AccessLevel Enum
The level of permissions granted to the CloudFront Distribution when configuring OAC.
Example
ts
// Create the simple Origin
const myBucket = new s3.Bucket(this, 'myBucket');
const s3Origin = origins.S3BucketOrigin.withOriginAccessControl(myBucket, {
originAccessLevels: [cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST],
});
// Create the Distribution construct
const myMultiTenantDistribution = new cloudfront.Distribution(this, 'distribution', {
defaultBehavior: {
origin: s3Origin,
},
defaultRootObject: 'index.html', // recommended to specify
});
// Access the underlying L1 CfnDistribution to configure SaaS Manager properties which are not yet available in the L2 Distribution construct
const cfnDistribution = myMultiTenantDistribution.node.defaultChild as cloudfront.CfnDistribution;
const defaultCacheBehavior: cloudfront.CfnDistribution.DefaultCacheBehaviorProperty = {
targetOriginId: myBucket.bucketArn,
viewerProtocolPolicy: 'allow-all',
compress: false,
allowedMethods: ['GET', 'HEAD'],
cachePolicyId: cloudfront.CachePolicy.CACHING_OPTIMIZED.cachePolicyId
};
// Create the updated distributionConfig
const distributionConfig: cloudfront.CfnDistribution.DistributionConfigProperty = {
defaultCacheBehavior: defaultCacheBehavior,
enabled: true,
// the properties below are optional
connectionMode: 'tenant-only',
origins: [
{
id: myBucket.bucketArn,
domainName: myBucket.bucketDomainName,
s3OriginConfig: {},
originPath: "/{{tenantName}}"
},
],
tenantConfig: {
parameterDefinitions: [
{
definition: {
stringSchema: {
required: false,
// the properties below are optional
comment: 'tenantName',
defaultValue: 'root',
},
},
name: 'tenantName',
},
],
},
};
// Override the distribution configuration to enable multi-tenancy.
cfnDistribution.distributionConfig = distributionConfig;
// Create a distribution tenant using an existing ACM certificate
const cfnDistributionTenant = new cloudfront.CfnDistributionTenant(this, 'distribution-tenant', {
distributionId: myMultiTenantDistribution.distributionId,
domains: ['my-tenant.my.domain.com'],
name: 'my-tenant',
enabled: true,
parameters: [ // Override the default 'tenantName' parameter (root) defined in the multi-tenant distribution.
{
name: 'tenantName',
value: 'app',
},
],
customizations: {
certificate: {
arn: 'REPLACE_WITH_ARN', // Certificate must be in us-east-1 region and cover 'my-tenant.my.domain.com'
},
},
});
python
# Create the simple Origin
my_bucket = s3.Bucket(self, "myBucket")
s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
)
# Create the Distribution construct
my_multi_tenant_distribution = cloudfront.Distribution(self, "distribution",
default_behavior=cloudfront.BehaviorOptions(
origin=s3_origin
),
default_root_object="index.html"
)
# Access the underlying L1 CfnDistribution to configure SaaS Manager properties which are not yet available in the L2 Distribution construct
cfn_distribution = my_multi_tenant_distribution.node.default_child
default_cache_behavior = cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
target_origin_id=my_bucket.bucket_arn,
viewer_protocol_policy="allow-all",
compress=False,
allowed_methods=["GET", "HEAD"],
cache_policy_id=cloudfront.CachePolicy.CACHING_OPTIMIZED.cache_policy_id
)
# Create the updated distributionConfig
distribution_config = cloudfront.CfnDistribution.DistributionConfigProperty(
default_cache_behavior=default_cache_behavior,
enabled=True,
# the properties below are optional
connection_mode="tenant-only",
origins=[cloudfront.CfnDistribution.OriginProperty(
id=my_bucket.bucket_arn,
domain_name=my_bucket.bucket_domain_name,
s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(),
origin_path="/{{tenantName}}"
)
],
tenant_config=cloudfront.CfnDistribution.TenantConfigProperty(
parameter_definitions=[cloudfront.CfnDistribution.ParameterDefinitionProperty(
definition=cloudfront.CfnDistribution.DefinitionProperty(
string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
required=False,
# the properties below are optional
comment="tenantName",
default_value="root"
)
),
name="tenantName"
)
]
)
)
# Override the distribution configuration to enable multi-tenancy.
cfn_distribution.distribution_config = distribution_config
# Create a distribution tenant using an existing ACM certificate
cfn_distribution_tenant = cloudfront.CfnDistributionTenant(self, "distribution-tenant",
distribution_id=my_multi_tenant_distribution.distribution_id,
domains=["my-tenant.my.domain.com"],
name="my-tenant",
enabled=True,
parameters=[cloudfront.CfnDistributionTenant.ParameterProperty(
name="tenantName",
value="app"
)],
customizations=cloudfront.CfnDistributionTenant.CustomizationsProperty(
certificate=cloudfront.CfnDistributionTenant.CertificateProperty(
arn="REPLACE_WITH_ARN"
)
)
)
java
// Create the simple Origin
Bucket myBucket = new Bucket(this, "myBucket");
IOrigin s3Origin = S3BucketOrigin.withOriginAccessControl(myBucket, S3BucketOriginWithOACProps.builder()
.originAccessLevels(List.of(AccessLevel.READ, AccessLevel.LIST))
.build());
// Create the Distribution construct
Distribution myMultiTenantDistribution = Distribution.Builder.create(this, "distribution")
.defaultBehavior(BehaviorOptions.builder()
.origin(s3Origin)
.build())
.defaultRootObject("index.html")
.build();
// Access the underlying L1 CfnDistribution to configure SaaS Manager properties which are not yet available in the L2 Distribution construct
CfnDistribution cfnDistribution = (CfnDistribution)myMultiTenantDistribution.getNode().getDefaultChild();
DefaultCacheBehaviorProperty defaultCacheBehavior = DefaultCacheBehaviorProperty.builder()
.targetOriginId(myBucket.getBucketArn())
.viewerProtocolPolicy("allow-all")
.compress(false)
.allowedMethods(List.of("GET", "HEAD"))
.cachePolicyId(CachePolicy.CACHING_OPTIMIZED.getCachePolicyId())
.build();
// Create the updated distributionConfig
DistributionConfigProperty distributionConfig = DistributionConfigProperty.builder()
.defaultCacheBehavior(defaultCacheBehavior)
.enabled(true)
// the properties below are optional
.connectionMode("tenant-only")
.origins(List.of(OriginProperty.builder()
.id(myBucket.getBucketArn())
.domainName(myBucket.getBucketDomainName())
.s3OriginConfig(S3OriginConfigProperty.builder().build())
.originPath("/{{tenantName}}")
.build()))
.tenantConfig(TenantConfigProperty.builder()
.parameterDefinitions(List.of(ParameterDefinitionProperty.builder()
.definition(DefinitionProperty.builder()
.stringSchema(StringSchemaProperty.builder()
.required(false)
// the properties below are optional
.comment("tenantName")
.defaultValue("root")
.build())
.build())
.name("tenantName")
.build()))
.build())
.build();
// Override the distribution configuration to enable multi-tenancy.
cfnDistribution.getDistributionConfig() = distributionConfig;
// Create a distribution tenant using an existing ACM certificate
CfnDistributionTenant cfnDistributionTenant = CfnDistributionTenant.Builder.create(this, "distribution-tenant")
.distributionId(myMultiTenantDistribution.getDistributionId())
.domains(List.of("my-tenant.my.domain.com"))
.name("my-tenant")
.enabled(true)
.parameters(List.of(ParameterProperty.builder()
.name("tenantName")
.value("app")
.build()))
.customizations(CustomizationsProperty.builder()
.certificate(CertificateProperty.builder()
.arn("REPLACE_WITH_ARN")
.build())
.build())
.build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
// Create the simple Origin
var myBucket = new Bucket(this, "myBucket");
var s3Origin = S3BucketOrigin.WithOriginAccessControl(myBucket, new S3BucketOriginWithOACProps {
OriginAccessLevels = new [] { AccessLevel.READ, AccessLevel.LIST }
});
// Create the Distribution construct
var myMultiTenantDistribution = new Distribution(this, "distribution", new DistributionProps {
DefaultBehavior = new BehaviorOptions {
Origin = s3Origin
},
DefaultRootObject = "index.html"
});
// Access the underlying L1 CfnDistribution to configure SaaS Manager properties which are not yet available in the L2 Distribution construct
var cfnDistribution = (CfnDistribution)myMultiTenantDistribution.Node.DefaultChild;
var defaultCacheBehavior = new DefaultCacheBehaviorProperty {
TargetOriginId = myBucket.BucketArn,
ViewerProtocolPolicy = "allow-all",
Compress = false,
AllowedMethods = new [] { "GET", "HEAD" },
CachePolicyId = CachePolicy.CACHING_OPTIMIZED.CachePolicyId
};
// Create the updated distributionConfig
var distributionConfig = new DistributionConfigProperty {
DefaultCacheBehavior = defaultCacheBehavior,
Enabled = true,
// the properties below are optional
ConnectionMode = "tenant-only",
Origins = new [] { new OriginProperty {
Id = myBucket.BucketArn,
DomainName = myBucket.BucketDomainName,
S3OriginConfig = new S3OriginConfigProperty { },
OriginPath = "/{{tenantName}}"
} },
TenantConfig = new TenantConfigProperty {
ParameterDefinitions = new [] { new ParameterDefinitionProperty {
Definition = new DefinitionProperty {
StringSchema = new StringSchemaProperty {
Required = false,
// the properties below are optional
Comment = "tenantName",
DefaultValue = "root"
}
},
Name = "tenantName"
} }
}
};
// Override the distribution configuration to enable multi-tenancy.
cfnDistribution.DistributionConfig = distributionConfig;
// Create a distribution tenant using an existing ACM certificate
var cfnDistributionTenant = new CfnDistributionTenant(this, "distribution-tenant", new CfnDistributionTenantProps {
DistributionId = myMultiTenantDistribution.DistributionId,
Domains = new [] { "my-tenant.my.domain.com" },
Name = "my-tenant",
Enabled = true,
Parameters = new [] { new ParameterProperty {
Name = "tenantName",
Value = "app"
} },
Customizations = new CustomizationsProperty {
Certificate = new CertificateProperty {
Arn = "REPLACE_WITH_ARN"
}
}
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
// Create the simple Origin
myBucket := s3.NewBucket(this, jsii.String("myBucket"))
s3Origin := origins.S3BucketOrigin_WithOriginAccessControl(myBucket, &S3BucketOriginWithOACProps{
OriginAccessLevels: []AccessLevel{
cloudfront.AccessLevel_READ,
cloudfront.AccessLevel_LIST,
},
})
// Create the Distribution construct
myMultiTenantDistribution := cloudfront.NewDistribution(this, jsii.String("distribution"), &DistributionProps{
DefaultBehavior: &BehaviorOptions{
Origin: s3Origin,
},
DefaultRootObject: jsii.String("index.html"),
})
// Access the underlying L1 CfnDistribution to configure SaaS Manager properties which are not yet available in the L2 Distribution construct
cfnDistribution := myMultiTenantDistribution.Node.defaultChild.(CfnDistribution)
defaultCacheBehavior := &DefaultCacheBehaviorProperty{
TargetOriginId: myBucket.bucketArn,
ViewerProtocolPolicy: jsii.String("allow-all"),
Compress: jsii.Boolean(false),
AllowedMethods: []*string{
jsii.String("GET"),
jsii.String("HEAD"),
},
CachePolicyId: cloudfront.CachePolicy_CACHING_OPTIMIZED().CachePolicyId,
}
// Create the updated distributionConfig
distributionConfig := &DistributionConfigProperty{
DefaultCacheBehavior: defaultCacheBehavior,
Enabled: jsii.Boolean(true),
// the properties below are optional
ConnectionMode: jsii.String("tenant-only"),
Origins: []interface{}{
&OriginProperty{
Id: myBucket.bucketArn,
DomainName: myBucket.BucketDomainName,
S3OriginConfig: &S3OriginConfigProperty{
},
OriginPath: jsii.String("/{{tenantName}}"),
},
},
TenantConfig: &TenantConfigProperty{
ParameterDefinitions: []interface{}{
&ParameterDefinitionProperty{
Definition: &DefinitionProperty{
StringSchema: &StringSchemaProperty{
Required: jsii.Boolean(false),
// the properties below are optional
Comment: jsii.String("tenantName"),
DefaultValue: jsii.String("root"),
},
},
Name: jsii.String("tenantName"),
},
},
},
}
// Override the distribution configuration to enable multi-tenancy.
cfnDistribution.distributionConfig = distributionConfig
// Create a distribution tenant using an existing ACM certificate
cfnDistributionTenant := cloudfront.NewCfnDistributionTenant(this, jsii.String("distribution-tenant"), &CfnDistributionTenantProps{
DistributionId: myMultiTenantDistribution.DistributionId,
Domains: []*string{
jsii.String("my-tenant.my.domain.com"),
},
Name: jsii.String("my-tenant"),
Enabled: jsii.Boolean(true),
Parameters: []interface{}{
&ParameterProperty{
Name: jsii.String("tenantName"),
Value: jsii.String("app"),
},
},
Customizations: &CustomizationsProperty{
Certificate: &CertificateProperty{
Arn: jsii.String("REPLACE_WITH_ARN"),
},
},
})
Members
| Member | Description |
|---|---|
READ | Grants read permissions to CloudFront Distribution. |
READ_VERSIONED | Grants versioned read permissions to CloudFront Distribution. |
LIST | Grants list permissions to CloudFront Distribution. |
WRITE | Grants write permission to CloudFront Distribution. |
DELETE | Grants delete permission to CloudFront Distribution. |
Referenced by
S3BucketOriginWithOACProps.originAccessLevelsorigin_access_levelsoriginAccessLevelsOriginAccessLevelsOriginAccessLevels