRequestQueryStringBehavior.allowList("username"))
         .build();
 
 Distribution.Builder.create(this, "myDistCustomPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .originRequestPolicy(myOriginRequestPolicy)
                 .build())
         .build();

Customizing Response Headers with Response Headers Policies

You can configure CloudFront to add one or more HTTP headers to the responses that it sends to viewers (web browsers or other clients), without making any changes to the origin or writing any code. To specify the headers that CloudFront adds to HTTP responses, you use a response headers policy. CloudFront adds the headers regardless of whether it serves the object from the cache or has to retrieve the object from the origin. If the origin response includes one or more of the headers that’s in a response headers policy, the policy can specify whether CloudFront uses the header it received from the origin or overwrites it with the one in the policy. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/adding-response-headers.html 

 // Using an existing managed response headers policy
 S3Origin bucketOrigin;
 
 Distribution.Builder.create(this, "myDistManagedPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .responseHeadersPolicy(ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS)
                 .build())
         .build();
 
 // Creating a custom response headers policy -- all parameters optional
 ResponseHeadersPolicy myResponseHeadersPolicy = ResponseHeadersPolicy.Builder.create(this, "ResponseHeadersPolicy")
         .responseHeadersPolicyName("MyPolicy")
         .comment("A default policy")
         .corsBehavior(ResponseHeadersCorsBehavior.builder()
                 .accessControlAllowCredentials(false)
                 .accessControlAllowHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
                 .accessControlAllowMethods(List.of("GET", "POST"))
                 .accessControlAllowOrigins(List.of("*"))
                 .accessControlExposeHeaders(List.of("X-Custom-Header-1", "X-Custom-Header-2"))
                 .accessControlMaxAge(Duration.seconds(600))
                 .originOverride(true)
                 .build())
         .customHeadersBehavior(ResponseCustomHeadersBehavior.builder()
                 .customHeaders(List.of(ResponseCustomHeader.builder().header("X-Amz-Date").value("some-value").override(true).build(), ResponseCustomHeader.builder().header("X-Amz-Security-Token").value("some-value").override(false).build()))
                 .build())
         .securityHeadersBehavior(ResponseSecurityHeadersBehavior.builder()
                 .contentSecurityPolicy(ResponseHeadersContentSecurityPolicy.builder().contentSecurityPolicy("default-src https:;").override(true).build())
                 .contentTypeOptions(ResponseHeadersContentTypeOptions.builder().override(true).build())
                 .frameOptions(ResponseHeadersFrameOptions.builder().frameOption(HeadersFrameOption.DENY).override(true).build())
                 .referrerPolicy(ResponseHeadersReferrerPolicy.builder().referrerPolicy(HeadersReferrerPolicy.NO_REFERRER).override(true).build())
                 .strictTransportSecurity(ResponseHeadersStrictTransportSecurity.builder().accessControlMaxAge(Duration.seconds(600)).includeSubdomains(true).override(true).build())
                 .xssProtection(ResponseHeadersXSSProtection.builder().protection(true).modeBlock(true).reportUri("https://example.com/csp-report").override(true).build())
                 .build())
         .build();
 Distribution.Builder.create(this, "myDistCustomPolicy")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(bucketOrigin)
                 .responseHeadersPolicy(myResponseHeadersPolicy)
                 .build())
         .build();

Validating signed URLs or signed cookies with Trusted Key Groups

CloudFront Distribution supports validating signed URLs or signed cookies using key groups. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. 

 // Validating signed URLs or signed cookies with Trusted Key Groups
 
 // public key in PEM format
 String publicKey;
 
 PublicKey pubKey = PublicKey.Builder.create(this, "MyPubKey")
         .encodedKey(publicKey)
         .build();
 
 KeyGroup keyGroup = KeyGroup.Builder.create(this, "MyKeyGroup")
         .items(List.of(pubKey))
         .build();
 
 Distribution.Builder.create(this, "Dist")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(new HttpOrigin("www.example.com"))
                 .trustedKeyGroups(List.of(keyGroup))
                 .build())
         .build();

Lambda@Edge

Lambda@Edge is an extension of AWS Lambda, a compute service that lets you execute functions that customize the content that CloudFront delivers. You can author Node.js or Python functions in the US East (N. Virginia) region, and then execute them in AWS locations globally that are closer to the viewer, without provisioning or managing servers. Lambda@Edge functions are associated with a specific behavior and event type. Lambda@Edge can be used to rewrite URLs, alter responses based on headers or cookies, or authorize requests based on headers or authorization tokens.

The following shows a Lambda@Edge function added to the default behavior and triggered on every request: 

 Bucket myBucket;
 // A Lambda@Edge function added to default behavior of a Distribution
 // and triggered on every request
 EdgeFunction myFunc = EdgeFunction.Builder.create(this, "MyFunction")
         .runtime(Runtime.NODEJS_12_X)
         .handler("index.handler")
         .code(Code.fromAsset(join(__dirname, "lambda-handler")))
         .build();
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(new S3Origin(myBucket))
                 .edgeLambdas(List.of(EdgeLambda.builder()
                         .functionVersion(myFunc.getCurrentVersion())
                         .eventType(LambdaEdgeEventType.VIEWER_REQUEST)
                         .build()))
                 .build())
         .build();

Note: Lambda@Edge functions must be created in the us-east-1 region, regardless of the region of the CloudFront distribution and stack. To make it easier to request functions for Lambda@Edge, the EdgeFunction construct can be used. The EdgeFunction construct will automatically request a function in us-east-1, regardless of the region of the current stack. EdgeFunction has the same interface as Function and can be created and used interchangeably. Please note that using EdgeFunction requires that the us-east-1 region has been bootstrapped. See https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html for more about bootstrapping regions.

If the stack is in us-east-1, a "normal" lambda.Function can be used instead of an EdgeFunction. 

 // Using a lambda Function instead of an EdgeFunction for stacks in `us-east-`.
 Function myFunc = Function.Builder.create(this, "MyFunction")
         .runtime(Runtime.NODEJS_12_X)
         .handler("index.handler")
         .code(Code.fromAsset(join(__dirname, "lambda-handler")))
         .build();

If the stack is not in us-east-1, and you need references from different applications on the same account, you can also set a specific stack ID for each Lambda@Edge. 

 // Setting stackIds for EdgeFunctions that can be referenced from different applications
 // on the same account.
 EdgeFunction myFunc1 = EdgeFunction.Builder.create(this, "MyFunction1")
         .runtime(Runtime.NODEJS_12_X)
         .handler("index.handler")
         .code(Code.fromAsset(join(__dirname, "lambda-handler1")))
         .stackId("edge-lambda-stack-id-1")
         .build();
 
 EdgeFunction myFunc2 = EdgeFunction.Builder.create(this, "MyFunction2")
         .runtime(Runtime.NODEJS_12_X)
         .handler("index.handler")
         .code(Code.fromAsset(join(__dirname, "lambda-handler2")))
         .stackId("edge-lambda-stack-id-2")
         .build();

Lambda@Edge functions can also be associated with additional behaviors, either at or after Distribution creation time. 

 // Associating a Lambda@Edge function with additional behaviors.
 
 EdgeFunction myFunc;
 // assigning at Distribution creation
 Bucket myBucket;
 
 S3Origin myOrigin = new S3Origin(myBucket);
 Distribution myDistribution = Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(myOrigin).build())
         .additionalBehaviors(Map.of(
                 "images/*", BehaviorOptions.builder()
                         .origin(myOrigin)
                         .edgeLambdas(List.of(EdgeLambda.builder()
                                 .functionVersion(myFunc.getCurrentVersion())
                                 .eventType(LambdaEdgeEventType.ORIGIN_REQUEST)
                                 .includeBody(true)
                                 .build()))
                         .build()))
         .build();
 
 // assigning after creation
 myDistribution.addBehavior("images/*", myOrigin, AddBehaviorOptions.builder()
         .edgeLambdas(List.of(EdgeLambda.builder()
                 .functionVersion(myFunc.getCurrentVersion())
                 .eventType(LambdaEdgeEventType.VIEWER_RESPONSE)
                 .build()))
         .build());

Adding an existing Lambda@Edge function created in a different stack to a CloudFront distribution. 

 // Adding an existing Lambda@Edge function created in a different stack
 // to a CloudFront distribution.
 Bucket s3Bucket;
 
 IVersion functionVersion = Version.fromVersionArn(this, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1");
 
 Distribution.Builder.create(this, "distro")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(new S3Origin(s3Bucket))
                 .edgeLambdas(List.of(EdgeLambda.builder()
                         .functionVersion(functionVersion)
                         .eventType(LambdaEdgeEventType.VIEWER_REQUEST)
                         .build()))
                 .build())
         .build();

CloudFront Function

You can also deploy CloudFront functions and add them to a CloudFront distribution. 

 Bucket s3Bucket;
 // Add a cloudfront Function to a Distribution
 Function cfFunction = Function.Builder.create(this, "Function")
         .code(FunctionCode.fromInline("function handler(event) { return event.request }"))
         .build();
 Distribution.Builder.create(this, "distro")
         .defaultBehavior(BehaviorOptions.builder()
                 .origin(new S3Origin(s3Bucket))
                 .functionAssociations(List.of(FunctionAssociation.builder()
                         .function(cfFunction)
                         .eventType(FunctionEventType.VIEWER_REQUEST)
                         .build()))
                 .build())
         .build();

It will auto-generate the name of the function and deploy it to the live stage.

Additionally, you can load the function's code from a file using the FunctionCode.fromFile() method.

Logging

You can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives. The logs can go to either an existing bucket, or a bucket will be created for you. 

 // Configure logging for Distributions
 
 // Simplest form - creates a new bucket and logs to it.
 // Configure logging for Distributions
 // Simplest form - creates a new bucket and logs to it.
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new HttpOrigin("www.example.com")).build())
         .enableLogging(true)
         .build();
 
 // You can optionally log to a specific bucket, configure whether cookies are logged, and give the log files a prefix.
 // You can optionally log to a specific bucket, configure whether cookies are logged, and give the log files a prefix.
 Distribution.Builder.create(this, "myDist")
         .defaultBehavior(BehaviorOptions.builder().origin(new HttpOrigin("www.example.com")).build())
         .enableLogging(true) // Optional, this is implied if logBucket is specified
         .logBucket(new Bucket(this, "LogBucket"))
         .logFilePrefix("distribution-access-logs/")
         .logIncludesCookies(true)
         .build();

Importing Distributions

Existing distributions can be imported as well; note that like most imported constructs, an imported distribution cannot be modified. However, it can be used as a reference for other higher-level constructs. 

 // Using a reference to an imported Distribution
 IDistribution distribution = Distribution.fromDistributionAttributes(this, "ImportedDist", DistributionAttributes.builder()
         .domainName("d111111abcdef8.cloudfront.net")
         .distributionId("012345ABCDEF")
         .build());

CloudFrontWebDistribution API

The CloudFrontWebDistribution construct is the original construct written for working with CloudFront distributions. Users are encouraged to use the newer Distribution instead, as it has a simpler interface and receives new features faster.

Example usage: 

 // Using a CloudFrontWebDistribution construct.
 
 Bucket sourceBucket;
 
 CloudFrontWebDistribution distribution = CloudFrontWebDistribution.Builder.create(this, "MyDistribution")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder()
                         .s3BucketSource(sourceBucket)
                         .build())
                 .behaviors(List.of(Behavior.builder().isDefaultBehavior(true).build()))
                 .build()))
         .build();

Viewer certificate

By default, CloudFront Web Distributions will answer HTTPS requests with CloudFront's default certificate, only containing the distribution domainName (e.g. d111111abcdef8.cloudfront.net). You can customize the viewer certificate property to provide a custom certificate and/or list of domain name aliases to fit your needs.

See Using Alternate Domain Names and HTTPS in the CloudFront User Guide.

Default certificate

You can customize the default certificate aliases. This is intended to be used in combination with CNAME records in your DNS zone.

Example: 

 Bucket s3BucketSource = new Bucket(this, "Bucket");
 
 CloudFrontWebDistribution distribution = CloudFrontWebDistribution.Builder.create(this, "AnAmazingWebsiteProbably")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder().s3BucketSource(s3BucketSource).build())
                 .behaviors(List.of(Behavior.builder().isDefaultBehavior(true).build()))
                 .build()))
         .viewerCertificate(ViewerCertificate.fromCloudFrontDefaultCertificate("www.example.com"))
         .build();

ACM certificate

You can change the default certificate by one stored AWS Certificate Manager, or ACM. Those certificate can either be generated by AWS, or purchased by another CA imported into ACM.

For more information, see the aws-certificatemanager module documentation or Importing Certificates into AWS Certificate Manager in the AWS Certificate Manager User Guide.

Example: 

 Bucket s3BucketSource = new Bucket(this, "Bucket");
 
 Certificate certificate = Certificate.Builder.create(this, "Certificate")
         .domainName("example.com")
         .subjectAlternativeNames(List.of("*.example.com"))
         .build();
 
 CloudFrontWebDistribution distribution = CloudFrontWebDistribution.Builder.create(this, "AnAmazingWebsiteProbably")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder().s3BucketSource(s3BucketSource).build())
                 .behaviors(List.of(Behavior.builder().isDefaultBehavior(true).build()))
                 .build()))
         .viewerCertificate(ViewerCertificate.fromAcmCertificate(certificate, ViewerCertificateOptions.builder()
                 .aliases(List.of("example.com", "www.example.com"))
                 .securityPolicy(SecurityPolicyProtocol.TLS_V1) // default
                 .sslMethod(SSLMethod.SNI)
                 .build()))
         .build();

IAM certificate

You can also import a certificate into the IAM certificate store.

See Importing an SSL/TLS Certificate in the CloudFront User Guide.

Example: 

 Bucket s3BucketSource = new Bucket(this, "Bucket");
 
 CloudFrontWebDistribution distribution = CloudFrontWebDistribution.Builder.create(this, "AnAmazingWebsiteProbably")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder().s3BucketSource(s3BucketSource).build())
                 .behaviors(List.of(Behavior.builder().isDefaultBehavior(true).build()))
                 .build()))
         .viewerCertificate(ViewerCertificate.fromIamCertificate("certificateId", ViewerCertificateOptions.builder()
                 .aliases(List.of("example.com"))
                 .securityPolicy(SecurityPolicyProtocol.SSL_V3) // default
                 .sslMethod(SSLMethod.SNI)
                 .build()))
         .build();

Trusted Key Groups

CloudFront Web Distributions supports validating signed URLs or signed cookies using key groups. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior.

Example: 

 // Using trusted key groups for Cloudfront Web Distributions.
 Bucket sourceBucket;
 String publicKey;
 
 PublicKey pubKey = PublicKey.Builder.create(this, "MyPubKey")
         .encodedKey(publicKey)
         .build();
 
 KeyGroup keyGroup = KeyGroup.Builder.create(this, "MyKeyGroup")
         .items(List.of(pubKey))
         .build();
 
 CloudFrontWebDistribution.Builder.create(this, "AnAmazingWebsiteProbably")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder()
                         .s3BucketSource(sourceBucket)
                         .build())
                 .behaviors(List.of(Behavior.builder()
                         .isDefaultBehavior(true)
                         .trustedKeyGroups(List.of(keyGroup))
                         .build()))
                 .build()))
         .build();

Restrictions

CloudFront supports adding restrictions to your distribution.

See Restricting the Geographic Distribution of Your Content in the CloudFront User Guide.

Example: 

 // Adding restrictions to a Cloudfront Web Distribution.
 Bucket sourceBucket;
 
 CloudFrontWebDistribution.Builder.create(this, "MyDistribution")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder()
                         .s3BucketSource(sourceBucket)
                         .build())
                 .behaviors(List.of(Behavior.builder().isDefaultBehavior(true).build()))
                 .build()))
         .geoRestriction(GeoRestriction.whitelist("US", "UK"))
         .build();

Connection behaviors between CloudFront and your origin

CloudFront provides you even more control over the connection behaviors between CloudFront and your origin. You can now configure the number of connection attempts CloudFront will make to your origin and the origin connection timeout for each attempt.

See Origin Connection Attempts

See Origin Connection Timeout

Example usage: 

 // Configuring connection behaviors between Cloudfront and your origin
 CloudFrontWebDistribution distribution = CloudFrontWebDistribution.Builder.create(this, "MyDistribution")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .connectionAttempts(3)
                 .connectionTimeout(Duration.seconds(10))
                 .behaviors(List.of(Behavior.builder()
                         .isDefaultBehavior(true)
                         .build()))
                 .build()))
         .build();

Origin Fallback

In case the origin source is not available and answers with one of the specified status codes the failover origin source will be used. 

 // Configuring origin fallback options for the CloudFrontWebDistribution
 // Configuring origin fallback options for the CloudFrontWebDistribution
 CloudFrontWebDistribution.Builder.create(this, "ADistribution")
         .originConfigs(List.of(SourceConfiguration.builder()
                 .s3OriginSource(S3OriginConfig.builder()
                         .s3BucketSource(Bucket.fromBucketName(this, "aBucket", "myoriginbucket"))
                         .originPath("/")
                         .originHeaders(Map.of(
                                 "myHeader", "42"))
                         .originShieldRegion("us-west-2")
                         .build())
                 .failoverS3OriginSource(S3OriginConfig.builder()
                         .s3BucketSource(Bucket.fromBucketName(this, "aBucketFallback", "myoriginbucketfallback"))
                         .originPath("/somewhere")
                         .originHeaders(Map.of(
                                 "myHeader2", "21"))
                         .originShieldRegion("us-east-1")
                         .build())
                 .failoverCriteriaStatusCodes(List.of(FailoverStatusCode.INTERNAL_SERVER_ERROR))
                 .behaviors(List.of(Behavior.builder()
                         .isDefaultBehavior(true)
                         .build()))
                 .build()))
         .build();

KeyGroup & PublicKey API

You can create a key group to use with CloudFront signed URLs and signed cookies You can add public keys to use with CloudFront features such as signed URLs, signed cookies, and field-level encryption.

The following example command uses OpenSSL to generate an RSA key pair with a length of 2048 bits and save to the file named private_key.pem. 

 openssl genrsa -out private_key.pem 2048

The resulting file contains both the public and the private key. The following example command extracts the public key from the file named private_key.pem and stores it in public_key.pem. 

 openssl rsa -pubout -in private_key.pem -out public_key.pem

Note: Don't forget to copy/paste the contents of public_key.pem file including -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines into encodedKey parameter when creating a PublicKey.

Example: 

 // Create a key group to use with CloudFront signed URLs and signed cookies.
 // Create a key group to use with CloudFront signed URLs and signed cookies.
 KeyGroup.Builder.create(this, "MyKeyGroup")
         .items(List.of(
             PublicKey.Builder.create(this, "MyPublicKey")
                     .encodedKey("...")
                     .build()))
         .build();

See:

Skip navigation links