# Behavior

A CloudFront behavior wrapper.

- Source: [`aws-cloudfront/lib/web-distribution.ts`](https://github.com/aws/aws-cdk/blob/v2.273.0/packages/aws-cdk-lib/aws-cloudfront/lib/web-distribution.ts#L370)
- Type last changed: v2.234.0 · 8 Jan 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as cdk from 'aws-cdk-lib';
import { aws_cloudfront as cloudfront } from 'aws-cdk-lib';
import { aws_lambda as lambda } from 'aws-cdk-lib';
import { aws_cloudfront as interfaces_cloudfront } from 'aws-cdk-lib/interfaces';

declare const functionRef: interfaces_cloudfront.IFunctionRef;
declare const keyGroupRef: interfaces_cloudfront.IKeyGroupRef;
declare const version: lambda.Version;
const behavior: cloudfront.Behavior = {
  allowedMethods: cloudfront.CloudFrontAllowedMethods.GET_HEAD,
  cachedMethods: cloudfront.CloudFrontAllowedCachedMethods.GET_HEAD,
  compress: false,
  defaultTtl: cdk.Duration.minutes(30),
  forwardedValues: {
    queryString: false,

    // the properties below are optional
    cookies: {
      forward: 'forward',

      // the properties below are optional
      whitelistedNames: ['whitelistedNames'],
    },
    headers: ['headers'],
    queryStringCacheKeys: ['queryStringCacheKeys'],
  },
  functionAssociations: [{
    eventType: cloudfront.FunctionEventType.VIEWER_REQUEST,
    function: functionRef,
  }],
  isDefaultBehavior: false,
  lambdaFunctionAssociations: [{
    eventType: cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
    lambdaFunction: version,

    // the properties below are optional
    includeBody: false,
  }],
  maxTtl: cdk.Duration.minutes(30),
  minTtl: cdk.Duration.minutes(30),
  pathPattern: 'pathPattern',
  trustedKeyGroups: [keyGroupRef],
  trustedSigners: ['trustedSigners'],
  viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.HTTPS_ONLY,
};
```

## Properties

- `allowedMethods`: [CloudFrontAllowedMethods](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CloudFrontAllowedMethods.html) = GET_HEAD — The method this CloudFront distribution responds do.

- `cachedMethods`: [CloudFrontAllowedCachedMethods](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CloudFrontAllowedCachedMethods.html) = GET_HEAD — Which methods are cached by CloudFront by default.

- `compress`: boolean = true — If CloudFront should automatically compress some content types.

- `defaultTtl`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = 86400 (1 day) — The default amount of time CloudFront will cache an object.

  This value applies only when your custom origin does not add HTTP headers,
  such as Cache-Control max-age, Cache-Control s-maxage, and Expires to objects.

- `forwardedValues`: [CfnDistribution.ForwardedValuesProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CfnDistribution.ForwardedValuesProperty.html) = none (no cookies - no headers) — The values CloudFront will forward to the origin when making a request.

- `functionAssociations`: [FunctionAssociation](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.FunctionAssociation.html)[] = no functions will be invoked — The CloudFront functions to invoke before serving the contents.

- `isDefaultBehavior`: boolean — If this behavior is the default behavior for the distribution.

  You must specify exactly one default distribution per CloudFront distribution.
  The default behavior is allowed to omit the "path" property.

- `lambdaFunctionAssociations`: [LambdaFunctionAssociation](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.LambdaFunctionAssociation.html)[] = No lambda function associated — Declares associated lambda@edge functions for this distribution behaviour.

- `maxTtl`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) = Duration.seconds(31536000) (one year) — The max amount of time you want objects to stay in the cache before CloudFront queries your origin.

  **Default:** Duration.seconds(31536000) (one year)

- `minTtl`: [Duration](/cdk/api/v2/docs/aws-cdk-lib.Duration.html) — The minimum amount of time that you want objects to stay in the cache before CloudFront queries your origin.

- `pathPattern`: string — The path this behavior responds to.

  Required for all non-default behaviors. (The default behavior implicitly has "*" as the path pattern. )

- `trustedKeyGroups`: [IKeyGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_cloudfront.IKeyGroupRef.html)[] = no KeyGroups are associated with cache behavior — A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.

  **Default:** no KeyGroups are associated with cache behavior

- `trustedSigners`: string[] — - We recommend using trustedKeyGroups instead of trustedSigners.

  The signers are the account IDs that are allowed to sign cookies/presigned URLs for this distribution.

  If you pass a non empty value, all requests for this behavior must be signed (no public access will be allowed)

- `viewerProtocolPolicy`: [ViewerProtocolPolicy](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.ViewerProtocolPolicy.html) = the distribution wide viewer protocol policy will be used — The viewer policy for this behavior.

  **Default:** the distribution wide viewer protocol policy will be used