AWS CloudFormation CloudFront - Reference

AWS CloudFormation CloudFront - Reference

This reference guide contains detailed information about AWS CloudFormation resources, intrinsic functions, and configurations for CloudFront CDN infrastructure.

AWS::CloudFront::Distribution

Creates a CloudFront distribution to serve content from multiple origins.

Properties

DistributionConfig Structure

Origins Structure

CustomOrigin Structure

S3Origin Structure

CacheBehavior Structure

ForwardedValues Structure

Cookies Structure

ViewerCertificate Structure

Example

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront distribution"
        Enabled: true
        IPV6Enabled: true
        PriceClass: PriceClass_All
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt StaticBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only
      Tags:
        - Key: Environment
          Value: !Ref Environment

Attributes

AWS::CloudFront::CloudFrontOriginAccessIdentity

Creates an Origin Access Identity to allow CloudFront to access private S3 buckets.

Properties

OriginAccessIdentityConfig Structure

Example

Resources:
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticBucket}"

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${StaticBucket.Arn}/*"

Attributes

AWS::CloudFront::CachePolicy

Creates a cache policy to configure how CloudFront handles caching.

Properties

CachePolicyConfig Structure

ParametersInCacheKeyAndForwardedToOrigin Structure

CookiesConfig Structure

HeadersConfig Structure

QueryStringsConfig Structure

Example

Resources:
  StaticAssetsCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-static-assets-policy"
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true

  ApiCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-api-cache-policy"
        DefaultTTL: 300
        MaxTTL: 600
        MinTTL: 60
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Authorization
              - Content-Type
          QueryStringsConfig:
            QueryStringBehavior: all

Attributes

AWS::CloudFront::OriginRequestPolicy

Creates a policy for origin requests.

Properties

OriginRequestPolicyConfig Structure

Example

Resources:
  ApiOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: !Sub "${AWS::StackName}-api-origin-request"
        CookiesConfig:
          CookieBehavior: all
        HeadersConfig:
          HeaderBehavior: whitelist
          Headers:
            - Authorization
            - Content-Type
            - X-Request-ID
        QueryStringsConfig:
          QueryStringBehavior: all

Attributes

AWS::CloudFront::ResponseHeadersPolicy

Creates a policy for response headers, useful for implementing security headers.

Properties

ResponseHeadersPolicyConfig Structure

SecurityHeadersConfig Structure

ContentTypeOptions Structure

FrameOptions Structure

ReferrerPolicy Structure

StrictTransportSecurity Structure

XSSProtection Structure

CorsConfig Structure

Example

Resources:
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Override: true
            Preload: true
          XSSProtection:
            ModeBlock: true
            Override: true
            Protection: true
        CorsConfig:
          AccessControlAllowCredentials: false
          AccessControlAllowHeaders:
            Items:
              - "*"
          AccessControlAllowMethods:
            Items:
              - GET
              - HEAD
              - OPTIONS
          AccessControlAllowOrigins:
            Items:
              - https://example.com
          AccessControlMaxAgeSec: 600
          OriginOverride: true

Attributes

AWS::CloudFront::Function

Creates a CloudFront Function for lightweight edge operations.

Properties

Supported Runtimes

Example

Resources:
  RewritePathFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-rewrite-path"
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;

          if (uri.endsWith('/')) {
            request.uri = uri.substring(0, uri.length - 1);
          }

          if (!uri.includes('.') && !uri.endsWith('/')) {
            request.uri = uri + '.html';
          }

          return request;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          FunctionAssociations:
            - FunctionARN: !GetAtt RewritePathFunction.FunctionARN
              EventType: viewer-request

Function Association Events

Attributes

AWS::WAFv2::WebACL

Creates a WAF Web ACL to protect CloudFront.

Properties

DefaultAction Structure

VisibilityConfig Structure

Example

Resources:
  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf-acl"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        - Name: AWSCommonRule
          Priority: 1
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSCommonRule
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAFACL

AWS::GlobalAccelerator::EndpointGroup

Creates an endpoint group for VPC Origins.

Properties

EndpointConfiguration Structure

Example

Resources:
  VPCOriginEndpoint:
    Type: AWS::GlobalAccelerator::EndpointGroup
    Properties:
      EndpointGroupRegion: !Ref VPCOriginRegion
      ListenerArn: !Ref AcceleratorListener
      EndpointConfigurations:
        - EndpointId: !Ref VPCEndpointService
          Weight: 128

GeoRestriction Structure

LoggingConfig Structure

RealTimeConfig Structure

Reference Intrinsic Functions

!GetAtt

Returns the value of an attribute from a CloudFront resource.

# Get distribution domain name
DistributionDomainName: !GetAtt CloudFrontDistribution.DomainName

# Get distribution ID
DistributionId: !Ref CloudFrontDistribution

# Get OAI canonical user ID
CanonicalUserId: !GetAtt CloudFrontOAI.S3CanonicalUserId

# Get S3 bucket regional domain name
BucketDomainName: !GetAtt StaticBucket.RegionalDomainName

!Sub

Substitutes variables in a string.

# With variable substitution
CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"

# Origin access identity path
OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"

!ImportValue

Imports values exported from other stacks.

# Import from another stack
BucketDomainName: !ImportValue
  !Sub "${NetworkStackName}-StaticAssetsBucketRegionalDomainName"

Limits and Quotas

CloudFront Limits

CloudFront Functions Limits

Lambda@Edge Limits

Managed Cache Policies

AWS provides predefined managed policies:

Managed Origin Request Policies

Common Tags for CloudFront

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins: []
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref ProjectName
        - Key: Owner
          Value: team@example.com
        - Key: ManagedBy
          Value: CloudFormation
        - Key: CostCenter
          Value: "12345"
        - Key: Version
          Value: "1.0.0"