Aws Cloudformation Cloudfront

Name: Aws Cloudformation Cloudfront
Author: giuseppe-trisciuoglio

giuseppe-trisciuoglio/developer-kit

70 installs
318 repo stars
Updated June 22, 2026
giuseppe-trisciuoglio/developer-kit

Author AWS CloudFormation templates for CloudFront distributions, multiple origins, cache behaviors, functions, and security headers.

About

Provides CloudFormation patterns for CloudFront CDN distributions, origins (ALB, S3, Lambda@Edge, VPC origins), caching strategies, and WAF. A developer uses it to provision a production CDN as code with custom domains and ACM certificates.

Multiple origin types and CacheBehaviors with cache policies
Custom domains with ACM, WAF, and security-header functions

Aws Cloudformation Cloudfront by the numbers

70 all-time installs (skills.sh)
Ranked #656 of 1,039 Cloud & Infrastructure skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

npx skills add https://github.com/giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-cloudfront

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/giuseppe-trisciuoglio/developer-kit/aws-cloudformation-cloudfront.svg)](https://skillselion.com/skills/giuseppe-trisciuoglio/developer-kit/aws-cloudformation-cloudfront)

Installs	70
repo stars	★ 318
Last updated	June 22, 2026
Repository	giuseppe-trisciuoglio/developer-kit ↗

What it does

Author AWS CloudFormation templates for CloudFront distributions, multiple origins, cache behaviors, functions, and security headers.

Files

SKILL.mdMarkdownGitHub ↗

AWS CloudFormation CloudFront CDN

Overview

Create production-ready CDN infrastructure using AWS CloudFormation templates. This skill covers CloudFront distributions, multiple origins (ALB, S3, Lambda@Edge, VPC Origins), CacheBehaviors, Functions, SecurityHeaders, and best practices for parameters, outputs, and cross-stack references.

When to Use

Use this skill when:

Creating new CloudFront distributions with CloudFormation
Configuring multiple origins (ALB, S3, API Gateway, Lambda@Edge, VPC Origins)
Implementing caching strategies with CacheBehaviors and Cache Policies
Configuring custom domains with ACM certificates
Implementing SecurityHeaders (CSP, HSTS, XSS protection)
Configuring CloudFront Functions and Lambda@Edge
Managing Geo-restrictions and Price Classes
Integrating WAF with CloudFront
Organizing templates with Parameters, Outputs, Mappings, Conditions
Implementing cross-stack references with export/import
Using Transform for macros and reuse

CloudFormation Template Structure

Standard Format Base Template

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront distribution with multiple origins

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Distribution Configuration
        Parameters:
          - DomainName
          - CertificateArn
          - PriceClass
      - Label:
          default: Origin Settings
        Parameters:
          - OriginDomainName
          - OriginPath
          - OriginProtocolPolicy

Parameters:
  DomainName:
    Type: String
    Default: cdn.example.com
    Description: Custom domain name for CloudFront distribution

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn
    Description: ACM certificate ARN for HTTPS

  PriceClass:
    Type: String
    Default: PriceClass_All
    AllowedValues:
      - PriceClass_All
      - PriceClass_100
      - PriceClass_200
    Description: CloudFront price class

  OriginDomainName:
    Type: String
    Description: Domain name of the origin (ALB or S3)

  OriginPath:
    Type: String
    Default: ""
    Description: Optional origin path

Mappings:
  EnvironmentConfig:
    us-east-1:
      CertificateRegion: us-east-1
    other:
      CertificateRegion: us-east-1

Conditions:
  IsUsEast1: !Equals [!Ref AWS::Region, us-east-1]
  HasOriginPath: !Not [!Equals [!Ref OriginPath, ""]]

Transform:
  - AWS::Serverless-2016-10-31

Resources:
  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront distribution for ${DomainName}"
        DomainNames:
          - !Ref DomainName
        Enabled: true
        PriceClass: !Ref PriceClass
        IPV6Enabled: true
        DefaultRootObject: index.html
        Origins:
          - Id: !Sub "${DomainName}-origin"
            DomainName: !Ref OriginDomainName
            OriginPath: !If [HasOriginPath, !Ref OriginPath, !Ref AWS::NoValue]
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
        DefaultCacheBehavior:
          TargetOriginId: !Sub "${DomainName}-origin"
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

Outputs:
  DistributionDomainName:
    Description: CloudFront distribution domain name
    Value: !GetAtt CloudFrontDistribution.DomainName
    Export:
      Name: !Sub "${AWS::StackName}-DistributionDomainName"

  DistributionId:
    Description: CloudFront distribution ID
    Value: !Ref CloudFrontDistribution
    Export:
      Name: !Sub "${AWS::StackName}-DistributionId"

Best Practices for Parameters

AWS-Specific Parameter Types

Parameters:
  # ACM Certificate for domain
  CertificateArn:
    Type: AWS::ACM::Certificate::Arn
    Description: ACM certificate for the domain

  # S3 Bucket origins
  StaticAssetsBucket:
    Type: AWS::S3::Bucket
    Description: S3 bucket for static assets

  StaticAssetsBucketDomainName:
    Type: AWS::S3::Bucket::RegionalDomainName
    Description: Regional domain name of the S3 bucket

  # ALB origins
  LoadBalancerArn:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer::Arn
    Description: ARN of the Application Load Balancer

  LoadBalancerDNSName:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer::DnsName
    Description: DNS name of the ALB

  # Lambda function origins
  LambdaFunctionArn:
    Type: AWS::Lambda::Function::Arn
    Description: ARN of the Lambda function for Lambda@Edge

  # VPC Origin
  VPCOriginEndpoint:
    Type: AWS::GlobalAccelerator::Endpoint::EndpointId
    Description: VPC Origin endpoint ID

  # IAM Role for Lambda@Edge
  LambdaEdgeRoleArn:
    Type: AWS::IAM::Role::Arn
    Description: IAM role for Lambda@Edge execution

Parameter Constraints

Parameters:
  DomainName:
    Type: String
    Default: cdn.example.com
    Description: Custom domain name for CloudFront
    ConstraintDescription: Must be a valid domain name
    MinLength: 4
    MaxLength: 253
    AllowedPattern: "[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*"

  PriceClass:
    Type: String
    Default: PriceClass_All
    Description: CloudFront price class
    AllowedValues:
      - PriceClass_All
      - PriceClass_100
      - PriceClass_200

  DefaultTTL:
    Type: Number
    Default: 86400
    Description: Default cache TTL in seconds
    MinValue: 0
    MaxValue: 31536000
    ConstraintDescription: Must be between 0 and 31536000 seconds

  MaxTTL:
    Type: Number
    Default: 31536000
    Description: Maximum cache TTL in seconds
    MinValue: 0
    MaxValue: 31536000

  MinTTL:
    Type: Number
    Default: 0
    Description: Minimum cache TTL in seconds
    MinValue: 0
    MaxValue: 31536000

SSM Parameter References

Parameters:
  WafWebAclArn:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /cloudfront/waf-webacl-arn
    Description: WAF Web ACL ARN from Parameter Store

  CloudFrontKeyId:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /cloudfront/keys/cloudfront-key-id
    Description: CloudFront key pair ID for signed URLs

Outputs and Cross-Stack References

Export/Import Patterns

# Stack A - Network/Infrastructure Stack
AWSTemplateFormatVersion: 2010-09-09
Description: Infrastructure stack exporting CloudFront resources

Resources:
  # S3 Bucket for static content
  StaticAssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - GET
              - HEAD
            AllowedOrigins:
              - "*"
            MaxAge: 3600

  # OAI for CloudFront access
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticAssetsBucket}"

Outputs:
  StaticAssetsBucketName:
    Description: S3 bucket name for static assets
    Value: !Ref StaticAssetsBucket
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketName"

  StaticAssetsBucketArn:
    Description: S3 bucket ARN
    Value: !GetAtt StaticAssetsBucket.Arn
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketArn"

  StaticAssetsBucketRegionalDomainName:
    Description: Regional domain name of the S3 bucket
    Value: !GetAtt StaticAssetsBucket.RegionalDomainName
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketRegionalDomainName"

  CloudFrontOAIId:
    Description: CloudFront OAI ID
    Value: !Ref CloudFrontOAI
    Export:
      Name: !Sub "${AWS::StackName}-CloudFrontOAIId"

  CloudFrontOAIArn:
    Description: CloudFront OAI ARN
    Value: !GetAtt CloudFrontOAI.Arn
    Export:
      Name: !Sub "${AWS::StackName}-CloudFrontOAIArn"

# Stack B - Application Stack (imports from Infrastructure Stack)
AWSTemplateFormatVersion: 2010-09-09
Description: Application stack importing from infrastructure stack

Parameters:
  InfrastructureStackName:
    Type: String
    Default: infrastructure-stack
    Description: Name of the infrastructure stack

  DomainName:
    Type: String
    Default: cdn.example.com
    Description: Custom domain name

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn
    Description: ACM certificate ARN

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront for ${DomainName}"
        Enabled: true
        IPV6Enabled: true
        DefaultRootObject: index.html
        Origins:
          - Id: StaticAssetsOrigin
            DomainName: !ImportValue
              !Sub "${InfrastructureStackName}-StaticAssetsBucketRegionalDomainName"
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${InfrastructureStackName}-CloudFrontOAIId"
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

Nested Stacks for Modularity

AWSTemplateFormatVersion: 2010-09-09
Description: Main stack with nested CloudFront stacks

Resources:
  # Nested stack for static assets distribution
  StaticAssetsDistributionStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/cloudfront-static.yaml
      TimeoutInMinutes: 15
      Parameters:
        DomainName: !Ref DomainName
        CertificateArn: !Ref CertificateArn
        StaticAssetsBucketName: !Ref StaticAssetsBucketName
        Environment: !Ref Environment

  # Nested stack for API distribution
  ApiDistributionStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/cloudfront-api.yaml
      TimeoutInMinutes: 15
      Parameters:
        DomainName: !Ref ApiDomainName
        CertificateArn: !Ref CertificateArn
        LoadBalancerDnsName: !Ref LoadBalancerDnsName
        Environment: !Ref Environment

S3 Origins

S3 Origin with OAI

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront distribution with S3 origin

Resources:
  # S3 Bucket
  StaticBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # CloudFront OAI
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticBucket}"

  # S3 Bucket Policy - Allow CloudFront OAI
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${StaticBucket.Arn}/*"
          - Effect: Deny
            Principal: "*"
            Action: s3:GetObject
            Resource: !Sub "${StaticBucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "Static assets CDN"
        Enabled: true
        IPV6Enabled: true
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt StaticBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Outputs:
  DistributionDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName

S3 Origin with Origin Access Control (OAC)

Resources:
  StaticBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-oac-${AWS::AccountId}-${AWS::Region}"
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # S3 Bucket Policy for OAC
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: s3:GetObject
            Resource: !Sub "${StaticBucket.Arn}/*"
            Condition:
              StringEquals:
                AWS:SourceArn: !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt StaticBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: ""
        # For OAC, use OriginAccessControl instead of S3OriginConfig
        # but CloudFormation supports both

ALB Origins

Application Load Balancer Origin

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with ALB origin

Resources:
  # Application Load Balancer
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub "${AWS::StackName}-alb"
      Scheme: internet-facing
      SecurityGroups:
        - !Ref ALBSecurityGroup
      Subnets:
        - !Ref PublicSubnet1
        - !Ref PublicSubnet2
      Type: application

  # ALB Security Group
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ALB security group
      VpcId: !Ref VPCId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref CloudFrontSecurityGroup
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref CloudFrontSecurityGroup

  # CloudFront Security Group (for ALB ingress)
  CloudFrontSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: CloudFront security group for ALB
      VpcId: !Ref VPCId
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          DestinationSecurityGroupId: !Ref ALBSecurityGroup
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          DestinationSecurityGroupId: !Ref ALBSecurityGroup

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with ALB origin"
        Enabled: true
        Origins:
          - Id: ALBOrigin
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
        DefaultCacheBehavior:
          TargetOriginId: ALBOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: true
            Headers:
              - Origin
              - Access-Control-Request-Method
              - Access-Control-Request-Headers
            Cookies:
              Forward: all
            QueryStringSettings:
              - Name: "*"
          MinTTL: 0
          DefaultTTL: 0
          MaxTTL: 0

Multiple Origins and CacheBehaviors

Multi-Origin with Path Patterns

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with multiple origins and cache behaviors

Resources:
  # S3 Bucket for static assets
  StaticAssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"

  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticAssetsBucket}"

  # Application Load Balancer for API
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub "${AWS::StackName}-api-alb"
      Scheme: internet-facing
      SecurityGroups:
        - !Ref ALBSecurityGroup
      Subnets: !Ref PublicSubnets
      Type: application

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "Multi-origin CloudFront distribution"
        Enabled: true
        IPV6Enabled: true
        DefaultRootObject: index.html
        Origins:
          # Static assets origin
          - Id: StaticAssetsOrigin
            DomainName: !GetAtt StaticAssetsBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
          # API origin
          - Id: ApiOrigin
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
          # Lambda origin
          - Id: LambdaOrigin
            DomainName: !Sub "${LambdaFunction}.execute-api.${AWS::Region}.amazonaws.com"
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          # Default: static assets
          TargetOriginId: StaticAssetsOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        CacheBehaviors:
          # API cache behavior
          - PathPattern: "/api/*"
            TargetOriginId: ApiOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: true
              Headers:
                - Accept
                - Accept-Language
                - Authorization
              Cookies:
                Forward: all
            MinTTL: 0
            DefaultTTL: 0
            MaxTTL: 0
          # Lambda function path
          - PathPattern: "/lambda/*"
            TargetOriginId: LambdaOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: none
            MinTTL: 0
            DefaultTTL: 0
            MaxTTL: 0

Cache Policies

Managed Cache Policy

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CacheBehaviors:
          - PathPattern: "/static/*"
            TargetOriginId: StaticAssetsOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            CachePolicyId: !Ref ManagedCachingOptimizedPolicyId
            FunctionAssociations:
              - FunctionARN: !GetAtt CloudFrontFunction.FunctionARN
                EventType: viewer-request

          - PathPattern: "/api/*"
            TargetOriginId: ApiOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            CachePolicyId: !Ref ManagedSecurityHeadersPolicyId

Custom Cache Policy

Resources:
  # Custom Cache Policy
  StaticAssetsCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-static-assets-policy"
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true

  # Custom Cache Policy for API
  ApiCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-api-cache-policy"
        DefaultTTL: 300
        MaxTTL: 600
        MinTTL: 60
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Authorization
              - Content-Type
              - Accept
          QueryStringsConfig:
            QueryStringBehavior: all
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: StaticAssetsOrigin
            DomainName: !GetAtt StaticAssetsBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        CacheBehaviors:
          - PathPattern: "/static/*"
            TargetOriginId: StaticAssetsOrigin
            CachePolicyId: !GetAtt StaticAssetsCachePolicy.Id

Origin Request Policies

Resources:
  # Origin Request Policy
  StaticAssetsOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: !Sub "${AWS::StackName}-static-assets-origin-request"
        CookiesConfig:
          CookieBehavior: none
        HeadersConfig:
          HeaderBehavior: none
        QueryStringsConfig:
          QueryStringBehavior: none

  ApiOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: !Sub "${AWS::StackName}-api-origin-request"
        CookiesConfig:
          CookieBehavior: all
        HeadersConfig:
          HeaderBehavior: whitelist
          Headers:
            - Authorization
            - Content-Type
            - X-Request-ID
        QueryStringsConfig:
          QueryStringBehavior: all

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CacheBehaviors:
          - PathPattern: "/api/*"
            TargetOriginId: ApiOrigin
            CachePolicyId: !GetAtt ApiCachePolicy.Id
            OriginRequestPolicyId: !GetAtt ApiOriginRequestPolicy.Id

Response Headers Policies (Security Headers)

Resources:
  # Security Headers Policy
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Override: true
            Preload: true
          XSSProtection:
            ModeBlock: true
            Override: true
            Protection: true
        CorsConfig:
          AccessControlAllowCredentials: false
          AccessControlAllowHeaders:
            Items:
              - "*"
          AccessControlAllowMethods:
            Items:
              - GET
              - HEAD
              - OPTIONS
          AccessControlAllowOrigins:
            Items:
              - !Ref AllowedOrigin
          AccessControlMaxAgeSec: 600
          OriginOverride: true

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          ResponseHeadersPolicyId: !GetAtt SecurityHeadersPolicy.Id

CloudFront Functions

Viewer Request Function

Resources:
  # CloudFront Function
  RewritePathFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-rewrite-path"
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;

          // Remove trailing slash
          if (uri.endsWith('/')) {
            request.uri = uri.substring(0, uri.length - 1);
          }

          // Add .html extension for HTML pages
          if (!uri.includes('.') && !uri.endsWith('/')) {
            request.uri = uri + '.html';
          }

          return request;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          FunctionAssociations:
            - FunctionARN: !GetAtt RewritePathFunction.FunctionARN
              EventType: viewer-request

Lambda@Edge Functions

Resources:
  # Lambda@Edge Function
  LambdaEdgeFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-lambda-edge"
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambda/edge-function.zip
      Handler: index.handler
      Runtime: nodejs20.x
      Role: !GetAtt LambdaEdgeRole.Arn

  # Lambda Version for Lambda@Edge
  LambdaEdgeVersion:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: !Ref LambdaEdgeFunction
      Description: Lambda@Edge version

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          LambdaFunctionAssociations:
            - FunctionARN: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${LambdaEdgeFunction}:${LambdaEdgeVersion}"
              EventType: origin-request

Geo-Restrictions and Price Class

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with geo restrictions"
        Enabled: true
        IPV6Enabled: true

        # Price Class - optimize costs
        PriceClass: PriceClass_200

        # Geo Restrictions
        GeoRestriction:
          RestrictionType: whitelist
          Locations:
            - US
            - CA
            - GB
            - DE
            - FR
            - IT
            - JP
            - AU

        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only

        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

WAF Integration

Resources:
  # WAF Web ACL
  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf-acl"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        # AWS Managed Rule - Common
        - Name: AWSCommonRule
          Priority: 1
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
              ExcludedRules:
                - Name: SizeRestrictions_BODY
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSCommonRule

        # Rate-based rule
        - Name: RateLimitRule
          Priority: 2
          Statement:
            RateBasedStatementKey:
              SingleHeader:
                Name: ip
            AggregateKeyType: IP
            Limit: 1000
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRule

        # SQL Injection protection
        - Name: SQLInjectionRule
          Priority: 3
          Statement:
            SqliMatchStatement:
              FieldToMatch:
                QueryString: {}
                UriPath: {}
              TextTransformations:
                - Priority: 1
                  Type: URL_DECODE
                - Priority: 2
                  Type: LOWERCASE
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: SQLInjectionRule

        # XSS protection
        - Name: XSSRule
          Priority: 4
          Statement:
            XssMatchStatement:
              FieldToMatch:
                QueryString: {}
                UriPath: {}
              TextTransformations:
                - Priority: 1
                  Type: URL_DECODE
                - Priority: 2
                  Type: LOWERCASE
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: XSSRule

      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAFACL

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with WAF"
        Enabled: true
        WebACLId: !GetAtt CloudFrontWebACL.Arn
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Real-Time Logs

Resources:
  # Kinesis Data Stream
  CloudFrontLogsStream:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: !Sub "${AWS::StackName}-cloudfront-logs"
      ShardCount: 1
      RetentionPeriodHours: 24

  # IAM Role for CloudFront
  CloudFrontLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-cloudfront-logging"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: KinesisPutRecord
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - kinesis:PutRecord
                  - kinesis:PutRecords
                Resource: !GetAtt CloudFrontLogsStream.Arn

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with real-time logs"
        Enabled: true
        RealTimeConfig:
          Endpoint: !GetAtt CloudFrontLogsStream.Arn
          RoleArn: !GetAtt CloudFrontLoggingRole.Arn
          Fields:
            - timestamp
            - c-ip
            - cs-method
            - cs-uri
            - sc-status
            - time-taken
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Conditions and Transform

Conditions for Environment-Specific Configuration

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with conditional configuration

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - production
    Description: Deployment environment

  EnableWAF:
    Type: String
    Default: false
    AllowedValues:
      - true
      - false
    Description: Enable WAF protection

Conditions:
  IsProduction: !Equals [!Ref Environment, production]
  IsStaging: !Equals [!Ref Environment, staging]
  EnableWAFProtection: !And
    - !Equals [!Ref EnableWAF, true]
    - !Or
      - [!Equals [!Ref Environment, staging]]
      - [!Equals [!Ref Environment, production]]

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront for ${Environment}"
        Enabled: true
        IPV6Enabled: true
        PriceClass: !If [IsProduction, PriceClass_All, PriceClass_100]
        WebACLId: !If [EnableWAFProtection, !Ref CloudFrontWebACL, !Ref AWS::NoValue]
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: !If [IsProduction, redirect-to-https, allow-all]
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: !If [IsProduction, true, false]
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: !If [IsProduction, 0, 0]
          DefaultTTL: !If [IsProduction, 86400, 3600]
          MaxTTL: !If [IsProduction, 31536000, 86400]

  # WAF only for staging and production
  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Condition: EnableWAFProtection
    Properties:
      Name: !Sub "${AWS::StackName}-waf-acl"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules: []
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAFACL

VPC Origins

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with VPC Origin

Resources:
  # VPC Origin Endpoint
  VPCOriginEndpoint:
    Type: AWS::GlobalAccelerator::EndpointGroup
    Properties:
      EndpointGroupRegion: !Ref VPCOriginRegion
      ListenerArn: !Ref AcceleratorListener
      EndpointConfigurations:
        - EndpointId: !Ref VPCEndpointService
          Weight: 128

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with VPC Origin"
        Enabled: true
        IPV6Enabled: true
        Origins:
          - Id: VPCOrigin
            DomainName: !Ref VPCOriginDomain
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginKeepaliveTimeout: 60
              OriginReadTimeout: 30
        DefaultCacheBehavior:
          TargetOriginId: VPCOrigin
          ViewerProtocolPolicy: https-only
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: true
            Headers:
              - "*"
            Cookies:
              Forward: all
          MinTTL: 0
          DefaultTTL: 3600
          MaxTTL: 86400

Best Practices

Security

Always use HTTPS with minimum TLS 1.2
Implement SecurityHeaders with HSTS, XSS protection
Use WAF for protection against common attacks
Configure appropriate Access-Control for CORS
Limit origin access with OAI/OAC
Use Signed URLs for private content
Implement rate limiting
Configure geo-restrictions if needed

Performance

Use appropriate PriceClass to optimize costs
Configure Cache TTL based on content type
Enable compression (Gzip/Brotli)
Use CloudFront Functions for lightweight operations
Optimize header forwarding (do not forward unnecessary headers)
Consider Origin Shield to reduce load on origins
Use multiple origins with path patterns

Monitoring

Enable CloudWatch metrics and alarms
Configure real-time logs for troubleshooting
Monitor cache hit ratio
Configure alerts for error rate and latency
Use CloudFront reports for traffic analysis

Deployment

Use change sets before deployment
Test templates with cfn-lint
Organize stacks by lifecycle and ownership
Implement blue/green deployments with weighted aliases
Use StackSets for multi-region deployment

CloudFormation Best Practices

Stack Policies

Stack Policies prevent accidental updates to critical resources during stack updates.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront distribution with stack policy

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        # ... configuration

  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules: []
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAF

# Stack Policy - protect critical resources
Metadata:
  AWS::CloudFormation::StackPolicy:
    Statement:
      - Effect: Allow
        Action: Update:*
        Resource: "*"
      - Effect: Deny
        Action:
          - Update:Replace
          - Update:Delete
        Resource: "LogicalID=CloudFrontDistribution"
        Principal: "*"
      - Effect: Deny
        Action:
          - Update:Replace
          - Update:Delete
        Resource: "LogicalID=CloudFrontWebACL"
        Principal: "*"

Termination Protection

Enable termination protection to prevent accidental stack deletion.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with termination protection

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        # ... configuration

# Note: Termination protection is enabled via AWS Console or CLI
# AWS CLI: aws cloudformation update-termination-protection --enable-termination-protection --stack-name my-stack
# Or set it in a separate stack update after creation

Drift Detection

Detect when infrastructure has been modified outside of CloudFormation.

# AWS CLI commands for drift detection
# Detect drift on a stack
aws cloudformation detect-stack-drift --stack-name my-cloudfront-stack

# Get drift detection status
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id>

# Get resources that have drifted
aws cloudformation describe-stack-resource-drifts --stack-name my-cloudfront-stack

# Example drift detection output format
# {
#     "StackResourceDrifts": [
#         {
#             "ResourceType": "AWS::CloudFront::Distribution",
#             "LogicalResourceId": "CloudFrontDistribution",
#             "PhysicalResourceId": "E1X2Y3Z4W5X6Y7",
#             "ResourceStatus": "UPDATE",
#             "PropertyDifferences": [
#                 {
#                     "PropertyPath": "$.DistributionConfig.Enabled",
#                     "ExpectedValue": "true",
#                     "ActualValue": "false"
#                 }
#             ],
#             "StackResourceDriftStatus": "MODIFIED"
#         }
#     ]
# }

Change Sets

Preview and review changes before executing stack updates.

# AWS CLI commands for change sets

# 1. Create a change set (preview)
aws cloudformation create-change-set \
  --stack-name my-cloudfront-stack \
  --template-body file://cloudfront-template.yaml \
  --change-set-name my-changeset \
  --capabilities CAPABILITY_IAM \
  --parameters ParameterKey=Environment,ParameterValue=production

# 2. Describe the change set to review changes
aws cloudformation describe-change-set \
  --stack-name my-cloudfront-stack \
  --change-set-name my-changeset

# 3. Execute the change set if changes are acceptable
aws cloudformation execute-change-set \
  --stack-name my-cloudfront-stack \
  --change-set-name my-changeset

# Or delete if changes are not desired
aws cloudformation delete-change-set \
  --stack-name my-cloudfront-stack \
  --change-set-name my-changeset

# Change set with nested stacks example
AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront infrastructure with nested stacks for change set management

Resources:
  # Parent stack managing multiple CloudFront distributions
  CloudFrontParentStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub "https://${ArtifactBucket}.s3.amazonaws.com/cloudfront-parent.yaml"
      TimeoutInMinutes: 30
      Parameters:
        Environment: !Ref Environment
        CertificateArn: !Ref CertificateArn
        DomainName: !Ref DomainName
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref ProjectName
        - Key: ManagedBy
          Value: CloudFormation

  # Change set will show impacts across all nested stacks
  # When updating, CloudFormation will show:
  # - Which nested stacks will be updated
  # - Resources being added, modified, or deleted
  # - IAM changes requiring special attention

Related Resources

Additional Files

For complete details on resources and their properties, see:

REFERENCE.md - Detailed reference guide for all CloudFormation resources
EXAMPLES.md - Complete production-ready examples

AWS CloudFormation CloudFront - Examples

Questo file contiene esempi completi e production-ready per pattern CloudFront con CloudFormation.

Esempio 1: Static Website Hosting con S3

Configurazione completa per un sito web statico su S3 con CloudFront, OAI e certificato ACM.

AWSTemplateFormatVersion: 2010-09-09
Description: Static website hosting with CloudFront and S3

Parameters:
  Environment:
    Type: String
    Default: production
    AllowedValues:
      - dev
      - staging
      - production

  DomainName:
    Type: String
    Default: cdn.example.com
    Description: Custom domain name

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn
    Description: ACM certificate ARN for the domain

  HostedZoneId:
    Type: AWS::Route53::HostedZone::Id
    Description: Route53 hosted zone ID

Mappings:
  EnvironmentConfig:
    dev:
      PriceClass: PriceClass_100
      Compress: false
    staging:
      PriceClass: PriceClass_100
      Compress: true
    production:
      PriceClass: PriceClass_All
      Compress: true

Resources:
  # S3 Bucket per contenuti statici
  StaticAssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - "*"
            AllowedMethods:
              - GET
              - HEAD
            AllowedOrigins:
              - "*"
            MaxAge: 3600
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: static-website

  # CloudFront Origin Access Identity
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticAssetsBucket}"

  # S3 Bucket Policy - Permetti accesso solo da CloudFront
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticAssetsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${StaticAssetsBucket.Arn}/*"
          - Effect: Deny
            Principal: "*"
            Action: s3:GetObject
            Resource: !Sub "${StaticAssetsBucket.Arn}/*"
            Condition:
              Bool:
                aws:SecureTransport: false

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "Static assets CDN for ${Environment}"
        Enabled: true
        IPV6Enabled: true
        PriceClass: !FindInMap [EnvironmentConfig, !Ref Environment, PriceClass]
        DefaultRootObject: index.html
        Origins:
          - Id: StaticAssetsOrigin
            DomainName: !GetAtt StaticAssetsBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: !FindInMap [EnvironmentConfig, !Ref Environment, Compress]
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: static-website
        - Key: ManagedBy
          Value: CloudFormation

  # Route53 Record Set
  CloudFrontDNSRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: !Ref DomainName
      Type: A
      HostedZoneId: !Ref HostedZoneId
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2

  # Route53 AAAA Record per IPv6
  CloudFrontDNSRecordAAAA:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: !Ref DomainName
      Type: AAAA
      HostedZoneId: !Ref HostedZoneId
      AliasTarget:
        DNSName: !GetAtt CloudFrontDistribution.DomainName
        EvaluateTargetHealth: false
        HostedZoneId: Z2FDTNDATAQYW2

Outputs:
  DistributionDomainName:
    Description: CloudFront distribution domain name
    Value: !GetAtt CloudFrontDistribution.DomainName
    Export:
      Name: !Sub "${AWS::StackName}-DistributionDomainName"

  DistributionId:
    Description: CloudFront distribution ID
    Value: !Ref CloudFrontDistribution
    Export:
      Name: !Sub "${AWS::StackName}-DistributionId"

  StaticAssetsBucketName:
    Description: S3 bucket name
    Value: !Ref StaticAssetsBucket
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketName"

Esempio 2: Multi-Origin con API, S3 e Lambda@Edge

Configurazione avanzata con origini multiple per contenuti statici, API e funzioni Lambda@Edge.

AWSTemplateFormatVersion: 2010-09-09
Description: Multi-origin CloudFront distribution with S3, ALB and Lambda@Edge

Parameters:
  Environment:
    Type: String
    Default: production
    AllowedValues:
      - dev
      - staging
      - production

  DomainName:
    Type: String
    Default: example.com
    Description: Custom domain name

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn
    Description: ACM certificate ARN

  StaticBucketName:
    Type: String
    Description: S3 bucket for static assets

  StaticBucketRegionalDomainName:
    Type: AWS::S3::Bucket::RegionalDomainName
    Description: Regional domain name of S3 bucket

  CloudFrontOAIId:
    Type: String
    Description: CloudFront OAI ID

  LoadBalancerDnsName:
    Type: String
    Description: DNS name of the Application Load Balancer

  LambdaEdgeFunctionArn:
    Type: AWS::Lambda::Function::Arn
    Description: ARN of Lambda@Edge function

  LambdaEdgeFunctionVersion:
    Type: String
    Description: Version of Lambda@Edge function

Mappings:
  EnvironmentConfig:
    dev:
      PriceClass: PriceClass_100
      ApiCacheTTL: 0
      StaticCacheTTL: 3600
    staging:
      PriceClass: PriceClass_100
      ApiCacheTTL: 300
      StaticCacheTTL: 86400
    production:
      PriceClass: PriceClass_All
      ApiCacheTTL: 300
      StaticCacheTTL: 31536000

Resources:
  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "Multi-origin CDN for ${DomainName}"
        Enabled: true
        IPV6Enabled: true
        PriceClass: !FindInMap [EnvironmentConfig, !Ref Environment, PriceClass]
        DefaultRootObject: index.html
        Origins:
          # Static assets origin (S3)
          - Id: StaticAssetsOrigin
            DomainName: !Ref StaticBucketRegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAIId}"

          # API origin (ALB)
          - Id: ApiOrigin
            DomainName: !Ref LoadBalancerDnsName
            CustomOriginConfig:
              HTTPPort: 80
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
            ConnectionAttempts: 3
            ConnectionTimeout: 10
            OriginReadTimeout: 30
            OriginKeepaliveTimeout: 5

          # Lambda@Edge origin
          - Id: LambdaOrigin
            DomainName: !Sub "${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com"
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only

        # Default cache behavior - Static assets
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: !FindInMap [EnvironmentConfig, !Ref Environment, StaticCacheTTL]
          MaxTTL: 31536000
          LambdaFunctionAssociations:
            - FunctionARN: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${LambdaEdgeFunctionArn}:${LambdaEdgeFunctionVersion}"
              EventType: viewer-request

        # API cache behavior
        CacheBehaviors:
          - PathPattern: "/api/*"
            TargetOriginId: ApiOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
              - PUT
              - POST
              - PATCH
              - DELETE
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: true
              Headers:
                - Accept
                - Accept-Language
                - Authorization
                - Content-Type
              Cookies:
                Forward: all
              QueryStringCacheKeys:
                - version
                - lang
            MinTTL: 0
            DefaultTTL: !FindInMap [EnvironmentConfig, !Ref Environment, ApiCacheTTL]
            MaxTTL: 600
            LambdaFunctionAssociations:
              - FunctionARN: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${LambdaEdgeFunctionArn}:${LambdaEdgeFunctionVersion}"
                EventType: origin-request

          # Static assets with longer cache
          - PathPattern: "/static/*"
            TargetOriginId: StaticAssetsOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: false
              Cookies:
                Forward: none
            MinTTL: 0
            DefaultTTL: 31536000
            MaxTTL: 31536000

          # Lambda function path
          - PathPattern: "/lambda/*"
            TargetOriginId: LambdaOrigin
            ViewerProtocolPolicy: redirect-to-https
            AllowedMethods:
              - GET
              - HEAD
              - OPTIONS
            CachedMethods:
              - GET
              - HEAD
            Compress: true
            ForwardedValues:
              QueryString: true
              Cookies:
                Forward: none
            MinTTL: 0
            DefaultTTL: 0
            MaxTTL: 0

        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

Outputs:
  DistributionDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName

  DistributionId:
    Value: !Ref CloudFrontDistribution

Esempio 3: CloudFront con WAF e Security Headers

Configurazione completa con WAF, security headers e monitoring.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with WAF, security headers and monitoring

Parameters:
  Environment:
    Type: String
    Default: production
    AllowedValues:
      - dev
      - staging
      - production

  DomainName:
    Type: String
    Default: secure.example.com

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn

  AlertEmail:
    Type: String
    Description: Email per alert SNS

Mappings:
  EnvironmentConfig:
    dev:
      EnableWAF: false
    staging:
      EnableWAF: true
    production:
      EnableWAF: true

Resources:
  # WAF Web ACL
  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf-acl"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        # AWS Managed - Common Rule Set
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 1
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
              ExcludedRules:
                - Name: SizeRestrictions_BODY
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSManagedRulesCommonRuleSet

        # AWS Managed - Known Bad Inputs
        - Name: AWSManagedRulesKnownBadInputsRuleSet
          Priority: 2
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesKnownBadInputsRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSKnownBadInputs

        # AWS Managed - SQL Database
        - Name: AWSManagedRulesSQLiRuleSet
          Priority: 3
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesSQLiRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSSQLi

        # Rate-based rule per protezione DDoS
        - Name: RateLimitRule
          Priority: 4
          Statement:
            RateBasedStatementKey:
              SingleHeader:
                Name: ip
            AggregateKeyType: IP
            Limit: 1000
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitRule

        # Geographic restriction
        - Name: GeoBlockRule
          Priority: 5
          Statement:
            NotStatement:
              Statement:
                GeoMatchStatement:
                  CountryCodes:
                    - US
                    - CA
                    - GB
                    - DE
                    - FR
          Action:
            Block: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: GeoBlockRule

      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAFACL

  # Security Headers Policy
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Override: true
            Preload: true
          XSSProtection:
            ModeBlock: true
            Override: true
            Protection: true
        CorsConfig:
          AccessControlAllowCredentials: false
          AccessControlAllowHeaders:
            Items:
              - "*"
          AccessControlAllowMethods:
            Items:
              - GET
              - HEAD
              - OPTIONS
          AccessControlAllowOrigins:
            Items:
              - https://example.com
              - https://www.example.com
          AccessControlMaxAgeSec: 600
          OriginOverride: true

  # Origin Domain
  OriginDomainName:
    Type: String
    Default: origin.example.com

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "Secure CDN with WAF for ${Environment}"
        Enabled: true
        IPV6Enabled: true
        PriceClass: PriceClass_All
        WebACLId: !GetAtt CloudFrontWebACL.Arn
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
          ResponseHeadersPolicyId: !GetAtt SecurityHeadersPolicy.Id
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

  # CloudWatch Alarms
  WAFBlockedRequestsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub "${AWS::StackName}-waf-blocked-requests"
      AlarmDescription: Alert when WAF blocks requests
      MetricName: BlockedRequests
      Namespace: AWS/WAFV2
      Dimensions:
        - Name: WebACL
          Value: !Sub "${AWS::StackName}-waf-acl"
        - Name: Region
          Value: Global
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 2
      Threshold: 100
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref AlertTopic
      OKActions:
        - !Ref AlertTopic

  High5XXErrorRateAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub "${AWS::StackName}-high-5xx-errors"
      AlarmDescription: Alert when 5XX error rate exceeds threshold
      MetricName: 5xxErrorRate
      Namespace: AWS/CloudFront
      Dimensions:
        - Name: DistributionId
          Value: !Ref CloudFrontDistribution
        - Name: Region
          Value: Global
      Statistic: Average
      Period: 60
      EvaluationPeriods: 5
      Threshold: 1
      ComparisonOperator: GreaterThanThreshold

  HighCacheMissRateAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub "${AWS::StackName}-high-cache-miss"
      AlarmDescription: Alert when cache miss rate is high
      MetricName: CacheMissRate
      Namespace: AWS/CloudFront
      Dimensions:
        - Name: DistributionId
          Value: !Ref CloudFrontDistribution
        - Name: Region
          Value: Global
      Statistic: Average
      Period: 300
      EvaluationPeriods: 3
      Threshold: 0.1
      ComparisonOperator: GreaterThanThreshold

  # SNS Topic per Alert
  AlertTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "${AWS::StackName}-alerts-${Environment}"
      Subscription:
        - Endpoint: !Ref AlertEmail
          Protocol: email

Outputs:
  DistributionDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName

  WebACLArn:
    Value: !GetAtt CloudFrontWebACL.Arn

Esempio 4: CloudFront Functions per URL Rewrite

CloudFront Functions per operazioni edge leggere come URL rewrite e header management.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront distribution with CloudFront Functions

Parameters:
  Environment:
    Type: String
    Default: production
    AllowedValues:
      - dev
      - staging
      - production

  OriginDomainName:
    Type: String
    Description: Origin domain name

Resources:
  # CloudFront Function - URL Rewrite
  UrlRewriteFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-url-rewrite"
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;

          // Remove trailing slash
          if (uri.endsWith('/') && uri.length > 1) {
            request.uri = uri.substring(0, uri.length - 1);
          }

          // Add .html extension for HTML pages
          if (!uri.includes('.') && !uri !== '/') {
            request.uri = uri + '.html';
          }

          // Rewrite /home to /index.html
          if (uri === '/home' || uri === '/home/') {
            request.uri = '/index.html';
          }

          // Rewrite /about to /about.html
          if (uri === '/about' || uri === '/about/') {
            request.uri = '/about.html';
          }

          return request;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  # CloudFront Function - Add Security Headers
  SecurityHeadersFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-security-headers"
      FunctionCode: |
        function handler(event) {
          var response = event.response;

          // Add security headers
          response.headers['x-content-type-options'] = { value: 'nosniff' };
          response.headers['x-frame-options'] = { value: 'DENY' };
          response.headers['x-xss-protection'] = { value: '1; mode=block' };
          response.headers['referrer-policy'] = { value: 'strict-origin-when-cross-origin' };

          return response;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  # CloudFront Function - A/B Testing
  ABTestingFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-ab-testing"
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var response = event.response;

          // Check for existing cookie
          var cookieName = 'ab-test-variant';
          var cookieValue = request.cookies[cookieName];

          if (!cookieValue) {
            // Randomly assign variant (50/50 split)
            var variants = ['A', 'B'];
            var variant = variants[Math.floor(Math.random() * variants.length)];

            // Set cookie
            response.headers['set-cookie'] = {
              value: cookieName + '=' + variant + '; Path=/; Max-Age=2592000'
            };
          } else {
            // Preserve existing variant
            response.headers['set-cookie'] = {
              value: cookieName + '=' + cookieValue + '; Path=/; Max-Age=2592000'
            };
          }

          return response;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with Functions for ${Environment}"
        Enabled: true
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
          FunctionAssociations:
            - FunctionARN: !GetAtt UrlRewriteFunction.FunctionARN
              EventType: viewer-request
            - FunctionARN: !GetAtt SecurityHeadersFunction.FunctionARN
              EventType: viewer-response

Esempio 5: Real-Time Logs con Kinesis

Configurazione CloudFront con real-time logs verso Kinesis Data Stream.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with real-time logs to Kinesis

Parameters:
  Environment:
    Type: String
    Default: production

  OriginDomainName:
    Type: String
    Description: Origin domain name

Resources:
  # Kinesis Data Stream
  CloudFrontLogsStream:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: !Sub "${AWS::StackName}-cloudfront-logs"
      ShardCount: 2
      RetentionPeriodHours: 24
      Tags:
        - Key: Environment
          Value: !Ref Environment

  # Kinesis Data Stream - Enhanced Monitoring (optional)
  CloudFrontLogsStreamConsumer:
    Type: AWS::Kinesis::StreamConsumer
    Properties:
      ConsumerName: !Sub "${AWS::StackName}-logs-consumer"
      StreamARN: !GetAtt CloudFrontLogsStream.Arn

  # IAM Role for CloudFront
  CloudFrontLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-cloudfront-logging"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudfront.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: KinesisPutRecord
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - kinesis:PutRecord
                  - kinesis:PutRecords
                Resource: !GetAtt CloudFrontLogsStream.Arn

  # CloudFront Distribution
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with real-time logs"
        Enabled: true
        IPV6Enabled: true
        RealTimeConfig:
          Endpoint: !GetAtt CloudFrontLogsStream.Arn
          RoleArn: !GetAtt CloudFrontLoggingRole.Arn
          Fields:
            - timestamp
            - c-ip
            - cs-method
            - cs-uri
            - sc-status
            - time-taken
            - cs(Referer)
            - cs(User-Agent)
            - cs(Cookie)
            - cs(Host)
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Outputs:
  StreamArn:
    Description: Kinesis stream ARN
    Value: !GetAtt CloudFrontLogsStream.Arn

  StreamName:
    Description: Kinesis stream name
    Value: !Ref CloudFrontLogsStream

Esempio 6: Cross-Stack References

Pattern per organizzare CloudFront in stack separati con cross-stack references.

# Stack A - Network/Infrastructure
AWSTemplateFormatVersion: 2010-09-09
Description: Infrastructure stack - exports for CloudFront

Resources:
  # S3 Bucket
  StaticAssetsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  # OAI
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticAssetsBucket}"

  # Bucket Policy
  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticAssetsBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${StaticAssetsBucket.Arn}/*"

Outputs:
  StaticAssetsBucketName:
    Description: S3 bucket name
    Value: !Ref StaticAssetsBucket
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketName"

  StaticAssetsBucketArn:
    Description: S3 bucket ARN
    Value: !GetAtt StaticAssetsBucket.Arn
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketArn"

  StaticAssetsBucketRegionalDomainName:
    Description: Regional domain name
    Value: !GetAtt StaticAssetsBucket.RegionalDomainName
    Export:
      Name: !Sub "${AWS::StackName}-StaticAssetsBucketRegionalDomainName"

  CloudFrontOAIId:
    Description: CloudFront OAI ID
    Value: !Ref CloudFrontOAI
    Export:
      Name: !Sub "${AWS::StackName}-CloudFrontOAIId"

  CloudFrontOAIArn:
    Description: CloudFront OAI ARN
    Value: !GetAtt CloudFrontOAI.Arn
    Export:
      Name: !Sub "${AWS::StackName}-CloudFrontOAIArn"

# Stack B - Application
AWSTemplateFormatVersion: 2010-09-09
Description: Application stack - imports from infrastructure stack

Parameters:
  InfrastructureStackName:
    Type: String
    Default: infrastructure-stack
    Description: Name of infrastructure stack

  DomainName:
    Type: String
    Default: cdn.example.com

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront distribution"
        Enabled: true
        Origins:
          - Id: StaticAssetsOrigin
            DomainName: !ImportValue
              !Sub "${InfrastructureStackName}-StaticAssetsBucketRegionalDomainName"
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${InfrastructureStackName}-CloudFrontOAIId"
        DefaultCacheBehavior:
          TargetOriginId: StaticAssetsOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

Outputs:
  DistributionDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName
    Export:
      Name: !Sub "${AWS::StackName}-DistributionDomainName"

  DistributionId:
    Value: !Ref CloudFrontDistribution
    Export:
      Name: !Sub "${AWS::StackName}-DistributionId"

Esempio 7: CloudFront per API Gateway

Configurazione CloudFront davanti a API Gateway con caching e throttling.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront distribution for API Gateway

Parameters:
  Environment:
    Type: String
    Default: production

  ApiGatewayDomainName:
    Type: String
    Description: API Gateway domain name

  CertificateArn:
    Type: AWS::ACM::Certificate::Arn

  CustomDomainName:
    Type: String
    Default: api.example.com

Resources:
  # Origin Request Policy per API
  ApiOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: !Sub "${AWS::StackName}-api-origin-request"
        CookiesConfig:
          CookieBehavior: all
        HeadersConfig:
          HeaderBehavior: whitelist
          Headers:
            - Authorization
            - Content-Type
            - Accept
            - Accept-Language
            - X-Request-ID
        QueryStringsConfig:
          QueryStringBehavior: all

  # Cache Policy per API
  ApiCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-api-cache"
        DefaultTTL: 300
        MaxTTL: 600
        MinTTL: 60
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Authorization
              - Content-Type
          QueryStringsConfig:
            QueryStringBehavior: all

  # CloudFront Distribution
  ApiCloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront for API Gateway - ${Environment}"
        Enabled: true
        IPV6Enabled: true
        PriceClass: PriceClass_All
        DomainNames:
          - !Ref CustomDomainName
        Origins:
          - Id: ApiGatewayOrigin
            DomainName: !Ref ApiGatewayDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginReadTimeout: 30
        DefaultCacheBehavior:
          TargetOriginId: ApiGatewayOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT
            - POST
            - PATCH
            - DELETE
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          CachePolicyId: !GetAtt ApiCachePolicy.Id
          OriginRequestPolicyId: !GetAtt ApiOriginRequestPolicy.Id
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only

Outputs:
  ApiDistributionDomainName:
    Value: !GetAtt ApiCloudFrontDistribution.DomainName

  ApiDistributionId:
    Value: !Ref ApiCloudFrontDistribution

Esempio 8: CloudFront con Custom Error Responses

Configurazione per pagine di errore personalizzate e redirect.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with custom error responses

Resources:
  # S3 Bucket per error pages
  ErrorPagesBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "error-pages-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${ErrorPagesBucket}"

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ErrorPagesBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${ErrorPagesBucket.Arn}/*"

  # Origin per error pages
  ErrorPagesOrigin:
    Type: String
    Description: Origin domain name

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Enabled: true
        CustomErrorResponses:
          # Custom 404 page
          - ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: /404.html
            ErrorCachingMinTTL: 300

          # Custom 403 page
          - ErrorCode: 403
            ResponseCode: 403
            ResponsePagePath: /403.html
            ErrorCachingMinTTL: 300

          # Custom 500 page
          - ErrorCode: 500
            ResponseCode: 500
            ResponsePagePath: /500.html
            ErrorCachingMinTTL: 60

          # Custom 502 page
          - ErrorCode: 502
            ResponseCode: 502
            ResponsePagePath: /502.html
            ErrorCachingMinTTL: 60

          # Redirect 404 to /not-found
          - ErrorCode: 404
            ResponseCode: 404
            ResponsePagePath: /not-found/
            ErrorCachingMinTTL: 0

        Origins:
          - Id: MainOrigin
            DomainName: !Ref ErrorPagesOrigin
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: MainOrigin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Esempio 9: CloudFront con Lambda@Edge per A/B Testing

Configurazione completa per A/B testing con Lambda@Edge.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with Lambda@Edge for A/B testing

Parameters:
  Environment:
    Type: String
    Default: production

Resources:
  # Lambda@Edge Function per A/B Testing
  ABTestingLambdaEdge:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-ab-testing"
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambda/ab-testing.zip
      Handler: index.handler
      Runtime: nodejs20.x
      Role: !GetAtt LambdaEdgeRole.Arn
      MemorySize: 128
      Timeout: 5

  # Lambda Version
  ABTestingLambdaVersion:
    Type: AWS::Lambda::Version
    Properties:
      FunctionName: !Ref ABTestingLambdaEdge
      Description: Lambda@Edge version for A/B testing

  # Lambda@Edge Role
  LambdaEdgeRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-lambda-edge-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
                - edgelambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  # Origin
  OriginDomainName:
    Type: String
    Description: Origin domain name

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with A/B testing - ${Environment}"
        Enabled: true
        Origins:
          - Id: OriginA
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: OriginA
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: true
            Cookies:
              Forward: all
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
          LambdaFunctionAssociations:
            # Viewer request - A/B testing logic
            - FunctionARN: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ABTestingLambdaEdge}:${ABTestingLambdaVersion}"
              EventType: viewer-request
            # Origin response - Set variant cookie
            - FunctionARN: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ABTestingLambdaEdge}:${ABTestingLambdaVersion}"
              EventType: origin-response

Esempio 10: CloudFront Distribution con Geo-Restrictions

Configurazione per limitare l'accesso geograficamente.

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront with geo restrictions

Parameters:
  Environment:
    Type: String
    Default: production

  AllowedCountries:
    Type: CommaDelimitedList
    Default: US,CA,GB,DE,FR,IT,JP,AU
    Description: List of allowed country codes

Resources:
  OriginDomainName:
    Type: String
    Description: Origin domain name

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront with geo restrictions - ${Environment}"
        Enabled: true
        IPV6Enabled: true

        # Geo restrictions
        GeoRestriction:
          RestrictionType: whitelist
          !If
            - HasAllowedCountries
            - Locations: !Ref AllowedCountries
            - !Ref AWS::NoValue

        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only

        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000

Conditions:
  HasAllowedCountries: !Not [!Equals [!Join ["", !Ref AllowedCountries], ""]]

Outputs:
  DistributionDomainName:
    Value: !GetAtt CloudFrontDistribution.DomainName

AWS CloudFormation CloudFront - Reference

Questa guida di riferimento contiene informazioni dettagliate sulle risorse AWS CloudFormation, le funzioni intrinseche e le configurazioni per l'infrastruttura CloudFront CDN.

AWS::CloudFront::Distribution

Crea una distribuzione CloudFront per servire contenuti da origini multiple.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
DistributionConfig	DistributionConfig	Si	Configurazione della distribuzione
Tags	List di Tag	No	Tag per la distribuzione

DistributionConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
CallerReference	String	Si	Identificatore univoco per la distribuzione
Comment	String	No	Commento per la distribuzione
CustomErrorResponses	List	No	Risposte di errore personalizzate
DefaultRootObject	String	No	Oggetto predefinito per richieste root
Enabled	Boolean	Si	Se la distribuzione e abilitata
HttpVersion	String	No	Versione HTTP supportata
IPV6Enabled	Boolean	No	Se IPv6 e abilitato
Logging	LoggingConfig	No	Configurazione logging
OriginGroups	List	No	Gruppi di origini per failover
Origins	List	Si	Lista delle origini
PriceClass	String	No	Classe di prezzo (PriceClass_All, PriceClass_100, PriceClass_200)
Restrictions	GeoRestriction	No	Restrizioni geografiche
ViewerCertificate	ViewerCertificate	No	Certificato per HTTPS
WebACLId	String	No	ID del Web ACL WAF
DefaultCacheBehavior	CacheBehavior	Si	Comportamento cache predefinito
CacheBehaviors	List	No	Comportamenti cache aggiuntivi
RealTimeConfig	RealTimeConfig	No	Configurazione log real-time

Origins Structure

Proprieta	Tipo	Richiesta	Descrizione
Id	String	Si	Identificatore univoco per l'origine
DomainName	String	Si	Nome di dominio dell'origine
OriginPath	String	No	Percorso opzionale nell'origine
CustomOriginConfig	CustomOrigin	No	Configurazione per origini personalizzate
S3OriginConfig	S3Origin	No	Configurazione per origini S3
ConnectionAttempts	Integer	No	Numero di tentativi di connessione
ConnectionTimeout	Integer	No	Timeout connessione in secondi
OriginShield	OriginShield	No	Configurazione Origin Shield
OriginKeepaliveTimeout	Integer	No	Timeout keepalive in secondi
OriginReadTimeout	Integer	No	Timeout lettura in secondi

CustomOrigin Structure

Proprieta	Tipo	Richiesta	Descrizione
HTTPPort	Integer	No	Porta HTTP (default: 80)
HTTPSPort	Integer	No	Porta HTTPS (default: 443)
OriginProtocolPolicy	String	Si	Politica protocollo (http-only, https-only, match-viewer)
OriginSSLProtocols	List	No	Protocolli SSL supportati
OriginReadTimeout	Integer	No	Timeout lettura (4-60 secondi)
OriginKeepaliveTimeout	Integer	No	Timeout keepalive (1-60 secondi)

S3Origin Structure

Proprieta	Tipo	Richiesta	Descrizione
OriginAccessIdentity	String	No	ID dell'OAI per accesso al bucket

CacheBehavior Structure

Proprieta	Tipo	Richiesta	Descrizione
AllowedMethods	List	Si	Metodi HTTP permessi
CachePolicyId	String	No	ID della cache policy
Compress	Boolean	No	Se abilitare compressione
DefaultTTL	Integer	No	TTL default in secondi
FieldLevelEncryptionId	String	No	ID crittografia campo
ForwardedValues	ForwardedValues	Si	Valori inoltrati all'origine
FunctionAssociations	List	No	Associazioni CloudFront Functions
LambdaFunctionAssociations	List	No	Associazioni Lambda@Edge
MaxTTL	Integer	No	TTL massimo in secondi
MinTTL	Integer	No	TTL minimo in secondi
OriginRequestPolicyId	String	No	ID della origin request policy
PathPattern	String	Si	Pattern percorso
ResponseHeadersPolicyId	String	No	ID della response headers policy
TargetOriginId	String	Si	ID dell'origine target
TrustedSigners	List	No	Account AWS autorizzati
ViewerProtocolPolicy	String	Si	Politica protocollo viewer

ForwardedValues Structure

Proprieta	Tipo	Richiesta	Descrizione
Cookies	Cookies	Si	Configurazione cookie
Headers	List	No	Lista header da inoltrare
QueryString	Boolean	No	Se inoltrare query string
QueryStringCacheKeys	List	No	Chiavi query string da cachare

Cookies Structure

Proprieta	Tipo	Richiesta	Descrizione
Forward	String	Si	none, whitelist, all

ViewerCertificate Structure

Proprieta	Tipo	Richiesta	Descrizione
AcmCertificateArn	String	No	ARN certificato ACM
CloudFrontDefaultCertificate	Boolean	No	Usa certificato default
IamCertificateId	String	No	ID certificato IAM
MinimumProtocolVersion	String	No	Versione minima TLS
SslSupportMethod	String	No	sni-only, vip

Esempio

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"
        Comment: !Sub "CloudFront distribution"
        Enabled: true
        IPV6Enabled: true
        PriceClass: PriceClass_All
        Origins:
          - Id: S3Origin
            DomainName: !GetAtt StaticBucket.RegionalDomainName
            S3OriginConfig:
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"
        DefaultCacheBehavior:
          TargetOriginId: S3Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          Compress: true
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
        ViewerCertificate:
          AcmCertificateArn: !Ref CertificateArn
          MinimumProtocolVersion: TLSv1.2_2021
          SslSupportMethod: sni-only
      Tags:
        - Key: Environment
          Value: !Ref Environment

Attributi

Attributo	Descrizione
DomainName	Nome dominio della distribuzione
Id	ID della distribuzione
ARN	ARN della distribuzione

AWS::CloudFront::CloudFrontOriginAccessIdentity

Crea un Origin Access Identity per permettere a CloudFront di accedere a bucket S3 privati.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
CloudFrontOriginAccessIdentityConfig	OriginAccessIdentityConfig	Si	Configurazione OAI

OriginAccessIdentityConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Comment	String	No	Commento per l'OAI

Esempio

Resources:
  CloudFrontOAI:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Sub "OAI for ${StaticBucket}"

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref StaticBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              CanonicalUser: !GetAtt CloudFrontOAI.S3CanonicalUserId
            Action: s3:GetObject
            Resource: !Sub "${StaticBucket.Arn}/*"

Attributi

Attributo	Descrizione
S3CanonicalUserId	ID canonico utente S3
Arn	ARN dell'OAI

AWS::CloudFront::CachePolicy

Crea una policy di cache per configurare come CloudFront gestisce la cache.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
CachePolicyConfig	CachePolicyConfig	Si	Configurazione della policy

CachePolicyConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Name	String	Si	Nome della policy
DefaultTTL	Integer	Si	TTL default in secondi
MaxTTL	Integer	Si	TTL massimo in secondi
MinTTL	Integer	Si	TTL minimo in secondi
ParametersInCacheKeyAndForwardedToOrigin	ParametersInCacheKeyAndForwardedToOrigin	Si	Parametri inclusi nella chiave di cache

ParametersInCacheKeyAndForwardedToOrigin Structure

Proprieta	Tipo	Richiesta	Descrizione
CookiesConfig	CookiesConfig	Si	Configurazione cookie
EnableAcceptEncodingBrotli	Boolean	No	Se abilitare compressione Brotli
EnableAcceptEncodingGzip	Boolean	No	Se abilitare compressione Gzip
HeadersConfig	HeadersConfig	Si	Configurazione header
QueryStringsConfig	QueryStringsConfig	Si	Configurazione query string

CookiesConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
CookieBehavior	String	Si	none, whitelist, all

HeadersConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
HeaderBehavior	String	Si	none, whitelist, all
Headers	List	Cond	Lista header (richiesto se whitelist)

QueryStringsConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
QueryStringBehavior	String	Si	none, whitelist, all, allExcept
QueryStrings	List	Cond	Lista query string (richiesto se whitelist/allExcept)

Esempio

Resources:
  StaticAssetsCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-static-assets-policy"
        DefaultTTL: 86400
        MaxTTL: 31536000
        MinTTL: 0
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: none
          HeadersConfig:
            HeaderBehavior: none
          QueryStringsConfig:
            QueryStringBehavior: none
          EnableAcceptEncodingBrotli: true
          EnableAcceptEncodingGzip: true

  ApiCachePolicy:
    Type: AWS::CloudFront::CachePolicy
    Properties:
      CachePolicyConfig:
        Name: !Sub "${AWS::StackName}-api-cache-policy"
        DefaultTTL: 300
        MaxTTL: 600
        MinTTL: 60
        ParametersInCacheKeyAndForwardedToOrigin:
          CookiesConfig:
            CookieBehavior: all
          HeadersConfig:
            HeaderBehavior: whitelist
            Headers:
              - Authorization
              - Content-Type
          QueryStringsConfig:
            QueryStringBehavior: all

Attributi

Attributo	Descrizione
Id	ID della policy

AWS::CloudFront::OriginRequestPolicy

Crea una policy per le richieste all'origine.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
OriginRequestPolicyConfig	OriginRequestPolicyConfig	Si	Configurazione della policy

OriginRequestPolicyConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Name	String	Si	Nome della policy
CookiesConfig	CookiesConfig	Si	Configurazione cookie
HeadersConfig	HeadersConfig	Si	Configurazione header
QueryStringsConfig	QueryStringsConfig	Si	Configurazione query string

Esempio

Resources:
  ApiOriginRequestPolicy:
    Type: AWS::CloudFront::OriginRequestPolicy
    Properties:
      OriginRequestPolicyConfig:
        Name: !Sub "${AWS::StackName}-api-origin-request"
        CookiesConfig:
          CookieBehavior: all
        HeadersConfig:
          HeaderBehavior: whitelist
          Headers:
            - Authorization
            - Content-Type
            - X-Request-ID
        QueryStringsConfig:
          QueryStringBehavior: all

Attributi

Attributo	Descrizione
Id	ID della policy

AWS::CloudFront::ResponseHeadersPolicy

Crea una policy per gli header di risposta, utile per implementare security headers.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
ResponseHeadersPolicyConfig	ResponseHeadersPolicyConfig	Si	Configurazione della policy

ResponseHeadersPolicyConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Name	String	Si	Nome della policy
SecurityHeadersConfig	SecurityHeadersConfig	No	Configurazione security headers
CorsConfig	CorsConfig	No	Configurazione CORS
CustomHeadersConfig	CustomHeadersConfig	No	Header personalizzati
ServerTimingHeadersConfig	ServerTimingHeadersConfig	No	Configurazione header Server-Timing

SecurityHeadersConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
ContentTypeOptions	ContentTypeOptions	No	Header X-Content-Type-Options
FrameOptions	FrameOptions	No	Header X-Frame-Options
ReferrerPolicy	ReferrerPolicy	No	Header Referrer-Policy
StrictTransportSecurity	StrictTransportSecurity	No	Header Strict-Transport-Security
XSSProtection	XSSProtection	No	Header X-XSS-Protection

ContentTypeOptions Structure

Proprieta	Tipo	Richiesta	Descrizione
Override	Boolean	Si	Se sovrascrivere header esistenti

FrameOptions Structure

Proprieta	Tipo	Richiesta	Descrizione
FrameOption	String	Si	DENY, SAMEORIGIN
Override	Boolean	Si	Se sovrascrivere

ReferrerPolicy Structure

Proprieta	Tipo	Richiesta	Descrizione
ReferrerPolicy	String	Si	Valore del referrer policy
Override	Boolean	Si	Se sovrascrivere

StrictTransportSecurity Structure

Proprieta	Tipo	Richiesta	Descrizione
AccessControlMaxAgeSec	Integer	Si	Max age in secondi
IncludeSubdomains	Boolean	No	Se includere subdomain
Override	Boolean	Si	Se sovrascrivere
Preload	Boolean	No	Se abilitare preload

XSSProtection Structure

Proprieta	Tipo	Richiesta	Descrizione
ModeBlock	Boolean	No	Se bloccare in modalita block
Override	Boolean	Si	Se sovrascrivere
Protection	Boolean	Si	Se abilitare protezione

CorsConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
AccessControlAllowCredentials	Boolean	No	Se允许 credenziali
AccessControlAllowHeaders	AccessControlAllowHeaders	No	Header permessi
AccessControlAllowMethods	AccessControlAllowMethods	No	Metodi permessi
AccessControlAllowOrigins	AccessControlAllowOrigins	No	Origini permesse
AccessControlMaxAgeSec	Integer	No	Max age per preflight
AccessControlExposeHeaders	AccessControlExposeHeaders	No	Header esposti
OriginOverride	Boolean	Si	Se sovrascrivere header origin

Esempio

Resources:
  SecurityHeadersPolicy:
    Type: AWS::CloudFront::ResponseHeadersPolicy
    Properties:
      ResponseHeadersPolicyConfig:
        Name: !Sub "${AWS::StackName}-security-headers"
        SecurityHeadersConfig:
          ContentTypeOptions:
            Override: true
          FrameOptions:
            FrameOption: DENY
            Override: true
          ReferrerPolicy:
            ReferrerPolicy: strict-origin-when-cross-origin
            Override: true
          StrictTransportSecurity:
            AccessControlMaxAgeSec: 31536000
            IncludeSubdomains: true
            Override: true
            Preload: true
          XSSProtection:
            ModeBlock: true
            Override: true
            Protection: true
        CorsConfig:
          AccessControlAllowCredentials: false
          AccessControlAllowHeaders:
            Items:
              - "*"
          AccessControlAllowMethods:
            Items:
              - GET
              - HEAD
              - OPTIONS
          AccessControlAllowOrigins:
            Items:
              - https://example.com
          AccessControlMaxAgeSec: 600
          OriginOverride: true

Attributi

Attributo	Descrizione
Id	ID della policy

AWS::CloudFront::Function

Crea una funzione CloudFront per operazioni leggere sul edge.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
AutoPublish	Boolean	No	Se pubblicare automaticamente
FunctionCode	String	Si	Codice della funzione
FunctionRuntime	String	Si	Runtime della funzione
Name	String	Si	Nome della funzione
Comment	String	No	Commento

Runtime Supportati

Runtime	Descrizione
cloudfront-js-1.0	CloudFront Functions JavaScript

Esempio

Resources:
  RewritePathFunction:
    Type: AWS::CloudFront::Function
    Properties:
      Name: !Sub "${AWS::StackName}-rewrite-path"
      FunctionCode: |
        function handler(event) {
          var request = event.request;
          var uri = request.uri;

          if (uri.endsWith('/')) {
            request.uri = uri.substring(0, uri.length - 1);
          }

          if (!uri.includes('.') && !uri.endsWith('/')) {
            request.uri = uri + '.html';
          }

          return request;
        }
      Runtime: cloudfront-js-1.0
      AutoPublish: true

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - Id: Origin
            DomainName: !Ref OriginDomainName
            CustomOriginConfig:
              HTTPPort: 443
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
        DefaultCacheBehavior:
          TargetOriginId: Origin
          FunctionAssociations:
            - FunctionARN: !GetAtt RewritePathFunction.FunctionARN
              EventType: viewer-request

Eventi Function Association

Evento	Descrizione
viewer-request	Prima della richiesta del viewer
viewer-response	Dopo la risposta al viewer
origin-request	Prima della richiesta all'origine
origin-response	Dopo la risposta dall'origine

Attributi

Attributo	Descrizione
FunctionARN	ARN della funzione

AWS::WAFv2::WebACL

Crea un Web ACL WAF per proteggere CloudFront.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
DefaultAction	DefaultAction	Si	Azione default
Name	String	Si	Nome del Web ACL
Rules	List	No	Lista delle regole
Scope	String	Si	CLOUDFRONT o REGIONAL
VisibilityConfig	VisibilityConfig	Si	Configurazione visibilita

DefaultAction Structure

Proprieta	Tipo	Richiesta	Descrizione
Allow	AllowAction	No	Azione allow
Block	BlockAction	No	Azione block

VisibilityConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
CloudWatchMetricsEnabled	Boolean	Si	Se abilitare metriche CloudWatch
MetricName	String	Si	Nome metrica
SampledRequestsEnabled	Boolean	Si	Se abilitare sampling

Esempio

Resources:
  CloudFrontWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf-acl"
      Scope: CLOUDFRONT
      DefaultAction:
        Allow: {}
      Rules:
        - Name: AWSCommonRule
          Priority: 1
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: AWSCommonRule
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: CloudFrontWAFACL

AWS::GlobalAccelerator::EndpointGroup

Crea un endpoint group per VPC Origins.

Proprieta

Proprieta	Tipo	Richiesta	Descrizione
EndpointGroupRegion	String	Si	Regione del endpoint group
EndpointConfigurations	List	No	Configurazioni endpoint
ListenerArn	String	Si	ARN del listener
TrafficDialPercentage	Integer	No	Percentuale traffico

EndpointConfiguration Structure

Proprieta	Tipo	Richiesta	Descrizione
EndpointId	String	Si	ID dell'endpoint
Weight	Integer	No	Peso per traffic routing

Esempio

Resources:
  VPCOriginEndpoint:
    Type: AWS::GlobalAccelerator::EndpointGroup
    Properties:
      EndpointGroupRegion: !Ref VPCOriginRegion
      ListenerArn: !Ref AcceleratorListener
      EndpointConfigurations:
        - EndpointId: !Ref VPCEndpointService
          Weight: 128

GeoRestriction Structure

Proprieta	Tipo	Richiesta	Descrizione
Locations	List	Cond	Lista codici paese (whitelist/blacklist)
RestrictionType	String	Si	none, blacklist, whitelist

LoggingConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Bucket	String	Si	S3 bucket per log
IncludeCookies	Boolean	No	Se includere cookie
Prefix	String	No	Prefisso per log

RealTimeConfig Structure

Proprieta	Tipo	Richiesta	Descrizione
Endpoint	String	Si	ARN del Kinesis stream
Fields	List	Si	Campi da includere
RoleArn	String	Si	ARN del ruolo IAM

Funzioni Intrinseche di Riferimento

!GetAtt

Restituisce il valore di un attributo da una risorsa CloudFront.

# Get distribution domain name
DistributionDomainName: !GetAtt CloudFrontDistribution.DomainName

# Get distribution ID
DistributionId: !Ref CloudFrontDistribution

# Get OAI canonical user ID
CanonicalUserId: !GetAtt CloudFrontOAI.S3CanonicalUserId

# Get S3 bucket regional domain name
BucketDomainName: !GetAtt StaticBucket.RegionalDomainName

!Sub

Sostituisce variabili in una stringa.

# With variable substitution
CallerReference: !Sub "${AWS::StackName}-${AWS::AccountId}"

# Origin access identity path
OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${CloudFrontOAI}"

!ImportValue

Importa valori esportati da altri stack.

# Import from another stack
BucketDomainName: !ImportValue
  !Sub "${NetworkStackName}-StaticAssetsBucketRegionalDomainName"

Limiti e Quote

CloudFront Limits

Risorsa	Limite Default
Distribuzioni per account	200
Origini per distribuzione	25
Cache behaviors per distribuzione	25
Certificate per account	2000
TTL massimo	31536000 secondi (1 anno)
Size request body	20 MB (edge), 5 MB (viewer)
Numero di OAI	100 per account
Lunghezza dominio personalizzato	253 caratteri

CloudFront Functions Limits

Risorsa	Limite
Tempo esecuzione	1 ms
Memory	2 MB
Size request/response	10 KB
Size function code	10 KB

Lambda@Edge Limits

Risorso	Limite
Memory	128 MB
Timeout	30 secondi
Size deployment package	1 MB
Size response body	1 MB

Managed Cache Policies

AWS fornisce managed policies predefinite:

Policy ID	Nome	Descrizione
658327ea-f89d-4fab-a63d-7e88639e58f6	Managed-CachingOptimized	Ottimizzato per caching
5cc3b908-e619-4b99-88e5-2cf7a4592e4c	Managed-Elemental-MediaPackage	Per MediaPackage
b2884449-e4de-46a7-ac21-5511b5d11b5f	Managed-Amplify	Per Amplify

Managed Origin Request Policies

Policy ID	Nome	Descrizione
33f36d7e-f398-4d50-aaf9-1a26f4830ef3	Managed-CORS-S3Origin	CORS per S3
10c336ab-3b4b-4e2b-a38b-5b4a20d0a1e2	Managed-AllView	Forward tutto

Tag Comuni per CloudFront

Resources:
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        Origins: []
        DefaultCacheBehavior:
          TargetOriginId: Origin
          ViewerProtocolPolicy: redirect-to-https
          AllowedMethods:
            - GET
            - HEAD
          CachedMethods:
            - GET
            - HEAD
          ForwardedValues:
            QueryString: false
            Cookies:
              Forward: none
          MinTTL: 0
          DefaultTTL: 86400
          MaxTTL: 31536000
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref ProjectName
        - Key: Owner
          Value: team@example.com
        - Key: ManagedBy
          Value: CloudFormation
        - Key: CostCenter
          Value: "12345"
        - Key: Version
          Value: "1.0.0"

Related skills

Azure AiIntegrates Azure AI Content Safety, Document Intelligence, Speech, and Search services into Java-based agents and applications.495k1.4k

Azure PrepareGenerate the exact Azure infrastructure files, Dockerfiles, and azure.yaml configuration needed before deploying any new or modernized application.494k1.4k

Azure StorageConnect agents and applications to Azure Blob Storage, File Shares, Queues, Tables, and Data Lake without leaving the coding environment.494k1.4k

Appinsights InstrumentationAutomatically instrument web applications running on Azure App Service with Application Insights for observability without manual configuration.493k1.4k

Azure Resource LookupInstantly list, query, and discover any Azure resources across subscriptions without leaving the agent chat.493k1.4k

Azure AigatewayConfigure Azure API Management as a secure, governed gateway for routing traffic to LLMs, MCP servers, and agent tools.493k1.4k

Cloud & Infrastructureinfra