aws-cdk-lib.aws_cloudfront.DistributionProps

DistributionProps Struct

Properties for a Distribution.

DistributionProps

used as props by

• Distribution

Source

aws-cloudfront/lib/distribution.ts

Type last changed

v2.235.0 · 15 Jan 2026

Example

// Creates a distribution from a Network Load Balancer
declare const vpc: ec2.Vpc;
// Create a network load balancer in a VPC. 'internetFacing' can be 'false'.
const nlb = new elbv2.NetworkLoadBalancer(this, 'NLB', {
  vpc,
  internetFacing: false,
  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_ISOLATED },
  securityGroups: [new ec2.SecurityGroup(this, 'NLB-SG', { vpc })],
});
new cloudfront.Distribution(this, 'myDist', {
  defaultBehavior: { origin: origins.VpcOrigin.withNetworkLoadBalancer(nlb) },
});

Properties

additionalBehaviors?optional{ [key: string]: BehaviorOptions }additional_behaviors?optionaltyping.Mapping[str, BehaviorOptions]additionalBehaviors?optionalMap<String, BehaviorOptions>AdditionalBehaviors?optionalIDictionary<string, BehaviorOptions>AdditionalBehaviors?optional*map[string]BehaviorOptions#

Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to.

Default: no additional behaviors are added.

certificate?optionalICertificateRefcertificate?optionalICertificateRefcertificate?optionalICertificateRefCertificate?optionalICertificateRefCertificate?optionalICertificateRef#

A certificate to associate with the distribution.

Default: the CloudFront wildcard certificate (*.cloudfront.net) will be used.

The certificate must be located in N. Virginia (us-east-1).

comment?optionalstringcomment?optionalstrcomment?optionalStringComment?optionalstringComment?optional*string#

Any comments you want to include about the distribution.

Default: no comment

defaultBehaviorBehaviorOptionsdefault_behaviorBehaviorOptionsdefaultBehaviorBehaviorOptionsDefaultBehaviorBehaviorOptionsDefaultBehaviorBehaviorOptionsrequired#

The default behavior for the distribution.

defaultRootObject?optionalstringdefault_root_object?optionalstrdefaultRootObject?optionalStringDefaultRootObject?optionalstringDefaultRootObject?optional*string#

The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/).

Default: no default root object

domainNames?optionalstring[]domain_names?optionaltyping.List[str]domainNames?optionalList<String>DomainNames?optionalstring[]DomainNames?optional*[]*string#

Alternative domain names for this distribution.

Default: The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)

notes

If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you should add (at least one of) the domain names of the certificate to this list.

When you want to move a domain name between distributions, you can associate a certificate without specifying any domain names. For more information, see the Moving an alternate domain name to a different distribution section in the README.

enabled?optionalbooleanenabled?optionalboolenabled?optionalBooleanEnabled?optionalboolEnabled?optional*bool= true#

Enable or disable the distribution.

enableIpv6?optionalbooleanenable_ipv6?optionalboolenableIpv6?optionalBooleanEnableIpv6?optionalboolEnableIpv6?optional*bool= true#

Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address.

If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution.

enableLogging?optionalbooleanenable_logging?optionalboolenableLogging?optionalBooleanEnableLogging?optionalboolEnableLogging?optional*bool#

Enable access logging for the distribution.

Default: false, unless logBucket is specified.

errorResponses?optionalErrorResponse[]error_responses?optionaltyping.List[ErrorResponse]errorResponses?optionalList<ErrorResponse>ErrorResponses?optionalErrorResponse[]ErrorResponses?optional*[]ErrorResponse#

How CloudFront should handle requests that are not successful (e.g., PageNotFound).

Default: No custom error responses.

geoRestriction?optionalGeoRestrictiongeo_restriction?optionalGeoRestrictiongeoRestriction?optionalGeoRestrictionGeoRestriction?optionalGeoRestrictionGeoRestriction?optionalGeoRestriction#

Controls the countries in which your content is distributed.

Default: No geographic restrictions

httpVersion?optionalHttpVersionhttp_version?optionalHttpVersionhttpVersion?optionalHttpVersionHttpVersion?optionalHttpVersionHttpVersion?optionalHttpVersion= HttpVersion.HTTP2#

The HTTP version(s) to enable on the distribution.

For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support Server Name Indication (SNI). For viewers and CloudFront to use HTTP/3, viewers must support TLS 1.3 and Server Name Indication (SNI).

logBucket?optionalIBucketlog_bucket?optionalIBucketlogBucket?optionalIBucketLogBucket?optionalIBucketLogBucket?optionalIBucket#

The Amazon S3 bucket to store the access logs in.

Default: A bucket is created if enableLogging is true

Make sure to set objectOwnership to s3.ObjectOwnership.OBJECT_WRITER in your custom bucket.

logFilePrefix?optionalstringlog_file_prefix?optionalstrlogFilePrefix?optionalStringLogFilePrefix?optionalstringLogFilePrefix?optional*string#

An optional string that you want CloudFront to prefix to the access log filenames for this distribution.

Default: no prefix

logIncludesCookies?optionalbooleanlog_includes_cookies?optionalboollogIncludesCookies?optionalBooleanLogIncludesCookies?optionalboolLogIncludesCookies?optional*bool= false#

Specifies whether you want CloudFront to include cookies in access logs.

minimumProtocolVersion?optionalSecurityPolicyProtocolminimum_protocol_version?optionalSecurityPolicyProtocolminimumProtocolVersion?optionalSecurityPolicyProtocolMinimumProtocolVersion?optionalSecurityPolicyProtocolMinimumProtocolVersion?optionalSecurityPolicyProtocol#

The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

Default: SecurityPolicyProtocol.TLS_V1_2_2021 if the '@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021' feature flag is set; otherwise, SecurityPolicyProtocol.TLS_V1_2_2019.

CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify.

priceClass?optionalPriceClassprice_class?optionalPriceClasspriceClass?optionalPriceClassPriceClass?optionalPriceClassPriceClass?optionalPriceClass= PriceClass.PRICE_CLASS_ALL#

The price class that corresponds with the maximum price that you want to pay for CloudFront service.

notes

If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations. If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class.

publishAdditionalMetrics?optionalbooleanpublish_additional_metrics?optionalboolpublishAdditionalMetrics?optionalBooleanPublishAdditionalMetrics?optionalboolPublishAdditionalMetrics?optional*bool= false#

Whether to enable additional CloudWatch metrics.

sslSupportMethod?optionalSSLMethodssl_support_method?optionalSSLMethodsslSupportMethod?optionalSSLMethodSslSupportMethod?optionalSSLMethodSslSupportMethod?optionalSSLMethod= SSLMethod.SNI#

The SSL method CloudFront will use for your distribution.

notes

Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.

If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).

See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/

webAclId?optionalstringweb_acl_id?optionalstrwebAclId?optionalStringWebAclId?optionalstringWebAclId?optional*string#

Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.

Default: No AWS Web Application Firewall web access control list (web ACL).

notes

To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example 473e64fd-f30b-4765-81a0-62ad96dd167a.