awscloudfront

package
v2.32.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2022 License: Apache-2.0 Imports: 10 Imported by: 23

README

Amazon CloudFront Construct Library

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so that content is delivered with the best possible performance.

Distribution API

The Distribution API is currently being built to replace the existing CloudFrontWebDistribution API. The Distribution API is optimized for the most common use cases of CloudFront distributions (e.g., single origin and behavior, few customizations) while still providing the ability for more advanced use cases. The API focuses on simplicity for the common use cases, and convenience methods for creating the behaviors and origins necessary for more complex use cases.

Creating a distribution

CloudFront distributions deliver your content from one or more origins; an origin is the location where you store the original version of your content. Origins can be created from S3 buckets or a custom origin (HTTP server). Constructs to define origins are in the @aws-cdk/aws-cloudfront-origins module.

Each distribution has a default behavior which applies to all requests to that distribution, and routes requests to a primary origin. Additional behaviors may be specified for an origin with a given URL path pattern. Behaviors allow routing with multiple origins, controlling which HTTP methods to support, whether to require users to use HTTPS, and what query strings or cookies to forward to your origin, among other settings.

From an S3 Bucket

An S3 bucket can be added as an origin. If the bucket is configured as a website endpoint, the distribution can use S3 redirects and S3 custom error documents.

// Creates a distribution from an S3 bucket.
myBucket := s3.NewBucket(this, jsii.String("myBucket"))
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
	},
})

The above will treat the bucket differently based on if IBucket.isWebsite is set or not. If the bucket is configured as a website, the bucket is treated as an HTTP origin, and the built-in S3 redirects and error pages can be used. Otherwise, the bucket is handled as a bucket origin and CloudFront's redirect and error handling will be used. In the latter case, the Origin will create an origin access identity and grant it access to the underlying bucket. This can be used in conjunction with a bucket that is not public to require that your users access your content using CloudFront URLs and not S3 URLs directly.

ELBv2 Load Balancer

An Elastic Load Balancing (ELB) v2 load balancer may be used as an origin. In order for a load balancer to serve as an origin, it must be publicly accessible (internetFacing is true). Both Application and Network load balancers are supported.

// Creates a distribution from an ELBv2 load balancer
var vpc vpc

// Create an application load balancer in a VPC. 'internetFacing' must be 'true'
// for CloudFront to access the load balancer and use it as an origin.
lb := elbv2.NewApplicationLoadBalancer(this, jsii.String("LB"), &applicationLoadBalancerProps{
	vpc: vpc,
	internetFacing: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewLoadBalancerV2Origin(lb),
	},
})
From an HTTP endpoint

Origins can also be created from any other HTTP endpoint, given the domain name, and optionally, other origin properties.

// Creates a distribution from an HTTP endpoint
// Creates a distribution from an HTTP endpoint
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
	},
})
Domain Names and Certificates

When you create a distribution, CloudFront assigns a domain name for the distribution, for example: d111111abcdef8.cloudfront.net; this value can be retrieved from distribution.distributionDomainName. CloudFront distributions use a default certificate (*.cloudfront.net) to support HTTPS by default. If you want to use your own domain name, such as www.example.com, you must associate a certificate with your distribution that contains your domain name, and provide one (or more) domain names from the certificate for the distribution.

The certificate must be present in the AWS Certificate Manager (ACM) service in the US East (N. Virginia) region; the certificate may either be created by ACM, or created elsewhere and imported into ACM. When a certificate is used, the distribution will support HTTPS connections from SNI only and a minimum protocol version of TLSv1.2_2021 if the @aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021 feature flag is set, and TLSv1.2_2019 otherwise.

// To use your own domain name in a Distribution, you must associate a certificate
import acm "github.com/aws/aws-cdk-go/awscdk"
import route53 "github.com/aws/aws-cdk-go/awscdk"

var hostedZone hostedZone

var myBucket bucket

myCertificate := acm.NewDnsValidatedCertificate(this, jsii.String("mySiteCert"), &dnsValidatedCertificateProps{
	domainName: jsii.String("www.example.com"),
	hostedZone: hostedZone,
})
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
	},
	domainNames: []*string{
		jsii.String("www.example.com"),
	},
	certificate: myCertificate,
})

However, you can customize the minimum protocol version for the certificate while creating the distribution using minimumProtocolVersion property.

// Create a Distribution with a custom domain name and a minimum protocol version.
var myBucket bucket

cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
	},
	domainNames: []*string{
		jsii.String("www.example.com"),
	},
	minimumProtocolVersion: cloudfront.securityPolicyProtocol_TLS_V1_2016,
	sslSupportMethod: cloudfront.sSLMethod_SNI,
})
Multiple Behaviors & Origins

Each distribution has a default behavior which applies to all requests to that distribution; additional behaviors may be specified for a given URL path pattern. Behaviors allow routing with multiple origins, controlling which HTTP methods to support, whether to require users to use HTTPS, and what query strings or cookies to forward to your origin, among others.

The properties of the default behavior can be adjusted as part of the distribution creation. The following example shows configuring the HTTP methods and viewer protocol policy of the cache.

// Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
var myBucket bucket

myWebDistribution := cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
		allowedMethods: cloudfront.allowedMethods_ALLOW_ALL(),
		viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
	},
})

Additional behaviors can be specified at creation, or added after the initial creation. Each additional behavior is associated with an origin, and enable customization for a specific set of resources based on a URL path pattern. For example, we can add a behavior to myWebDistribution to override the default viewer protocol policy for all of the images.

// Add a behavior to a Distribution after initial creation.
var myBucket bucket
var myWebDistribution distribution

myWebDistribution.addBehavior(jsii.String("/images/*.jpg"), origins.NewS3Origin(myBucket), &addBehaviorOptions{
	viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
})

These behaviors can also be specified at distribution creation time.

// Create a Distribution with additional behaviors at creation time.
var myBucket bucket

bucketOrigin := origins.NewS3Origin(myBucket)
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		allowedMethods: cloudfront.allowedMethods_ALLOW_ALL(),
		viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
	},
	additionalBehaviors: map[string]*behaviorOptions{
		"/images/*.jpg": &behaviorOptions{
			"origin": bucketOrigin,
			"viewerProtocolPolicy": cloudfront.*viewerProtocolPolicy_REDIRECT_TO_HTTPS,
		},
	},
})
Customizing Cache Keys and TTLs with Cache Policies

You can use a cache policy to improve your cache hit ratio by controlling the values (URL query strings, HTTP headers, and cookies) that are included in the cache key, and/or adjusting how long items remain in the cache via the time-to-live (TTL) settings. CloudFront provides some predefined cache policies, known as managed policies, for common use cases. You can use these managed policies, or you can create your own cache policy that’s specific to your needs. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html for more details.

// Using an existing cache policy for a Distribution
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: cloudfront.cachePolicy_CACHING_OPTIMIZED(),
	},
})

// Creating a custom cache policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myCachePolicy := cloudfront.NewCachePolicy(this, jsii.String("myCachePolicy"), &cachePolicyProps{
	cachePolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	defaultTtl: awscdk.Duration.days(jsii.Number(2)),
	minTtl: awscdk.Duration.minutes(jsii.Number(1)),
	maxTtl: awscdk.Duration.days(jsii.Number(10)),
	cookieBehavior: cloudfront.cacheCookieBehavior.all(),
	headerBehavior: cloudfront.cacheHeaderBehavior.allowList(jsii.String("X-CustomHeader")),
	queryStringBehavior: cloudfront.cacheQueryStringBehavior.denyList(jsii.String("username")),
	enableAcceptEncodingGzip: jsii.Boolean(true),
	enableAcceptEncodingBrotli: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: myCachePolicy,
	},
})
Customizing Origin Requests with Origin Request Policies

When CloudFront makes a request to an origin, the URL path, request body (if present), and a few standard headers are included. Other information from the viewer request, such as URL query strings, HTTP headers, and cookies, is not included in the origin request by default. You can use an origin request policy to control the information that’s included in an origin request. CloudFront provides some predefined origin request policies, known as managed policies, for common use cases. You can use these managed policies, or you can create your own origin request policy that’s specific to your needs. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html for more details.

// Using an existing origin request policy for a Distribution
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: cloudfront.originRequestPolicy_CORS_S3_ORIGIN(),
	},
})

// Creating a custom origin request policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myOriginRequestPolicy := cloudfront.NewOriginRequestPolicy(this, jsii.String("OriginRequestPolicy"), &originRequestPolicyProps{
	originRequestPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	cookieBehavior: cloudfront.originRequestCookieBehavior.none(),
	headerBehavior: cloudfront.originRequestHeaderBehavior.all(jsii.String("CloudFront-Is-Android-Viewer")),
	queryStringBehavior: cloudfront.originRequestQueryStringBehavior.allowList(jsii.String("username")),
})

cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: myOriginRequestPolicy,
	},
})
Customizing Response Headers with Response Headers Policies

You can configure CloudFront to add one or more HTTP headers to the responses that it sends to viewers (web browsers or other clients), without making any changes to the origin or writing any code. To specify the headers that CloudFront adds to HTTP responses, you use a response headers policy. CloudFront adds the headers regardless of whether it serves the object from the cache or has to retrieve the object from the origin. If the origin response includes one or more of the headers that’s in a response headers policy, the policy can specify whether CloudFront uses the header it received from the origin or overwrites it with the one in the policy. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/adding-response-headers.html

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})
Validating signed URLs or signed cookies with Trusted Key Groups

CloudFront Distribution supports validating signed URLs or signed cookies using key groups. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior.

// Validating signed URLs or signed cookies with Trusted Key Groups

// public key in PEM format
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewDistribution(this, jsii.String("Dist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
		trustedKeyGroups: []iKeyGroup{
			keyGroup,
		},
	},
})
Lambda@Edge

Lambda@Edge is an extension of AWS Lambda, a compute service that lets you execute functions that customize the content that CloudFront delivers. You can author Node.js or Python functions in the US East (N. Virginia) region, and then execute them in AWS locations globally that are closer to the viewer, without provisioning or managing servers. Lambda@Edge functions are associated with a specific behavior and event type. Lambda@Edge can be used to rewrite URLs, alter responses based on headers or cookies, or authorize requests based on headers or authorization tokens.

The following shows a Lambda@Edge function added to the default behavior and triggered on every request:

var myBucket bucket
// A Lambda@Edge function added to default behavior of a Distribution
// and triggered on every request
myFunc := #error#.NewEdgeFunction(this, jsii.String("MyFunction"), &edgeFunctionProps{
	runtime: lambda.runtime_NODEJS_14_X(),
	handler: jsii.String("index.handler"),
	code: lambda.code.fromAsset(path.join(__dirname, jsii.String("lambda-handler"))),
})
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: myFunc.currentVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})

Note: Lambda@Edge functions must be created in the us-east-1 region, regardless of the region of the CloudFront distribution and stack. To make it easier to request functions for Lambda@Edge, the EdgeFunction construct can be used. The EdgeFunction construct will automatically request a function in us-east-1, regardless of the region of the current stack. EdgeFunction has the same interface as Function and can be created and used interchangeably. Please note that using EdgeFunction requires that the us-east-1 region has been bootstrapped. See https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html for more about bootstrapping regions.

If the stack is in us-east-1, a "normal" lambda.Function can be used instead of an EdgeFunction.

// Using a lambda Function instead of an EdgeFunction for stacks in `us-east-`.
myFunc := lambda.NewFunction(this, jsii.String("MyFunction"), &functionProps{
	runtime: lambda.runtime_NODEJS_14_X(),
	handler: jsii.String("index.handler"),
	code: lambda.code.fromAsset(path.join(__dirname, jsii.String("lambda-handler"))),
})

If the stack is not in us-east-1, and you need references from different applications on the same account, you can also set a specific stack ID for each Lambda@Edge.

// Setting stackIds for EdgeFunctions that can be referenced from different applications
// on the same account.
myFunc1 := #error#.NewEdgeFunction(this, jsii.String("MyFunction1"), &edgeFunctionProps{
	runtime: lambda.runtime_NODEJS_14_X(),
	handler: jsii.String("index.handler"),
	code: lambda.code.fromAsset(path.join(__dirname, jsii.String("lambda-handler1"))),
	stackId: jsii.String("edge-lambda-stack-id-1"),
})

myFunc2 := #error#.NewEdgeFunction(this, jsii.String("MyFunction2"), &edgeFunctionProps{
	runtime: lambda.*runtime_NODEJS_14_X(),
	handler: jsii.String("index.handler"),
	code: lambda.*code.fromAsset(path.join(__dirname, jsii.String("lambda-handler2"))),
	stackId: jsii.String("edge-lambda-stack-id-2"),
})

Lambda@Edge functions can also be associated with additional behaviors, either at or after Distribution creation time.

// Associating a Lambda@Edge function with additional behaviors.

var myFunc edgeFunction
// assigning at Distribution creation
var myBucket bucket

myOrigin := origins.NewS3Origin(myBucket)
myDistribution := cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: myOrigin,
	},
	additionalBehaviors: map[string]*behaviorOptions{
		"images/*": &behaviorOptions{
			"origin": myOrigin,
			"edgeLambdas": []EdgeLambda{
				&EdgeLambda{
					"functionVersion": myFunc.currentVersion,
					"eventType": cloudfront.LambdaEdgeEventType_ORIGIN_REQUEST,
					"includeBody": jsii.Boolean(true),
				},
			},
		},
	},
})

// assigning after creation
myDistribution.addBehavior(jsii.String("images/*"), myOrigin, &addBehaviorOptions{
	edgeLambdas: []edgeLambda{
		&edgeLambda{
			functionVersion: myFunc.currentVersion,
			eventType: cloudfront.lambdaEdgeEventType_VIEWER_RESPONSE,
		},
	},
})

Adding an existing Lambda@Edge function created in a different stack to a CloudFront distribution.

// Adding an existing Lambda@Edge function created in a different stack
// to a CloudFront distribution.
var s3Bucket bucket

functionVersion := lambda.version.fromVersionArn(this, jsii.String("Version"), jsii.String("arn:aws:lambda:us-east-1:123456789012:function:functionName:1"))

cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: functionVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})
CloudFront Function

You can also deploy CloudFront functions and add them to a CloudFront distribution.

var s3Bucket bucket
// Add a cloudfront Function to a Distribution
cfFunction := cloudfront.NewFunction(this, jsii.String("Function"), &functionProps{
	code: cloudfront.functionCode.fromInline(jsii.String("function handler(event) { return event.request }")),
})
cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		functionAssociations: []functionAssociation{
			&functionAssociation{
				function: cfFunction,
				eventType: cloudfront.functionEventType_VIEWER_REQUEST,
			},
		},
	},
})

It will auto-generate the name of the function and deploy it to the live stage.

Additionally, you can load the function's code from a file using the FunctionCode.fromFile() method.

Logging

You can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives. The logs can go to either an existing bucket, or a bucket will be created for you.

// Configure logging for Distributions

// Simplest form - creates a new bucket and logs to it.
// Configure logging for Distributions
// Simplest form - creates a new bucket and logs to it.
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
	},
	enableLogging: jsii.Boolean(true),
})

// You can optionally log to a specific bucket, configure whether cookies are logged, and give the log files a prefix.
// You can optionally log to a specific bucket, configure whether cookies are logged, and give the log files a prefix.
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
	},
	enableLogging: jsii.Boolean(true),
	 // Optional, this is implied if logBucket is specified
	logBucket: s3.NewBucket(this, jsii.String("LogBucket")),
	logFilePrefix: jsii.String("distribution-access-logs/"),
	logIncludesCookies: jsii.Boolean(true),
})
Importing Distributions

Existing distributions can be imported as well; note that like most imported constructs, an imported distribution cannot be modified. However, it can be used as a reference for other higher-level constructs.

// Using a reference to an imported Distribution
distribution := cloudfront.distribution.fromDistributionAttributes(this, jsii.String("ImportedDist"), &distributionAttributes{
	domainName: jsii.String("d111111abcdef8.cloudfront.net"),
	distributionId: jsii.String("012345ABCDEF"),
})

Migrating from the original CloudFrontWebDistribution to the newer Distribution construct

It's possible to migrate a distribution from the original to the modern API. The changes necessary are the following:

The Distribution

Replace new CloudFrontWebDistribution with new Distribution. Some configuration properties have been changed:

Old API New API
originConfigs defaultBehavior; use additionalBehaviors if necessary
viewerCertificate certificate; use domainNames for aliases
errorConfigurations errorResponses
loggingConfig enableLogging; configure with logBucket logFilePrefix and logIncludesCookies
viewerProtocolPolicy removed; set on each behavior instead. default changed from REDIRECT_TO_HTTPS to ALLOW_ALL

After switching constructs, you need to maintain the same logical ID for the underlying CfnDistribution if you wish to avoid the deletion and recreation of your distribution. To do this, use escape hatches to override the logical ID created by the new Distribution construct with the logical ID created by the old construct.

Example:

var sourceBucket bucket


myDistribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
})
cfnDistribution := myDistribution.node.defaultChild.(cfnDistribution)
cfnDistribution.overrideLogicalId(jsii.String("MyDistributionCFDistribution3H55TI9Q"))
Behaviors

The modern API makes use of the CloudFront Origins module to easily configure your origin. Replace your origin configuration with the relevant CloudFront Origins class. For example, here's a behavior with an S3 origin:

var sourceBucket bucket
var oai originAccessIdentity


cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
				originAccessIdentity: oai,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
})

Becomes:

var sourceBucket bucket


distribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
})

In the original API all behaviors are defined in the originConfigs property. The new API is optimized for a single origin and behavior, so the default behavior and additional behaviors will be defined separately.

var sourceBucket bucket
var oai originAccessIdentity


cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
				originAccessIdentity: oai,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
		&sourceConfiguration{
			customOriginSource: &customOriginConfig{
				domainName: jsii.String("MYALIAS"),
			},
			behaviors: []*behavior{
				&behavior{
					pathPattern: jsii.String("/somewhere"),
				},
			},
		},
	},
})

Becomes:

var sourceBucket bucket


distribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
	additionalBehaviors: map[string]*behaviorOptions{
		"/somewhere": &behaviorOptions{
			"origin": origins.NewHttpOrigin(jsii.String("MYALIAS")),
		},
	},
})
Certificates

If you are using an ACM certificate, you can pass the certificate directly to the certificate prop. Any aliases used before in the ViewerCertificate class should be passed in to the domainNames prop in the modern API.

import acm "github.com/aws/aws-cdk-go/awscdk"
var certificate certificate
var sourceBucket bucket


viewerCertificate := cloudfront.viewerCertificate.fromAcmCertificate(certificate, &viewerCertificateOptions{
	aliases: []*string{
		jsii.String("MYALIAS"),
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: viewerCertificate,
})

Becomes:

import acm "github.com/aws/aws-cdk-go/awscdk"
var certificate certificate
var sourceBucket bucket


distribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
	domainNames: []*string{
		jsii.String("MYALIAS"),
	},
	certificate: certificate,
})

IAM certificates aren't directly supported by the new API, but can be easily configured through escape hatches

var sourceBucket bucket

viewerCertificate := cloudfront.viewerCertificate.fromIamCertificate(jsii.String("MYIAMROLEIDENTIFIER"), &viewerCertificateOptions{
	aliases: []*string{
		jsii.String("MYALIAS"),
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: viewerCertificate,
})

Becomes:

var sourceBucket bucket

distribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
	domainNames: []*string{
		jsii.String("MYALIAS"),
	},
})

cfnDistribution := distribution.node.defaultChild.(cfnDistribution)

cfnDistribution.addPropertyOverride(jsii.String("ViewerCertificate.IamCertificateId"), jsii.String("MYIAMROLEIDENTIFIER"))
cfnDistribution.addPropertyOverride(jsii.String("ViewerCertificate.SslSupportMethod"), jsii.String("sni-only"))
Other changes

A number of default settings have changed on the new API when creating a new distribution, behavior, and origin. After making the major changes needed for the migration, run cdk diff to see what settings have changed. If no changes are desired during migration, you will at the least be able to use escape hatches to override what the CDK synthesizes, if you can't change the properties directly.

CloudFrontWebDistribution API

The CloudFrontWebDistribution construct is the original construct written for working with CloudFront distributions. Users are encouraged to use the newer Distribution instead, as it has a simpler interface and receives new features faster.

Example usage:

// Using a CloudFrontWebDistribution construct.

var sourceBucket bucket

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
})
Viewer certificate

By default, CloudFront Web Distributions will answer HTTPS requests with CloudFront's default certificate, only containing the distribution domainName (e.g. d111111abcdef8.cloudfront.net). You can customize the viewer certificate property to provide a custom certificate and/or list of domain name aliases to fit your needs.

See Using Alternate Domain Names and HTTPS in the CloudFront User Guide.

Default certificate

You can customize the default certificate aliases. This is intended to be used in combination with CNAME records in your DNS zone.

Example:

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromCloudFrontDefaultCertificate(jsii.String("www.example.com")),
})
ACM certificate

You can change the default certificate by one stored AWS Certificate Manager, or ACM. Those certificate can either be generated by AWS, or purchased by another CA imported into ACM.

For more information, see the aws-certificatemanager module documentation or Importing Certificates into AWS Certificate Manager in the AWS Certificate Manager User Guide.

Example:

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

certificate := certificatemanager.NewCertificate(this, jsii.String("Certificate"), &certificateProps{
	domainName: jsii.String("example.com"),
	subjectAlternativeNames: []*string{
		jsii.String("*.example.com"),
	},
})

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromAcmCertificate(certificate, &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
			jsii.String("www.example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_TLS_V1,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})
IAM certificate

You can also import a certificate into the IAM certificate store.

See Importing an SSL/TLS Certificate in the CloudFront User Guide.

Example:

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromIamCertificate(jsii.String("certificateId"), &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_SSL_V3,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})
Trusted Key Groups

CloudFront Web Distributions supports validating signed URLs or signed cookies using key groups. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior.

Example:

// Using trusted key groups for Cloudfront Web Distributions.
var sourceBucket bucket
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
					trustedKeyGroups: []iKeyGroup{
						keyGroup,
					},
				},
			},
		},
	},
})
Restrictions

CloudFront supports adding restrictions to your distribution.

See Restricting the Geographic Distribution of Your Content in the CloudFront User Guide.

Example:

// Adding restrictions to a Cloudfront Web Distribution.
var sourceBucket bucket

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	geoRestriction: cloudfront.geoRestriction.allowlist(jsii.String("US"), jsii.String("GB")),
})
Connection behaviors between CloudFront and your origin

CloudFront provides you even more control over the connection behaviors between CloudFront and your origin. You can now configure the number of connection attempts CloudFront will make to your origin and the origin connection timeout for each attempt.

See Origin Connection Attempts

See Origin Connection Timeout

Example usage:

// Configuring connection behaviors between Cloudfront and your origin
distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			connectionAttempts: jsii.Number(3),
			connectionTimeout: awscdk.Duration.seconds(jsii.Number(10)),
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
})
Origin Fallback

In case the origin source is not available and answers with one of the specified status codes the failover origin source will be used.

// Configuring origin fallback options for the CloudFrontWebDistribution
// Configuring origin fallback options for the CloudFrontWebDistribution
cloudfront.NewCloudFrontWebDistribution(this, jsii.String("ADistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3.bucket.fromBucketName(this, jsii.String("aBucket"), jsii.String("myoriginbucket")),
				originPath: jsii.String("/"),
				originHeaders: map[string]*string{
					"myHeader": jsii.String("42"),
				},
				originShieldRegion: jsii.String("us-west-2"),
			},
			failoverS3OriginSource: &s3OriginConfig{
				s3BucketSource: s3.*bucket.fromBucketName(this, jsii.String("aBucketFallback"), jsii.String("myoriginbucketfallback")),
				originPath: jsii.String("/somewhere"),
				originHeaders: map[string]*string{
					"myHeader2": jsii.String("21"),
				},
				originShieldRegion: jsii.String("us-east-1"),
			},
			failoverCriteriaStatusCodes: []failoverStatusCode{
				cloudfront.*failoverStatusCode_INTERNAL_SERVER_ERROR,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
})

KeyGroup & PublicKey API

You can create a key group to use with CloudFront signed URLs and signed cookies You can add public keys to use with CloudFront features such as signed URLs, signed cookies, and field-level encryption.

The following example command uses OpenSSL to generate an RSA key pair with a length of 2048 bits and save to the file named private_key.pem.

openssl genrsa -out private_key.pem 2048

The resulting file contains both the public and the private key. The following example command extracts the public key from the file named private_key.pem and stores it in public_key.pem.

openssl rsa -pubout -in private_key.pem -out public_key.pem

Note: Don't forget to copy/paste the contents of public_key.pem file including -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines into encodedKey parameter when creating a PublicKey.

Example:

// Create a key group to use with CloudFront signed URLs and signed cookies.
// Create a key group to use with CloudFront signed URLs and signed cookies.
cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		cloudfront.NewPublicKey(this, jsii.String("MyPublicKey"), &publicKeyProps{
			encodedKey: jsii.String("..."),
		}),
	},
})

See:

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CachePolicy_IsConstruct 

func CachePolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CachePolicy_IsOwnedResource added in v2.32.0 

func CachePolicy_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func CachePolicy_IsResource 

func CachePolicy_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func CfnCachePolicy_CFN_RESOURCE_TYPE_NAME 

func CfnCachePolicy_CFN_RESOURCE_TYPE_NAME() *string

func CfnCachePolicy_IsCfnElement 

func CfnCachePolicy_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnCachePolicy_IsCfnResource 

func CfnCachePolicy_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnCachePolicy_IsConstruct 

func CfnCachePolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnCloudFrontOriginAccessIdentity_CFN_RESOURCE_TYPE_NAME 

func CfnCloudFrontOriginAccessIdentity_CFN_RESOURCE_TYPE_NAME() *string

func CfnCloudFrontOriginAccessIdentity_IsCfnElement 

func CfnCloudFrontOriginAccessIdentity_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnCloudFrontOriginAccessIdentity_IsCfnResource 

func CfnCloudFrontOriginAccessIdentity_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnCloudFrontOriginAccessIdentity_IsConstruct 

func CfnCloudFrontOriginAccessIdentity_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnDistribution_CFN_RESOURCE_TYPE_NAME 

func CfnDistribution_CFN_RESOURCE_TYPE_NAME() *string

func CfnDistribution_IsCfnElement 

func CfnDistribution_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnDistribution_IsCfnResource 

func CfnDistribution_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnDistribution_IsConstruct 

func CfnDistribution_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnFunction_CFN_RESOURCE_TYPE_NAME 

func CfnFunction_CFN_RESOURCE_TYPE_NAME() *string

func CfnFunction_IsCfnElement 

func CfnFunction_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnFunction_IsCfnResource 

func CfnFunction_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnFunction_IsConstruct 

func CfnFunction_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnKeyGroup_CFN_RESOURCE_TYPE_NAME 

func CfnKeyGroup_CFN_RESOURCE_TYPE_NAME() *string

func CfnKeyGroup_IsCfnElement 

func CfnKeyGroup_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnKeyGroup_IsCfnResource 

func CfnKeyGroup_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnKeyGroup_IsConstruct 

func CfnKeyGroup_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnOriginRequestPolicy_CFN_RESOURCE_TYPE_NAME 

func CfnOriginRequestPolicy_CFN_RESOURCE_TYPE_NAME() *string

func CfnOriginRequestPolicy_IsCfnElement 

func CfnOriginRequestPolicy_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnOriginRequestPolicy_IsCfnResource 

func CfnOriginRequestPolicy_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnOriginRequestPolicy_IsConstruct 

func CfnOriginRequestPolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnPublicKey_CFN_RESOURCE_TYPE_NAME 

func CfnPublicKey_CFN_RESOURCE_TYPE_NAME() *string

func CfnPublicKey_IsCfnElement 

func CfnPublicKey_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnPublicKey_IsCfnResource 

func CfnPublicKey_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnPublicKey_IsConstruct 

func CfnPublicKey_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnRealtimeLogConfig_CFN_RESOURCE_TYPE_NAME 

func CfnRealtimeLogConfig_CFN_RESOURCE_TYPE_NAME() *string

func CfnRealtimeLogConfig_IsCfnElement 

func CfnRealtimeLogConfig_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnRealtimeLogConfig_IsCfnResource 

func CfnRealtimeLogConfig_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnRealtimeLogConfig_IsConstruct 

func CfnRealtimeLogConfig_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnResponseHeadersPolicy_CFN_RESOURCE_TYPE_NAME 

func CfnResponseHeadersPolicy_CFN_RESOURCE_TYPE_NAME() *string

func CfnResponseHeadersPolicy_IsCfnElement 

func CfnResponseHeadersPolicy_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnResponseHeadersPolicy_IsCfnResource 

func CfnResponseHeadersPolicy_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnResponseHeadersPolicy_IsConstruct 

func CfnResponseHeadersPolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CfnStreamingDistribution_CFN_RESOURCE_TYPE_NAME 

func CfnStreamingDistribution_CFN_RESOURCE_TYPE_NAME() *string

func CfnStreamingDistribution_IsCfnElement 

func CfnStreamingDistribution_IsCfnElement(x interface{}) *bool

Returns `true` if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of `instanceof` to allow stack elements from different versions of this library to be included in the same stack.

Returns: The construct as a stack element or undefined if it is not a stack element.

func CfnStreamingDistribution_IsCfnResource 

func CfnStreamingDistribution_IsCfnResource(construct constructs.IConstruct) *bool

Check whether the given construct is a CfnResource.

func CfnStreamingDistribution_IsConstruct 

func CfnStreamingDistribution_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CloudFrontWebDistribution_IsConstruct 

func CloudFrontWebDistribution_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func CloudFrontWebDistribution_IsOwnedResource added in v2.32.0 

func CloudFrontWebDistribution_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func CloudFrontWebDistribution_IsResource 

func CloudFrontWebDistribution_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func Distribution_IsConstruct 

func Distribution_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func Distribution_IsOwnedResource added in v2.32.0 

func Distribution_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func Distribution_IsResource 

func Distribution_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func Function_IsConstruct 

func Function_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func Function_IsOwnedResource added in v2.32.0 

func Function_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func Function_IsResource 

func Function_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func KeyGroup_IsConstruct 

func KeyGroup_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func KeyGroup_IsOwnedResource added in v2.32.0 

func KeyGroup_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func KeyGroup_IsResource 

func KeyGroup_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func NewCachePolicy_Override 

func NewCachePolicy_Override(c CachePolicy, scope constructs.Construct, id *string, props *CachePolicyProps)

func NewCfnCachePolicy_Override 

func NewCfnCachePolicy_Override(c CfnCachePolicy, scope constructs.Construct, id *string, props *CfnCachePolicyProps)

Create a new `AWS::CloudFront::CachePolicy`.

func NewCfnCloudFrontOriginAccessIdentity_Override 

func NewCfnCloudFrontOriginAccessIdentity_Override(c CfnCloudFrontOriginAccessIdentity, scope constructs.Construct, id *string, props *CfnCloudFrontOriginAccessIdentityProps)

Create a new `AWS::CloudFront::CloudFrontOriginAccessIdentity`.

func NewCfnDistribution_Override 

func NewCfnDistribution_Override(c CfnDistribution, scope constructs.Construct, id *string, props *CfnDistributionProps)

Create a new `AWS::CloudFront::Distribution`.

func NewCfnFunction_Override 

func NewCfnFunction_Override(c CfnFunction, scope constructs.Construct, id *string, props *CfnFunctionProps)

Create a new `AWS::CloudFront::Function`.

func NewCfnKeyGroup_Override 

func NewCfnKeyGroup_Override(c CfnKeyGroup, scope constructs.Construct, id *string, props *CfnKeyGroupProps)

Create a new `AWS::CloudFront::KeyGroup`.

func NewCfnOriginRequestPolicy_Override 

func NewCfnOriginRequestPolicy_Override(c CfnOriginRequestPolicy, scope constructs.Construct, id *string, props *CfnOriginRequestPolicyProps)

Create a new `AWS::CloudFront::OriginRequestPolicy`.

func NewCfnPublicKey_Override 

func NewCfnPublicKey_Override(c CfnPublicKey, scope constructs.Construct, id *string, props *CfnPublicKeyProps)

Create a new `AWS::CloudFront::PublicKey`.

func NewCfnRealtimeLogConfig_Override 

func NewCfnRealtimeLogConfig_Override(c CfnRealtimeLogConfig, scope constructs.Construct, id *string, props *CfnRealtimeLogConfigProps)

Create a new `AWS::CloudFront::RealtimeLogConfig`.

func NewCfnResponseHeadersPolicy_Override 

func NewCfnResponseHeadersPolicy_Override(c CfnResponseHeadersPolicy, scope constructs.Construct, id *string, props *CfnResponseHeadersPolicyProps)

Create a new `AWS::CloudFront::ResponseHeadersPolicy`.

func NewCfnStreamingDistribution_Override 

func NewCfnStreamingDistribution_Override(c CfnStreamingDistribution, scope constructs.Construct, id *string, props *CfnStreamingDistributionProps)

Create a new `AWS::CloudFront::StreamingDistribution`.

func NewCloudFrontWebDistribution_Override 

func NewCloudFrontWebDistribution_Override(c CloudFrontWebDistribution, scope constructs.Construct, id *string, props *CloudFrontWebDistributionProps)

func NewDistribution_Override 

func NewDistribution_Override(d Distribution, scope constructs.Construct, id *string, props *DistributionProps)

func NewFunctionCode_Override 

func NewFunctionCode_Override(f FunctionCode)

func NewFunction_Override 

func NewFunction_Override(f Function, scope constructs.Construct, id *string, props *FunctionProps)

func NewKeyGroup_Override 

func NewKeyGroup_Override(k KeyGroup, scope constructs.Construct, id *string, props *KeyGroupProps)

func NewOriginAccessIdentity_Override 

func NewOriginAccessIdentity_Override(o OriginAccessIdentity, scope constructs.Construct, id *string, props *OriginAccessIdentityProps)

func NewOriginBase_Override 

func NewOriginBase_Override(o OriginBase, domainName *string, props *OriginProps)

func NewOriginRequestPolicy_Override 

func NewOriginRequestPolicy_Override(o OriginRequestPolicy, scope constructs.Construct, id *string, props *OriginRequestPolicyProps)

func NewPublicKey_Override 

func NewPublicKey_Override(p PublicKey, scope constructs.Construct, id *string, props *PublicKeyProps)

func NewResponseHeadersPolicy_Override added in v2.1.0 

func NewResponseHeadersPolicy_Override(r ResponseHeadersPolicy, scope constructs.Construct, id *string, props *ResponseHeadersPolicyProps)

func OriginAccessIdentity_IsConstruct 

func OriginAccessIdentity_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func OriginAccessIdentity_IsOwnedResource added in v2.32.0 

func OriginAccessIdentity_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func OriginAccessIdentity_IsResource 

func OriginAccessIdentity_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func OriginRequestPolicy_IsConstruct 

func OriginRequestPolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func OriginRequestPolicy_IsOwnedResource added in v2.32.0 

func OriginRequestPolicy_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func OriginRequestPolicy_IsResource 

func OriginRequestPolicy_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func PublicKey_IsConstruct 

func PublicKey_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func PublicKey_IsOwnedResource added in v2.32.0 

func PublicKey_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func PublicKey_IsResource 

func PublicKey_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

func ResponseHeadersPolicy_IsConstruct added in v2.1.0 

func ResponseHeadersPolicy_IsConstruct(x interface{}) *bool

Checks if `x` is a construct.

Use this method instead of `instanceof` to properly detect `Construct` instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the `constructs` library on disk are seen as independent, completely different libraries. As a consequence, the class `Construct` in each copy of the `constructs` library is seen as a different class, and an instance of one class will not test as `instanceof` the other class. `npm install` will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the `constructs` library can be accidentally installed, and `instanceof` will behave unpredictably. It is safest to avoid using `instanceof`, and using this type-testing method instead.

Returns: true if `x` is an object created from a class which extends `Construct`.

func ResponseHeadersPolicy_IsOwnedResource added in v2.32.0 

func ResponseHeadersPolicy_IsOwnedResource(construct constructs.IConstruct) *bool

Returns true if the construct was created by CDK, and false otherwise.

func ResponseHeadersPolicy_IsResource added in v2.1.0 

func ResponseHeadersPolicy_IsResource(construct constructs.IConstruct) *bool

Check whether the given construct is a Resource.

Types

type AddBehaviorOptions 

type AddBehaviorOptions struct {
	// HTTP methods to allow for this behavior.
	AllowedMethods AllowedMethods `field:"optional" json:"allowedMethods" yaml:"allowedMethods"`
	// HTTP methods to cache for this behavior.
	CachedMethods CachedMethods `field:"optional" json:"cachedMethods" yaml:"cachedMethods"`
	// The cache policy for this behavior.
	//
	// The cache policy determines what values are included in the cache key,
	// and the time-to-live (TTL) values for the cache.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html.
	//
	CachePolicy ICachePolicy `field:"optional" json:"cachePolicy" yaml:"cachePolicy"`
	// Whether you want CloudFront to automatically compress certain files for this cache behavior.
	//
	// See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types
	// for file types CloudFront will compress.
	Compress *bool `field:"optional" json:"compress" yaml:"compress"`
	// The Lambda@Edge functions to invoke before serving the contents.
	// See: https://aws.amazon.com/lambda/edge
	//
	EdgeLambdas *[]*EdgeLambda `field:"optional" json:"edgeLambdas" yaml:"edgeLambdas"`
	// The CloudFront functions to invoke before serving the contents.
	FunctionAssociations *[]*FunctionAssociation `field:"optional" json:"functionAssociations" yaml:"functionAssociations"`
	// The origin request policy for this behavior.
	//
	// The origin request policy determines which values (e.g., headers, cookies)
	// are included in requests that CloudFront sends to the origin.
	OriginRequestPolicy IOriginRequestPolicy `field:"optional" json:"originRequestPolicy" yaml:"originRequestPolicy"`
	// The response headers policy for this behavior.
	//
	// The response headers policy determines which headers are included in responses.
	ResponseHeadersPolicy IResponseHeadersPolicy `field:"optional" json:"responseHeadersPolicy" yaml:"responseHeadersPolicy"`
	// Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior.
	SmoothStreaming *bool `field:"optional" json:"smoothStreaming" yaml:"smoothStreaming"`
	// A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
	//
	TrustedKeyGroups *[]IKeyGroup `field:"optional" json:"trustedKeyGroups" yaml:"trustedKeyGroups"`
	// The protocol that viewers can use to access the files controlled by this behavior.
	ViewerProtocolPolicy ViewerProtocolPolicy `field:"optional" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
}

Options for adding a new behavior to a Distribution.

Example: 

// Add a behavior to a Distribution after initial creation.
var myBucket bucket
var myWebDistribution distribution

myWebDistribution.addBehavior(jsii.String("/images/*.jpg"), origins.NewS3Origin(myBucket), &addBehaviorOptions{
	viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
})

type AllowedMethods 

type AllowedMethods interface {
	// HTTP methods supported.
	Methods() *[]*string
}

The HTTP methods that the Behavior will accept requests on.

Example: 

// Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
var myBucket bucket

myWebDistribution := cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
		allowedMethods: cloudfront.allowedMethods_ALLOW_ALL(),
		viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
	},
})

func AllowedMethods_ALLOW_ALL 

func AllowedMethods_ALLOW_ALL() AllowedMethods

func AllowedMethods_ALLOW_GET_HEAD 

func AllowedMethods_ALLOW_GET_HEAD() AllowedMethods

func AllowedMethods_ALLOW_GET_HEAD_OPTIONS 

func AllowedMethods_ALLOW_GET_HEAD_OPTIONS() AllowedMethods

type Behavior 

type Behavior struct {
	// The method this CloudFront distribution responds do.
	AllowedMethods CloudFrontAllowedMethods `field:"optional" json:"allowedMethods" yaml:"allowedMethods"`
	// Which methods are cached by CloudFront by default.
	CachedMethods CloudFrontAllowedCachedMethods `field:"optional" json:"cachedMethods" yaml:"cachedMethods"`
	// If CloudFront should automatically compress some content types.
	Compress *bool `field:"optional" json:"compress" yaml:"compress"`
	// The default amount of time CloudFront will cache an object.
	//
	// This value applies only when your custom origin does not add HTTP headers,
	// such as Cache-Control max-age, Cache-Control s-maxage, and Expires to objects.
	DefaultTtl awscdk.Duration `field:"optional" json:"defaultTtl" yaml:"defaultTtl"`
	// The values CloudFront will forward to the origin when making a request.
	ForwardedValues *CfnDistribution_ForwardedValuesProperty `field:"optional" json:"forwardedValues" yaml:"forwardedValues"`
	// The CloudFront functions to invoke before serving the contents.
	FunctionAssociations *[]*FunctionAssociation `field:"optional" json:"functionAssociations" yaml:"functionAssociations"`
	// If this behavior is the default behavior for the distribution.
	//
	// You must specify exactly one default distribution per CloudFront distribution.
	// The default behavior is allowed to omit the "path" property.
	IsDefaultBehavior *bool `field:"optional" json:"isDefaultBehavior" yaml:"isDefaultBehavior"`
	// Declares associated lambda@edge functions for this distribution behaviour.
	LambdaFunctionAssociations *[]*LambdaFunctionAssociation `field:"optional" json:"lambdaFunctionAssociations" yaml:"lambdaFunctionAssociations"`
	// The max amount of time you want objects to stay in the cache before CloudFront queries your origin.
	MaxTtl awscdk.Duration `field:"optional" json:"maxTtl" yaml:"maxTtl"`
	// The minimum amount of time that you want objects to stay in the cache before CloudFront queries your origin.
	MinTtl awscdk.Duration `field:"optional" json:"minTtl" yaml:"minTtl"`
	// The path this behavior responds to.
	//
	// Required for all non-default behaviors. (The default behavior implicitly has "*" as the path pattern. )
	PathPattern *string `field:"optional" json:"pathPattern" yaml:"pathPattern"`
	// A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
	//
	TrustedKeyGroups *[]IKeyGroup `field:"optional" json:"trustedKeyGroups" yaml:"trustedKeyGroups"`
	// Trusted signers is how CloudFront allows you to serve private content.
	//
	// The signers are the account IDs that are allowed to sign cookies/presigned URLs for this distribution.
	//
	// If you pass a non empty value, all requests for this behavior must be signed (no public access will be allowed).
	// Deprecated: - We recommend using trustedKeyGroups instead of trustedSigners.
	TrustedSigners *[]*string `field:"optional" json:"trustedSigners" yaml:"trustedSigners"`
	// The viewer policy for this behavior.
	ViewerProtocolPolicy ViewerProtocolPolicy `field:"optional" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
}

A CloudFront behavior wrapper.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import cdk "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

var function_ function
var keyGroup keyGroup
var version version

behavior := &behavior{
	allowedMethods: awscdk.Aws_cloudfront.cloudFrontAllowedMethods_GET_HEAD,
	cachedMethods: awscdk.*Aws_cloudfront.cloudFrontAllowedCachedMethods_GET_HEAD,
	compress: jsii.Boolean(false),
	defaultTtl: cdk.duration.minutes(jsii.Number(30)),
	forwardedValues: &forwardedValuesProperty{
		queryString: jsii.Boolean(false),

		// the properties below are optional
		cookies: &cookiesProperty{
			forward: jsii.String("forward"),

			// the properties below are optional
			whitelistedNames: []*string{
				jsii.String("whitelistedNames"),
			},
		},
		headers: []*string{
			jsii.String("headers"),
		},
		queryStringCacheKeys: []*string{
			jsii.String("queryStringCacheKeys"),
		},
	},
	functionAssociations: []functionAssociation{
		&functionAssociation{
			eventType: awscdk.*Aws_cloudfront.functionEventType_VIEWER_REQUEST,
			function: function_,
		},
	},
	isDefaultBehavior: jsii.Boolean(false),
	lambdaFunctionAssociations: []lambdaFunctionAssociation{
		&lambdaFunctionAssociation{
			eventType: awscdk.*Aws_cloudfront.lambdaEdgeEventType_ORIGIN_REQUEST,
			lambdaFunction: version,

			// the properties below are optional
			includeBody: jsii.Boolean(false),
		},
	},
	maxTtl: cdk.*duration.minutes(jsii.Number(30)),
	minTtl: cdk.*duration.minutes(jsii.Number(30)),
	pathPattern: jsii.String("pathPattern"),
	trustedKeyGroups: []iKeyGroup{
		keyGroup,
	},
	trustedSigners: []*string{
		jsii.String("trustedSigners"),
	},
	viewerProtocolPolicy: awscdk.*Aws_cloudfront.viewerProtocolPolicy_HTTPS_ONLY,
}

type BehaviorOptions 

type BehaviorOptions struct {
	// HTTP methods to allow for this behavior.
	AllowedMethods AllowedMethods `field:"optional" json:"allowedMethods" yaml:"allowedMethods"`
	// HTTP methods to cache for this behavior.
	CachedMethods CachedMethods `field:"optional" json:"cachedMethods" yaml:"cachedMethods"`
	// The cache policy for this behavior.
	//
	// The cache policy determines what values are included in the cache key,
	// and the time-to-live (TTL) values for the cache.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html.
	//
	CachePolicy ICachePolicy `field:"optional" json:"cachePolicy" yaml:"cachePolicy"`
	// Whether you want CloudFront to automatically compress certain files for this cache behavior.
	//
	// See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types
	// for file types CloudFront will compress.
	Compress *bool `field:"optional" json:"compress" yaml:"compress"`
	// The Lambda@Edge functions to invoke before serving the contents.
	// See: https://aws.amazon.com/lambda/edge
	//
	EdgeLambdas *[]*EdgeLambda `field:"optional" json:"edgeLambdas" yaml:"edgeLambdas"`
	// The CloudFront functions to invoke before serving the contents.
	FunctionAssociations *[]*FunctionAssociation `field:"optional" json:"functionAssociations" yaml:"functionAssociations"`
	// The origin request policy for this behavior.
	//
	// The origin request policy determines which values (e.g., headers, cookies)
	// are included in requests that CloudFront sends to the origin.
	OriginRequestPolicy IOriginRequestPolicy `field:"optional" json:"originRequestPolicy" yaml:"originRequestPolicy"`
	// The response headers policy for this behavior.
	//
	// The response headers policy determines which headers are included in responses.
	ResponseHeadersPolicy IResponseHeadersPolicy `field:"optional" json:"responseHeadersPolicy" yaml:"responseHeadersPolicy"`
	// Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior.
	SmoothStreaming *bool `field:"optional" json:"smoothStreaming" yaml:"smoothStreaming"`
	// A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
	//
	TrustedKeyGroups *[]IKeyGroup `field:"optional" json:"trustedKeyGroups" yaml:"trustedKeyGroups"`
	// The protocol that viewers can use to access the files controlled by this behavior.
	ViewerProtocolPolicy ViewerProtocolPolicy `field:"optional" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
	// The origin that you want CloudFront to route requests to when they match this behavior.
	Origin IOrigin `field:"required" json:"origin" yaml:"origin"`
}

Options for creating a new behavior.

Example: 

// Adding an existing Lambda@Edge function created in a different stack
// to a CloudFront distribution.
var s3Bucket bucket

functionVersion := lambda.version.fromVersionArn(this, jsii.String("Version"), jsii.String("arn:aws:lambda:us-east-1:123456789012:function:functionName:1"))

cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: functionVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})

type CacheCookieBehavior 

type CacheCookieBehavior interface {
	// The behavior of cookies: allow all, none, an allow list, or a deny list.
	Behavior() *string
	// The cookies to allow or deny, if the behavior is an allow or deny list.
	Cookies() *[]*string
}

Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom cache policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myCachePolicy := cloudfront.NewCachePolicy(this, jsii.String("myCachePolicy"), &cachePolicyProps{
	cachePolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	defaultTtl: awscdk.Duration.days(jsii.Number(2)),
	minTtl: awscdk.Duration.minutes(jsii.Number(1)),
	maxTtl: awscdk.Duration.days(jsii.Number(10)),
	cookieBehavior: cloudfront.cacheCookieBehavior.all(),
	headerBehavior: cloudfront.cacheHeaderBehavior.allowList(jsii.String("X-CustomHeader")),
	queryStringBehavior: cloudfront.cacheQueryStringBehavior.denyList(jsii.String("username")),
	enableAcceptEncodingGzip: jsii.Boolean(true),
	enableAcceptEncodingBrotli: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: myCachePolicy,
	},
})

func CacheCookieBehavior_All 

func CacheCookieBehavior_All() CacheCookieBehavior

All cookies in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.

func CacheCookieBehavior_AllowList 

func CacheCookieBehavior_AllowList(cookies ...*string) CacheCookieBehavior

Only the provided `cookies` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

func CacheCookieBehavior_DenyList 

func CacheCookieBehavior_DenyList(cookies ...*string) CacheCookieBehavior

All cookies except the provided `cookies` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

func CacheCookieBehavior_None 

func CacheCookieBehavior_None() CacheCookieBehavior

Cookies in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.

type CacheHeaderBehavior 

type CacheHeaderBehavior interface {
	// If no headers will be passed, or an allow list of headers.
	Behavior() *string
	// The headers for the allow/deny list, if applicable.
	Headers() *[]*string
}

Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom cache policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myCachePolicy := cloudfront.NewCachePolicy(this, jsii.String("myCachePolicy"), &cachePolicyProps{
	cachePolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	defaultTtl: awscdk.Duration.days(jsii.Number(2)),
	minTtl: awscdk.Duration.minutes(jsii.Number(1)),
	maxTtl: awscdk.Duration.days(jsii.Number(10)),
	cookieBehavior: cloudfront.cacheCookieBehavior.all(),
	headerBehavior: cloudfront.cacheHeaderBehavior.allowList(jsii.String("X-CustomHeader")),
	queryStringBehavior: cloudfront.cacheQueryStringBehavior.denyList(jsii.String("username")),
	enableAcceptEncodingGzip: jsii.Boolean(true),
	enableAcceptEncodingBrotli: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: myCachePolicy,
	},
})

func CacheHeaderBehavior_AllowList 

func CacheHeaderBehavior_AllowList(headers ...*string) CacheHeaderBehavior

Listed headers are included in the cache key and are automatically included in requests that CloudFront sends to the origin.

func CacheHeaderBehavior_None 

func CacheHeaderBehavior_None() CacheHeaderBehavior

HTTP headers are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.

type CachePolicy 

type CachePolicy interface {
	awscdk.Resource
	ICachePolicy
	// The ID of the cache policy.
	CachePolicyId() *string
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A Cache Policy configuration.

Example: 

// Using an existing cache policy for a Distribution
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: cloudfront.cachePolicy_CACHING_OPTIMIZED(),
	},
})

func NewCachePolicy 

func NewCachePolicy(scope constructs.Construct, id *string, props *CachePolicyProps) CachePolicy

type CachePolicyProps 

type CachePolicyProps struct {
	// A unique name to identify the cache policy.
	//
	// The name must only include '-', '_', or alphanumeric characters.
	CachePolicyName *string `field:"optional" json:"cachePolicyName" yaml:"cachePolicyName"`
	// A comment to describe the cache policy.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	CookieBehavior CacheCookieBehavior `field:"optional" json:"cookieBehavior" yaml:"cookieBehavior"`
	// The default amount of time for objects to stay in the CloudFront cache.
	//
	// Only used when the origin does not send Cache-Control or Expires headers with the object.
	DefaultTtl awscdk.Duration `field:"optional" json:"defaultTtl" yaml:"defaultTtl"`
	// Whether to normalize and include the `Accept-Encoding` header in the cache key when the `Accept-Encoding` header is 'br'.
	EnableAcceptEncodingBrotli *bool `field:"optional" json:"enableAcceptEncodingBrotli" yaml:"enableAcceptEncodingBrotli"`
	// Whether to normalize and include the `Accept-Encoding` header in the cache key when the `Accept-Encoding` header is 'gzip'.
	EnableAcceptEncodingGzip *bool `field:"optional" json:"enableAcceptEncodingGzip" yaml:"enableAcceptEncodingGzip"`
	// Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	HeaderBehavior CacheHeaderBehavior `field:"optional" json:"headerBehavior" yaml:"headerBehavior"`
	// The maximum amount of time for objects to stay in the CloudFront cache.
	//
	// CloudFront uses this value only when the origin sends Cache-Control or Expires headers with the object.
	MaxTtl awscdk.Duration `field:"optional" json:"maxTtl" yaml:"maxTtl"`
	// The minimum amount of time for objects to stay in the CloudFront cache.
	MinTtl awscdk.Duration `field:"optional" json:"minTtl" yaml:"minTtl"`
	// Determines whether any query strings are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	QueryStringBehavior CacheQueryStringBehavior `field:"optional" json:"queryStringBehavior" yaml:"queryStringBehavior"`
}

Properties for creating a Cache Policy.

Example: 

// Creating a custom cache policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myCachePolicy := cloudfront.NewCachePolicy(this, jsii.String("myCachePolicy"), &cachePolicyProps{
	cachePolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	defaultTtl: awscdk.Duration.days(jsii.Number(2)),
	minTtl: awscdk.Duration.minutes(jsii.Number(1)),
	maxTtl: awscdk.Duration.days(jsii.Number(10)),
	cookieBehavior: cloudfront.cacheCookieBehavior.all(),
	headerBehavior: cloudfront.cacheHeaderBehavior.allowList(jsii.String("X-CustomHeader")),
	queryStringBehavior: cloudfront.cacheQueryStringBehavior.denyList(jsii.String("username")),
	enableAcceptEncodingGzip: jsii.Boolean(true),
	enableAcceptEncodingBrotli: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: myCachePolicy,
	},
})

type CacheQueryStringBehavior 

type CacheQueryStringBehavior interface {
	// The behavior of query strings -- allow all, none, only an allow list, or a deny list.
	Behavior() *string
	// The query strings to allow or deny, if the behavior is an allow or deny list.
	QueryStrings() *[]*string
}

Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom cache policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myCachePolicy := cloudfront.NewCachePolicy(this, jsii.String("myCachePolicy"), &cachePolicyProps{
	cachePolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	defaultTtl: awscdk.Duration.days(jsii.Number(2)),
	minTtl: awscdk.Duration.minutes(jsii.Number(1)),
	maxTtl: awscdk.Duration.days(jsii.Number(10)),
	cookieBehavior: cloudfront.cacheCookieBehavior.all(),
	headerBehavior: cloudfront.cacheHeaderBehavior.allowList(jsii.String("X-CustomHeader")),
	queryStringBehavior: cloudfront.cacheQueryStringBehavior.denyList(jsii.String("username")),
	enableAcceptEncodingGzip: jsii.Boolean(true),
	enableAcceptEncodingBrotli: jsii.Boolean(true),
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		cachePolicy: myCachePolicy,
	},
})

func CacheQueryStringBehavior_All 

func CacheQueryStringBehavior_All() CacheQueryStringBehavior

All query strings in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.

func CacheQueryStringBehavior_AllowList 

func CacheQueryStringBehavior_AllowList(queryStrings ...*string) CacheQueryStringBehavior

Only the provided `queryStrings` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

func CacheQueryStringBehavior_DenyList 

func CacheQueryStringBehavior_DenyList(queryStrings ...*string) CacheQueryStringBehavior

All query strings except the provided `queryStrings` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

func CacheQueryStringBehavior_None 

func CacheQueryStringBehavior_None() CacheQueryStringBehavior

Query strings in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.

type CachedMethods 

type CachedMethods interface {
	// HTTP methods supported.
	Methods() *[]*string
}

The HTTP methods that the Behavior will cache requests on.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cachedMethods := awscdk.Aws_cloudfront.cachedMethods_CACHE_GET_HEAD()

func CachedMethods_CACHE_GET_HEAD 

func CachedMethods_CACHE_GET_HEAD() CachedMethods

func CachedMethods_CACHE_GET_HEAD_OPTIONS 

func CachedMethods_CACHE_GET_HEAD_OPTIONS() CachedMethods

type CfnCachePolicy 

type CfnCachePolicy interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The unique identifier for the cache policy.
	//
	// For example: `2766f7b2-75c5-41c6-8f06-bf4303a2f2f5` .
	AttrId() *string
	// The date and time when the cache policy was last modified.
	AttrLastModifiedTime() *string
	// The cache policy configuration.
	CachePolicyConfig() interface{}
	SetCachePolicyConfig(val interface{})
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::CachePolicy`.

A cache policy.

When it’s attached to a cache behavior, the cache policy determines the following:

- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer. - The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.

The headers, cookies, and query strings that are included in the cache key are automatically included in requests that CloudFront sends to the origin. CloudFront sends a request when it can’t find a valid object in its cache that matches the request’s cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnCachePolicy := awscdk.Aws_cloudfront.NewCfnCachePolicy(this, jsii.String("MyCfnCachePolicy"), &cfnCachePolicyProps{
	cachePolicyConfig: &cachePolicyConfigProperty{
		defaultTtl: jsii.Number(123),
		maxTtl: jsii.Number(123),
		minTtl: jsii.Number(123),
		name: jsii.String("name"),
		parametersInCacheKeyAndForwardedToOrigin: &parametersInCacheKeyAndForwardedToOriginProperty{
			cookiesConfig: &cookiesConfigProperty{
				cookieBehavior: jsii.String("cookieBehavior"),

				// the properties below are optional
				cookies: []*string{
					jsii.String("cookies"),
				},
			},
			enableAcceptEncodingGzip: jsii.Boolean(false),
			headersConfig: &headersConfigProperty{
				headerBehavior: jsii.String("headerBehavior"),

				// the properties below are optional
				headers: []*string{
					jsii.String("headers"),
				},
			},
			queryStringsConfig: &queryStringsConfigProperty{
				queryStringBehavior: jsii.String("queryStringBehavior"),

				// the properties below are optional
				queryStrings: []*string{
					jsii.String("queryStrings"),
				},
			},

			// the properties below are optional
			enableAcceptEncodingBrotli: jsii.Boolean(false),
		},

		// the properties below are optional
		comment: jsii.String("comment"),
	},
})

func NewCfnCachePolicy 

func NewCfnCachePolicy(scope constructs.Construct, id *string, props *CfnCachePolicyProps) CfnCachePolicy

Create a new `AWS::CloudFront::CachePolicy`.

type CfnCachePolicyProps 

type CfnCachePolicyProps struct {
	// The cache policy configuration.
	CachePolicyConfig interface{} `field:"required" json:"cachePolicyConfig" yaml:"cachePolicyConfig"`
}

Properties for defining a `CfnCachePolicy`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnCachePolicyProps := &cfnCachePolicyProps{
	cachePolicyConfig: &cachePolicyConfigProperty{
		defaultTtl: jsii.Number(123),
		maxTtl: jsii.Number(123),
		minTtl: jsii.Number(123),
		name: jsii.String("name"),
		parametersInCacheKeyAndForwardedToOrigin: &parametersInCacheKeyAndForwardedToOriginProperty{
			cookiesConfig: &cookiesConfigProperty{
				cookieBehavior: jsii.String("cookieBehavior"),

				// the properties below are optional
				cookies: []*string{
					jsii.String("cookies"),
				},
			},
			enableAcceptEncodingGzip: jsii.Boolean(false),
			headersConfig: &headersConfigProperty{
				headerBehavior: jsii.String("headerBehavior"),

				// the properties below are optional
				headers: []*string{
					jsii.String("headers"),
				},
			},
			queryStringsConfig: &queryStringsConfigProperty{
				queryStringBehavior: jsii.String("queryStringBehavior"),

				// the properties below are optional
				queryStrings: []*string{
					jsii.String("queryStrings"),
				},
			},

			// the properties below are optional
			enableAcceptEncodingBrotli: jsii.Boolean(false),
		},

		// the properties below are optional
		comment: jsii.String("comment"),
	},
}

type CfnCachePolicy_CachePolicyConfigProperty 

type CfnCachePolicy_CachePolicyConfigProperty struct {
	// The default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
	//
	// CloudFront uses this value as the object’s time to live (TTL) only when the origin does *not* send `Cache-Control` or `Expires` headers with the object. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The default value for this field is 86400 seconds (one day). If the value of `MinTTL` is more than 86400 seconds, then the default value for this field is the same as the value of `MinTTL` .
	DefaultTtl *float64 `field:"required" json:"defaultTtl" yaml:"defaultTtl"`
	// The maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
	//
	// CloudFront uses this value only when the origin sends `Cache-Control` or `Expires` headers with the object. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The default value for this field is 31536000 seconds (one year). If the value of `MinTTL` or `DefaultTTL` is more than 31536000 seconds, then the default value for this field is the same as the value of `DefaultTTL` .
	MaxTtl *float64 `field:"required" json:"maxTtl" yaml:"maxTtl"`
	// The minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.
	//
	// For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	MinTtl *float64 `field:"required" json:"minTtl" yaml:"minTtl"`
	// A unique name to identify the cache policy.
	Name *string `field:"required" json:"name" yaml:"name"`
	// The HTTP headers, cookies, and URL query strings to include in the cache key.
	//
	// The values included in the cache key are automatically included in requests that CloudFront sends to the origin.
	ParametersInCacheKeyAndForwardedToOrigin interface{} `field:"required" json:"parametersInCacheKeyAndForwardedToOrigin" yaml:"parametersInCacheKeyAndForwardedToOrigin"`
	// A comment to describe the cache policy.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
}

A cache policy configuration.

This configuration determines the following:

- The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer. - The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.

The headers, cookies, and query strings that are included in the cache key are automatically included in requests that CloudFront sends to the origin. CloudFront sends a request when it can’t find a valid object in its cache that matches the request’s cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cachePolicyConfigProperty := &cachePolicyConfigProperty{
	defaultTtl: jsii.Number(123),
	maxTtl: jsii.Number(123),
	minTtl: jsii.Number(123),
	name: jsii.String("name"),
	parametersInCacheKeyAndForwardedToOrigin: &parametersInCacheKeyAndForwardedToOriginProperty{
		cookiesConfig: &cookiesConfigProperty{
			cookieBehavior: jsii.String("cookieBehavior"),

			// the properties below are optional
			cookies: []*string{
				jsii.String("cookies"),
			},
		},
		enableAcceptEncodingGzip: jsii.Boolean(false),
		headersConfig: &headersConfigProperty{
			headerBehavior: jsii.String("headerBehavior"),

			// the properties below are optional
			headers: []*string{
				jsii.String("headers"),
			},
		},
		queryStringsConfig: &queryStringsConfigProperty{
			queryStringBehavior: jsii.String("queryStringBehavior"),

			// the properties below are optional
			queryStrings: []*string{
				jsii.String("queryStrings"),
			},
		},

		// the properties below are optional
		enableAcceptEncodingBrotli: jsii.Boolean(false),
	},

	// the properties below are optional
	comment: jsii.String("comment"),
}

type CfnCachePolicy_CookiesConfigProperty 

type CfnCachePolicy_CookiesConfigProperty struct {
	// Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	//
	// Valid values are:
	//
	// - `none` – Cookies in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any cookies that are listed in an `OriginRequestPolicy` *are* included in origin requests.
	// - `whitelist` – The cookies in viewer requests that are listed in the `CookieNames` type are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	// - `allExcept` – All cookies in viewer requests that are **not** listed in the `CookieNames` type are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	// - `all` – All cookies in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.
	CookieBehavior *string `field:"required" json:"cookieBehavior" yaml:"cookieBehavior"`
	// Contains a list of cookie names.
	Cookies *[]*string `field:"optional" json:"cookies" yaml:"cookies"`
}

An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cookiesConfigProperty := &cookiesConfigProperty{
	cookieBehavior: jsii.String("cookieBehavior"),

	// the properties below are optional
	cookies: []*string{
		jsii.String("cookies"),
	},
}

type CfnCachePolicy_HeadersConfigProperty 

type CfnCachePolicy_HeadersConfigProperty struct {
	// Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	//
	// Valid values are:
	//
	// - `none` – HTTP headers are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any headers that are listed in an `OriginRequestPolicy` *are* included in origin requests.
	// - `whitelist` – The HTTP headers that are listed in the `Headers` type are included in the cache key and are automatically included in requests that CloudFront sends to the origin.
	HeaderBehavior *string `field:"required" json:"headerBehavior" yaml:"headerBehavior"`
	// Contains a list of HTTP header names.
	Headers *[]*string `field:"optional" json:"headers" yaml:"headers"`
}

An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

headersConfigProperty := &headersConfigProperty{
	headerBehavior: jsii.String("headerBehavior"),

	// the properties below are optional
	headers: []*string{
		jsii.String("headers"),
	},
}

type CfnCachePolicy_ParametersInCacheKeyAndForwardedToOriginProperty 

type CfnCachePolicy_ParametersInCacheKeyAndForwardedToOriginProperty struct {
	// An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	CookiesConfig interface{} `field:"required" json:"cookiesConfig" yaml:"cookiesConfig"`
	// A flag that can affect whether the `Accept-Encoding` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
	//
	// This field is related to the `EnableAcceptEncodingBrotli` field. If one or both of these fields is `true` *and* the viewer request includes the `Accept-Encoding` header, then CloudFront does the following:
	//
	// - Normalizes the value of the viewer’s `Accept-Encoding` header
	// - Includes the normalized header in the cache key
	// - Includes the normalized header in the request to the origin, if a request is necessary
	//
	// For more information, see [Compression support](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects) in the *Amazon CloudFront Developer Guide* .
	//
	// If you set this value to `true` , and this cache behavior also has an origin request policy attached, do not include the `Accept-Encoding` header in the origin request policy. CloudFront always includes the `Accept-Encoding` header in origin requests when the value of this field is `true` , so including this header in an origin request policy has no effect.
	//
	// If both of these fields are `false` , then CloudFront treats the `Accept-Encoding` header the same as any other HTTP header in the viewer request. By default, it’s not included in the cache key and it’s not included in origin requests. In this case, you can manually add `Accept-Encoding` to the headers whitelist like any other HTTP header.
	EnableAcceptEncodingGzip interface{} `field:"required" json:"enableAcceptEncodingGzip" yaml:"enableAcceptEncodingGzip"`
	// An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	HeadersConfig interface{} `field:"required" json:"headersConfig" yaml:"headersConfig"`
	// An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	QueryStringsConfig interface{} `field:"required" json:"queryStringsConfig" yaml:"queryStringsConfig"`
	// A flag that can affect whether the `Accept-Encoding` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
	//
	// This field is related to the `EnableAcceptEncodingGzip` field. If one or both of these fields is `true` *and* the viewer request includes the `Accept-Encoding` header, then CloudFront does the following:
	//
	// - Normalizes the value of the viewer’s `Accept-Encoding` header
	// - Includes the normalized header in the cache key
	// - Includes the normalized header in the request to the origin, if a request is necessary
	//
	// For more information, see [Compression support](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects) in the *Amazon CloudFront Developer Guide* .
	//
	// If you set this value to `true` , and this cache behavior also has an origin request policy attached, do not include the `Accept-Encoding` header in the origin request policy. CloudFront always includes the `Accept-Encoding` header in origin requests when the value of this field is `true` , so including this header in an origin request policy has no effect.
	//
	// If both of these fields are `false` , then CloudFront treats the `Accept-Encoding` header the same as any other HTTP header in the viewer request. By default, it’s not included in the cache key and it’s not included in origin requests. In this case, you can manually add `Accept-Encoding` to the headers whitelist like any other HTTP header.
	EnableAcceptEncodingBrotli interface{} `field:"optional" json:"enableAcceptEncodingBrotli" yaml:"enableAcceptEncodingBrotli"`
}

This object determines the values that CloudFront includes in the cache key.

These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.

The headers, cookies, and query strings that are included in the cache key are automatically included in requests that CloudFront sends to the origin. CloudFront sends a request when it can’t find an object in its cache that matches the request’s cache key. If you want to send values to the origin but *not* include them in the cache key, use `OriginRequestPolicy` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

parametersInCacheKeyAndForwardedToOriginProperty := &parametersInCacheKeyAndForwardedToOriginProperty{
	cookiesConfig: &cookiesConfigProperty{
		cookieBehavior: jsii.String("cookieBehavior"),

		// the properties below are optional
		cookies: []*string{
			jsii.String("cookies"),
		},
	},
	enableAcceptEncodingGzip: jsii.Boolean(false),
	headersConfig: &headersConfigProperty{
		headerBehavior: jsii.String("headerBehavior"),

		// the properties below are optional
		headers: []*string{
			jsii.String("headers"),
		},
	},
	queryStringsConfig: &queryStringsConfigProperty{
		queryStringBehavior: jsii.String("queryStringBehavior"),

		// the properties below are optional
		queryStrings: []*string{
			jsii.String("queryStrings"),
		},
	},

	// the properties below are optional
	enableAcceptEncodingBrotli: jsii.Boolean(false),
}

type CfnCachePolicy_QueryStringsConfigProperty 

type CfnCachePolicy_QueryStringsConfigProperty struct {
	// Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	//
	// Valid values are:
	//
	// - `none` – Query strings in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any query strings that are listed in an `OriginRequestPolicy` *are* included in origin requests.
	// - `whitelist` – The query strings in viewer requests that are listed in the `QueryStringNames` type are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	// - `allExcept` – All query strings in viewer requests that are **not** listed in the `QueryStringNames` type are included in the cache key and automatically included in requests that CloudFront sends to the origin.
	// - `all` – All query strings in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.
	QueryStringBehavior *string `field:"required" json:"queryStringBehavior" yaml:"queryStringBehavior"`
	// Contains a list of query string names.
	QueryStrings *[]*string `field:"optional" json:"queryStrings" yaml:"queryStrings"`
}

An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

queryStringsConfigProperty := &queryStringsConfigProperty{
	queryStringBehavior: jsii.String("queryStringBehavior"),

	// the properties below are optional
	queryStrings: []*string{
		jsii.String("queryStrings"),
	},
}

type CfnCloudFrontOriginAccessIdentity 

type CfnCloudFrontOriginAccessIdentity interface {
	awscdk.CfnResource
	awscdk.IInspectable
	AttrId() *string
	// The Amazon S3 canonical user ID for the origin access identity, used when giving the origin access identity read permission to an object in Amazon S3.
	//
	// For example: `b970b42360b81c8ddbd79d2f5df0069ba9033c8a79655752abe380cd6d63ba8bcf23384d568fcf89fc49700b5e11a0fd` .
	AttrS3CanonicalUserId() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// The current configuration information for the identity.
	CloudFrontOriginAccessIdentityConfig() interface{}
	SetCloudFrontOriginAccessIdentityConfig(val interface{})
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::CloudFrontOriginAccessIdentity`.

The request to create a new origin access identity (OAI). An origin access identity is a special CloudFront user that you can associate with Amazon S3 origins, so that you can secure all or just some of your Amazon S3 content. For more information, see [Restricting Access to Amazon S3 Content by Using an Origin Access Identity](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnCloudFrontOriginAccessIdentity := awscdk.Aws_cloudfront.NewCfnCloudFrontOriginAccessIdentity(this, jsii.String("MyCfnCloudFrontOriginAccessIdentity"), &cfnCloudFrontOriginAccessIdentityProps{
	cloudFrontOriginAccessIdentityConfig: &cloudFrontOriginAccessIdentityConfigProperty{
		comment: jsii.String("comment"),
	},
})

func NewCfnCloudFrontOriginAccessIdentity 

func NewCfnCloudFrontOriginAccessIdentity(scope constructs.Construct, id *string, props *CfnCloudFrontOriginAccessIdentityProps) CfnCloudFrontOriginAccessIdentity

Create a new `AWS::CloudFront::CloudFrontOriginAccessIdentity`.

type CfnCloudFrontOriginAccessIdentityProps 

type CfnCloudFrontOriginAccessIdentityProps struct {
	// The current configuration information for the identity.
	CloudFrontOriginAccessIdentityConfig interface{} `field:"required" json:"cloudFrontOriginAccessIdentityConfig" yaml:"cloudFrontOriginAccessIdentityConfig"`
}

Properties for defining a `CfnCloudFrontOriginAccessIdentity`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnCloudFrontOriginAccessIdentityProps := &cfnCloudFrontOriginAccessIdentityProps{
	cloudFrontOriginAccessIdentityConfig: &cloudFrontOriginAccessIdentityConfigProperty{
		comment: jsii.String("comment"),
	},
}

type CfnCloudFrontOriginAccessIdentity_CloudFrontOriginAccessIdentityConfigProperty 

type CfnCloudFrontOriginAccessIdentity_CloudFrontOriginAccessIdentityConfigProperty struct {
	// A comment to describe the origin access identity.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"required" json:"comment" yaml:"comment"`
}

Origin access identity configuration.

Send a `GET` request to the `/ *CloudFront API version* /CloudFront/identity ID/config` resource.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cloudFrontOriginAccessIdentityConfigProperty := &cloudFrontOriginAccessIdentityConfigProperty{
	comment: jsii.String("comment"),
}

type CfnDistribution 

type CfnDistribution interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The domain name of the resource, such as `d111111abcdef8.cloudfront.net` .
	AttrDomainName() *string
	AttrId() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The current configuration information for the distribution.
	//
	// Send a `GET` request to the `/ *CloudFront API version* /distribution ID/config` resource.
	DistributionConfig() interface{}
	SetDistributionConfig(val interface{})
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// A complex type that contains zero or more `Tag` elements.
	Tags() awscdk.TagManager
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::Distribution`.

A distribution tells CloudFront where you want content to be delivered from, and the details about how to track and manage content delivery.

Example: 

var sourceBucket bucket

myDistribution := cloudfront.NewDistribution(this, jsii.String("MyCfWebDistribution"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(sourceBucket),
	},
})
cfnDistribution := myDistribution.node.defaultChild.(cfnDistribution)
cfnDistribution.overrideLogicalId(jsii.String("MyDistributionCFDistribution3H55TI9Q"))

func NewCfnDistribution 

func NewCfnDistribution(scope constructs.Construct, id *string, props *CfnDistributionProps) CfnDistribution

Create a new `AWS::CloudFront::Distribution`.

type CfnDistributionProps 

type CfnDistributionProps struct {
	// The current configuration information for the distribution.
	//
	// Send a `GET` request to the `/ *CloudFront API version* /distribution ID/config` resource.
	DistributionConfig interface{} `field:"required" json:"distributionConfig" yaml:"distributionConfig"`
	// A complex type that contains zero or more `Tag` elements.
	Tags *[]*awscdk.CfnTag `field:"optional" json:"tags" yaml:"tags"`
}

Properties for defining a `CfnDistribution`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnDistributionProps := &cfnDistributionProps{
	distributionConfig: &distributionConfigProperty{
		enabled: jsii.Boolean(false),

		// the properties below are optional
		aliases: []*string{
			jsii.String("aliases"),
		},
		cacheBehaviors: []interface{}{
			&cacheBehaviorProperty{
				pathPattern: jsii.String("pathPattern"),
				targetOriginId: jsii.String("targetOriginId"),
				viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

				// the properties below are optional
				allowedMethods: []*string{
					jsii.String("allowedMethods"),
				},
				cachedMethods: []*string{
					jsii.String("cachedMethods"),
				},
				cachePolicyId: jsii.String("cachePolicyId"),
				compress: jsii.Boolean(false),
				defaultTtl: jsii.Number(123),
				fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
				forwardedValues: &forwardedValuesProperty{
					queryString: jsii.Boolean(false),

					// the properties below are optional
					cookies: &cookiesProperty{
						forward: jsii.String("forward"),

						// the properties below are optional
						whitelistedNames: []*string{
							jsii.String("whitelistedNames"),
						},
					},
					headers: []*string{
						jsii.String("headers"),
					},
					queryStringCacheKeys: []*string{
						jsii.String("queryStringCacheKeys"),
					},
				},
				functionAssociations: []interface{}{
					&functionAssociationProperty{
						eventType: jsii.String("eventType"),
						functionArn: jsii.String("functionArn"),
					},
				},
				lambdaFunctionAssociations: []interface{}{
					&lambdaFunctionAssociationProperty{
						eventType: jsii.String("eventType"),
						includeBody: jsii.Boolean(false),
						lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
					},
				},
				maxTtl: jsii.Number(123),
				minTtl: jsii.Number(123),
				originRequestPolicyId: jsii.String("originRequestPolicyId"),
				realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
				responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
				smoothStreaming: jsii.Boolean(false),
				trustedKeyGroups: []*string{
					jsii.String("trustedKeyGroups"),
				},
				trustedSigners: []*string{
					jsii.String("trustedSigners"),
				},
			},
		},
		cnamEs: []*string{
			jsii.String("cnamEs"),
		},
		comment: jsii.String("comment"),
		customErrorResponses: []interface{}{
			&customErrorResponseProperty{
				errorCode: jsii.Number(123),

				// the properties below are optional
				errorCachingMinTtl: jsii.Number(123),
				responseCode: jsii.Number(123),
				responsePagePath: jsii.String("responsePagePath"),
			},
		},
		customOrigin: &legacyCustomOriginProperty{
			dnsName: jsii.String("dnsName"),
			originProtocolPolicy: jsii.String("originProtocolPolicy"),
			originSslProtocols: []*string{
				jsii.String("originSslProtocols"),
			},

			// the properties below are optional
			httpPort: jsii.Number(123),
			httpsPort: jsii.Number(123),
		},
		defaultCacheBehavior: &defaultCacheBehaviorProperty{
			targetOriginId: jsii.String("targetOriginId"),
			viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

			// the properties below are optional
			allowedMethods: []*string{
				jsii.String("allowedMethods"),
			},
			cachedMethods: []*string{
				jsii.String("cachedMethods"),
			},
			cachePolicyId: jsii.String("cachePolicyId"),
			compress: jsii.Boolean(false),
			defaultTtl: jsii.Number(123),
			fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
			forwardedValues: &forwardedValuesProperty{
				queryString: jsii.Boolean(false),

				// the properties below are optional
				cookies: &cookiesProperty{
					forward: jsii.String("forward"),

					// the properties below are optional
					whitelistedNames: []*string{
						jsii.String("whitelistedNames"),
					},
				},
				headers: []*string{
					jsii.String("headers"),
				},
				queryStringCacheKeys: []*string{
					jsii.String("queryStringCacheKeys"),
				},
			},
			functionAssociations: []interface{}{
				&functionAssociationProperty{
					eventType: jsii.String("eventType"),
					functionArn: jsii.String("functionArn"),
				},
			},
			lambdaFunctionAssociations: []interface{}{
				&lambdaFunctionAssociationProperty{
					eventType: jsii.String("eventType"),
					includeBody: jsii.Boolean(false),
					lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
				},
			},
			maxTtl: jsii.Number(123),
			minTtl: jsii.Number(123),
			originRequestPolicyId: jsii.String("originRequestPolicyId"),
			realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
			responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
			smoothStreaming: jsii.Boolean(false),
			trustedKeyGroups: []*string{
				jsii.String("trustedKeyGroups"),
			},
			trustedSigners: []*string{
				jsii.String("trustedSigners"),
			},
		},
		defaultRootObject: jsii.String("defaultRootObject"),
		httpVersion: jsii.String("httpVersion"),
		ipv6Enabled: jsii.Boolean(false),
		logging: &loggingProperty{
			bucket: jsii.String("bucket"),

			// the properties below are optional
			includeCookies: jsii.Boolean(false),
			prefix: jsii.String("prefix"),
		},
		originGroups: &originGroupsProperty{
			quantity: jsii.Number(123),

			// the properties below are optional
			items: []interface{}{
				&originGroupProperty{
					failoverCriteria: &originGroupFailoverCriteriaProperty{
						statusCodes: &statusCodesProperty{
							items: []interface{}{
								jsii.Number(123),
							},
							quantity: jsii.Number(123),
						},
					},
					id: jsii.String("id"),
					members: &originGroupMembersProperty{
						items: []interface{}{
							&originGroupMemberProperty{
								originId: jsii.String("originId"),
							},
						},
						quantity: jsii.Number(123),
					},
				},
			},
		},
		origins: []interface{}{
			&originProperty{
				domainName: jsii.String("domainName"),
				id: jsii.String("id"),

				// the properties below are optional
				connectionAttempts: jsii.Number(123),
				connectionTimeout: jsii.Number(123),
				customOriginConfig: &customOriginConfigProperty{
					originProtocolPolicy: jsii.String("originProtocolPolicy"),

					// the properties below are optional
					httpPort: jsii.Number(123),
					httpsPort: jsii.Number(123),
					originKeepaliveTimeout: jsii.Number(123),
					originReadTimeout: jsii.Number(123),
					originSslProtocols: []*string{
						jsii.String("originSslProtocols"),
					},
				},
				originCustomHeaders: []interface{}{
					&originCustomHeaderProperty{
						headerName: jsii.String("headerName"),
						headerValue: jsii.String("headerValue"),
					},
				},
				originPath: jsii.String("originPath"),
				originShield: &originShieldProperty{
					enabled: jsii.Boolean(false),
					originShieldRegion: jsii.String("originShieldRegion"),
				},
				s3OriginConfig: &s3OriginConfigProperty{
					originAccessIdentity: jsii.String("originAccessIdentity"),
				},
			},
		},
		priceClass: jsii.String("priceClass"),
		restrictions: &restrictionsProperty{
			geoRestriction: &geoRestrictionProperty{
				restrictionType: jsii.String("restrictionType"),

				// the properties below are optional
				locations: []*string{
					jsii.String("locations"),
				},
			},
		},
		s3Origin: &legacyS3OriginProperty{
			dnsName: jsii.String("dnsName"),

			// the properties below are optional
			originAccessIdentity: jsii.String("originAccessIdentity"),
		},
		viewerCertificate: &viewerCertificateProperty{
			acmCertificateArn: jsii.String("acmCertificateArn"),
			cloudFrontDefaultCertificate: jsii.Boolean(false),
			iamCertificateId: jsii.String("iamCertificateId"),
			minimumProtocolVersion: jsii.String("minimumProtocolVersion"),
			sslSupportMethod: jsii.String("sslSupportMethod"),
		},
		webAclId: jsii.String("webAclId"),
	},

	// the properties below are optional
	tags: []cfnTag{
		&cfnTag{
			key: jsii.String("key"),
			value: jsii.String("value"),
		},
	},
}

type CfnDistribution_CacheBehaviorProperty 

type CfnDistribution_CacheBehaviorProperty struct {
	// The pattern (for example, `images/*.jpg` ) that specifies which requests to apply the behavior to. When CloudFront receives a viewer request, the requested path is compared with path patterns in the order in which cache behaviors are listed in the distribution.
	//
	// > You can optionally include a slash ( `/` ) at the beginning of the path pattern. For example, `/images/*.jpg` . CloudFront behavior is the same with or without the leading `/` .
	//
	// The path pattern for the default cache behavior is `*` and cannot be changed. If the request for an object does not match the path pattern for any cache behaviors, CloudFront applies the behavior in the default cache behavior.
	//
	// For more information, see [Path Pattern](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesPathPattern) in the *Amazon CloudFront Developer Guide* .
	PathPattern *string `field:"required" json:"pathPattern" yaml:"pathPattern"`
	// The value of `ID` for the origin that you want CloudFront to route requests to when they match this cache behavior.
	TargetOriginId *string `field:"required" json:"targetOriginId" yaml:"targetOriginId"`
	// The protocol that viewers can use to access the files in the origin specified by `TargetOriginId` when a request matches the path pattern in `PathPattern` .
	//
	// You can specify the following options:
	//
	// - `allow-all` : Viewers can use HTTP or HTTPS.
	// - `redirect-to-https` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL.
	// - `https-only` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden).
	//
	// For more information about requiring the HTTPS protocol, see [Requiring HTTPS Between Viewers and CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html) in the *Amazon CloudFront Developer Guide* .
	//
	// > The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects’ cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see [Managing Cache Expiration](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	ViewerProtocolPolicy *string `field:"required" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
	// A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
	//
	// There are three choices:
	//
	// - CloudFront forwards only `GET` and `HEAD` requests.
	// - CloudFront forwards only `GET` , `HEAD` , and `OPTIONS` requests.
	// - CloudFront forwards `GET, HEAD, OPTIONS, PUT, PATCH, POST` , and `DELETE` requests.
	//
	// If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.
	AllowedMethods *[]*string `field:"optional" json:"allowedMethods" yaml:"allowedMethods"`
	// A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods.
	//
	// There are two choices:
	//
	// - CloudFront caches responses to `GET` and `HEAD` requests.
	// - CloudFront caches responses to `GET` , `HEAD` , and `OPTIONS` requests.
	//
	// If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.
	CachedMethods *[]*string `field:"optional" json:"cachedMethods" yaml:"cachedMethods"`
	// The unique identifier of the cache policy that is attached to this cache behavior.
	//
	// For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// A `CacheBehavior` must include either a `CachePolicyId` or `ForwardedValues` . We recommend that you use a `CachePolicyId` .
	CachePolicyId *string `field:"optional" json:"cachePolicyId" yaml:"cachePolicyId"`
	// Whether you want CloudFront to automatically compress certain files for this cache behavior.
	//
	// If so, specify true; if not, specify false. For more information, see [Serving Compressed Files](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html) in the *Amazon CloudFront Developer Guide* .
	Compress interface{} `field:"optional" json:"compress" yaml:"compress"`
	// This field is deprecated.
	//
	// We recommend that you use the `DefaultTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as `Cache-Control max-age` , `Cache-Control s-maxage` , and `Expires` to objects. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	DefaultTtl *float64 `field:"optional" json:"defaultTtl" yaml:"defaultTtl"`
	// The value of `ID` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for this cache behavior.
	FieldLevelEncryptionId *string `field:"optional" json:"fieldLevelEncryptionId" yaml:"fieldLevelEncryptionId"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see [Working with policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to include values in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) or [Using the managed origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// A `CacheBehavior` must include either a `CachePolicyId` or `ForwardedValues` . We recommend that you use a `CachePolicyId` .
	//
	// A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.
	ForwardedValues interface{} `field:"optional" json:"forwardedValues" yaml:"forwardedValues"`
	// A list of CloudFront functions that are associated with this cache behavior.
	//
	// CloudFront functions must be published to the `LIVE` stage to associate them with a cache behavior.
	FunctionAssociations interface{} `field:"optional" json:"functionAssociations" yaml:"functionAssociations"`
	// A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.
	LambdaFunctionAssociations interface{} `field:"optional" json:"lambdaFunctionAssociations" yaml:"lambdaFunctionAssociations"`
	// This field is deprecated.
	//
	// We recommend that you use the `MaxTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as `Cache-Control max-age` , `Cache-Control s-maxage` , and `Expires` to objects. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	MaxTtl *float64 `field:"optional" json:"maxTtl" yaml:"maxTtl"`
	// This field is deprecated.
	//
	// We recommend that you use the `MinTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	//
	// You must specify `0` for `MinTTL` if you configure CloudFront to forward all headers to your origin (under `Headers` , if you specify `1` for `Quantity` and `*` for `Name` ).
	MinTtl *float64 `field:"optional" json:"minTtl" yaml:"minTtl"`
	// The unique identifier of the origin request policy that is attached to this cache behavior.
	//
	// For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) or [Using the managed origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html) in the *Amazon CloudFront Developer Guide* .
	OriginRequestPolicyId *string `field:"optional" json:"originRequestPolicyId" yaml:"originRequestPolicyId"`
	// The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior.
	//
	// For more information, see [Real-time logs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html) in the *Amazon CloudFront Developer Guide* .
	RealtimeLogConfigArn *string `field:"optional" json:"realtimeLogConfigArn" yaml:"realtimeLogConfigArn"`
	// The identifier for a response headers policy.
	ResponseHeadersPolicyId *string `field:"optional" json:"responseHeadersPolicyId" yaml:"responseHeadersPolicyId"`
	// Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
	//
	// If so, specify `true` ; if not, specify `false` . If you specify `true` for `SmoothStreaming` , you can still distribute other content using this cache behavior if the content matches the value of `PathPattern` .
	SmoothStreaming interface{} `field:"optional" json:"smoothStreaming" yaml:"smoothStreaming"`
	// A list of key groups that CloudFront can use to validate signed URLs or signed cookies.
	//
	// When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see [Serving private content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	TrustedKeyGroups *[]*string `field:"optional" json:"trustedKeyGroups" yaml:"trustedKeyGroups"`
	// > We recommend using `TrustedKeyGroups` instead of `TrustedSigners` .
	//
	// A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies.
	//
	// When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in the trusted signer’s AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see [Serving private content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	TrustedSigners *[]*string `field:"optional" json:"trustedSigners" yaml:"trustedSigners"`
}

A complex type that describes how CloudFront processes requests.

You must create at least as many cache behaviors (including the default cache behavior) as you have origins if you want CloudFront to serve objects from all of the origins. Each cache behavior specifies the one origin from which you want CloudFront to get objects. If you have two origins and only the default cache behavior, the default cache behavior will cause CloudFront to get objects from one of the origins, but the other origin is never used.

For the current quota (formerly known as limit) on the number of cache behaviors that you can add to a distribution, see [Quotas](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html) in the *Amazon CloudFront Developer Guide* .

If you don’t want to specify any cache behaviors, include only an empty `CacheBehaviors` element. Don’t include an empty `CacheBehavior` element because this is invalid.

To delete all cache behaviors in an existing distribution, update the distribution configuration and include only an empty `CacheBehaviors` element.

To add, change, or remove one or more cache behaviors, update the distribution configuration and specify all of the cache behaviors that you want to include in the updated distribution.

For more information about cache behaviors, see [Cache Behavior Settings](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesCacheBehavior) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cacheBehaviorProperty := &cacheBehaviorProperty{
	pathPattern: jsii.String("pathPattern"),
	targetOriginId: jsii.String("targetOriginId"),
	viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

	// the properties below are optional
	allowedMethods: []*string{
		jsii.String("allowedMethods"),
	},
	cachedMethods: []*string{
		jsii.String("cachedMethods"),
	},
	cachePolicyId: jsii.String("cachePolicyId"),
	compress: jsii.Boolean(false),
	defaultTtl: jsii.Number(123),
	fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
	forwardedValues: &forwardedValuesProperty{
		queryString: jsii.Boolean(false),

		// the properties below are optional
		cookies: &cookiesProperty{
			forward: jsii.String("forward"),

			// the properties below are optional
			whitelistedNames: []*string{
				jsii.String("whitelistedNames"),
			},
		},
		headers: []*string{
			jsii.String("headers"),
		},
		queryStringCacheKeys: []*string{
			jsii.String("queryStringCacheKeys"),
		},
	},
	functionAssociations: []interface{}{
		&functionAssociationProperty{
			eventType: jsii.String("eventType"),
			functionArn: jsii.String("functionArn"),
		},
	},
	lambdaFunctionAssociations: []interface{}{
		&lambdaFunctionAssociationProperty{
			eventType: jsii.String("eventType"),
			includeBody: jsii.Boolean(false),
			lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
		},
	},
	maxTtl: jsii.Number(123),
	minTtl: jsii.Number(123),
	originRequestPolicyId: jsii.String("originRequestPolicyId"),
	realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
	responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
	smoothStreaming: jsii.Boolean(false),
	trustedKeyGroups: []*string{
		jsii.String("trustedKeyGroups"),
	},
	trustedSigners: []*string{
		jsii.String("trustedSigners"),
	},
}

type CfnDistribution_CookiesProperty 

type CfnDistribution_CookiesProperty struct {
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include cookies in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send cookies to the origin but not include them in the cache key, use origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// Specifies which cookies to forward to the origin for this cache behavior: all, none, or the list of cookies specified in the `WhitelistedNames` complex type.
	//
	// Amazon S3 doesn't process cookies. When the cache behavior is forwarding requests to an Amazon S3 origin, specify none for the `Forward` element.
	Forward *string `field:"required" json:"forward" yaml:"forward"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include cookies in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// Required if you specify `whitelist` for the value of `Forward` . A complex type that specifies how many different cookies you want CloudFront to forward to the origin for this cache behavior and, if you want to forward selected cookies, the names of those cookies.
	//
	// If you specify `all` or `none` for the value of `Forward` , omit `WhitelistedNames` . If you change the value of `Forward` from `whitelist` to `all` or `none` and you don't delete the `WhitelistedNames` element and its child elements, CloudFront deletes them automatically.
	//
	// For the current limit on the number of cookie names that you can whitelist for each cache behavior, see [CloudFront Limits](https://docs.aws.amazon.com/general/latest/gr/xrefaws_service_limits.html#limits_cloudfront) in the *AWS General Reference* .
	WhitelistedNames *[]*string `field:"optional" json:"whitelistedNames" yaml:"whitelistedNames"`
}

This field is deprecated.

We recommend that you use a cache policy or an origin request policy instead of this field.

If you want to include cookies in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .

If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .

A complex type that specifies whether you want CloudFront to forward cookies to the origin and, if so, which ones. For more information about forwarding cookies to the origin, see [How CloudFront Forwards, Caches, and Logs Cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cookiesProperty := &cookiesProperty{
	forward: jsii.String("forward"),

	// the properties below are optional
	whitelistedNames: []*string{
		jsii.String("whitelistedNames"),
	},
}

type CfnDistribution_CustomErrorResponseProperty 

type CfnDistribution_CustomErrorResponseProperty struct {
	// The HTTP status code for which you want to specify a custom error page and/or a caching duration.
	ErrorCode *float64 `field:"required" json:"errorCode" yaml:"errorCode"`
	// The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in `ErrorCode` .
	//
	// When this time period has elapsed, CloudFront queries your origin to see whether the problem that caused the error has been resolved and the requested object is now available.
	//
	// For more information, see [Customizing Error Responses](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html) in the *Amazon CloudFront Developer Guide* .
	ErrorCachingMinTtl *float64 `field:"optional" json:"errorCachingMinTtl" yaml:"errorCachingMinTtl"`
	// The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.
	//
	// There are a variety of reasons that you might want CloudFront to return a status code different from the status code that your origin returned to CloudFront, for example:
	//
	// - Some Internet devices (some firewalls and corporate proxies, for example) intercept HTTP 4xx and 5xx and prevent the response from being returned to the viewer. If you substitute `200` , the response typically won't be intercepted.
	// - If you don't care about distinguishing among different client errors or server errors, you can specify `400` or `500` as the `ResponseCode` for all 4xx or 5xx errors.
	// - You might want to return a `200` status code (OK) and static website so your customers don't know that your website is down.
	//
	// If you specify a value for `ResponseCode` , you must also specify a value for `ResponsePagePath` .
	ResponseCode *float64 `field:"optional" json:"responseCode" yaml:"responseCode"`
	// The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by `ErrorCode` , for example, `/4xx-errors/403-forbidden.html` . If you want to store your objects and your custom error pages in different locations, your distribution must include a cache behavior for which the following is true:.
	//
	// - The value of `PathPattern` matches the path to your custom error messages. For example, suppose you saved custom error pages for 4xx errors in an Amazon S3 bucket in a directory named `/4xx-errors` . Your distribution must include a cache behavior for which the path pattern routes requests for your custom error pages to that location, for example, `/4xx-errors/*` .
	// - The value of `TargetOriginId` specifies the value of the `ID` element for the origin that contains your custom error pages.
	//
	// If you specify a value for `ResponsePagePath` , you must also specify a value for `ResponseCode` .
	//
	// We recommend that you store custom error pages in an Amazon S3 bucket. If you store custom error pages on an HTTP server and the server starts to return 5xx errors, CloudFront can't get the files that you want to return to viewers because the origin server is unavailable.
	ResponsePagePath *string `field:"optional" json:"responsePagePath" yaml:"responsePagePath"`
}

A complex type that controls:.

- Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer. - How long CloudFront caches HTTP status codes in the 4xx and 5xx range.

For more information about custom error pages, see [Customizing Error Responses](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

customErrorResponseProperty := &customErrorResponseProperty{
	errorCode: jsii.Number(123),

	// the properties below are optional
	errorCachingMinTtl: jsii.Number(123),
	responseCode: jsii.Number(123),
	responsePagePath: jsii.String("responsePagePath"),
}

type CfnDistribution_CustomOriginConfigProperty 

type CfnDistribution_CustomOriginConfigProperty struct {
	// Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin. Valid values are:.
	//
	// - `http-only` – CloudFront always uses HTTP to connect to the origin.
	// - `match-viewer` – CloudFront connects to the origin using the same protocol that the viewer used to connect to CloudFront.
	// - `https-only` – CloudFront always uses HTTPS to connect to the origin.
	OriginProtocolPolicy *string `field:"required" json:"originProtocolPolicy" yaml:"originProtocolPolicy"`
	// The HTTP port that CloudFront uses to connect to the origin.
	//
	// Specify the HTTP port that the origin listens on.
	HttpPort *float64 `field:"optional" json:"httpPort" yaml:"httpPort"`
	// The HTTPS port that CloudFront uses to connect to the origin.
	//
	// Specify the HTTPS port that the origin listens on.
	HttpsPort *float64 `field:"optional" json:"httpsPort" yaml:"httpsPort"`
	// Specifies how long, in seconds, CloudFront persists its connection to the origin.
	//
	// The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don’t specify otherwise) is 5 seconds.
	//
	// For more information, see [Origin Keep-alive Timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout) in the *Amazon CloudFront Developer Guide* .
	OriginKeepaliveTimeout *float64 `field:"optional" json:"originKeepaliveTimeout" yaml:"originKeepaliveTimeout"`
	// Specifies how long, in seconds, CloudFront waits for a response from the origin.
	//
	// This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don’t specify otherwise) is 30 seconds.
	//
	// For more information, see [Origin Response Timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout) in the *Amazon CloudFront Developer Guide* .
	OriginReadTimeout *float64 `field:"optional" json:"originReadTimeout" yaml:"originReadTimeout"`
	// Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS.
	//
	// Valid values include `SSLv3` , `TLSv1` , `TLSv1.1` , and `TLSv1.2` .
	//
	// For more information, see [Minimum Origin SSL Protocol](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols) in the *Amazon CloudFront Developer Guide* .
	OriginSslProtocols *[]*string `field:"optional" json:"originSslProtocols" yaml:"originSslProtocols"`
}

A custom origin.

A custom origin is any origin that is *not* an Amazon S3 bucket, with one exception. An Amazon S3 bucket that is [configured with static website hosting](https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html) *is* a custom origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

customOriginConfigProperty := &customOriginConfigProperty{
	originProtocolPolicy: jsii.String("originProtocolPolicy"),

	// the properties below are optional
	httpPort: jsii.Number(123),
	httpsPort: jsii.Number(123),
	originKeepaliveTimeout: jsii.Number(123),
	originReadTimeout: jsii.Number(123),
	originSslProtocols: []*string{
		jsii.String("originSslProtocols"),
	},
}

type CfnDistribution_DefaultCacheBehaviorProperty 

type CfnDistribution_DefaultCacheBehaviorProperty struct {
	// The value of `ID` for the origin that you want CloudFront to route requests to when they use the default cache behavior.
	TargetOriginId *string `field:"required" json:"targetOriginId" yaml:"targetOriginId"`
	// The protocol that viewers can use to access the files in the origin specified by `TargetOriginId` when a request matches the path pattern in `PathPattern` .
	//
	// You can specify the following options:
	//
	// - `allow-all` : Viewers can use HTTP or HTTPS.
	// - `redirect-to-https` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL.
	// - `https-only` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden).
	//
	// For more information about requiring the HTTPS protocol, see [Requiring HTTPS Between Viewers and CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html) in the *Amazon CloudFront Developer Guide* .
	//
	// > The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects’ cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see [Managing Cache Expiration](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	ViewerProtocolPolicy *string `field:"required" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
	// A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
	//
	// There are three choices:
	//
	// - CloudFront forwards only `GET` and `HEAD` requests.
	// - CloudFront forwards only `GET` , `HEAD` , and `OPTIONS` requests.
	// - CloudFront forwards `GET, HEAD, OPTIONS, PUT, PATCH, POST` , and `DELETE` requests.
	//
	// If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.
	AllowedMethods *[]*string `field:"optional" json:"allowedMethods" yaml:"allowedMethods"`
	// A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods.
	//
	// There are two choices:
	//
	// - CloudFront caches responses to `GET` and `HEAD` requests.
	// - CloudFront caches responses to `GET` , `HEAD` , and `OPTIONS` requests.
	//
	// If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.
	CachedMethods *[]*string `field:"optional" json:"cachedMethods" yaml:"cachedMethods"`
	// The unique identifier of the cache policy that is attached to the default cache behavior.
	//
	// For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// A `DefaultCacheBehavior` must include either a `CachePolicyId` or `ForwardedValues` . We recommend that you use a `CachePolicyId` .
	CachePolicyId *string `field:"optional" json:"cachePolicyId" yaml:"cachePolicyId"`
	// Whether you want CloudFront to automatically compress certain files for this cache behavior.
	//
	// If so, specify `true` ; if not, specify `false` . For more information, see [Serving Compressed Files](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html) in the *Amazon CloudFront Developer Guide* .
	Compress interface{} `field:"optional" json:"compress" yaml:"compress"`
	// This field is deprecated.
	//
	// We recommend that you use the `DefaultTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as `Cache-Control max-age` , `Cache-Control s-maxage` , and `Expires` to objects. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	DefaultTtl *float64 `field:"optional" json:"defaultTtl" yaml:"defaultTtl"`
	// The value of `ID` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for the default cache behavior.
	FieldLevelEncryptionId *string `field:"optional" json:"fieldLevelEncryptionId" yaml:"fieldLevelEncryptionId"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see [Working with policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to include values in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) or [Using the managed origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// A `DefaultCacheBehavior` must include either a `CachePolicyId` or `ForwardedValues` . We recommend that you use a `CachePolicyId` .
	//
	// A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.
	ForwardedValues interface{} `field:"optional" json:"forwardedValues" yaml:"forwardedValues"`
	// A list of CloudFront functions that are associated with this cache behavior.
	//
	// CloudFront functions must be published to the `LIVE` stage to associate them with a cache behavior.
	FunctionAssociations interface{} `field:"optional" json:"functionAssociations" yaml:"functionAssociations"`
	// A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.
	LambdaFunctionAssociations interface{} `field:"optional" json:"lambdaFunctionAssociations" yaml:"lambdaFunctionAssociations"`
	// This field is deprecated.
	//
	// We recommend that you use the `MaxTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as `Cache-Control max-age` , `Cache-Control s-maxage` , and `Expires` to objects. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	MaxTtl *float64 `field:"optional" json:"maxTtl" yaml:"maxTtl"`
	// This field is deprecated.
	//
	// We recommend that you use the `MinTTL` field in a cache policy instead of this field. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) or [Using the managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html) in the *Amazon CloudFront Developer Guide* .
	//
	// The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see [Managing How Long Content Stays in an Edge Cache (Expiration)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html) in the *Amazon CloudFront Developer Guide* .
	//
	// You must specify `0` for `MinTTL` if you configure CloudFront to forward all headers to your origin (under `Headers` , if you specify `1` for `Quantity` and `*` for `Name` ).
	MinTtl *float64 `field:"optional" json:"minTtl" yaml:"minTtl"`
	// The unique identifier of the origin request policy that is attached to the default cache behavior.
	//
	// For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) or [Using the managed origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html) in the *Amazon CloudFront Developer Guide* .
	OriginRequestPolicyId *string `field:"optional" json:"originRequestPolicyId" yaml:"originRequestPolicyId"`
	// The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior.
	//
	// For more information, see [Real-time logs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html) in the *Amazon CloudFront Developer Guide* .
	RealtimeLogConfigArn *string `field:"optional" json:"realtimeLogConfigArn" yaml:"realtimeLogConfigArn"`
	// The identifier for a response headers policy.
	ResponseHeadersPolicyId *string `field:"optional" json:"responseHeadersPolicyId" yaml:"responseHeadersPolicyId"`
	// Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
	//
	// If so, specify `true` ; if not, specify `false` . If you specify `true` for `SmoothStreaming` , you can still distribute other content using this cache behavior if the content matches the value of `PathPattern` .
	SmoothStreaming interface{} `field:"optional" json:"smoothStreaming" yaml:"smoothStreaming"`
	// A list of key groups that CloudFront can use to validate signed URLs or signed cookies.
	//
	// When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see [Serving private content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	TrustedKeyGroups *[]*string `field:"optional" json:"trustedKeyGroups" yaml:"trustedKeyGroups"`
	// > We recommend using `TrustedKeyGroups` instead of `TrustedSigners` .
	//
	// A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies.
	//
	// When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in a trusted signer’s AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see [Serving private content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	TrustedSigners *[]*string `field:"optional" json:"trustedSigners" yaml:"trustedSigners"`
}

A complex type that describes the default cache behavior if you don’t specify a `CacheBehavior` element or if request URLs don’t match any of the values of `PathPattern` in `CacheBehavior` elements.

You must create exactly one default cache behavior.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

defaultCacheBehaviorProperty := &defaultCacheBehaviorProperty{
	targetOriginId: jsii.String("targetOriginId"),
	viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

	// the properties below are optional
	allowedMethods: []*string{
		jsii.String("allowedMethods"),
	},
	cachedMethods: []*string{
		jsii.String("cachedMethods"),
	},
	cachePolicyId: jsii.String("cachePolicyId"),
	compress: jsii.Boolean(false),
	defaultTtl: jsii.Number(123),
	fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
	forwardedValues: &forwardedValuesProperty{
		queryString: jsii.Boolean(false),

		// the properties below are optional
		cookies: &cookiesProperty{
			forward: jsii.String("forward"),

			// the properties below are optional
			whitelistedNames: []*string{
				jsii.String("whitelistedNames"),
			},
		},
		headers: []*string{
			jsii.String("headers"),
		},
		queryStringCacheKeys: []*string{
			jsii.String("queryStringCacheKeys"),
		},
	},
	functionAssociations: []interface{}{
		&functionAssociationProperty{
			eventType: jsii.String("eventType"),
			functionArn: jsii.String("functionArn"),
		},
	},
	lambdaFunctionAssociations: []interface{}{
		&lambdaFunctionAssociationProperty{
			eventType: jsii.String("eventType"),
			includeBody: jsii.Boolean(false),
			lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
		},
	},
	maxTtl: jsii.Number(123),
	minTtl: jsii.Number(123),
	originRequestPolicyId: jsii.String("originRequestPolicyId"),
	realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
	responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
	smoothStreaming: jsii.Boolean(false),
	trustedKeyGroups: []*string{
		jsii.String("trustedKeyGroups"),
	},
	trustedSigners: []*string{
		jsii.String("trustedSigners"),
	},
}

type CfnDistribution_DistributionConfigProperty 

type CfnDistribution_DistributionConfigProperty struct {
	// From this field, you can enable or disable the selected distribution.
	Enabled interface{} `field:"required" json:"enabled" yaml:"enabled"`
	// A complex type that contains information about CNAMEs (alternate domain names), if any, for this distribution.
	Aliases *[]*string `field:"optional" json:"aliases" yaml:"aliases"`
	// A complex type that contains zero or more `CacheBehavior` elements.
	CacheBehaviors interface{} `field:"optional" json:"cacheBehaviors" yaml:"cacheBehaviors"`
	// `CfnDistribution.DistributionConfigProperty.CNAMEs`.
	CnamEs *[]*string `field:"optional" json:"cnamEs" yaml:"cnamEs"`
	// An optional comment to describe the distribution.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A complex type that controls the following:.
	//
	// - Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer.
	// - How long CloudFront caches HTTP status codes in the 4xx and 5xx range.
	//
	// For more information about custom error pages, see [Customizing Error Responses](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html) in the *Amazon CloudFront Developer Guide* .
	CustomErrorResponses interface{} `field:"optional" json:"customErrorResponses" yaml:"customErrorResponses"`
	// `CfnDistribution.DistributionConfigProperty.CustomOrigin`.
	CustomOrigin interface{} `field:"optional" json:"customOrigin" yaml:"customOrigin"`
	// A complex type that describes the default cache behavior if you don't specify a `CacheBehavior` element or if files don't match any of the values of `PathPattern` in `CacheBehavior` elements.
	//
	// You must create exactly one default cache behavior.
	DefaultCacheBehavior interface{} `field:"optional" json:"defaultCacheBehavior" yaml:"defaultCacheBehavior"`
	// The object that you want CloudFront to request from your origin (for example, `index.html` ) when a viewer requests the root URL for your distribution ( `http://www.example.com` ) instead of an object in your distribution ( `http://www.example.com/product-description.html` ). Specifying a default root object avoids exposing the contents of your distribution.
	//
	// Specify only the object name, for example, `index.html` . Don't add a `/` before the object name.
	//
	// If you don't want to specify a default root object when you create a distribution, include an empty `DefaultRootObject` element.
	//
	// To delete the default root object from an existing distribution, update the distribution configuration and include an empty `DefaultRootObject` element.
	//
	// To replace the default root object, update the distribution configuration and specify the new object.
	//
	// For more information about the default root object, see [Creating a Default Root Object](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html) in the *Amazon CloudFront Developer Guide* .
	DefaultRootObject *string `field:"optional" json:"defaultRootObject" yaml:"defaultRootObject"`
	// (Optional) Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront .
	//
	// The default value for new web distributions is `http1.1` .
	//
	// For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI).
	//
	// In general, configuring CloudFront to communicate with viewers using HTTP/2 reduces latency. You can improve performance by optimizing for HTTP/2.
	HttpVersion *string `field:"optional" json:"httpVersion" yaml:"httpVersion"`
	// If you want CloudFront to respond to IPv6 DNS requests with an IPv6 address for your distribution, specify `true` .
	//
	// If you specify `false` , CloudFront responds to IPv6 DNS requests with the DNS response code `NOERROR` and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution.
	//
	// In general, you should enable IPv6 if you have users on IPv6 networks who want to access your content. However, if you're using signed URLs or signed cookies to restrict access to your content, and if you're using a custom policy that includes the `IpAddress` parameter to restrict the IP addresses that can access your content, don't enable IPv6. If you want to restrict access to some content by IP address and not restrict access to other content (or restrict access but not by IP address), you can create two distributions. For more information, see [Creating a Signed URL Using a Custom Policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html) in the *Amazon CloudFront Developer Guide* .
	//
	// If you're using an Amazon Route 53 AWS Integration alias resource record set to route traffic to your CloudFront distribution, you need to create a second alias resource record set when both of the following are true:
	//
	// - You enable IPv6 for the distribution
	// - You're using alternate domain names in the URLs for your objects
	//
	// For more information, see [Routing Traffic to an Amazon CloudFront Web Distribution by Using Your Domain Name](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html) in the *Amazon Route 53 AWS Integration Developer Guide* .
	//
	// If you created a CNAME resource record set, either with Amazon Route 53 AWS Integration or with another DNS service, you don't need to make any changes. A CNAME record will route traffic to your distribution regardless of the IP address format of the viewer request.
	Ipv6Enabled interface{} `field:"optional" json:"ipv6Enabled" yaml:"ipv6Enabled"`
	// A complex type that controls whether access logs are written for the distribution.
	//
	// For more information about logging, see [Access Logs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) in the *Amazon CloudFront Developer Guide* .
	Logging interface{} `field:"optional" json:"logging" yaml:"logging"`
	// A complex type that contains information about origin groups for this distribution.
	OriginGroups interface{} `field:"optional" json:"originGroups" yaml:"originGroups"`
	// A complex type that contains information about origins for this distribution.
	Origins interface{} `field:"optional" json:"origins" yaml:"origins"`
	// The price class that corresponds with the maximum price that you want to pay for CloudFront service.
	//
	// If you specify `PriceClass_All` , CloudFront responds to requests for your objects from all CloudFront edge locations.
	//
	// If you specify a price class other than `PriceClass_All` , CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class. Viewers who are in or near regions that are excluded from your specified price class may encounter slower performance.
	//
	// For more information about price classes, see [Choosing the Price Class for a CloudFront Distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PriceClass.html) in the *Amazon CloudFront Developer Guide* . For information about CloudFront pricing, including how price classes (such as Price Class 100) map to CloudFront regions, see [Amazon CloudFront Pricing](https://docs.aws.amazon.com/cloudfront/pricing/) .
	PriceClass *string `field:"optional" json:"priceClass" yaml:"priceClass"`
	// A complex type that identifies ways in which you want to restrict distribution of your content.
	Restrictions interface{} `field:"optional" json:"restrictions" yaml:"restrictions"`
	// `CfnDistribution.DistributionConfigProperty.S3Origin`.
	S3Origin interface{} `field:"optional" json:"s3Origin" yaml:"s3Origin"`
	// A complex type that determines the distribution’s SSL/TLS configuration for communicating with viewers.
	ViewerCertificate interface{} `field:"optional" json:"viewerCertificate" yaml:"viewerCertificate"`
	// A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution.
	//
	// To specify a web ACL created using the latest version of AWS WAF , use the ACL ARN, for example `arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a` . To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a` .
	//
	// AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to CloudFront, and lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront responds to requests either with the requested content or with an HTTP 403 status code (Forbidden). You can also configure CloudFront to return a custom error page when a request is blocked. For more information about AWS WAF , see the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html) .
	WebAclId *string `field:"optional" json:"webAclId" yaml:"webAclId"`
}

A distribution configuration.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

distributionConfigProperty := &distributionConfigProperty{
	enabled: jsii.Boolean(false),

	// the properties below are optional
	aliases: []*string{
		jsii.String("aliases"),
	},
	cacheBehaviors: []interface{}{
		&cacheBehaviorProperty{
			pathPattern: jsii.String("pathPattern"),
			targetOriginId: jsii.String("targetOriginId"),
			viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

			// the properties below are optional
			allowedMethods: []*string{
				jsii.String("allowedMethods"),
			},
			cachedMethods: []*string{
				jsii.String("cachedMethods"),
			},
			cachePolicyId: jsii.String("cachePolicyId"),
			compress: jsii.Boolean(false),
			defaultTtl: jsii.Number(123),
			fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
			forwardedValues: &forwardedValuesProperty{
				queryString: jsii.Boolean(false),

				// the properties below are optional
				cookies: &cookiesProperty{
					forward: jsii.String("forward"),

					// the properties below are optional
					whitelistedNames: []*string{
						jsii.String("whitelistedNames"),
					},
				},
				headers: []*string{
					jsii.String("headers"),
				},
				queryStringCacheKeys: []*string{
					jsii.String("queryStringCacheKeys"),
				},
			},
			functionAssociations: []interface{}{
				&functionAssociationProperty{
					eventType: jsii.String("eventType"),
					functionArn: jsii.String("functionArn"),
				},
			},
			lambdaFunctionAssociations: []interface{}{
				&lambdaFunctionAssociationProperty{
					eventType: jsii.String("eventType"),
					includeBody: jsii.Boolean(false),
					lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
				},
			},
			maxTtl: jsii.Number(123),
			minTtl: jsii.Number(123),
			originRequestPolicyId: jsii.String("originRequestPolicyId"),
			realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
			responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
			smoothStreaming: jsii.Boolean(false),
			trustedKeyGroups: []*string{
				jsii.String("trustedKeyGroups"),
			},
			trustedSigners: []*string{
				jsii.String("trustedSigners"),
			},
		},
	},
	cnamEs: []*string{
		jsii.String("cnamEs"),
	},
	comment: jsii.String("comment"),
	customErrorResponses: []interface{}{
		&customErrorResponseProperty{
			errorCode: jsii.Number(123),

			// the properties below are optional
			errorCachingMinTtl: jsii.Number(123),
			responseCode: jsii.Number(123),
			responsePagePath: jsii.String("responsePagePath"),
		},
	},
	customOrigin: &legacyCustomOriginProperty{
		dnsName: jsii.String("dnsName"),
		originProtocolPolicy: jsii.String("originProtocolPolicy"),
		originSslProtocols: []*string{
			jsii.String("originSslProtocols"),
		},

		// the properties below are optional
		httpPort: jsii.Number(123),
		httpsPort: jsii.Number(123),
	},
	defaultCacheBehavior: &defaultCacheBehaviorProperty{
		targetOriginId: jsii.String("targetOriginId"),
		viewerProtocolPolicy: jsii.String("viewerProtocolPolicy"),

		// the properties below are optional
		allowedMethods: []*string{
			jsii.String("allowedMethods"),
		},
		cachedMethods: []*string{
			jsii.String("cachedMethods"),
		},
		cachePolicyId: jsii.String("cachePolicyId"),
		compress: jsii.Boolean(false),
		defaultTtl: jsii.Number(123),
		fieldLevelEncryptionId: jsii.String("fieldLevelEncryptionId"),
		forwardedValues: &forwardedValuesProperty{
			queryString: jsii.Boolean(false),

			// the properties below are optional
			cookies: &cookiesProperty{
				forward: jsii.String("forward"),

				// the properties below are optional
				whitelistedNames: []*string{
					jsii.String("whitelistedNames"),
				},
			},
			headers: []*string{
				jsii.String("headers"),
			},
			queryStringCacheKeys: []*string{
				jsii.String("queryStringCacheKeys"),
			},
		},
		functionAssociations: []interface{}{
			&functionAssociationProperty{
				eventType: jsii.String("eventType"),
				functionArn: jsii.String("functionArn"),
			},
		},
		lambdaFunctionAssociations: []interface{}{
			&lambdaFunctionAssociationProperty{
				eventType: jsii.String("eventType"),
				includeBody: jsii.Boolean(false),
				lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
			},
		},
		maxTtl: jsii.Number(123),
		minTtl: jsii.Number(123),
		originRequestPolicyId: jsii.String("originRequestPolicyId"),
		realtimeLogConfigArn: jsii.String("realtimeLogConfigArn"),
		responseHeadersPolicyId: jsii.String("responseHeadersPolicyId"),
		smoothStreaming: jsii.Boolean(false),
		trustedKeyGroups: []*string{
			jsii.String("trustedKeyGroups"),
		},
		trustedSigners: []*string{
			jsii.String("trustedSigners"),
		},
	},
	defaultRootObject: jsii.String("defaultRootObject"),
	httpVersion: jsii.String("httpVersion"),
	ipv6Enabled: jsii.Boolean(false),
	logging: &loggingProperty{
		bucket: jsii.String("bucket"),

		// the properties below are optional
		includeCookies: jsii.Boolean(false),
		prefix: jsii.String("prefix"),
	},
	originGroups: &originGroupsProperty{
		quantity: jsii.Number(123),

		// the properties below are optional
		items: []interface{}{
			&originGroupProperty{
				failoverCriteria: &originGroupFailoverCriteriaProperty{
					statusCodes: &statusCodesProperty{
						items: []interface{}{
							jsii.Number(123),
						},
						quantity: jsii.Number(123),
					},
				},
				id: jsii.String("id"),
				members: &originGroupMembersProperty{
					items: []interface{}{
						&originGroupMemberProperty{
							originId: jsii.String("originId"),
						},
					},
					quantity: jsii.Number(123),
				},
			},
		},
	},
	origins: []interface{}{
		&originProperty{
			domainName: jsii.String("domainName"),
			id: jsii.String("id"),

			// the properties below are optional
			connectionAttempts: jsii.Number(123),
			connectionTimeout: jsii.Number(123),
			customOriginConfig: &customOriginConfigProperty{
				originProtocolPolicy: jsii.String("originProtocolPolicy"),

				// the properties below are optional
				httpPort: jsii.Number(123),
				httpsPort: jsii.Number(123),
				originKeepaliveTimeout: jsii.Number(123),
				originReadTimeout: jsii.Number(123),
				originSslProtocols: []*string{
					jsii.String("originSslProtocols"),
				},
			},
			originCustomHeaders: []interface{}{
				&originCustomHeaderProperty{
					headerName: jsii.String("headerName"),
					headerValue: jsii.String("headerValue"),
				},
			},
			originPath: jsii.String("originPath"),
			originShield: &originShieldProperty{
				enabled: jsii.Boolean(false),
				originShieldRegion: jsii.String("originShieldRegion"),
			},
			s3OriginConfig: &s3OriginConfigProperty{
				originAccessIdentity: jsii.String("originAccessIdentity"),
			},
		},
	},
	priceClass: jsii.String("priceClass"),
	restrictions: &restrictionsProperty{
		geoRestriction: &geoRestrictionProperty{
			restrictionType: jsii.String("restrictionType"),

			// the properties below are optional
			locations: []*string{
				jsii.String("locations"),
			},
		},
	},
	s3Origin: &legacyS3OriginProperty{
		dnsName: jsii.String("dnsName"),

		// the properties below are optional
		originAccessIdentity: jsii.String("originAccessIdentity"),
	},
	viewerCertificate: &viewerCertificateProperty{
		acmCertificateArn: jsii.String("acmCertificateArn"),
		cloudFrontDefaultCertificate: jsii.Boolean(false),
		iamCertificateId: jsii.String("iamCertificateId"),
		minimumProtocolVersion: jsii.String("minimumProtocolVersion"),
		sslSupportMethod: jsii.String("sslSupportMethod"),
	},
	webAclId: jsii.String("webAclId"),
}

type CfnDistribution_ForwardedValuesProperty 

type CfnDistribution_ForwardedValuesProperty struct {
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include query strings in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior and cache based on the query string parameters. CloudFront behavior depends on the value of `QueryString` and on the values that you specify for `QueryStringCacheKeys` , if any:
	//
	// If you specify true for `QueryString` and you don't specify any values for `QueryStringCacheKeys` , CloudFront forwards all query string parameters to the origin and caches based on all query string parameters. Depending on how many query string parameters and values you have, this can adversely affect performance because CloudFront must forward more requests to the origin.
	//
	// If you specify true for `QueryString` and you specify one or more values for `QueryStringCacheKeys` , CloudFront forwards all query string parameters to the origin, but it only caches based on the query string parameters that you specify.
	//
	// If you specify false for `QueryString` , CloudFront doesn't forward any query string parameters to the origin, and doesn't cache based on query string parameters.
	//
	// For more information, see [Configuring CloudFront to Cache Based on Query String Parameters](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/QueryStringParameters.html) in the *Amazon CloudFront Developer Guide* .
	QueryString interface{} `field:"required" json:"queryString" yaml:"queryString"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include cookies in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// A complex type that specifies whether you want CloudFront to forward cookies to the origin and, if so, which ones. For more information about forwarding cookies to the origin, see [How CloudFront Forwards, Caches, and Logs Cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html) in the *Amazon CloudFront Developer Guide* .
	Cookies interface{} `field:"optional" json:"cookies" yaml:"cookies"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include headers in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send headers to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// A complex type that specifies the `Headers` , if any, that you want CloudFront to forward to the origin for this cache behavior (whitelisted headers). For the headers that you specify, CloudFront also caches separate versions of a specified object that is based on the header values in viewer requests.
	//
	// For more information, see [Caching Content Based on Request Headers](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html) in the *Amazon CloudFront Developer Guide* .
	Headers *[]*string `field:"optional" json:"headers" yaml:"headers"`
	// This field is deprecated.
	//
	// We recommend that you use a cache policy or an origin request policy instead of this field.
	//
	// If you want to include query strings in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .
	//
	// A complex type that contains information about the query string parameters that you want CloudFront to use for caching for this cache behavior.
	QueryStringCacheKeys *[]*string `field:"optional" json:"queryStringCacheKeys" yaml:"queryStringCacheKeys"`
}

This field is deprecated.

We recommend that you use a cache policy or an origin request policy instead of this field.

If you want to include values in the cache key, use a cache policy. For more information, see [Creating cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy) in the *Amazon CloudFront Developer Guide* .

If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see [Creating origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy) in the *Amazon CloudFront Developer Guide* .

A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

forwardedValuesProperty := &forwardedValuesProperty{
	queryString: jsii.Boolean(false),

	// the properties below are optional
	cookies: &cookiesProperty{
		forward: jsii.String("forward"),

		// the properties below are optional
		whitelistedNames: []*string{
			jsii.String("whitelistedNames"),
		},
	},
	headers: []*string{
		jsii.String("headers"),
	},
	queryStringCacheKeys: []*string{
		jsii.String("queryStringCacheKeys"),
	},
}

type CfnDistribution_FunctionAssociationProperty 

type CfnDistribution_FunctionAssociationProperty struct {
	// The event type of the function, either `viewer-request` or `viewer-response` .
	//
	// You cannot use origin-facing event types ( `origin-request` and `origin-response` ) with a CloudFront function.
	EventType *string `field:"optional" json:"eventType" yaml:"eventType"`
	// The Amazon Resource Name (ARN) of the function.
	FunctionArn *string `field:"optional" json:"functionArn" yaml:"functionArn"`
}

A CloudFront function that is associated with a cache behavior in a CloudFront distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

functionAssociationProperty := &functionAssociationProperty{
	eventType: jsii.String("eventType"),
	functionArn: jsii.String("functionArn"),
}

type CfnDistribution_GeoRestrictionProperty 

type CfnDistribution_GeoRestrictionProperty struct {
	// The method that you want to use to restrict distribution of your content by country:.
	//
	// - `none` : No geo restriction is enabled, meaning access to content is not restricted by client geo location.
	// - `blacklist` : The `Location` elements specify the countries in which you don't want CloudFront to distribute your content.
	// - `whitelist` : The `Location` elements specify the countries in which you want CloudFront to distribute your content.
	RestrictionType *string `field:"required" json:"restrictionType" yaml:"restrictionType"`
	// A complex type that contains a `Location` element for each country in which you want CloudFront either to distribute your content ( `whitelist` ) or not distribute your content ( `blacklist` ).
	//
	// The `Location` element is a two-letter, uppercase country code for a country that you want to include in your `blacklist` or `whitelist` . Include one `Location` element for each country.
	//
	// CloudFront and `MaxMind` both use `ISO 3166` country codes. For the current list of countries and the corresponding codes, see `ISO 3166-1-alpha-2` code on the *International Organization for Standardization* website. You can also refer to the country list on the CloudFront console, which includes both country names and codes.
	Locations *[]*string `field:"optional" json:"locations" yaml:"locations"`
}

A complex type that controls the countries in which your content is distributed.

CloudFront determines the location of your users using `MaxMind` GeoIP databases. To disable geo restriction, remove the [Restrictions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions) property from your stack template.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

geoRestrictionProperty := &geoRestrictionProperty{
	restrictionType: jsii.String("restrictionType"),

	// the properties below are optional
	locations: []*string{
		jsii.String("locations"),
	},
}

type CfnDistribution_LambdaFunctionAssociationProperty 

type CfnDistribution_LambdaFunctionAssociationProperty struct {
	// Specifies the event type that triggers a Lambda@Edge function invocation. You can specify the following values:.
	//
	// - `viewer-request` : The function executes when CloudFront receives a request from a viewer and before it checks to see whether the requested object is in the edge cache.
	// - `origin-request` : The function executes only when CloudFront sends a request to your origin. When the requested object is in the edge cache, the function doesn't execute.
	// - `origin-response` : The function executes after CloudFront receives a response from the origin and before it caches the object in the response. When the requested object is in the edge cache, the function doesn't execute.
	// - `viewer-response` : The function executes before CloudFront returns the requested object to the viewer. The function executes regardless of whether the object was already in the edge cache.
	//
	// If the origin returns an HTTP status code other than HTTP 200 (OK), the function doesn't execute.
	EventType *string `field:"optional" json:"eventType" yaml:"eventType"`
	// A flag that allows a Lambda@Edge function to have read access to the body content.
	//
	// For more information, see [Accessing the Request Body by Choosing the Include Body Option](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html) in the Amazon CloudFront Developer Guide.
	IncludeBody interface{} `field:"optional" json:"includeBody" yaml:"includeBody"`
	// The ARN of the Lambda@Edge function.
	//
	// You must specify the ARN of a function version; you can't specify an alias or $LATEST.
	LambdaFunctionArn *string `field:"optional" json:"lambdaFunctionArn" yaml:"lambdaFunctionArn"`
}

A complex type that contains a Lambda@Edge function association.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

lambdaFunctionAssociationProperty := &lambdaFunctionAssociationProperty{
	eventType: jsii.String("eventType"),
	includeBody: jsii.Boolean(false),
	lambdaFunctionArn: jsii.String("lambdaFunctionArn"),
}

type CfnDistribution_LegacyCustomOriginProperty 

type CfnDistribution_LegacyCustomOriginProperty struct {
	// `CfnDistribution.LegacyCustomOriginProperty.DNSName`.
	DnsName *string `field:"required" json:"dnsName" yaml:"dnsName"`
	// `CfnDistribution.LegacyCustomOriginProperty.OriginProtocolPolicy`.
	OriginProtocolPolicy *string `field:"required" json:"originProtocolPolicy" yaml:"originProtocolPolicy"`
	// `CfnDistribution.LegacyCustomOriginProperty.OriginSSLProtocols`.
	OriginSslProtocols *[]*string `field:"required" json:"originSslProtocols" yaml:"originSslProtocols"`
	// `CfnDistribution.LegacyCustomOriginProperty.HTTPPort`.
	HttpPort *float64 `field:"optional" json:"httpPort" yaml:"httpPort"`
	// `CfnDistribution.LegacyCustomOriginProperty.HTTPSPort`.
	HttpsPort *float64 `field:"optional" json:"httpsPort" yaml:"httpsPort"`
}

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

legacyCustomOriginProperty := &legacyCustomOriginProperty{
	dnsName: jsii.String("dnsName"),
	originProtocolPolicy: jsii.String("originProtocolPolicy"),
	originSslProtocols: []*string{
		jsii.String("originSslProtocols"),
	},

	// the properties below are optional
	httpPort: jsii.Number(123),
	httpsPort: jsii.Number(123),
}

type CfnDistribution_LegacyS3OriginProperty 

type CfnDistribution_LegacyS3OriginProperty struct {
	// `CfnDistribution.LegacyS3OriginProperty.DNSName`.
	DnsName *string `field:"required" json:"dnsName" yaml:"dnsName"`
	// `CfnDistribution.LegacyS3OriginProperty.OriginAccessIdentity`.
	OriginAccessIdentity *string `field:"optional" json:"originAccessIdentity" yaml:"originAccessIdentity"`
}

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

legacyS3OriginProperty := &legacyS3OriginProperty{
	dnsName: jsii.String("dnsName"),

	// the properties below are optional
	originAccessIdentity: jsii.String("originAccessIdentity"),
}

type CfnDistribution_LoggingProperty 

type CfnDistribution_LoggingProperty struct {
	// The Amazon S3 bucket to store the access logs in, for example, `myawslogbucket.s3.amazonaws.com` .
	Bucket *string `field:"required" json:"bucket" yaml:"bucket"`
	// Specifies whether you want CloudFront to include cookies in access logs, specify `true` for `IncludeCookies` .
	//
	// If you choose to include cookies in logs, CloudFront logs all cookies regardless of how you configure the cache behaviors for this distribution. If you don't want to include cookies when you create a distribution or if you want to disable include cookies for an existing distribution, specify `false` for `IncludeCookies` .
	IncludeCookies interface{} `field:"optional" json:"includeCookies" yaml:"includeCookies"`
	// An optional string that you want CloudFront to prefix to the access log `filenames` for this distribution, for example, `myprefix/` .
	//
	// If you want to enable logging, but you don't want to specify a prefix, you still must include an empty `Prefix` element in the `Logging` element.
	Prefix *string `field:"optional" json:"prefix" yaml:"prefix"`
}

A complex type that controls whether access logs are written for the distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

loggingProperty := &loggingProperty{
	bucket: jsii.String("bucket"),

	// the properties below are optional
	includeCookies: jsii.Boolean(false),
	prefix: jsii.String("prefix"),
}

type CfnDistribution_OriginCustomHeaderProperty 

type CfnDistribution_OriginCustomHeaderProperty struct {
	// The name of a header that you want CloudFront to send to your origin.
	//
	// For more information, see [Adding Custom Headers to Origin Requests](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/forward-custom-headers.html) in the *Amazon CloudFront Developer Guide* .
	HeaderName *string `field:"required" json:"headerName" yaml:"headerName"`
	// The value for the header that you specified in the `HeaderName` field.
	HeaderValue *string `field:"required" json:"headerValue" yaml:"headerValue"`
}

A complex type that contains `HeaderName` and `HeaderValue` elements, if any, for this distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originCustomHeaderProperty := &originCustomHeaderProperty{
	headerName: jsii.String("headerName"),
	headerValue: jsii.String("headerValue"),
}

type CfnDistribution_OriginGroupFailoverCriteriaProperty 

type CfnDistribution_OriginGroupFailoverCriteriaProperty struct {
	// The status codes that, when returned from the primary origin, will trigger CloudFront to failover to the second origin.
	StatusCodes interface{} `field:"required" json:"statusCodes" yaml:"statusCodes"`
}

A complex data type that includes information about the failover criteria for an origin group, including the status codes for which CloudFront will failover from the primary origin to the second origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originGroupFailoverCriteriaProperty := &originGroupFailoverCriteriaProperty{
	statusCodes: &statusCodesProperty{
		items: []interface{}{
			jsii.Number(123),
		},
		quantity: jsii.Number(123),
	},
}

type CfnDistribution_OriginGroupMemberProperty 

type CfnDistribution_OriginGroupMemberProperty struct {
	// The ID for an origin in an origin group.
	OriginId *string `field:"required" json:"originId" yaml:"originId"`
}

An origin in an origin group.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originGroupMemberProperty := &originGroupMemberProperty{
	originId: jsii.String("originId"),
}

type CfnDistribution_OriginGroupMembersProperty 

type CfnDistribution_OriginGroupMembersProperty struct {
	// Items (origins) in an origin group.
	Items interface{} `field:"required" json:"items" yaml:"items"`
	// The number of origins in an origin group.
	Quantity *float64 `field:"required" json:"quantity" yaml:"quantity"`
}

A complex data type for the origins included in an origin group.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originGroupMembersProperty := &originGroupMembersProperty{
	items: []interface{}{
		&originGroupMemberProperty{
			originId: jsii.String("originId"),
		},
	},
	quantity: jsii.Number(123),
}

type CfnDistribution_OriginGroupProperty 

type CfnDistribution_OriginGroupProperty struct {
	// A complex type that contains information about the failover criteria for an origin group.
	FailoverCriteria interface{} `field:"required" json:"failoverCriteria" yaml:"failoverCriteria"`
	// The origin group's ID.
	Id *string `field:"required" json:"id" yaml:"id"`
	// A complex type that contains information about the origins in an origin group.
	Members interface{} `field:"required" json:"members" yaml:"members"`
}

An origin group includes two origins (a primary origin and a second origin to failover to) and a failover criteria that you specify.

You create an origin group to support origin failover in CloudFront. When you create or update a distribution, you can specifiy the origin group instead of a single origin, and CloudFront will failover from the primary origin to the second origin under the failover conditions that you've chosen.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originGroupProperty := &originGroupProperty{
	failoverCriteria: &originGroupFailoverCriteriaProperty{
		statusCodes: &statusCodesProperty{
			items: []interface{}{
				jsii.Number(123),
			},
			quantity: jsii.Number(123),
		},
	},
	id: jsii.String("id"),
	members: &originGroupMembersProperty{
		items: []interface{}{
			&originGroupMemberProperty{
				originId: jsii.String("originId"),
			},
		},
		quantity: jsii.Number(123),
	},
}

type CfnDistribution_OriginGroupsProperty 

type CfnDistribution_OriginGroupsProperty struct {
	// The number of origin groups.
	Quantity *float64 `field:"required" json:"quantity" yaml:"quantity"`
	// The items (origin groups) in a distribution.
	Items interface{} `field:"optional" json:"items" yaml:"items"`
}

A complex data type for the origin groups specified for a distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originGroupsProperty := &originGroupsProperty{
	quantity: jsii.Number(123),

	// the properties below are optional
	items: []interface{}{
		&originGroupProperty{
			failoverCriteria: &originGroupFailoverCriteriaProperty{
				statusCodes: &statusCodesProperty{
					items: []interface{}{
						jsii.Number(123),
					},
					quantity: jsii.Number(123),
				},
			},
			id: jsii.String("id"),
			members: &originGroupMembersProperty{
				items: []interface{}{
					&originGroupMemberProperty{
						originId: jsii.String("originId"),
					},
				},
				quantity: jsii.Number(123),
			},
		},
	},
}

type CfnDistribution_OriginProperty 

type CfnDistribution_OriginProperty struct {
	// The domain name for the origin.
	//
	// For more information, see [Origin Domain Name](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesDomainName) in the *Amazon CloudFront Developer Guide* .
	DomainName *string `field:"required" json:"domainName" yaml:"domainName"`
	// A unique identifier for the origin. This value must be unique within the distribution.
	//
	// Use this value to specify the `TargetOriginId` in a `CacheBehavior` or `DefaultCacheBehavior` .
	Id *string `field:"required" json:"id" yaml:"id"`
	// The number of times that CloudFront attempts to connect to the origin.
	//
	// The minimum number is 1, the maximum is 3, and the default (if you don’t specify otherwise) is 3.
	//
	// For a custom origin (including an Amazon S3 bucket that’s configured with static website hosting), this value also specifies the number of times that CloudFront attempts to get a response from the origin, in the case of an [Origin Response Timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout) .
	//
	// For more information, see [Origin Connection Attempts](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-attempts) in the *Amazon CloudFront Developer Guide* .
	ConnectionAttempts *float64 `field:"optional" json:"connectionAttempts" yaml:"connectionAttempts"`
	// The number of seconds that CloudFront waits when trying to establish a connection to the origin.
	//
	// The minimum timeout is 1 second, the maximum is 10 seconds, and the default (if you don’t specify otherwise) is 10 seconds.
	//
	// For more information, see [Origin Connection Timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-timeout) in the *Amazon CloudFront Developer Guide* .
	ConnectionTimeout *float64 `field:"optional" json:"connectionTimeout" yaml:"connectionTimeout"`
	// Use this type to specify an origin that is not an Amazon S3 bucket, with one exception.
	//
	// If the Amazon S3 bucket is configured with static website hosting, use this type. If the Amazon S3 bucket is not configured with static website hosting, use the `S3OriginConfig` type instead.
	CustomOriginConfig interface{} `field:"optional" json:"customOriginConfig" yaml:"customOriginConfig"`
	// A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin.
	//
	// For more information, see [Adding Custom Headers to Origin Requests](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html) in the *Amazon CloudFront Developer Guide* .
	OriginCustomHeaders interface{} `field:"optional" json:"originCustomHeaders" yaml:"originCustomHeaders"`
	// An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
	//
	// For more information, see [Origin Path](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath) in the *Amazon CloudFront Developer Guide* .
	OriginPath *string `field:"optional" json:"originPath" yaml:"originPath"`
	// CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin.
	//
	// For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the *Amazon CloudFront Developer Guide* .
	OriginShield interface{} `field:"optional" json:"originShield" yaml:"originShield"`
	// Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting.
	//
	// To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the `CustomOriginConfig` type instead.
	S3OriginConfig interface{} `field:"optional" json:"s3OriginConfig" yaml:"s3OriginConfig"`
}

An origin.

An origin is the location where content is stored, and from which CloudFront gets content to serve to viewers. To specify an origin:

- Use `S3OriginConfig` to specify an Amazon S3 bucket that is not configured with static website hosting. - Use `CustomOriginConfig` to specify all other kinds of origins, including:

- An Amazon S3 bucket that is configured with static website hosting - An Elastic Load Balancing load balancer - An AWS Elemental MediaPackage endpoint - An AWS Elemental MediaStore container - Any other HTTP server, running on an Amazon EC2 instance or any other kind of host

For the current maximum number of origins that you can specify per distribution, see [General Quotas on Web Distributions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#limits-web-distributions) in the *Amazon CloudFront Developer Guide* (quotas were formerly referred to as limits).

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originProperty := &originProperty{
	domainName: jsii.String("domainName"),
	id: jsii.String("id"),

	// the properties below are optional
	connectionAttempts: jsii.Number(123),
	connectionTimeout: jsii.Number(123),
	customOriginConfig: &customOriginConfigProperty{
		originProtocolPolicy: jsii.String("originProtocolPolicy"),

		// the properties below are optional
		httpPort: jsii.Number(123),
		httpsPort: jsii.Number(123),
		originKeepaliveTimeout: jsii.Number(123),
		originReadTimeout: jsii.Number(123),
		originSslProtocols: []*string{
			jsii.String("originSslProtocols"),
		},
	},
	originCustomHeaders: []interface{}{
		&originCustomHeaderProperty{
			headerName: jsii.String("headerName"),
			headerValue: jsii.String("headerValue"),
		},
	},
	originPath: jsii.String("originPath"),
	originShield: &originShieldProperty{
		enabled: jsii.Boolean(false),
		originShieldRegion: jsii.String("originShieldRegion"),
	},
	s3OriginConfig: &s3OriginConfigProperty{
		originAccessIdentity: jsii.String("originAccessIdentity"),
	},
}

type CfnDistribution_OriginShieldProperty 

type CfnDistribution_OriginShieldProperty struct {
	// A flag that specifies whether Origin Shield is enabled.
	//
	// When it’s enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it’s disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
	Enabled interface{} `field:"optional" json:"enabled" yaml:"enabled"`
	// The AWS Region for Origin Shield.
	//
	// Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as `us-east-2` .
	//
	// When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see [Choosing the AWS Region for Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region) in the *Amazon CloudFront Developer Guide* .
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
}

CloudFront Origin Shield.

Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originShieldProperty := &originShieldProperty{
	enabled: jsii.Boolean(false),
	originShieldRegion: jsii.String("originShieldRegion"),
}

type CfnDistribution_RestrictionsProperty 

type CfnDistribution_RestrictionsProperty struct {
	// A complex type that controls the countries in which your content is distributed.
	//
	// CloudFront determines the location of your users using `MaxMind` GeoIP databases. To disable geo restriction, remove the [Restrictions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions) property from your stack template.
	GeoRestriction interface{} `field:"required" json:"geoRestriction" yaml:"geoRestriction"`
}

A complex type that identifies ways in which you want to restrict distribution of your content.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

restrictionsProperty := &restrictionsProperty{
	geoRestriction: &geoRestrictionProperty{
		restrictionType: jsii.String("restrictionType"),

		// the properties below are optional
		locations: []*string{
			jsii.String("locations"),
		},
	},
}

type CfnDistribution_S3OriginConfigProperty 

type CfnDistribution_S3OriginConfigProperty struct {
	// The CloudFront origin access identity to associate with the origin.
	//
	// Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is:
	//
	// origin-access-identity/cloudfront/ *ID-of-origin-access-identity*
	//
	// where `*ID-of-origin-access-identity*` is the value that CloudFront returned in the `ID` element when you created the origin access identity.
	//
	// If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty `OriginAccessIdentity` element.
	//
	// To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty `OriginAccessIdentity` element.
	//
	// To replace the origin access identity, update the distribution configuration and specify the new origin access identity.
	//
	// For more information about the origin access identity, see [Serving Private Content through CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	OriginAccessIdentity *string `field:"optional" json:"originAccessIdentity" yaml:"originAccessIdentity"`
}

A complex type that contains information about the Amazon S3 origin.

If the origin is a custom origin or an S3 bucket that is configured as a website endpoint, use the `CustomOriginConfig` element instead.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

s3OriginConfigProperty := &s3OriginConfigProperty{
	originAccessIdentity: jsii.String("originAccessIdentity"),
}

type CfnDistribution_StatusCodesProperty 

type CfnDistribution_StatusCodesProperty struct {
	// The items (status codes) for an origin group.
	Items interface{} `field:"required" json:"items" yaml:"items"`
	// The number of status codes.
	Quantity *float64 `field:"required" json:"quantity" yaml:"quantity"`
}

A complex data type for the status codes that you specify that, when returned by a primary origin, trigger CloudFront to failover to a second origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

statusCodesProperty := &statusCodesProperty{
	items: []interface{}{
		jsii.Number(123),
	},
	quantity: jsii.Number(123),
}

type CfnDistribution_ViewerCertificateProperty 

type CfnDistribution_ViewerCertificateProperty struct {
	// > In CloudFormation, this field name is `AcmCertificateArn` . Note the different capitalization.
	//
	// If the distribution uses `Aliases` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in [AWS Certificate Manager (ACM)](https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html) , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( `us-east-1` ).
	//
	// If you specify an ACM certificate ARN, you must also specify values for `MinimumProtocolVersion` and `SSLSupportMethod` . (In CloudFormation, the field name is `SslSupportMethod` . Note the different capitalization.)
	AcmCertificateArn *string `field:"optional" json:"acmCertificateArn" yaml:"acmCertificateArn"`
	// If the distribution uses the CloudFront domain name such as `d111111abcdef8.cloudfront.net` , set this field to `true` .
	//
	// If the distribution uses `Aliases` (alternate domain names or CNAMEs), set this field to `false` and specify values for the following fields:
	//
	// - `ACMCertificateArn` or `IAMCertificateId` (specify a value for one, not both)
	//
	// In CloudFormation, these field names are `AcmCertificateArn` and `IamCertificateId` . Note the different capitalization.
	// - `MinimumProtocolVersion`
	// - `SSLSupportMethod` (In CloudFormation, this field name is `SslSupportMethod` . Note the different capitalization.)
	CloudFrontDefaultCertificate interface{} `field:"optional" json:"cloudFrontDefaultCertificate" yaml:"cloudFrontDefaultCertificate"`
	// > In CloudFormation, this field name is `IamCertificateId` . Note the different capitalization.
	//
	// If the distribution uses `Aliases` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) , provide the ID of the IAM certificate.
	//
	// If you specify an IAM certificate ID, you must also specify values for `MinimumProtocolVersion` and `SSLSupportMethod` . (In CloudFormation, the field name is `SslSupportMethod` . Note the different capitalization.)
	IamCertificateId *string `field:"optional" json:"iamCertificateId" yaml:"iamCertificateId"`
	// If the distribution uses `Aliases` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers.
	//
	// The security policy determines two settings:
	//
	// - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers.
	// - The ciphers that CloudFront can use to encrypt the content that it returns to viewers.
	//
	// For more information, see [Security Policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy) and [Supported Protocols and Ciphers Between Viewers and CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers) in the *Amazon CloudFront Developer Guide* .
	//
	// > On the CloudFront console, this setting is called *Security Policy* .
	//
	// When you’re using SNI only (you set `SSLSupportMethod` to `sni-only` ), you must specify `TLSv1` or higher. (In CloudFormation, the field name is `SslSupportMethod` . Note the different capitalization.)
	//
	// If the distribution uses the CloudFront domain name such as `d111111abcdef8.cloudfront.net` (you set `CloudFrontDefaultCertificate` to `true` ), CloudFront automatically sets the security policy to `TLSv1` regardless of the value that you set here.
	MinimumProtocolVersion *string `field:"optional" json:"minimumProtocolVersion" yaml:"minimumProtocolVersion"`
	// > In CloudFormation, this field name is `SslSupportMethod` . Note the different capitalization.
	//
	// If the distribution uses `Aliases` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from.
	//
	// - `sni-only` – The distribution accepts HTTPS connections from only viewers that support [server name indication (SNI)](https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication) . This is recommended. Most browsers and clients support SNI.
	// - `vip` – The distribution accepts HTTPS connections from all viewers including those that don’t support SNI. This is not recommended, and results in additional monthly charges from CloudFront.
	// - `static-ip` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the [AWS Support Center](https://docs.aws.amazon.com/support/home) .
	//
	// If the distribution uses the CloudFront domain name such as `d111111abcdef8.cloudfront.net` , don’t set a value for this field.
	SslSupportMethod *string `field:"optional" json:"sslSupportMethod" yaml:"sslSupportMethod"`
}

A complex type that determines the distribution’s SSL/TLS configuration for communicating with viewers.

If the distribution doesn’t use `Aliases` (also known as alternate domain names or CNAMEs)—that is, if the distribution uses the CloudFront domain name such as `d111111abcdef8.cloudfront.net` —set `CloudFrontDefaultCertificate` to `true` and leave all other fields empty.

If the distribution uses `Aliases` (alternate domain names or CNAMEs), use the fields in this type to specify the following settings:

- Which viewers the distribution accepts HTTPS connections from: only viewers that support [server name indication (SNI)](https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication) (recommended), or all viewers including those that don’t support SNI.

- To accept HTTPS connections from only viewers that support SNI, set `SSLSupportMethod` to `sni-only` . This is recommended. Most browsers and clients support SNI. (In CloudFormation, the field name is `SslSupportMethod` . Note the different capitalization.) - To accept HTTPS connections from all viewers, including those that don’t support SNI, set `SSLSupportMethod` to `vip` . This is not recommended, and results in additional monthly charges from CloudFront. (In CloudFormation, the field name is `SslSupportMethod` . Note the different capitalization.) - The minimum SSL/TLS protocol version that the distribution can use to communicate with viewers. To specify a minimum version, choose a value for `MinimumProtocolVersion` . For more information, see [Security Policy](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy) in the *Amazon CloudFront Developer Guide* . - The location of the SSL/TLS certificate, [AWS Certificate Manager (ACM)](https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html) (recommended) or [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html) . You specify the location by setting a value in one of the following fields (not both):

- `ACMCertificateArn` (In CloudFormation, this field name is `AcmCertificateArn` . Note the different capitalization.) - `IAMCertificateId` (In CloudFormation, this field name is `IamCertificateId` . Note the different capitalization.)

All distributions support HTTPS connections from viewers. To require viewers to use HTTPS only, or to redirect them from HTTP to HTTPS, use `ViewerProtocolPolicy` in the `CacheBehavior` or `DefaultCacheBehavior` . To specify how CloudFront should use SSL/TLS to communicate with your custom origin, use `CustomOriginConfig` .

For more information, see [Using HTTPS with CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html) and [Using Alternate Domain Names and HTTPS](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

viewerCertificateProperty := &viewerCertificateProperty{
	acmCertificateArn: jsii.String("acmCertificateArn"),
	cloudFrontDefaultCertificate: jsii.Boolean(false),
	iamCertificateId: jsii.String("iamCertificateId"),
	minimumProtocolVersion: jsii.String("minimumProtocolVersion"),
	sslSupportMethod: jsii.String("sslSupportMethod"),
}

type CfnFunction 

type CfnFunction interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The ARN of the function. For example:.
	//
	// `arn:aws:cloudfront::123456789012:function/ExampleFunction` .
	//
	// To get the function ARN, use the following syntax:
	//
	// `!GetAtt *Function_Logical_ID* .FunctionMetadata.FunctionARN`
	AttrFunctionArn() *string
	AttrFunctionMetadataFunctionArn() *string
	AttrStage() *string
	// A flag that determines whether to automatically publish the function to the `LIVE` stage when it’s created.
	//
	// To automatically publish to the `LIVE` stage, set this property to `true` .
	AutoPublish() interface{}
	SetAutoPublish(val interface{})
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The function code.
	//
	// For more information about writing a CloudFront function, see [Writing function code for CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html) in the *Amazon CloudFront Developer Guide* .
	FunctionCode() *string
	SetFunctionCode(val *string)
	// Contains configuration information about a CloudFront function.
	FunctionConfig() interface{}
	SetFunctionConfig(val interface{})
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// A name to identify the function.
	Name() *string
	SetName(val *string)
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::Function`.

Creates a CloudFront function.

To create a function, you provide the function code and some configuration information about the function. The response contains an Amazon Resource Name (ARN) that uniquely identifies the function, and the function’s stage.

By default, when you create a function, it’s in the `DEVELOPMENT` stage. In this stage, you can [test the function](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/test-function.html) in the CloudFront console (or with `TestFunction` in the CloudFront API).

When you’re ready to use your function with a CloudFront distribution, publish the function to the `LIVE` stage. You can do this in the CloudFront console, with `PublishFunction` in the CloudFront API, or by updating the `AWS::CloudFront::Function` resource with the `AutoPublish` property set to `true` . When the function is published to the `LIVE` stage, you can attach it to a distribution’s cache behavior, using the function’s ARN.

To automatically publish the function to the `LIVE` stage when it’s created, set the `AutoPublish` property to `true` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnFunction := awscdk.Aws_cloudfront.NewCfnFunction(this, jsii.String("MyCfnFunction"), &cfnFunctionProps{
	name: jsii.String("name"),

	// the properties below are optional
	autoPublish: jsii.Boolean(false),
	functionCode: jsii.String("functionCode"),
	functionConfig: &functionConfigProperty{
		comment: jsii.String("comment"),
		runtime: jsii.String("runtime"),
	},
})

func NewCfnFunction 

func NewCfnFunction(scope constructs.Construct, id *string, props *CfnFunctionProps) CfnFunction

Create a new `AWS::CloudFront::Function`.

type CfnFunctionProps 

type CfnFunctionProps struct {
	// A name to identify the function.
	Name *string `field:"required" json:"name" yaml:"name"`
	// A flag that determines whether to automatically publish the function to the `LIVE` stage when it’s created.
	//
	// To automatically publish to the `LIVE` stage, set this property to `true` .
	AutoPublish interface{} `field:"optional" json:"autoPublish" yaml:"autoPublish"`
	// The function code.
	//
	// For more information about writing a CloudFront function, see [Writing function code for CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html) in the *Amazon CloudFront Developer Guide* .
	FunctionCode *string `field:"optional" json:"functionCode" yaml:"functionCode"`
	// Contains configuration information about a CloudFront function.
	FunctionConfig interface{} `field:"optional" json:"functionConfig" yaml:"functionConfig"`
}

Properties for defining a `CfnFunction`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnFunctionProps := &cfnFunctionProps{
	name: jsii.String("name"),

	// the properties below are optional
	autoPublish: jsii.Boolean(false),
	functionCode: jsii.String("functionCode"),
	functionConfig: &functionConfigProperty{
		comment: jsii.String("comment"),
		runtime: jsii.String("runtime"),
	},
}

type CfnFunction_FunctionConfigProperty 

type CfnFunction_FunctionConfigProperty struct {
	// A comment to describe the function.
	Comment *string `field:"required" json:"comment" yaml:"comment"`
	// The function’s runtime environment.
	//
	// The only valid value is `cloudfront-js-1.0` .
	Runtime *string `field:"required" json:"runtime" yaml:"runtime"`
}

Contains configuration information about a CloudFront function.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

functionConfigProperty := &functionConfigProperty{
	comment: jsii.String("comment"),
	runtime: jsii.String("runtime"),
}

type CfnFunction_FunctionMetadataProperty 

type CfnFunction_FunctionMetadataProperty struct {
	// The Amazon Resource Name (ARN) of the function.
	//
	// The ARN uniquely identifies the function.
	FunctionArn *string `field:"optional" json:"functionArn" yaml:"functionArn"`
}

Contains metadata about a CloudFront function.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

functionMetadataProperty := &functionMetadataProperty{
	functionArn: jsii.String("functionArn"),
}

type CfnKeyGroup 

type CfnKeyGroup interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The identifier for the key group.
	AttrId() *string
	// The date and time when the key group was last modified.
	AttrLastModifiedTime() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The key group configuration.
	KeyGroupConfig() interface{}
	SetKeyGroupConfig(val interface{})
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::KeyGroup`.

A key group.

A key group contains a list of public keys that you can use with [CloudFront signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnKeyGroup := awscdk.Aws_cloudfront.NewCfnKeyGroup(this, jsii.String("MyCfnKeyGroup"), &cfnKeyGroupProps{
	keyGroupConfig: &keyGroupConfigProperty{
		items: []*string{
			jsii.String("items"),
		},
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
	},
})

func NewCfnKeyGroup 

func NewCfnKeyGroup(scope constructs.Construct, id *string, props *CfnKeyGroupProps) CfnKeyGroup

Create a new `AWS::CloudFront::KeyGroup`.

type CfnKeyGroupProps 

type CfnKeyGroupProps struct {
	// The key group configuration.
	KeyGroupConfig interface{} `field:"required" json:"keyGroupConfig" yaml:"keyGroupConfig"`
}

Properties for defining a `CfnKeyGroup`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnKeyGroupProps := &cfnKeyGroupProps{
	keyGroupConfig: &keyGroupConfigProperty{
		items: []*string{
			jsii.String("items"),
		},
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
	},
}

type CfnKeyGroup_KeyGroupConfigProperty 

type CfnKeyGroup_KeyGroupConfigProperty struct {
	// A list of the identifiers of the public keys in the key group.
	Items *[]*string `field:"required" json:"items" yaml:"items"`
	// A name to identify the key group.
	Name *string `field:"required" json:"name" yaml:"name"`
	// A comment to describe the key group.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
}

A key group configuration.

A key group contains a list of public keys that you can use with [CloudFront signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

keyGroupConfigProperty := &keyGroupConfigProperty{
	items: []*string{
		jsii.String("items"),
	},
	name: jsii.String("name"),

	// the properties below are optional
	comment: jsii.String("comment"),
}

type CfnOriginRequestPolicy 

type CfnOriginRequestPolicy interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The unique identifier for the origin request policy.
	//
	// For example: `befd7079-9bbc-4ebf-8ade-498a3694176c` .
	AttrId() *string
	// The date and time when the origin request policy was last modified.
	AttrLastModifiedTime() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// The origin request policy configuration.
	OriginRequestPolicyConfig() interface{}
	SetOriginRequestPolicyConfig(val interface{})
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::OriginRequestPolicy`.

An origin request policy.

When it’s attached to a cache behavior, the origin request policy determines the values that CloudFront includes in requests that it sends to the origin. Each request that CloudFront sends to the origin includes the following:

- The request body and the URL path (without the domain name) from the viewer request. - The headers that CloudFront automatically includes in every origin request, including `Host` , `User-Agent` , and `X-Amz-Cf-Id` . - All HTTP headers, cookies, and URL query strings that are specified in the cache policy or the origin request policy. These can include items from the viewer request and, in the case of headers, additional ones that are added by CloudFront.

CloudFront sends a request when it can’t find an object in its cache that matches the request. If you want to send values to the origin and also include them in the cache key, use `CachePolicy` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnOriginRequestPolicy := awscdk.Aws_cloudfront.NewCfnOriginRequestPolicy(this, jsii.String("MyCfnOriginRequestPolicy"), &cfnOriginRequestPolicyProps{
	originRequestPolicyConfig: &originRequestPolicyConfigProperty{
		cookiesConfig: &cookiesConfigProperty{
			cookieBehavior: jsii.String("cookieBehavior"),

			// the properties below are optional
			cookies: []*string{
				jsii.String("cookies"),
			},
		},
		headersConfig: &headersConfigProperty{
			headerBehavior: jsii.String("headerBehavior"),

			// the properties below are optional
			headers: []*string{
				jsii.String("headers"),
			},
		},
		name: jsii.String("name"),
		queryStringsConfig: &queryStringsConfigProperty{
			queryStringBehavior: jsii.String("queryStringBehavior"),

			// the properties below are optional
			queryStrings: []*string{
				jsii.String("queryStrings"),
			},
		},

		// the properties below are optional
		comment: jsii.String("comment"),
	},
})

func NewCfnOriginRequestPolicy 

func NewCfnOriginRequestPolicy(scope constructs.Construct, id *string, props *CfnOriginRequestPolicyProps) CfnOriginRequestPolicy

Create a new `AWS::CloudFront::OriginRequestPolicy`.

type CfnOriginRequestPolicyProps 

type CfnOriginRequestPolicyProps struct {
	// The origin request policy configuration.
	OriginRequestPolicyConfig interface{} `field:"required" json:"originRequestPolicyConfig" yaml:"originRequestPolicyConfig"`
}

Properties for defining a `CfnOriginRequestPolicy`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnOriginRequestPolicyProps := &cfnOriginRequestPolicyProps{
	originRequestPolicyConfig: &originRequestPolicyConfigProperty{
		cookiesConfig: &cookiesConfigProperty{
			cookieBehavior: jsii.String("cookieBehavior"),

			// the properties below are optional
			cookies: []*string{
				jsii.String("cookies"),
			},
		},
		headersConfig: &headersConfigProperty{
			headerBehavior: jsii.String("headerBehavior"),

			// the properties below are optional
			headers: []*string{
				jsii.String("headers"),
			},
		},
		name: jsii.String("name"),
		queryStringsConfig: &queryStringsConfigProperty{
			queryStringBehavior: jsii.String("queryStringBehavior"),

			// the properties below are optional
			queryStrings: []*string{
				jsii.String("queryStrings"),
			},
		},

		// the properties below are optional
		comment: jsii.String("comment"),
	},
}

type CfnOriginRequestPolicy_CookiesConfigProperty 

type CfnOriginRequestPolicy_CookiesConfigProperty struct {
	// Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:.
	//
	// - `none` – Cookies in viewer requests are not included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any cookies that are listed in a `CachePolicy` *are* included in origin requests.
	// - `whitelist` – The cookies in viewer requests that are listed in the `CookieNames` type are included in requests that CloudFront sends to the origin.
	// - `all` – All cookies in viewer requests are included in requests that CloudFront sends to the origin.
	CookieBehavior *string `field:"required" json:"cookieBehavior" yaml:"cookieBehavior"`
	// Contains a list of cookie names.
	Cookies *[]*string `field:"optional" json:"cookies" yaml:"cookies"`
}

An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cookiesConfigProperty := &cookiesConfigProperty{
	cookieBehavior: jsii.String("cookieBehavior"),

	// the properties below are optional
	cookies: []*string{
		jsii.String("cookies"),
	},
}

type CfnOriginRequestPolicy_HeadersConfigProperty 

type CfnOriginRequestPolicy_HeadersConfigProperty struct {
	// Determines whether any HTTP headers are included in requests that CloudFront sends to the origin. Valid values are:.
	//
	// - `none` – HTTP headers are not included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any headers that are listed in a `CachePolicy` *are* included in origin requests.
	// - `whitelist` – The HTTP headers that are listed in the `Headers` type are included in requests that CloudFront sends to the origin.
	// - `allViewer` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin.
	// - `allViewerAndWhitelistCloudFront` – All HTTP headers in viewer requests and the additional CloudFront headers that are listed in the `Headers` type are included in requests that CloudFront sends to the origin. The additional headers are added by CloudFront.
	HeaderBehavior *string `field:"required" json:"headerBehavior" yaml:"headerBehavior"`
	// Contains a list of HTTP header names.
	Headers *[]*string `field:"optional" json:"headers" yaml:"headers"`
}

An object that determines whether any HTTP headers (and if so, which headers) are included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

headersConfigProperty := &headersConfigProperty{
	headerBehavior: jsii.String("headerBehavior"),

	// the properties below are optional
	headers: []*string{
		jsii.String("headers"),
	},
}

type CfnOriginRequestPolicy_OriginRequestPolicyConfigProperty 

type CfnOriginRequestPolicy_OriginRequestPolicyConfigProperty struct {
	// The cookies from viewer requests to include in origin requests.
	CookiesConfig interface{} `field:"required" json:"cookiesConfig" yaml:"cookiesConfig"`
	// The HTTP headers to include in origin requests.
	//
	// These can include headers from viewer requests and additional headers added by CloudFront.
	HeadersConfig interface{} `field:"required" json:"headersConfig" yaml:"headersConfig"`
	// A unique name to identify the origin request policy.
	Name *string `field:"required" json:"name" yaml:"name"`
	// The URL query strings from viewer requests to include in origin requests.
	QueryStringsConfig interface{} `field:"required" json:"queryStringsConfig" yaml:"queryStringsConfig"`
	// A comment to describe the origin request policy.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
}

An origin request policy configuration.

This configuration determines the values that CloudFront includes in requests that it sends to the origin. Each request that CloudFront sends to the origin includes the following:

- The request body and the URL path (without the domain name) from the viewer request. - The headers that CloudFront automatically includes in every origin request, including `Host` , `User-Agent` , and `X-Amz-Cf-Id` . - All HTTP headers, cookies, and URL query strings that are specified in the cache policy or the origin request policy. These can include items from the viewer request and, in the case of headers, additional ones that are added by CloudFront.

CloudFront sends a request when it can’t find an object in its cache that matches the request. If you want to send values to the origin and also include them in the cache key, use `CachePolicy` .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originRequestPolicyConfigProperty := &originRequestPolicyConfigProperty{
	cookiesConfig: &cookiesConfigProperty{
		cookieBehavior: jsii.String("cookieBehavior"),

		// the properties below are optional
		cookies: []*string{
			jsii.String("cookies"),
		},
	},
	headersConfig: &headersConfigProperty{
		headerBehavior: jsii.String("headerBehavior"),

		// the properties below are optional
		headers: []*string{
			jsii.String("headers"),
		},
	},
	name: jsii.String("name"),
	queryStringsConfig: &queryStringsConfigProperty{
		queryStringBehavior: jsii.String("queryStringBehavior"),

		// the properties below are optional
		queryStrings: []*string{
			jsii.String("queryStrings"),
		},
	},

	// the properties below are optional
	comment: jsii.String("comment"),
}

type CfnOriginRequestPolicy_QueryStringsConfigProperty 

type CfnOriginRequestPolicy_QueryStringsConfigProperty struct {
	// Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin.
	//
	// Valid values are:
	//
	// - `none` – Query strings in viewer requests are not included in requests that CloudFront sends to the origin. Even when this field is set to `none` , any query strings that are listed in a `CachePolicy` *are* included in origin requests.
	// - `whitelist` – The query strings in viewer requests that are listed in the `QueryStringNames` type are included in requests that CloudFront sends to the origin.
	// - `all` – All query strings in viewer requests are included in requests that CloudFront sends to the origin.
	QueryStringBehavior *string `field:"required" json:"queryStringBehavior" yaml:"queryStringBehavior"`
	// Contains a list of query string names.
	QueryStrings *[]*string `field:"optional" json:"queryStrings" yaml:"queryStrings"`
}

An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in requests that CloudFront sends to the origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

queryStringsConfigProperty := &queryStringsConfigProperty{
	queryStringBehavior: jsii.String("queryStringBehavior"),

	// the properties below are optional
	queryStrings: []*string{
		jsii.String("queryStrings"),
	},
}

type CfnPublicKey 

type CfnPublicKey interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The date and time when the public key was uploaded.
	AttrCreatedTime() *string
	// The identifier of the public key.
	AttrId() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Configuration information about a public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) , or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) .
	PublicKeyConfig() interface{}
	SetPublicKeyConfig(val interface{})
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::PublicKey`.

A public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) , or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnPublicKey := awscdk.Aws_cloudfront.NewCfnPublicKey(this, jsii.String("MyCfnPublicKey"), &cfnPublicKeyProps{
	publicKeyConfig: &publicKeyConfigProperty{
		callerReference: jsii.String("callerReference"),
		encodedKey: jsii.String("encodedKey"),
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
	},
})

func NewCfnPublicKey 

func NewCfnPublicKey(scope constructs.Construct, id *string, props *CfnPublicKeyProps) CfnPublicKey

Create a new `AWS::CloudFront::PublicKey`.

type CfnPublicKeyProps 

type CfnPublicKeyProps struct {
	// Configuration information about a public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) , or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) .
	PublicKeyConfig interface{} `field:"required" json:"publicKeyConfig" yaml:"publicKeyConfig"`
}

Properties for defining a `CfnPublicKey`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnPublicKeyProps := &cfnPublicKeyProps{
	publicKeyConfig: &publicKeyConfigProperty{
		callerReference: jsii.String("callerReference"),
		encodedKey: jsii.String("encodedKey"),
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
	},
}

type CfnPublicKey_PublicKeyConfigProperty 

type CfnPublicKey_PublicKeyConfigProperty struct {
	// A string included in the request to help make sure that the request can’t be replayed.
	CallerReference *string `field:"required" json:"callerReference" yaml:"callerReference"`
	// The public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) , or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) .
	EncodedKey *string `field:"required" json:"encodedKey" yaml:"encodedKey"`
	// A name to help identify the public key.
	Name *string `field:"required" json:"name" yaml:"name"`
	// A comment to describe the public key.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
}

Configuration information about a public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) , or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html) .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

publicKeyConfigProperty := &publicKeyConfigProperty{
	callerReference: jsii.String("callerReference"),
	encodedKey: jsii.String("encodedKey"),
	name: jsii.String("name"),

	// the properties below are optional
	comment: jsii.String("comment"),
}

type CfnRealtimeLogConfig 

type CfnRealtimeLogConfig interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The Amazon Resource Name (ARN) of the real-time log configuration.
	//
	// For example: `arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig` .
	AttrArn() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
	EndPoints() interface{}
	SetEndPoints(val interface{})
	// A list of fields that are included in each real-time log record.
	//
	// In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream.
	//
	// For more information about fields, see [Real-time log configuration fields](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) in the *Amazon CloudFront Developer Guide* .
	Fields() *[]*string
	SetFields(val *[]*string)
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The unique name of this real-time log configuration.
	Name() *string
	SetName(val *string)
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The sampling rate for this real-time log configuration.
	//
	// The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.
	SamplingRate() *float64
	SetSamplingRate(val *float64)
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::RealtimeLogConfig`.

A real-time log configuration.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnRealtimeLogConfig := awscdk.Aws_cloudfront.NewCfnRealtimeLogConfig(this, jsii.String("MyCfnRealtimeLogConfig"), &cfnRealtimeLogConfigProps{
	endPoints: []interface{}{
		&endPointProperty{
			kinesisStreamConfig: &kinesisStreamConfigProperty{
				roleArn: jsii.String("roleArn"),
				streamArn: jsii.String("streamArn"),
			},
			streamType: jsii.String("streamType"),
		},
	},
	fields: []*string{
		jsii.String("fields"),
	},
	name: jsii.String("name"),
	samplingRate: jsii.Number(123),
})

func NewCfnRealtimeLogConfig 

func NewCfnRealtimeLogConfig(scope constructs.Construct, id *string, props *CfnRealtimeLogConfigProps) CfnRealtimeLogConfig

Create a new `AWS::CloudFront::RealtimeLogConfig`.

type CfnRealtimeLogConfigProps 

type CfnRealtimeLogConfigProps struct {
	// Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
	EndPoints interface{} `field:"required" json:"endPoints" yaml:"endPoints"`
	// A list of fields that are included in each real-time log record.
	//
	// In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream.
	//
	// For more information about fields, see [Real-time log configuration fields](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) in the *Amazon CloudFront Developer Guide* .
	Fields *[]*string `field:"required" json:"fields" yaml:"fields"`
	// The unique name of this real-time log configuration.
	Name *string `field:"required" json:"name" yaml:"name"`
	// The sampling rate for this real-time log configuration.
	//
	// The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.
	SamplingRate *float64 `field:"required" json:"samplingRate" yaml:"samplingRate"`
}

Properties for defining a `CfnRealtimeLogConfig`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnRealtimeLogConfigProps := &cfnRealtimeLogConfigProps{
	endPoints: []interface{}{
		&endPointProperty{
			kinesisStreamConfig: &kinesisStreamConfigProperty{
				roleArn: jsii.String("roleArn"),
				streamArn: jsii.String("streamArn"),
			},
			streamType: jsii.String("streamType"),
		},
	},
	fields: []*string{
		jsii.String("fields"),
	},
	name: jsii.String("name"),
	samplingRate: jsii.Number(123),
}

type CfnRealtimeLogConfig_EndPointProperty 

type CfnRealtimeLogConfig_EndPointProperty struct {
	// Contains information about the Amazon Kinesis data stream where you are sending real-time log data.
	KinesisStreamConfig interface{} `field:"required" json:"kinesisStreamConfig" yaml:"kinesisStreamConfig"`
	// The type of data stream where you are sending real-time log data.
	//
	// The only valid value is `Kinesis` .
	StreamType *string `field:"required" json:"streamType" yaml:"streamType"`
}

Contains information about the Amazon Kinesis data stream where you are sending real-time log data in a real-time log configuration.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

endPointProperty := &endPointProperty{
	kinesisStreamConfig: &kinesisStreamConfigProperty{
		roleArn: jsii.String("roleArn"),
		streamArn: jsii.String("streamArn"),
	},
	streamType: jsii.String("streamType"),
}

type CfnRealtimeLogConfig_KinesisStreamConfigProperty 

type CfnRealtimeLogConfig_KinesisStreamConfigProperty struct {
	// The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that CloudFront can use to send real-time log data to your Kinesis data stream.
	//
	// For more information the IAM role, see [Real-time log configuration IAM role](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) in the *Amazon CloudFront Developer Guide* .
	RoleArn *string `field:"required" json:"roleArn" yaml:"roleArn"`
	// The Amazon Resource Name (ARN) of the Kinesis data stream where you are sending real-time log data.
	StreamArn *string `field:"required" json:"streamArn" yaml:"streamArn"`
}

Contains information about the Amazon Kinesis data stream where you are sending real-time log data.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

kinesisStreamConfigProperty := &kinesisStreamConfigProperty{
	roleArn: jsii.String("roleArn"),
	streamArn: jsii.String("streamArn"),
}

type CfnResponseHeadersPolicy 

type CfnResponseHeadersPolicy interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The unique identifier for the cache policy.
	//
	// For example: `57f99797-3b20-4e1b-a728-27972a74082a` .
	AttrId() *string
	// The date and time when the response headers policy was last modified.
	AttrLastModifiedTime() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// A response headers policy configuration.
	//
	// A response headers policy contains information about a set of HTTP response headers and their values. CloudFront adds the headers in the policy to HTTP responses that it sends for requests that match a cache behavior that’s associated with the policy.
	ResponseHeadersPolicyConfig() interface{}
	SetResponseHeadersPolicyConfig(val interface{})
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::ResponseHeadersPolicy`.

A response headers policy.

A response headers policy contains information about a set of HTTP response headers and their values.

After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution. When it’s attached to a cache behavior, CloudFront adds the headers in the policy to HTTP responses that it sends for requests that match the cache behavior.

For more information, see [Adding HTTP headers to CloudFront responses](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/adding-response-headers.html) in the *Amazon CloudFront Developer Guide* .

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnResponseHeadersPolicy := awscdk.Aws_cloudfront.NewCfnResponseHeadersPolicy(this, jsii.String("MyCfnResponseHeadersPolicy"), &cfnResponseHeadersPolicyProps{
	responseHeadersPolicyConfig: &responseHeadersPolicyConfigProperty{
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
		corsConfig: &corsConfigProperty{
			accessControlAllowCredentials: jsii.Boolean(false),
			accessControlAllowHeaders: &accessControlAllowHeadersProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlAllowMethods: &accessControlAllowMethodsProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlAllowOrigins: &accessControlAllowOriginsProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			originOverride: jsii.Boolean(false),

			// the properties below are optional
			accessControlExposeHeaders: &accessControlExposeHeadersProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlMaxAgeSec: jsii.Number(123),
		},
		customHeadersConfig: &customHeadersConfigProperty{
			items: []interface{}{
				&customHeaderProperty{
					header: jsii.String("header"),
					override: jsii.Boolean(false),
					value: jsii.String("value"),
				},
			},
		},
		securityHeadersConfig: &securityHeadersConfigProperty{
			contentSecurityPolicy: &contentSecurityPolicyProperty{
				contentSecurityPolicy: jsii.String("contentSecurityPolicy"),
				override: jsii.Boolean(false),
			},
			contentTypeOptions: &contentTypeOptionsProperty{
				override: jsii.Boolean(false),
			},
			frameOptions: &frameOptionsProperty{
				frameOption: jsii.String("frameOption"),
				override: jsii.Boolean(false),
			},
			referrerPolicy: &referrerPolicyProperty{
				override: jsii.Boolean(false),
				referrerPolicy: jsii.String("referrerPolicy"),
			},
			strictTransportSecurity: &strictTransportSecurityProperty{
				accessControlMaxAgeSec: jsii.Number(123),
				override: jsii.Boolean(false),

				// the properties below are optional
				includeSubdomains: jsii.Boolean(false),
				preload: jsii.Boolean(false),
			},
			xssProtection: &xSSProtectionProperty{
				override: jsii.Boolean(false),
				protection: jsii.Boolean(false),

				// the properties below are optional
				modeBlock: jsii.Boolean(false),
				reportUri: jsii.String("reportUri"),
			},
		},
	},
})

func NewCfnResponseHeadersPolicy 

func NewCfnResponseHeadersPolicy(scope constructs.Construct, id *string, props *CfnResponseHeadersPolicyProps) CfnResponseHeadersPolicy

Create a new `AWS::CloudFront::ResponseHeadersPolicy`.

type CfnResponseHeadersPolicyProps 

type CfnResponseHeadersPolicyProps struct {
	// A response headers policy configuration.
	//
	// A response headers policy contains information about a set of HTTP response headers and their values. CloudFront adds the headers in the policy to HTTP responses that it sends for requests that match a cache behavior that’s associated with the policy.
	ResponseHeadersPolicyConfig interface{} `field:"required" json:"responseHeadersPolicyConfig" yaml:"responseHeadersPolicyConfig"`
}

Properties for defining a `CfnResponseHeadersPolicy`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnResponseHeadersPolicyProps := &cfnResponseHeadersPolicyProps{
	responseHeadersPolicyConfig: &responseHeadersPolicyConfigProperty{
		name: jsii.String("name"),

		// the properties below are optional
		comment: jsii.String("comment"),
		corsConfig: &corsConfigProperty{
			accessControlAllowCredentials: jsii.Boolean(false),
			accessControlAllowHeaders: &accessControlAllowHeadersProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlAllowMethods: &accessControlAllowMethodsProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlAllowOrigins: &accessControlAllowOriginsProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			originOverride: jsii.Boolean(false),

			// the properties below are optional
			accessControlExposeHeaders: &accessControlExposeHeadersProperty{
				items: []*string{
					jsii.String("items"),
				},
			},
			accessControlMaxAgeSec: jsii.Number(123),
		},
		customHeadersConfig: &customHeadersConfigProperty{
			items: []interface{}{
				&customHeaderProperty{
					header: jsii.String("header"),
					override: jsii.Boolean(false),
					value: jsii.String("value"),
				},
			},
		},
		securityHeadersConfig: &securityHeadersConfigProperty{
			contentSecurityPolicy: &contentSecurityPolicyProperty{
				contentSecurityPolicy: jsii.String("contentSecurityPolicy"),
				override: jsii.Boolean(false),
			},
			contentTypeOptions: &contentTypeOptionsProperty{
				override: jsii.Boolean(false),
			},
			frameOptions: &frameOptionsProperty{
				frameOption: jsii.String("frameOption"),
				override: jsii.Boolean(false),
			},
			referrerPolicy: &referrerPolicyProperty{
				override: jsii.Boolean(false),
				referrerPolicy: jsii.String("referrerPolicy"),
			},
			strictTransportSecurity: &strictTransportSecurityProperty{
				accessControlMaxAgeSec: jsii.Number(123),
				override: jsii.Boolean(false),

				// the properties below are optional
				includeSubdomains: jsii.Boolean(false),
				preload: jsii.Boolean(false),
			},
			xssProtection: &xSSProtectionProperty{
				override: jsii.Boolean(false),
				protection: jsii.Boolean(false),

				// the properties below are optional
				modeBlock: jsii.Boolean(false),
				reportUri: jsii.String("reportUri"),
			},
		},
	},
}

type CfnResponseHeadersPolicy_AccessControlAllowHeadersProperty 

type CfnResponseHeadersPolicy_AccessControlAllowHeadersProperty struct {
	// The list of HTTP header names.
	//
	// You can specify `*` to allow all headers.
	Items *[]*string `field:"required" json:"items" yaml:"items"`
}

A list of HTTP header names that CloudFront includes as values for the `Access-Control-Allow-Headers` HTTP response header.

For more information about the `Access-Control-Allow-Headers` HTTP response header, see [Access-Control-Allow-Headers](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

accessControlAllowHeadersProperty := &accessControlAllowHeadersProperty{
	items: []*string{
		jsii.String("items"),
	},
}

type CfnResponseHeadersPolicy_AccessControlAllowMethodsProperty 

type CfnResponseHeadersPolicy_AccessControlAllowMethodsProperty struct {
	// The list of HTTP methods. Valid values are:.
	//
	// - `GET`
	// - `DELETE`
	// - `HEAD`
	// - `OPTIONS`
	// - `PATCH`
	// - `POST`
	// - `PUT`
	// - `ALL`
	//
	// `ALL` is a special value that includes all of the listed HTTP methods.
	Items *[]*string `field:"required" json:"items" yaml:"items"`
}

A list of HTTP methods that CloudFront includes as values for the `Access-Control-Allow-Methods` HTTP response header.

For more information about the `Access-Control-Allow-Methods` HTTP response header, see [Access-Control-Allow-Methods](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

accessControlAllowMethodsProperty := &accessControlAllowMethodsProperty{
	items: []*string{
		jsii.String("items"),
	},
}

type CfnResponseHeadersPolicy_AccessControlAllowOriginsProperty 

type CfnResponseHeadersPolicy_AccessControlAllowOriginsProperty struct {
	// The list of origins (domain names).
	//
	// You can specify `*` to allow all origins.
	Items *[]*string `field:"required" json:"items" yaml:"items"`
}

A list of origins (domain names) that CloudFront can use as the value for the `Access-Control-Allow-Origin` HTTP response header.

For more information about the `Access-Control-Allow-Origin` HTTP response header, see [Access-Control-Allow-Origin](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

accessControlAllowOriginsProperty := &accessControlAllowOriginsProperty{
	items: []*string{
		jsii.String("items"),
	},
}

type CfnResponseHeadersPolicy_AccessControlExposeHeadersProperty 

type CfnResponseHeadersPolicy_AccessControlExposeHeadersProperty struct {
	// The list of HTTP headers.
	//
	// You can specify `*` to expose all headers.
	Items *[]*string `field:"required" json:"items" yaml:"items"`
}

A list of HTTP headers that CloudFront includes as values for the `Access-Control-Expose-Headers` HTTP response header.

For more information about the `Access-Control-Expose-Headers` HTTP response header, see [Access-Control-Expose-Headers](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

accessControlExposeHeadersProperty := &accessControlExposeHeadersProperty{
	items: []*string{
		jsii.String("items"),
	},
}

type CfnResponseHeadersPolicy_ContentSecurityPolicyProperty 

type CfnResponseHeadersPolicy_ContentSecurityPolicyProperty struct {
	// The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.
	ContentSecurityPolicy *string `field:"required" json:"contentSecurityPolicy" yaml:"contentSecurityPolicy"`
	// A Boolean that determines whether CloudFront overrides the `Content-Security-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
}

The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.

For more information about the `Content-Security-Policy` HTTP response header, see [Content-Security-Policy](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

contentSecurityPolicyProperty := &contentSecurityPolicyProperty{
	contentSecurityPolicy: jsii.String("contentSecurityPolicy"),
	override: jsii.Boolean(false),
}

type CfnResponseHeadersPolicy_ContentTypeOptionsProperty 

type CfnResponseHeadersPolicy_ContentTypeOptionsProperty struct {
	// A Boolean that determines whether CloudFront overrides the `X-Content-Type-Options` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
}

Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff` .

For more information about the `X-Content-Type-Options` HTTP response header, see [X-Content-Type-Options](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

contentTypeOptionsProperty := &contentTypeOptionsProperty{
	override: jsii.Boolean(false),
}

type CfnResponseHeadersPolicy_CorsConfigProperty 

type CfnResponseHeadersPolicy_CorsConfigProperty struct {
	// A Boolean that CloudFront uses as the value for the `Access-Control-Allow-Credentials` HTTP response header.
	//
	// For more information about the `Access-Control-Allow-Credentials` HTTP response header, see [Access-Control-Allow-Credentials](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) in the MDN Web Docs.
	AccessControlAllowCredentials interface{} `field:"required" json:"accessControlAllowCredentials" yaml:"accessControlAllowCredentials"`
	// A list of HTTP header names that CloudFront includes as values for the `Access-Control-Allow-Headers` HTTP response header.
	//
	// For more information about the `Access-Control-Allow-Headers` HTTP response header, see [Access-Control-Allow-Headers](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers) in the MDN Web Docs.
	AccessControlAllowHeaders interface{} `field:"required" json:"accessControlAllowHeaders" yaml:"accessControlAllowHeaders"`
	// A list of HTTP methods that CloudFront includes as values for the `Access-Control-Allow-Methods` HTTP response header.
	//
	// For more information about the `Access-Control-Allow-Methods` HTTP response header, see [Access-Control-Allow-Methods](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods) in the MDN Web Docs.
	AccessControlAllowMethods interface{} `field:"required" json:"accessControlAllowMethods" yaml:"accessControlAllowMethods"`
	// A list of origins (domain names) that CloudFront can use as the value for the `Access-Control-Allow-Origin` HTTP response header.
	//
	// For more information about the `Access-Control-Allow-Origin` HTTP response header, see [Access-Control-Allow-Origin](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin) in the MDN Web Docs.
	AccessControlAllowOrigins interface{} `field:"required" json:"accessControlAllowOrigins" yaml:"accessControlAllowOrigins"`
	// A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
	OriginOverride interface{} `field:"required" json:"originOverride" yaml:"originOverride"`
	// A list of HTTP headers that CloudFront includes as values for the `Access-Control-Expose-Headers` HTTP response header.
	//
	// For more information about the `Access-Control-Expose-Headers` HTTP response header, see [Access-Control-Expose-Headers](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers) in the MDN Web Docs.
	AccessControlExposeHeaders interface{} `field:"optional" json:"accessControlExposeHeaders" yaml:"accessControlExposeHeaders"`
	// A number that CloudFront uses as the value for the `Access-Control-Max-Age` HTTP response header.
	//
	// For more information about the `Access-Control-Max-Age` HTTP response header, see [Access-Control-Max-Age](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age) in the MDN Web Docs.
	AccessControlMaxAgeSec *float64 `field:"optional" json:"accessControlMaxAgeSec" yaml:"accessControlMaxAgeSec"`
}

A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

CloudFront adds these headers to HTTP responses that it sends for CORS requests that match a cache behavior associated with this response headers policy.

For more information about CORS, see [Cross-Origin Resource Sharing (CORS)](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

corsConfigProperty := &corsConfigProperty{
	accessControlAllowCredentials: jsii.Boolean(false),
	accessControlAllowHeaders: &accessControlAllowHeadersProperty{
		items: []*string{
			jsii.String("items"),
		},
	},
	accessControlAllowMethods: &accessControlAllowMethodsProperty{
		items: []*string{
			jsii.String("items"),
		},
	},
	accessControlAllowOrigins: &accessControlAllowOriginsProperty{
		items: []*string{
			jsii.String("items"),
		},
	},
	originOverride: jsii.Boolean(false),

	// the properties below are optional
	accessControlExposeHeaders: &accessControlExposeHeadersProperty{
		items: []*string{
			jsii.String("items"),
		},
	},
	accessControlMaxAgeSec: jsii.Number(123),
}

type CfnResponseHeadersPolicy_CustomHeaderProperty 

type CfnResponseHeadersPolicy_CustomHeaderProperty struct {
	// The HTTP response header name.
	Header *string `field:"required" json:"header" yaml:"header"`
	// A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.
	Override interface{} `field:"required" json:"override" yaml:"override"`
	// The value for the HTTP response header.
	Value *string `field:"required" json:"value" yaml:"value"`
}

An HTTP response header name and its value.

CloudFront includes this header in HTTP responses that it sends for requests that match a cache behavior that’s associated with this response headers policy.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

customHeaderProperty := &customHeaderProperty{
	header: jsii.String("header"),
	override: jsii.Boolean(false),
	value: jsii.String("value"),
}

type CfnResponseHeadersPolicy_CustomHeadersConfigProperty 

type CfnResponseHeadersPolicy_CustomHeadersConfigProperty struct {
	// The list of HTTP response headers and their values.
	Items interface{} `field:"required" json:"items" yaml:"items"`
}

A list of HTTP response header names and their values.

CloudFront includes these headers in HTTP responses that it sends for requests that match a cache behavior that’s associated with this response headers policy.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

customHeadersConfigProperty := &customHeadersConfigProperty{
	items: []interface{}{
		&customHeaderProperty{
			header: jsii.String("header"),
			override: jsii.Boolean(false),
			value: jsii.String("value"),
		},
	},
}

type CfnResponseHeadersPolicy_FrameOptionsProperty 

type CfnResponseHeadersPolicy_FrameOptionsProperty struct {
	// The value of the `X-Frame-Options` HTTP response header. Valid values are `DENY` and `SAMEORIGIN` .
	//
	// For more information about these values, see [X-Frame-Options](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) in the MDN Web Docs.
	FrameOption *string `field:"required" json:"frameOption" yaml:"frameOption"`
	// A Boolean that determines whether CloudFront overrides the `X-Frame-Options` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
}

Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header’s value.

For more information about the `X-Frame-Options` HTTP response header, see [X-Frame-Options](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

frameOptionsProperty := &frameOptionsProperty{
	frameOption: jsii.String("frameOption"),
	override: jsii.Boolean(false),
}

type CfnResponseHeadersPolicy_ReferrerPolicyProperty 

type CfnResponseHeadersPolicy_ReferrerPolicyProperty struct {
	// A Boolean that determines whether CloudFront overrides the `Referrer-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
	// The value of the `Referrer-Policy` HTTP response header. Valid values are:.
	//
	// - `no-referrer`
	// - `no-referrer-when-downgrade`
	// - `origin`
	// - `origin-when-cross-origin`
	// - `same-origin`
	// - `strict-origin`
	// - `strict-origin-when-cross-origin`
	// - `unsafe-url`
	//
	// For more information about these values, see [Referrer-Policy](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) in the MDN Web Docs.
	ReferrerPolicy *string `field:"required" json:"referrerPolicy" yaml:"referrerPolicy"`
}

Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header’s value.

For more information about the `Referrer-Policy` HTTP response header, see [Referrer-Policy](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

referrerPolicyProperty := &referrerPolicyProperty{
	override: jsii.Boolean(false),
	referrerPolicy: jsii.String("referrerPolicy"),
}

type CfnResponseHeadersPolicy_ResponseHeadersPolicyConfigProperty 

type CfnResponseHeadersPolicy_ResponseHeadersPolicyConfigProperty struct {
	// A name to identify the response headers policy.
	//
	// The name must be unique for response headers policies in this AWS account .
	Name *string `field:"required" json:"name" yaml:"name"`
	// A comment to describe the response headers policy.
	//
	// The comment cannot be longer than 128 characters.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).
	CorsConfig interface{} `field:"optional" json:"corsConfig" yaml:"corsConfig"`
	// A configuration for a set of custom HTTP response headers.
	CustomHeadersConfig interface{} `field:"optional" json:"customHeadersConfig" yaml:"customHeadersConfig"`
	// A configuration for a set of security-related HTTP response headers.
	SecurityHeadersConfig interface{} `field:"optional" json:"securityHeadersConfig" yaml:"securityHeadersConfig"`
}

A response headers policy configuration.

A response headers policy configuration contains metadata about the response headers policy, and configurations for sets of HTTP response headers and their values. CloudFront adds the headers in the policy to HTTP responses that it sends for requests that match a cache behavior associated with the policy.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

responseHeadersPolicyConfigProperty := &responseHeadersPolicyConfigProperty{
	name: jsii.String("name"),

	// the properties below are optional
	comment: jsii.String("comment"),
	corsConfig: &corsConfigProperty{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: &accessControlAllowHeadersProperty{
			items: []*string{
				jsii.String("items"),
			},
		},
		accessControlAllowMethods: &accessControlAllowMethodsProperty{
			items: []*string{
				jsii.String("items"),
			},
		},
		accessControlAllowOrigins: &accessControlAllowOriginsProperty{
			items: []*string{
				jsii.String("items"),
			},
		},
		originOverride: jsii.Boolean(false),

		// the properties below are optional
		accessControlExposeHeaders: &accessControlExposeHeadersProperty{
			items: []*string{
				jsii.String("items"),
			},
		},
		accessControlMaxAgeSec: jsii.Number(123),
	},
	customHeadersConfig: &customHeadersConfigProperty{
		items: []interface{}{
			&customHeaderProperty{
				header: jsii.String("header"),
				override: jsii.Boolean(false),
				value: jsii.String("value"),
			},
		},
	},
	securityHeadersConfig: &securityHeadersConfigProperty{
		contentSecurityPolicy: &contentSecurityPolicyProperty{
			contentSecurityPolicy: jsii.String("contentSecurityPolicy"),
			override: jsii.Boolean(false),
		},
		contentTypeOptions: &contentTypeOptionsProperty{
			override: jsii.Boolean(false),
		},
		frameOptions: &frameOptionsProperty{
			frameOption: jsii.String("frameOption"),
			override: jsii.Boolean(false),
		},
		referrerPolicy: &referrerPolicyProperty{
			override: jsii.Boolean(false),
			referrerPolicy: jsii.String("referrerPolicy"),
		},
		strictTransportSecurity: &strictTransportSecurityProperty{
			accessControlMaxAgeSec: jsii.Number(123),
			override: jsii.Boolean(false),

			// the properties below are optional
			includeSubdomains: jsii.Boolean(false),
			preload: jsii.Boolean(false),
		},
		xssProtection: &xSSProtectionProperty{
			override: jsii.Boolean(false),
			protection: jsii.Boolean(false),

			// the properties below are optional
			modeBlock: jsii.Boolean(false),
			reportUri: jsii.String("reportUri"),
		},
	},
}

type CfnResponseHeadersPolicy_SecurityHeadersConfigProperty 

type CfnResponseHeadersPolicy_SecurityHeadersConfigProperty struct {
	// The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.
	//
	// For more information about the `Content-Security-Policy` HTTP response header, see [Content-Security-Policy](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) in the MDN Web Docs.
	ContentSecurityPolicy interface{} `field:"optional" json:"contentSecurityPolicy" yaml:"contentSecurityPolicy"`
	// Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff` .
	//
	// For more information about the `X-Content-Type-Options` HTTP response header, see [X-Content-Type-Options](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options) in the MDN Web Docs.
	ContentTypeOptions interface{} `field:"optional" json:"contentTypeOptions" yaml:"contentTypeOptions"`
	// Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header’s value.
	//
	// For more information about the `X-Frame-Options` HTTP response header, see [X-Frame-Options](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) in the MDN Web Docs.
	FrameOptions interface{} `field:"optional" json:"frameOptions" yaml:"frameOptions"`
	// Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header’s value.
	//
	// For more information about the `Referrer-Policy` HTTP response header, see [Referrer-Policy](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) in the MDN Web Docs.
	ReferrerPolicy interface{} `field:"optional" json:"referrerPolicy" yaml:"referrerPolicy"`
	// Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header’s value.
	//
	// For more information about the `Strict-Transport-Security` HTTP response header, see [Strict-Transport-Security](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) in the MDN Web Docs.
	StrictTransportSecurity interface{} `field:"optional" json:"strictTransportSecurity" yaml:"strictTransportSecurity"`
	// Determines whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header’s value.
	//
	// For more information about the `X-XSS-Protection` HTTP response header, see [X-XSS-Protection](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) in the MDN Web Docs.
	XssProtection interface{} `field:"optional" json:"xssProtection" yaml:"xssProtection"`
}

A configuration for a set of security-related HTTP response headers.

CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior associated with this response headers policy.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

securityHeadersConfigProperty := &securityHeadersConfigProperty{
	contentSecurityPolicy: &contentSecurityPolicyProperty{
		contentSecurityPolicy: jsii.String("contentSecurityPolicy"),
		override: jsii.Boolean(false),
	},
	contentTypeOptions: &contentTypeOptionsProperty{
		override: jsii.Boolean(false),
	},
	frameOptions: &frameOptionsProperty{
		frameOption: jsii.String("frameOption"),
		override: jsii.Boolean(false),
	},
	referrerPolicy: &referrerPolicyProperty{
		override: jsii.Boolean(false),
		referrerPolicy: jsii.String("referrerPolicy"),
	},
	strictTransportSecurity: &strictTransportSecurityProperty{
		accessControlMaxAgeSec: jsii.Number(123),
		override: jsii.Boolean(false),

		// the properties below are optional
		includeSubdomains: jsii.Boolean(false),
		preload: jsii.Boolean(false),
	},
	xssProtection: &xSSProtectionProperty{
		override: jsii.Boolean(false),
		protection: jsii.Boolean(false),

		// the properties below are optional
		modeBlock: jsii.Boolean(false),
		reportUri: jsii.String("reportUri"),
	},
}

type CfnResponseHeadersPolicy_StrictTransportSecurityProperty 

type CfnResponseHeadersPolicy_StrictTransportSecurityProperty struct {
	// A number that CloudFront uses as the value for the `max-age` directive in the `Strict-Transport-Security` HTTP response header.
	AccessControlMaxAgeSec *float64 `field:"required" json:"accessControlMaxAgeSec" yaml:"accessControlMaxAgeSec"`
	// A Boolean that determines whether CloudFront overrides the `Strict-Transport-Security` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
	// A Boolean that determines whether CloudFront includes the `includeSubDomains` directive in the `Strict-Transport-Security` HTTP response header.
	IncludeSubdomains interface{} `field:"optional" json:"includeSubdomains" yaml:"includeSubdomains"`
	// A Boolean that determines whether CloudFront includes the `preload` directive in the `Strict-Transport-Security` HTTP response header.
	Preload interface{} `field:"optional" json:"preload" yaml:"preload"`
}

Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header’s value.

For more information about the `Strict-Transport-Security` HTTP response header, see [Strict-Transport-Security](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

strictTransportSecurityProperty := &strictTransportSecurityProperty{
	accessControlMaxAgeSec: jsii.Number(123),
	override: jsii.Boolean(false),

	// the properties below are optional
	includeSubdomains: jsii.Boolean(false),
	preload: jsii.Boolean(false),
}

type CfnResponseHeadersPolicy_XSSProtectionProperty 

type CfnResponseHeadersPolicy_XSSProtectionProperty struct {
	// A Boolean that determines whether CloudFront overrides the `X-XSS-Protection` HTTP response header received from the origin with the one specified in this response headers policy.
	Override interface{} `field:"required" json:"override" yaml:"override"`
	// A Boolean that determines the value of the `X-XSS-Protection` HTTP response header.
	//
	// When this setting is `true` , the value of the `X-XSS-Protection` header is `1` . When this setting is `false` , the value of the `X-XSS-Protection` header is `0` .
	//
	// For more information about these settings, see [X-XSS-Protection](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) in the MDN Web Docs.
	Protection interface{} `field:"required" json:"protection" yaml:"protection"`
	// A Boolean that determines whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
	//
	// For more information about this directive, see [X-XSS-Protection](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) in the MDN Web Docs.
	ModeBlock interface{} `field:"optional" json:"modeBlock" yaml:"modeBlock"`
	// A reporting URI, which CloudFront uses as the value of the `report` directive in the `X-XSS-Protection` header.
	//
	// You cannot specify a `ReportUri` when `ModeBlock` is `true` .
	//
	// For more information about using a reporting URL, see [X-XSS-Protection](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) in the MDN Web Docs.
	ReportUri *string `field:"optional" json:"reportUri" yaml:"reportUri"`
}

Determines whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header’s value.

For more information about the `X-XSS-Protection` HTTP response header, see [X-XSS-Protection](https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) in the MDN Web Docs.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

xSSProtectionProperty := &xSSProtectionProperty{
	override: jsii.Boolean(false),
	protection: jsii.Boolean(false),

	// the properties below are optional
	modeBlock: jsii.Boolean(false),
	reportUri: jsii.String("reportUri"),
}

type CfnStreamingDistribution 

type CfnStreamingDistribution interface {
	awscdk.CfnResource
	awscdk.IInspectable
	// The domain name of the resource, such as `d111111abcdef8.cloudfront.net` .
	AttrDomainName() *string
	// Options for this resource, such as condition, update policy etc.
	CfnOptions() awscdk.ICfnResourceOptions
	CfnProperties() *map[string]interface{}
	// AWS resource type.
	CfnResourceType() *string
	// Returns: the stack trace of the point where this Resource was created from, sourced
	// from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most
	// node +internal+ entries filtered.
	CreationStack() *[]*string
	// The logical ID for this CloudFormation stack element.
	//
	// The logical ID of the element
	// is calculated from the path of the resource node in the construct tree.
	//
	// To override this value, use `overrideLogicalId(newLogicalId)`.
	//
	// Returns: the logical ID as a stringified token. This value will only get
	// resolved during synthesis.
	LogicalId() *string
	// The tree node.
	Node() constructs.Node
	// Return a string that will be resolved to a CloudFormation `{ Ref }` for this element.
	//
	// If, by any chance, the intrinsic reference of a resource is not a string, you could
	// coerce it to an IResolvable through `Lazy.any({ produce: resource.ref })`.
	Ref() *string
	// The stack in which this element is defined.
	//
	// CfnElements must be defined within a stack scope (directly or indirectly).
	Stack() awscdk.Stack
	// The current configuration information for the RTMP distribution.
	StreamingDistributionConfig() interface{}
	SetStreamingDistributionConfig(val interface{})
	// A complex type that contains zero or more `Tag` elements.
	Tags() awscdk.TagManager
	// Deprecated.
	// Deprecated: use `updatedProperties`
	//
	// Return properties modified after initiation
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperites() *map[string]interface{}
	// Return properties modified after initiation.
	//
	// Resources that expose mutable properties should override this function to
	// collect and return the properties object for this resource.
	UpdatedProperties() *map[string]interface{}
	// Syntactic sugar for `addOverride(path, undefined)`.
	AddDeletionOverride(path *string)
	// Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.
	//
	// This can be used for resources across stacks (or nested stack) boundaries
	// and the dependency will automatically be transferred to the relevant scope.
	AddDependsOn(target awscdk.CfnResource)
	// Add a value to the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	AddMetadata(key *string, value interface{})
	// Adds an override to the synthesized CloudFormation resource.
	//
	// To add a
	// property override, either use `addPropertyOverride` or prefix `path` with
	// "Properties." (i.e. `Properties.TopicName`).
	//
	// If the override is nested, separate each nested level using a dot (.) in the path parameter.
	// If there is an array as part of the nesting, specify the index in the path.
	//
	// To include a literal `.` in the property name, prefix with a `\`. In most
	// programming languages you will need to write this as `"\\."` because the
	// `\` itself will need to be escaped.
	//
	// For example,
	// “`typescript
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes', ['myattribute']);
	// cfnResource.addOverride('Properties.GlobalSecondaryIndexes.1.ProjectionType', 'INCLUDE');
	// “`
	// would add the overrides
	// “`json
	// "Properties": {
	//    "GlobalSecondaryIndexes": [
	//      {
	//        "Projection": {
	//          "NonKeyAttributes": [ "myattribute" ]
	//          ...
	//        }
	//        ...
	//      },
	//      {
	//        "ProjectionType": "INCLUDE"
	//        ...
	//      },
	//    ]
	//    ...
	// }
	// “`
	//
	// The `value` argument to `addOverride` will not be processed or translated
	// in any way. Pass raw JSON values in here with the correct capitalization
	// for CloudFormation. If you pass CDK classes or structs, they will be
	// rendered with lowercased key names, and CloudFormation will reject the
	// template.
	AddOverride(path *string, value interface{})
	// Adds an override that deletes the value of a property from the resource definition.
	AddPropertyDeletionOverride(propertyPath *string)
	// Adds an override to a resource property.
	//
	// Syntactic sugar for `addOverride("Properties.<...>", value)`.
	AddPropertyOverride(propertyPath *string, value interface{})
	// Sets the deletion policy of the resource based on the removal policy specified.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`). In some
	// cases, a snapshot can be taken of the resource prior to deletion
	// (`RemovalPolicy.SNAPSHOT`). A list of resources that support this policy
	// can be found in the following link:.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options
	//
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy, options *awscdk.RemovalPolicyOptions)
	// Returns a token for an runtime attribute of this resource.
	//
	// Ideally, use generated attribute accessors (e.g. `resource.arn`), but this can be used for future compatibility
	// in case there is no generated attribute.
	GetAtt(attributeName *string) awscdk.Reference
	// Retrieve a value value from the CloudFormation Resource Metadata.
	// See: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html
	//
	// Note that this is a different set of metadata from CDK node metadata; this
	// metadata ends up in the stack template under the resource, whereas CDK
	// node metadata ends up in the Cloud Assembly.
	//
	GetMetadata(key *string) interface{}
	// Examines the CloudFormation resource and discloses attributes.
	Inspect(inspector awscdk.TreeInspector)
	// Overrides the auto-generated logical ID with a specific ID.
	OverrideLogicalId(newLogicalId *string)
	RenderProperties(props *map[string]interface{}) *map[string]interface{}
	// Can be overridden by subclasses to determine if this resource will be rendered into the cloudformation template.
	//
	// Returns: `true` if the resource should be included or `false` is the resource
	// should be omitted.
	ShouldSynthesize() *bool
	// Returns a string representation of this construct.
	//
	// Returns: a string representation of this resource.
	ToString() *string
	ValidateProperties(_properties interface{})
}

A CloudFormation `AWS::CloudFront::StreamingDistribution`.

This resource is deprecated. Amazon CloudFront is deprecating real-time messaging protocol (RTMP) distributions on December 31, 2020. For more information, [read the announcement](https://docs.aws.amazon.com/ann.jspa?annID=7356) on the Amazon CloudFront discussion forum.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnStreamingDistribution := awscdk.Aws_cloudfront.NewCfnStreamingDistribution(this, jsii.String("MyCfnStreamingDistribution"), &cfnStreamingDistributionProps{
	streamingDistributionConfig: &streamingDistributionConfigProperty{
		comment: jsii.String("comment"),
		enabled: jsii.Boolean(false),
		s3Origin: &s3OriginProperty{
			domainName: jsii.String("domainName"),
			originAccessIdentity: jsii.String("originAccessIdentity"),
		},
		trustedSigners: &trustedSignersProperty{
			enabled: jsii.Boolean(false),

			// the properties below are optional
			awsAccountNumbers: []*string{
				jsii.String("awsAccountNumbers"),
			},
		},

		// the properties below are optional
		aliases: []*string{
			jsii.String("aliases"),
		},
		logging: &loggingProperty{
			bucket: jsii.String("bucket"),
			enabled: jsii.Boolean(false),
			prefix: jsii.String("prefix"),
		},
		priceClass: jsii.String("priceClass"),
	},
	tags: []cfnTag{
		&cfnTag{
			key: jsii.String("key"),
			value: jsii.String("value"),
		},
	},
})

func NewCfnStreamingDistribution 

func NewCfnStreamingDistribution(scope constructs.Construct, id *string, props *CfnStreamingDistributionProps) CfnStreamingDistribution

Create a new `AWS::CloudFront::StreamingDistribution`.

type CfnStreamingDistributionProps 

type CfnStreamingDistributionProps struct {
	// The current configuration information for the RTMP distribution.
	StreamingDistributionConfig interface{} `field:"required" json:"streamingDistributionConfig" yaml:"streamingDistributionConfig"`
	// A complex type that contains zero or more `Tag` elements.
	Tags *[]*awscdk.CfnTag `field:"required" json:"tags" yaml:"tags"`
}

Properties for defining a `CfnStreamingDistribution`.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cfnStreamingDistributionProps := &cfnStreamingDistributionProps{
	streamingDistributionConfig: &streamingDistributionConfigProperty{
		comment: jsii.String("comment"),
		enabled: jsii.Boolean(false),
		s3Origin: &s3OriginProperty{
			domainName: jsii.String("domainName"),
			originAccessIdentity: jsii.String("originAccessIdentity"),
		},
		trustedSigners: &trustedSignersProperty{
			enabled: jsii.Boolean(false),

			// the properties below are optional
			awsAccountNumbers: []*string{
				jsii.String("awsAccountNumbers"),
			},
		},

		// the properties below are optional
		aliases: []*string{
			jsii.String("aliases"),
		},
		logging: &loggingProperty{
			bucket: jsii.String("bucket"),
			enabled: jsii.Boolean(false),
			prefix: jsii.String("prefix"),
		},
		priceClass: jsii.String("priceClass"),
	},
	tags: []cfnTag{
		&cfnTag{
			key: jsii.String("key"),
			value: jsii.String("value"),
		},
	},
}

type CfnStreamingDistribution_LoggingProperty 

type CfnStreamingDistribution_LoggingProperty struct {
	// The Amazon S3 bucket to store the access logs in, for example, `myawslogbucket.s3.amazonaws.com` .
	Bucket *string `field:"required" json:"bucket" yaml:"bucket"`
	// Specifies whether you want CloudFront to save access logs to an Amazon S3 bucket.
	//
	// If you don't want to enable logging when you create a streaming distribution or if you want to disable logging for an existing streaming distribution, specify `false` for `Enabled` , and specify `empty Bucket` and `Prefix` elements. If you specify `false` for `Enabled` but you specify values for `Bucket` and `Prefix` , the values are automatically deleted.
	Enabled interface{} `field:"required" json:"enabled" yaml:"enabled"`
	// An optional string that you want CloudFront to prefix to the access log filenames for this streaming distribution, for example, `myprefix/` .
	//
	// If you want to enable logging, but you don't want to specify a prefix, you still must include an empty `Prefix` element in the `Logging` element.
	Prefix *string `field:"required" json:"prefix" yaml:"prefix"`
}

A complex type that controls whether access logs are written for the streaming distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

loggingProperty := &loggingProperty{
	bucket: jsii.String("bucket"),
	enabled: jsii.Boolean(false),
	prefix: jsii.String("prefix"),
}

type CfnStreamingDistribution_S3OriginProperty 

type CfnStreamingDistribution_S3OriginProperty struct {
	// The DNS name of the Amazon S3 origin.
	DomainName *string `field:"required" json:"domainName" yaml:"domainName"`
	// The CloudFront origin access identity to associate with the distribution.
	//
	// Use an origin access identity to configure the distribution so that end users can only access objects in an Amazon S3 bucket through CloudFront.
	//
	// If you want end users to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty `OriginAccessIdentity` element.
	//
	// To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty `OriginAccessIdentity` element.
	//
	// To replace the origin access identity, update the distribution configuration and specify the new origin access identity.
	//
	// For more information, see [Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) in the *Amazon CloudFront Developer Guide* .
	OriginAccessIdentity *string `field:"required" json:"originAccessIdentity" yaml:"originAccessIdentity"`
}

A complex type that contains information about the Amazon S3 bucket from which you want CloudFront to get your media files for distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

s3OriginProperty := &s3OriginProperty{
	domainName: jsii.String("domainName"),
	originAccessIdentity: jsii.String("originAccessIdentity"),
}

type CfnStreamingDistribution_StreamingDistributionConfigProperty 

type CfnStreamingDistribution_StreamingDistributionConfigProperty struct {
	// Any comments you want to include about the streaming distribution.
	Comment *string `field:"required" json:"comment" yaml:"comment"`
	// Whether the streaming distribution is enabled to accept user requests for content.
	Enabled interface{} `field:"required" json:"enabled" yaml:"enabled"`
	// A complex type that contains information about the Amazon S3 bucket from which you want CloudFront to get your media files for distribution.
	S3Origin interface{} `field:"required" json:"s3Origin" yaml:"s3Origin"`
	// A complex type that specifies any AWS accounts that you want to permit to create signed URLs for private content.
	//
	// If you want the distribution to use signed URLs, include this element; if you want the distribution to use public URLs, remove this element. For more information, see [Serving Private Content through CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html) in the *Amazon CloudFront Developer Guide* .
	TrustedSigners interface{} `field:"required" json:"trustedSigners" yaml:"trustedSigners"`
	// A complex type that contains information about CNAMEs (alternate domain names), if any, for this streaming distribution.
	Aliases *[]*string `field:"optional" json:"aliases" yaml:"aliases"`
	// A complex type that controls whether access logs are written for the streaming distribution.
	Logging interface{} `field:"optional" json:"logging" yaml:"logging"`
	// A complex type that contains information about price class for this streaming distribution.
	PriceClass *string `field:"optional" json:"priceClass" yaml:"priceClass"`
}

The RTMP distribution's configuration information.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

streamingDistributionConfigProperty := &streamingDistributionConfigProperty{
	comment: jsii.String("comment"),
	enabled: jsii.Boolean(false),
	s3Origin: &s3OriginProperty{
		domainName: jsii.String("domainName"),
		originAccessIdentity: jsii.String("originAccessIdentity"),
	},
	trustedSigners: &trustedSignersProperty{
		enabled: jsii.Boolean(false),

		// the properties below are optional
		awsAccountNumbers: []*string{
			jsii.String("awsAccountNumbers"),
		},
	},

	// the properties below are optional
	aliases: []*string{
		jsii.String("aliases"),
	},
	logging: &loggingProperty{
		bucket: jsii.String("bucket"),
		enabled: jsii.Boolean(false),
		prefix: jsii.String("prefix"),
	},
	priceClass: jsii.String("priceClass"),
}

type CfnStreamingDistribution_TrustedSignersProperty 

type CfnStreamingDistribution_TrustedSignersProperty struct {
	// This field is `true` if any of the AWS accounts have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
	//
	// If not, this field is `false` .
	Enabled interface{} `field:"required" json:"enabled" yaml:"enabled"`
	// An AWS account number that contains active CloudFront key pairs that CloudFront can use to verify the signatures of signed URLs and signed cookies.
	//
	// If the AWS account that owns the key pairs is the same account that owns the CloudFront distribution, the value of this field is `self` .
	AwsAccountNumbers *[]*string `field:"optional" json:"awsAccountNumbers" yaml:"awsAccountNumbers"`
}

A list of AWS accounts whose public keys CloudFront can use to verify the signatures of signed URLs and signed cookies.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

trustedSignersProperty := &trustedSignersProperty{
	enabled: jsii.Boolean(false),

	// the properties below are optional
	awsAccountNumbers: []*string{
		jsii.String("awsAccountNumbers"),
	},
}

type CloudFrontAllowedCachedMethods 

type CloudFrontAllowedCachedMethods string

Enums for the methods CloudFront can cache. 

const (
	CloudFrontAllowedCachedMethods_GET_HEAD         CloudFrontAllowedCachedMethods = "GET_HEAD"
	CloudFrontAllowedCachedMethods_GET_HEAD_OPTIONS CloudFrontAllowedCachedMethods = "GET_HEAD_OPTIONS"
)

type CloudFrontAllowedMethods 

type CloudFrontAllowedMethods string

An enum for the supported methods to a CloudFront distribution. 

const (
	CloudFrontAllowedMethods_GET_HEAD         CloudFrontAllowedMethods = "GET_HEAD"
	CloudFrontAllowedMethods_GET_HEAD_OPTIONS CloudFrontAllowedMethods = "GET_HEAD_OPTIONS"
	CloudFrontAllowedMethods_ALL              CloudFrontAllowedMethods = "ALL"
)

type CloudFrontWebDistribution 

type CloudFrontWebDistribution interface {
	awscdk.Resource
	IDistribution
	// The domain name created by CloudFront for this distribution.
	//
	// If you are using aliases for your distribution, this is the domainName your DNS records should point to.
	// (In Route53, you could create an ALIAS record to this value, for example.)
	DistributionDomainName() *string
	// The distribution ID for this distribution.
	DistributionId() *string
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The logging bucket for this CloudFront distribution.
	//
	// If logging is not enabled for this distribution - this property will be undefined.
	LoggingBucket() awss3.IBucket
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

Amazon CloudFront is a global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to your viewers with low latency and high transfer speeds.

CloudFront fronts user provided content and caches it at edge locations across the world.

Here's how you can use this construct:

```ts const sourceBucket = new s3.Bucket(this, 'Bucket'); 

const distribution = new cloudfront.CloudFrontWebDistribution(this, 'MyDistribution', {
   originConfigs: [
     {
       s3OriginSource: {
       s3BucketSource: sourceBucket,
       },
       behaviors : [ {isDefaultBehavior: true}],
     },
   ],
});

```

This will create a CloudFront distribution that uses your S3Bucket as it's origin.

You can customize the distribution using additional properties from the CloudFrontWebDistributionProps interface.

Example: 

var sourceBucket bucket

viewerCertificate := cloudfront.viewerCertificate.fromIamCertificate(jsii.String("MYIAMROLEIDENTIFIER"), &viewerCertificateOptions{
	aliases: []*string{
		jsii.String("MYALIAS"),
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: viewerCertificate,
})

func NewCloudFrontWebDistribution 

func NewCloudFrontWebDistribution(scope constructs.Construct, id *string, props *CloudFrontWebDistributionProps) CloudFrontWebDistribution

type CloudFrontWebDistributionAttributes 

type CloudFrontWebDistributionAttributes struct {
	// The distribution ID for this distribution.
	DistributionId *string `field:"required" json:"distributionId" yaml:"distributionId"`
	// The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
	DomainName *string `field:"required" json:"domainName" yaml:"domainName"`
}

Attributes used to import a Distribution.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

cloudFrontWebDistributionAttributes := &cloudFrontWebDistributionAttributes{
	distributionId: jsii.String("distributionId"),
	domainName: jsii.String("domainName"),
}

type CloudFrontWebDistributionProps 

type CloudFrontWebDistributionProps struct {
	// The origin configurations for this distribution.
	//
	// Behaviors are a part of the origin.
	OriginConfigs *[]*SourceConfiguration `field:"required" json:"originConfigs" yaml:"originConfigs"`
	// A comment for this distribution in the CloudFront console.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// The default object to serve.
	DefaultRootObject *string `field:"optional" json:"defaultRootObject" yaml:"defaultRootObject"`
	// Enable or disable the distribution.
	Enabled *bool `field:"optional" json:"enabled" yaml:"enabled"`
	// If your distribution should have IPv6 enabled.
	EnableIpV6 *bool `field:"optional" json:"enableIpV6" yaml:"enableIpV6"`
	// How CloudFront should handle requests that are not successful (eg PageNotFound).
	//
	// By default, CloudFront does not replace HTTP status codes in the 4xx and 5xx range
	// with custom error messages. CloudFront does not cache HTTP status codes.
	ErrorConfigurations *[]*CfnDistribution_CustomErrorResponseProperty `field:"optional" json:"errorConfigurations" yaml:"errorConfigurations"`
	// Controls the countries in which your content is distributed.
	GeoRestriction GeoRestriction `field:"optional" json:"geoRestriction" yaml:"geoRestriction"`
	// The max supported HTTP Versions.
	HttpVersion HttpVersion `field:"optional" json:"httpVersion" yaml:"httpVersion"`
	// Optional - if we should enable logging.
	//
	// You can pass an empty object ({}) to have us auto create a bucket for logging.
	// Omission of this property indicates no logging is to be enabled.
	LoggingConfig *LoggingConfiguration `field:"optional" json:"loggingConfig" yaml:"loggingConfig"`
	// The price class for the distribution (this impacts how many locations CloudFront uses for your distribution, and billing).
	PriceClass PriceClass `field:"optional" json:"priceClass" yaml:"priceClass"`
	// Specifies whether you want viewers to use HTTP or HTTPS to request your objects, whether you're using an alternate domain name with HTTPS, and if so, if you're using AWS Certificate Manager (ACM) or a third-party certificate authority.
	// See: https://aws.amazon.com/premiumsupport/knowledge-center/custom-ssl-certificate-cloudfront/
	//
	ViewerCertificate ViewerCertificate `field:"optional" json:"viewerCertificate" yaml:"viewerCertificate"`
	// The default viewer policy for incoming clients.
	ViewerProtocolPolicy ViewerProtocolPolicy `field:"optional" json:"viewerProtocolPolicy" yaml:"viewerProtocolPolicy"`
	// Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.
	//
	// To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
	// `arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`.
	//
	// To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a`.
	// See: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html#API_CreateDistribution_RequestParameters.
	//
	WebACLId *string `field:"optional" json:"webACLId" yaml:"webACLId"`
}

Example: 

var sourceBucket bucket

viewerCertificate := cloudfront.viewerCertificate.fromIamCertificate(jsii.String("MYIAMROLEIDENTIFIER"), &viewerCertificateOptions{
	aliases: []*string{
		jsii.String("MYALIAS"),
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: viewerCertificate,
})

type CustomOriginConfig 

type CustomOriginConfig struct {
	// The domain name of the custom origin.
	//
	// Should not include the path - that should be in the parent SourceConfiguration.
	DomainName *string `field:"required" json:"domainName" yaml:"domainName"`
	// The SSL versions to use when interacting with the origin.
	AllowedOriginSSLVersions *[]OriginSslPolicy `field:"optional" json:"allowedOriginSSLVersions" yaml:"allowedOriginSSLVersions"`
	// The origin HTTP port.
	HttpPort *float64 `field:"optional" json:"httpPort" yaml:"httpPort"`
	// The origin HTTPS port.
	HttpsPort *float64 `field:"optional" json:"httpsPort" yaml:"httpsPort"`
	// Any additional headers to pass to the origin.
	OriginHeaders *map[string]*string `field:"optional" json:"originHeaders" yaml:"originHeaders"`
	// The keep alive timeout when making calls in seconds.
	OriginKeepaliveTimeout awscdk.Duration `field:"optional" json:"originKeepaliveTimeout" yaml:"originKeepaliveTimeout"`
	// The relative path to the origin root to use for sources.
	OriginPath *string `field:"optional" json:"originPath" yaml:"originPath"`
	// The protocol (http or https) policy to use when interacting with the origin.
	OriginProtocolPolicy OriginProtocolPolicy `field:"optional" json:"originProtocolPolicy" yaml:"originProtocolPolicy"`
	// The read timeout when calling the origin in seconds.
	OriginReadTimeout awscdk.Duration `field:"optional" json:"originReadTimeout" yaml:"originReadTimeout"`
	// When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
}

A custom origin configuration.

Example: 

var sourceBucket bucket
var oai originAccessIdentity

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
				originAccessIdentity: oai,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
		&sourceConfiguration{
			customOriginSource: &customOriginConfig{
				domainName: jsii.String("MYALIAS"),
			},
			behaviors: []*behavior{
				&behavior{
					pathPattern: jsii.String("/somewhere"),
				},
			},
		},
	},
})

type Distribution 

type Distribution interface {
	awscdk.Resource
	IDistribution
	// The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
	DistributionDomainName() *string
	// The distribution ID for this distribution.
	DistributionId() *string
	// The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
	DomainName() *string
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Adds a new behavior to this distribution for the given pathPattern.
	AddBehavior(pathPattern *string, origin IOrigin, behaviorOptions *AddBehaviorOptions)
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A CloudFront distribution with associated origin(s) and caching behavior(s).

Example: 

// Adding an existing Lambda@Edge function created in a different stack
// to a CloudFront distribution.
var s3Bucket bucket

functionVersion := lambda.version.fromVersionArn(this, jsii.String("Version"), jsii.String("arn:aws:lambda:us-east-1:123456789012:function:functionName:1"))

cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: functionVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})

func NewDistribution 

func NewDistribution(scope constructs.Construct, id *string, props *DistributionProps) Distribution

type DistributionAttributes 

type DistributionAttributes struct {
	// The distribution ID for this distribution.
	DistributionId *string `field:"required" json:"distributionId" yaml:"distributionId"`
	// The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
	DomainName *string `field:"required" json:"domainName" yaml:"domainName"`
}

Attributes used to import a Distribution.

Example: 

// Using a reference to an imported Distribution
distribution := cloudfront.distribution.fromDistributionAttributes(this, jsii.String("ImportedDist"), &distributionAttributes{
	domainName: jsii.String("d111111abcdef8.cloudfront.net"),
	distributionId: jsii.String("012345ABCDEF"),
})

type DistributionProps 

type DistributionProps struct {
	// The default behavior for the distribution.
	DefaultBehavior *BehaviorOptions `field:"required" json:"defaultBehavior" yaml:"defaultBehavior"`
	// Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to.
	AdditionalBehaviors *map[string]*BehaviorOptions `field:"optional" json:"additionalBehaviors" yaml:"additionalBehaviors"`
	// A certificate to associate with the distribution.
	//
	// The certificate must be located in N. Virginia (us-east-1).
	Certificate awscertificatemanager.ICertificate `field:"optional" json:"certificate" yaml:"certificate"`
	// Any comments you want to include about the distribution.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/).
	DefaultRootObject *string `field:"optional" json:"defaultRootObject" yaml:"defaultRootObject"`
	// Alternative domain names for this distribution.
	//
	// If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name,
	// you can add an alternate domain name to your distribution. If you attach a certificate to the distribution,
	// you must add (at least one of) the domain names of the certificate to this list.
	DomainNames *[]*string `field:"optional" json:"domainNames" yaml:"domainNames"`
	// Enable or disable the distribution.
	Enabled *bool `field:"optional" json:"enabled" yaml:"enabled"`
	// Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address.
	//
	// If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses.
	// This allows viewers to submit a second request, for an IPv4 address for your distribution.
	EnableIpv6 *bool `field:"optional" json:"enableIpv6" yaml:"enableIpv6"`
	// Enable access logging for the distribution.
	EnableLogging *bool `field:"optional" json:"enableLogging" yaml:"enableLogging"`
	// How CloudFront should handle requests that are not successful (e.g., PageNotFound).
	ErrorResponses *[]*ErrorResponse `field:"optional" json:"errorResponses" yaml:"errorResponses"`
	// Controls the countries in which your content is distributed.
	GeoRestriction GeoRestriction `field:"optional" json:"geoRestriction" yaml:"geoRestriction"`
	// Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront.
	//
	// For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI).
	HttpVersion HttpVersion `field:"optional" json:"httpVersion" yaml:"httpVersion"`
	// The Amazon S3 bucket to store the access logs in.
	LogBucket awss3.IBucket `field:"optional" json:"logBucket" yaml:"logBucket"`
	// An optional string that you want CloudFront to prefix to the access log filenames for this distribution.
	LogFilePrefix *string `field:"optional" json:"logFilePrefix" yaml:"logFilePrefix"`
	// Specifies whether you want CloudFront to include cookies in access logs.
	LogIncludesCookies *bool `field:"optional" json:"logIncludesCookies" yaml:"logIncludesCookies"`
	// The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.
	//
	// CloudFront serves your objects only to browsers or devices that support at
	// least the SSL version that you specify.
	MinimumProtocolVersion SecurityPolicyProtocol `field:"optional" json:"minimumProtocolVersion" yaml:"minimumProtocolVersion"`
	// The price class that corresponds with the maximum price that you want to pay for CloudFront service.
	//
	// If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations.
	// If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location
	// that has the lowest latency among the edge locations in your price class.
	PriceClass PriceClass `field:"optional" json:"priceClass" yaml:"priceClass"`
	// The SSL method CloudFront will use for your distribution.
	//
	// Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates
	// which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present
	// multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites
	// (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.
	//
	// CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.
	//
	// If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for
	// using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).
	//
	// See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/
	SslSupportMethod SSLMethod `field:"optional" json:"sslSupportMethod" yaml:"sslSupportMethod"`
	// Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.
	//
	// To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
	// `arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`.
	// To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example `473e64fd-f30b-4765-81a0-62ad96dd167a`.
	// See: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html#API_CreateDistribution_RequestParameters.
	//
	WebAclId *string `field:"optional" json:"webAclId" yaml:"webAclId"`
}

Properties for a Distribution.

Example: 

// Adding an existing Lambda@Edge function created in a different stack
// to a CloudFront distribution.
var s3Bucket bucket

functionVersion := lambda.version.fromVersionArn(this, jsii.String("Version"), jsii.String("arn:aws:lambda:us-east-1:123456789012:function:functionName:1"))

cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: functionVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})

type EdgeLambda 

type EdgeLambda struct {
	// The type of event in response to which should the function be invoked.
	EventType LambdaEdgeEventType `field:"required" json:"eventType" yaml:"eventType"`
	// The version of the Lambda function that will be invoked.
	//
	// **Note**: it's not possible to use the '$LATEST' function version for Lambda@Edge!
	FunctionVersion awslambda.IVersion `field:"required" json:"functionVersion" yaml:"functionVersion"`
	// Allows a Lambda function to have read access to the body content.
	//
	// Only valid for "request" event types (`ORIGIN_REQUEST` or `VIEWER_REQUEST`).
	// See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html
	IncludeBody *bool `field:"optional" json:"includeBody" yaml:"includeBody"`
}

Represents a Lambda function version and event type when using Lambda@Edge.

The type of the {@link AddBehaviorOptions.edgeLambdas} property.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

var version version

edgeLambda := &edgeLambda{
	eventType: awscdk.Aws_cloudfront.lambdaEdgeEventType_ORIGIN_REQUEST,
	functionVersion: version,

	// the properties below are optional
	includeBody: jsii.Boolean(false),
}

type ErrorResponse 

type ErrorResponse struct {
	// The HTTP status code for which you want to specify a custom error page and/or a caching duration.
	HttpStatus *float64 `field:"required" json:"httpStatus" yaml:"httpStatus"`
	// The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.
	//
	// If you specify a value for `responseHttpStatus`, you must also specify a value for `responsePagePath`.
	ResponseHttpStatus *float64 `field:"optional" json:"responseHttpStatus" yaml:"responseHttpStatus"`
	// The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the `httpStatus`, for example, /4xx-errors/403-forbidden.html.
	ResponsePagePath *string `field:"optional" json:"responsePagePath" yaml:"responsePagePath"`
	// The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in ErrorCode.
	Ttl awscdk.Duration `field:"optional" json:"ttl" yaml:"ttl"`
}

Options for configuring custom error responses.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import cdk "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

errorResponse := &errorResponse{
	httpStatus: jsii.Number(123),

	// the properties below are optional
	responseHttpStatus: jsii.Number(123),
	responsePagePath: jsii.String("responsePagePath"),
	ttl: cdk.duration.minutes(jsii.Number(30)),
}

type FailoverStatusCode 

type FailoverStatusCode string

HTTP status code to failover to second origin.

Example: 

// Configuring origin fallback options for the CloudFrontWebDistribution
// Configuring origin fallback options for the CloudFrontWebDistribution
cloudfront.NewCloudFrontWebDistribution(this, jsii.String("ADistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3.bucket.fromBucketName(this, jsii.String("aBucket"), jsii.String("myoriginbucket")),
				originPath: jsii.String("/"),
				originHeaders: map[string]*string{
					"myHeader": jsii.String("42"),
				},
				originShieldRegion: jsii.String("us-west-2"),
			},
			failoverS3OriginSource: &s3OriginConfig{
				s3BucketSource: s3.*bucket.fromBucketName(this, jsii.String("aBucketFallback"), jsii.String("myoriginbucketfallback")),
				originPath: jsii.String("/somewhere"),
				originHeaders: map[string]*string{
					"myHeader2": jsii.String("21"),
				},
				originShieldRegion: jsii.String("us-east-1"),
			},
			failoverCriteriaStatusCodes: []failoverStatusCode{
				cloudfront.*failoverStatusCode_INTERNAL_SERVER_ERROR,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
})

const (
	// Forbidden (403).
	FailoverStatusCode_FORBIDDEN FailoverStatusCode = "FORBIDDEN"
	// Not found (404).
	FailoverStatusCode_NOT_FOUND FailoverStatusCode = "NOT_FOUND"
	// Internal Server Error (500).
	FailoverStatusCode_INTERNAL_SERVER_ERROR FailoverStatusCode = "INTERNAL_SERVER_ERROR"
	// Bad Gateway (502).
	FailoverStatusCode_BAD_GATEWAY FailoverStatusCode = "BAD_GATEWAY"
	// Service Unavailable (503).
	FailoverStatusCode_SERVICE_UNAVAILABLE FailoverStatusCode = "SERVICE_UNAVAILABLE"
	// Gateway Timeout (504).
	FailoverStatusCode_GATEWAY_TIMEOUT FailoverStatusCode = "GATEWAY_TIMEOUT"
)

type FileCodeOptions 

type FileCodeOptions struct {
	// The path of the file to read the code from.
	FilePath *string `field:"required" json:"filePath" yaml:"filePath"`
}

Options when reading the function's code from an external file.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

fileCodeOptions := &fileCodeOptions{
	filePath: jsii.String("filePath"),
}

type Function 

type Function interface {
	awscdk.Resource
	IFunction
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// the ARN of the CloudFront function.
	FunctionArn() *string
	// the name of the CloudFront function.
	FunctionName() *string
	// the deployment stage of the CloudFront function.
	FunctionStage() *string
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A CloudFront Function.

Example: 

var s3Bucket bucket
// Add a cloudfront Function to a Distribution
cfFunction := cloudfront.NewFunction(this, jsii.String("Function"), &functionProps{
	code: cloudfront.functionCode.fromInline(jsii.String("function handler(event) { return event.request }")),
})
cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		functionAssociations: []functionAssociation{
			&functionAssociation{
				function: cfFunction,
				eventType: cloudfront.functionEventType_VIEWER_REQUEST,
			},
		},
	},
})

func NewFunction 

func NewFunction(scope constructs.Construct, id *string, props *FunctionProps) Function

type FunctionAssociation 

type FunctionAssociation struct {
	// The type of event which should invoke the function.
	EventType FunctionEventType `field:"required" json:"eventType" yaml:"eventType"`
	// The CloudFront function that will be invoked.
	Function IFunction `field:"required" json:"function" yaml:"function"`
}

Represents a CloudFront function and event type when using CF Functions.

The type of the {@link AddBehaviorOptions.functionAssociations} property.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

var function_ function

functionAssociation := &functionAssociation{
	eventType: awscdk.Aws_cloudfront.functionEventType_VIEWER_REQUEST,
	function: function_,
}

type FunctionAttributes 

type FunctionAttributes struct {
	// The ARN of the function.
	FunctionArn *string `field:"required" json:"functionArn" yaml:"functionArn"`
	// The name of the function.
	FunctionName *string `field:"required" json:"functionName" yaml:"functionName"`
}

Attributes of an existing CloudFront Function to import it.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

functionAttributes := &functionAttributes{
	functionArn: jsii.String("functionArn"),
	functionName: jsii.String("functionName"),
}

type FunctionCode 

type FunctionCode interface {
	// renders the function code.
	Render() *string
}

Represents the function's source code.

Example: 

var s3Bucket bucket
// Add a cloudfront Function to a Distribution
cfFunction := cloudfront.NewFunction(this, jsii.String("Function"), &functionProps{
	code: cloudfront.functionCode.fromInline(jsii.String("function handler(event) { return event.request }")),
})
cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		functionAssociations: []functionAssociation{
			&functionAssociation{
				function: cfFunction,
				eventType: cloudfront.functionEventType_VIEWER_REQUEST,
			},
		},
	},
})

func FunctionCode_FromFile 

func FunctionCode_FromFile(options *FileCodeOptions) FunctionCode

Code from external file for function.

Returns: code object with contents from file.

func FunctionCode_FromInline 

func FunctionCode_FromInline(code *string) FunctionCode

Inline code for function.

Returns: code object with inline code.

type FunctionEventType 

type FunctionEventType string

The type of events that a CloudFront function can be invoked in response to.

Example: 

var s3Bucket bucket
// Add a cloudfront Function to a Distribution
cfFunction := cloudfront.NewFunction(this, jsii.String("Function"), &functionProps{
	code: cloudfront.functionCode.fromInline(jsii.String("function handler(event) { return event.request }")),
})
cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		functionAssociations: []functionAssociation{
			&functionAssociation{
				function: cfFunction,
				eventType: cloudfront.functionEventType_VIEWER_REQUEST,
			},
		},
	},
})

const (
	// The viewer-request specifies the incoming request.
	FunctionEventType_VIEWER_REQUEST FunctionEventType = "VIEWER_REQUEST"
	// The viewer-response specifies the outgoing response.
	FunctionEventType_VIEWER_RESPONSE FunctionEventType = "VIEWER_RESPONSE"
)

type FunctionProps 

type FunctionProps struct {
	// The source code of the function.
	Code FunctionCode `field:"required" json:"code" yaml:"code"`
	// A comment to describe the function.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A name to identify the function.
	FunctionName *string `field:"optional" json:"functionName" yaml:"functionName"`
}

Properties for creating a CloudFront Function.

Example: 

var s3Bucket bucket
// Add a cloudfront Function to a Distribution
cfFunction := cloudfront.NewFunction(this, jsii.String("Function"), &functionProps{
	code: cloudfront.functionCode.fromInline(jsii.String("function handler(event) { return event.request }")),
})
cloudfront.NewDistribution(this, jsii.String("distro"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(s3Bucket),
		functionAssociations: []functionAssociation{
			&functionAssociation{
				function: cfFunction,
				eventType: cloudfront.functionEventType_VIEWER_REQUEST,
			},
		},
	},
})

type GeoRestriction 

type GeoRestriction interface {
	// Two-letter, uppercase country code for a country that you want to allow/deny.
	//
	// Include one element for each country.
	// See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website.
	Locations() *[]*string
	// Specifies the restriction type to impose.
	RestrictionType() *string
}

Controls the countries in which content is distributed.

Example: 

// Adding restrictions to a Cloudfront Web Distribution.
var sourceBucket bucket

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	geoRestriction: cloudfront.geoRestriction.allowlist(jsii.String("US"), jsii.String("GB")),
})

func GeoRestriction_Allowlist 

func GeoRestriction_Allowlist(locations ...*string) GeoRestriction

Allow specific countries which you want CloudFront to distribute your content.

func GeoRestriction_Denylist 

func GeoRestriction_Denylist(locations ...*string) GeoRestriction

Deny specific countries which you don't want CloudFront to distribute your content.

type HeadersFrameOption added in v2.1.0 

type HeadersFrameOption string

Enum representing possible values of the X-Frame-Options HTTP response header.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

const (
	// The page can only be displayed in a frame on the same origin as the page itself.
	HeadersFrameOption_DENY HeadersFrameOption = "DENY"
	// The page can only be displayed in a frame on the specified origin.
	HeadersFrameOption_SAMEORIGIN HeadersFrameOption = "SAMEORIGIN"
)

type HeadersReferrerPolicy added in v2.1.0 

type HeadersReferrerPolicy string

Enum representing possible values of the Referrer-Policy HTTP response header.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

const (
	// The referrer policy is not set.
	HeadersReferrerPolicy_NO_REFERRER HeadersReferrerPolicy = "NO_REFERRER"
	// The referrer policy is no-referrer-when-downgrade.
	HeadersReferrerPolicy_NO_REFERRER_WHEN_DOWNGRADE HeadersReferrerPolicy = "NO_REFERRER_WHEN_DOWNGRADE"
	// The referrer policy is origin.
	HeadersReferrerPolicy_ORIGIN HeadersReferrerPolicy = "ORIGIN"
	// The referrer policy is origin-when-cross-origin.
	HeadersReferrerPolicy_ORIGIN_WHEN_CROSS_ORIGIN HeadersReferrerPolicy = "ORIGIN_WHEN_CROSS_ORIGIN"
	// The referrer policy is same-origin.
	HeadersReferrerPolicy_SAME_ORIGIN HeadersReferrerPolicy = "SAME_ORIGIN"
	// The referrer policy is strict-origin.
	HeadersReferrerPolicy_STRICT_ORIGIN HeadersReferrerPolicy = "STRICT_ORIGIN"
	// The referrer policy is strict-origin-when-cross-origin.
	HeadersReferrerPolicy_STRICT_ORIGIN_WHEN_CROSS_ORIGIN HeadersReferrerPolicy = "STRICT_ORIGIN_WHEN_CROSS_ORIGIN"
	// The referrer policy is unsafe-url.
	HeadersReferrerPolicy_UNSAFE_URL HeadersReferrerPolicy = "UNSAFE_URL"
)

type HttpVersion 

type HttpVersion string

Maximum HTTP version to support. 

const (
	// HTTP 1.1.
	HttpVersion_HTTP1_1 HttpVersion = "HTTP1_1"
	// HTTP 2.
	HttpVersion_HTTP2 HttpVersion = "HTTP2"
)

type ICachePolicy 

type ICachePolicy interface {
	// The ID of the cache policy.
	CachePolicyId() *string
}

Represents a Cache Policy.

func CachePolicy_AMPLIFY 

func CachePolicy_AMPLIFY() ICachePolicy

func CachePolicy_CACHING_DISABLED 

func CachePolicy_CACHING_DISABLED() ICachePolicy

func CachePolicy_CACHING_OPTIMIZED 

func CachePolicy_CACHING_OPTIMIZED() ICachePolicy

func CachePolicy_CACHING_OPTIMIZED_FOR_UNCOMPRESSED_OBJECTS 

func CachePolicy_CACHING_OPTIMIZED_FOR_UNCOMPRESSED_OBJECTS() ICachePolicy

func CachePolicy_ELEMENTAL_MEDIA_PACKAGE 

func CachePolicy_ELEMENTAL_MEDIA_PACKAGE() ICachePolicy

func CachePolicy_FromCachePolicyId 

func CachePolicy_FromCachePolicyId(scope constructs.Construct, id *string, cachePolicyId *string) ICachePolicy

Imports a Cache Policy from its id.

type IDistribution 

type IDistribution interface {
	awscdk.IResource
	// The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
	DistributionDomainName() *string
	// The distribution ID for this distribution.
	DistributionId() *string
}

Interface for CloudFront distributions.

func CloudFrontWebDistribution_FromDistributionAttributes 

func CloudFrontWebDistribution_FromDistributionAttributes(scope constructs.Construct, id *string, attrs *CloudFrontWebDistributionAttributes) IDistribution

Creates a construct that represents an external (imported) distribution.

func Distribution_FromDistributionAttributes 

func Distribution_FromDistributionAttributes(scope constructs.Construct, id *string, attrs *DistributionAttributes) IDistribution

Creates a Distribution construct that represents an external (imported) distribution.

type IFunction 

type IFunction interface {
	awscdk.IResource
	// The ARN of the function.
	FunctionArn() *string
	// The name of the function.
	FunctionName() *string
}

Represents a CloudFront Function.

func Function_FromFunctionAttributes 

func Function_FromFunctionAttributes(scope constructs.Construct, id *string, attrs *FunctionAttributes) IFunction

Imports a function by its name and ARN.

type IKeyGroup 

type IKeyGroup interface {
	awscdk.IResource
	// The ID of the key group.
	KeyGroupId() *string
}

Represents a Key Group.

func KeyGroup_FromKeyGroupId 

func KeyGroup_FromKeyGroupId(scope constructs.Construct, id *string, keyGroupId *string) IKeyGroup

Imports a Key Group from its id.

type IOrigin 

type IOrigin interface {
	// The method called when a given Origin is added (for the first time) to a Distribution.
	Bind(scope constructs.Construct, options *OriginBindOptions) *OriginBindConfig
}

Represents the concept of a CloudFront Origin.

You provide one or more origins when creating a Distribution.

type IOriginAccessIdentity 

type IOriginAccessIdentity interface {
	awsiam.IGrantable
	awscdk.IResource
	// The Origin Access Identity Id (physical id) This was called originAccessIdentityName before.
	OriginAccessIdentityId() *string
	// The Origin Access Identity Id (physical id) It is misnamed and superseded by the correctly named originAccessIdentityId.
	// Deprecated: use originAccessIdentityId instead.
	OriginAccessIdentityName() *string
}

Interface for CloudFront OriginAccessIdentity.

func OriginAccessIdentity_FromOriginAccessIdentityId added in v2.31.0 

func OriginAccessIdentity_FromOriginAccessIdentityId(scope constructs.Construct, id *string, originAccessIdentityId *string) IOriginAccessIdentity

Creates a OriginAccessIdentity by providing the OriginAccessIdentityId.

func OriginAccessIdentity_FromOriginAccessIdentityName 

func OriginAccessIdentity_FromOriginAccessIdentityName(scope constructs.Construct, id *string, originAccessIdentityName *string) IOriginAccessIdentity

Creates a OriginAccessIdentity by providing the OriginAccessIdentityId.

It is misnamed and superseded by the correctly named fromOriginAccessIdentityId. Deprecated: use `fromOriginAccessIdentityId`.

type IOriginRequestPolicy 

type IOriginRequestPolicy interface {
	// The ID of the origin request policy.
	OriginRequestPolicyId() *string
}

Represents a Origin Request Policy.

func OriginRequestPolicy_ALL_VIEWER 

func OriginRequestPolicy_ALL_VIEWER() IOriginRequestPolicy

func OriginRequestPolicy_CORS_CUSTOM_ORIGIN 

func OriginRequestPolicy_CORS_CUSTOM_ORIGIN() IOriginRequestPolicy

func OriginRequestPolicy_CORS_S3_ORIGIN 

func OriginRequestPolicy_CORS_S3_ORIGIN() IOriginRequestPolicy

func OriginRequestPolicy_ELEMENTAL_MEDIA_TAILOR 

func OriginRequestPolicy_ELEMENTAL_MEDIA_TAILOR() IOriginRequestPolicy

func OriginRequestPolicy_FromOriginRequestPolicyId 

func OriginRequestPolicy_FromOriginRequestPolicyId(scope constructs.Construct, id *string, originRequestPolicyId *string) IOriginRequestPolicy

Imports a Origin Request Policy from its id.

func OriginRequestPolicy_USER_AGENT_REFERER_HEADERS 

func OriginRequestPolicy_USER_AGENT_REFERER_HEADERS() IOriginRequestPolicy

type IPublicKey 

type IPublicKey interface {
	awscdk.IResource
	// The ID of the key group.
	PublicKeyId() *string
}

Represents a Public Key.

func PublicKey_FromPublicKeyId 

func PublicKey_FromPublicKeyId(scope constructs.Construct, id *string, publicKeyId *string) IPublicKey

Imports a Public Key from its id.

type IResponseHeadersPolicy added in v2.1.0 

type IResponseHeadersPolicy interface {
	// The ID of the response headers policy.
	ResponseHeadersPolicyId() *string
}

Represents a response headers policy.

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS added in v2.1.0 

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS() IResponseHeadersPolicy

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_AND_SECURITY_HEADERS added in v2.1.0 

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_AND_SECURITY_HEADERS() IResponseHeadersPolicy

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT added in v2.1.0 

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT() IResponseHeadersPolicy

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS added in v2.1.0 

func ResponseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS() IResponseHeadersPolicy

func ResponseHeadersPolicy_FromResponseHeadersPolicyId added in v2.1.0 

func ResponseHeadersPolicy_FromResponseHeadersPolicyId(scope constructs.Construct, id *string, responseHeadersPolicyId *string) IResponseHeadersPolicy

Import an existing Response Headers Policy from its ID.

func ResponseHeadersPolicy_SECURITY_HEADERS added in v2.1.0 

func ResponseHeadersPolicy_SECURITY_HEADERS() IResponseHeadersPolicy

type KeyGroup 

type KeyGroup interface {
	awscdk.Resource
	IKeyGroup
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The ID of the key group.
	KeyGroupId() *string
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A Key Group configuration.

Example: 

// Validating signed URLs or signed cookies with Trusted Key Groups

// public key in PEM format
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewDistribution(this, jsii.String("Dist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
		trustedKeyGroups: []iKeyGroup{
			keyGroup,
		},
	},
})

func NewKeyGroup 

func NewKeyGroup(scope constructs.Construct, id *string, props *KeyGroupProps) KeyGroup

type KeyGroupProps 

type KeyGroupProps struct {
	// A list of public keys to add to the key group.
	Items *[]IPublicKey `field:"required" json:"items" yaml:"items"`
	// A comment to describe the key group.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A name to identify the key group.
	KeyGroupName *string `field:"optional" json:"keyGroupName" yaml:"keyGroupName"`
}

Properties for creating a Public Key.

Example: 

// Validating signed URLs or signed cookies with Trusted Key Groups

// public key in PEM format
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewDistribution(this, jsii.String("Dist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
		trustedKeyGroups: []iKeyGroup{
			keyGroup,
		},
	},
})

type LambdaEdgeEventType 

type LambdaEdgeEventType string

The type of events that a Lambda@Edge function can be invoked in response to.

Example: 

var myBucket bucket
// A Lambda@Edge function added to default behavior of a Distribution
// and triggered on every request
myFunc := #error#.NewEdgeFunction(this, jsii.String("MyFunction"), &edgeFunctionProps{
	runtime: lambda.runtime_NODEJS_14_X(),
	handler: jsii.String("index.handler"),
	code: lambda.code.fromAsset(path.join(__dirname, jsii.String("lambda-handler"))),
})
cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
		edgeLambdas: []edgeLambda{
			&edgeLambda{
				functionVersion: myFunc.currentVersion,
				eventType: cloudfront.lambdaEdgeEventType_VIEWER_REQUEST,
			},
		},
	},
})

const (
	// The origin-request specifies the request to the origin location (e.g. S3).
	LambdaEdgeEventType_ORIGIN_REQUEST LambdaEdgeEventType = "ORIGIN_REQUEST"
	// The origin-response specifies the response from the origin location (e.g. S3).
	LambdaEdgeEventType_ORIGIN_RESPONSE LambdaEdgeEventType = "ORIGIN_RESPONSE"
	// The viewer-request specifies the incoming request.
	LambdaEdgeEventType_VIEWER_REQUEST LambdaEdgeEventType = "VIEWER_REQUEST"
	// The viewer-response specifies the outgoing response.
	LambdaEdgeEventType_VIEWER_RESPONSE LambdaEdgeEventType = "VIEWER_RESPONSE"
)

type LambdaFunctionAssociation 

type LambdaFunctionAssociation struct {
	// The lambda event type defines at which event the lambda is called during the request lifecycle.
	EventType LambdaEdgeEventType `field:"required" json:"eventType" yaml:"eventType"`
	// A version of the lambda to associate.
	LambdaFunction awslambda.IVersion `field:"required" json:"lambdaFunction" yaml:"lambdaFunction"`
	// Allows a Lambda function to have read access to the body content.
	//
	// Only valid for "request" event types (`ORIGIN_REQUEST` or `VIEWER_REQUEST`).
	// See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html
	IncludeBody *bool `field:"optional" json:"includeBody" yaml:"includeBody"`
}

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

var version version

lambdaFunctionAssociation := &lambdaFunctionAssociation{
	eventType: awscdk.Aws_cloudfront.lambdaEdgeEventType_ORIGIN_REQUEST,
	lambdaFunction: version,

	// the properties below are optional
	includeBody: jsii.Boolean(false),
}

type LoggingConfiguration 

type LoggingConfiguration struct {
	// Bucket to log requests to.
	Bucket awss3.IBucket `field:"optional" json:"bucket" yaml:"bucket"`
	// Whether to include the cookies in the logs.
	IncludeCookies *bool `field:"optional" json:"includeCookies" yaml:"includeCookies"`
	// Where in the bucket to store logs.
	Prefix *string `field:"optional" json:"prefix" yaml:"prefix"`
}

Logging configuration for incoming requests.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

var bucket bucket

loggingConfiguration := &loggingConfiguration{
	bucket: bucket,
	includeCookies: jsii.Boolean(false),
	prefix: jsii.String("prefix"),
}

type OriginAccessIdentity 

type OriginAccessIdentity interface {
	awscdk.Resource
	IOriginAccessIdentity
	// The Amazon S3 canonical user ID for the origin access identity, used when giving the origin access identity read permission to an object in Amazon S3.
	CloudFrontOriginAccessIdentityS3CanonicalUserId() *string
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// Derived principal value for bucket access.
	GrantPrincipal() awsiam.IPrincipal
	// The tree node.
	Node() constructs.Node
	// The Origin Access Identity Id (physical id) This was called originAccessIdentityName before.
	OriginAccessIdentityId() *string
	// The Origin Access Identity Id (physical id) It is misnamed and superseded by the correctly named originAccessIdentityId.
	// Deprecated: use originAccessIdentityId instead.
	OriginAccessIdentityName() *string
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	// The ARN to include in S3 bucket policy to allow CloudFront access.
	Arn() *string
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

An origin access identity is a special CloudFront user that you can associate with Amazon S3 origins, so that you can secure all or just some of your Amazon S3 content.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originAccessIdentity := awscdk.Aws_cloudfront.NewOriginAccessIdentity(this, jsii.String("MyOriginAccessIdentity"), &originAccessIdentityProps{
	comment: jsii.String("comment"),
})

func NewOriginAccessIdentity 

func NewOriginAccessIdentity(scope constructs.Construct, id *string, props *OriginAccessIdentityProps) OriginAccessIdentity

type OriginAccessIdentityProps 

type OriginAccessIdentityProps struct {
	// Any comments you want to include about the origin access identity.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
}

Properties of CloudFront OriginAccessIdentity.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originAccessIdentityProps := &originAccessIdentityProps{
	comment: jsii.String("comment"),
}

type OriginBase 

type OriginBase interface {
	IOrigin
	// Binds the origin to the associated Distribution.
	//
	// Can be used to grant permissions, create dependent resources, etc.
	Bind(_scope constructs.Construct, options *OriginBindOptions) *OriginBindConfig
	RenderCustomOriginConfig() *CfnDistribution_CustomOriginConfigProperty
	RenderS3OriginConfig() *CfnDistribution_S3OriginConfigProperty
}

Represents a distribution origin, that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon MediaStore, or other server from which CloudFront gets your files.

type OriginBindConfig 

type OriginBindConfig struct {
	// The failover configuration for this Origin.
	FailoverConfig *OriginFailoverConfig `field:"optional" json:"failoverConfig" yaml:"failoverConfig"`
	// The CloudFormation OriginProperty configuration for this Origin.
	OriginProperty *CfnDistribution_OriginProperty `field:"optional" json:"originProperty" yaml:"originProperty"`
}

The struct returned from {@link IOrigin.bind}.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

var origin iOrigin

originBindConfig := &originBindConfig{
	failoverConfig: &originFailoverConfig{
		failoverOrigin: origin,

		// the properties below are optional
		statusCodes: []*f64{
			jsii.Number(123),
		},
	},
	originProperty: &originProperty{
		domainName: jsii.String("domainName"),
		id: jsii.String("id"),

		// the properties below are optional
		connectionAttempts: jsii.Number(123),
		connectionTimeout: jsii.Number(123),
		customOriginConfig: &customOriginConfigProperty{
			originProtocolPolicy: jsii.String("originProtocolPolicy"),

			// the properties below are optional
			httpPort: jsii.Number(123),
			httpsPort: jsii.Number(123),
			originKeepaliveTimeout: jsii.Number(123),
			originReadTimeout: jsii.Number(123),
			originSslProtocols: []*string{
				jsii.String("originSslProtocols"),
			},
		},
		originCustomHeaders: []interface{}{
			&originCustomHeaderProperty{
				headerName: jsii.String("headerName"),
				headerValue: jsii.String("headerValue"),
			},
		},
		originPath: jsii.String("originPath"),
		originShield: &originShieldProperty{
			enabled: jsii.Boolean(false),
			originShieldRegion: jsii.String("originShieldRegion"),
		},
		s3OriginConfig: &s3OriginConfigProperty{
			originAccessIdentity: jsii.String("originAccessIdentity"),
		},
	},
}

type OriginBindOptions 

type OriginBindOptions struct {
	// The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.
	OriginId *string `field:"required" json:"originId" yaml:"originId"`
}

Options passed to Origin.bind().

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

originBindOptions := &originBindOptions{
	originId: jsii.String("originId"),
}

type OriginFailoverConfig 

type OriginFailoverConfig struct {
	// The origin to use as the fallback origin.
	FailoverOrigin IOrigin `field:"required" json:"failoverOrigin" yaml:"failoverOrigin"`
	// The HTTP status codes of the response that trigger querying the failover Origin.
	StatusCodes *[]*float64 `field:"optional" json:"statusCodes" yaml:"statusCodes"`
}

The failover configuration used for Origin Groups, returned in {@link OriginBindConfig.failoverConfig}.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

var origin iOrigin

originFailoverConfig := &originFailoverConfig{
	failoverOrigin: origin,

	// the properties below are optional
	statusCodes: []*f64{
		jsii.Number(123),
	},
}

type OriginOptions added in v2.25.0 

type OriginOptions struct {
	// The number of times that CloudFront attempts to connect to the origin;
	//
	// valid values are 1, 2, or 3 attempts.
	ConnectionAttempts *float64 `field:"optional" json:"connectionAttempts" yaml:"connectionAttempts"`
	// The number of seconds that CloudFront waits when trying to establish a connection to the origin.
	//
	// Valid values are 1-10 seconds, inclusive.
	ConnectionTimeout awscdk.Duration `field:"optional" json:"connectionTimeout" yaml:"connectionTimeout"`
	// A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.
	CustomHeaders *map[string]*string `field:"optional" json:"customHeaders" yaml:"customHeaders"`
	// When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
	//
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
}

Options to define an Origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import cdk "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

originOptions := &originOptions{
	connectionAttempts: jsii.Number(123),
	connectionTimeout: cdk.duration.minutes(jsii.Number(30)),
	customHeaders: map[string]*string{
		"customHeadersKey": jsii.String("customHeaders"),
	},
	originShieldRegion: jsii.String("originShieldRegion"),
}

type OriginProps 

type OriginProps struct {
	// The number of times that CloudFront attempts to connect to the origin;
	//
	// valid values are 1, 2, or 3 attempts.
	ConnectionAttempts *float64 `field:"optional" json:"connectionAttempts" yaml:"connectionAttempts"`
	// The number of seconds that CloudFront waits when trying to establish a connection to the origin.
	//
	// Valid values are 1-10 seconds, inclusive.
	ConnectionTimeout awscdk.Duration `field:"optional" json:"connectionTimeout" yaml:"connectionTimeout"`
	// A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.
	CustomHeaders *map[string]*string `field:"optional" json:"customHeaders" yaml:"customHeaders"`
	// When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
	//
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
	// An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
	//
	// Must begin, but not end, with '/' (e.g., '/production/images').
	OriginPath *string `field:"optional" json:"originPath" yaml:"originPath"`
}

Properties to define an Origin.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import cdk "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

originProps := &originProps{
	connectionAttempts: jsii.Number(123),
	connectionTimeout: cdk.duration.minutes(jsii.Number(30)),
	customHeaders: map[string]*string{
		"customHeadersKey": jsii.String("customHeaders"),
	},
	originPath: jsii.String("originPath"),
	originShieldRegion: jsii.String("originShieldRegion"),
}

type OriginProtocolPolicy 

type OriginProtocolPolicy string

Defines what protocols CloudFront will use to connect to an origin.

Example: 

import elbv2 "github.com/aws/aws-cdk-go/awscdk"

var loadBalancer applicationLoadBalancer

origin := origins.NewLoadBalancerV2Origin(loadBalancer, &loadBalancerV2OriginProps{
	connectionAttempts: jsii.Number(3),
	connectionTimeout: awscdk.Duration.seconds(jsii.Number(5)),
	readTimeout: awscdk.Duration.seconds(jsii.Number(45)),
	keepaliveTimeout: awscdk.Duration.seconds(jsii.Number(45)),
	protocolPolicy: cloudfront.originProtocolPolicy_MATCH_VIEWER,
})

const (
	// Connect on HTTP only.
	OriginProtocolPolicy_HTTP_ONLY OriginProtocolPolicy = "HTTP_ONLY"
	// Connect with the same protocol as the viewer.
	OriginProtocolPolicy_MATCH_VIEWER OriginProtocolPolicy = "MATCH_VIEWER"
	// Connect on HTTPS only.
	OriginProtocolPolicy_HTTPS_ONLY OriginProtocolPolicy = "HTTPS_ONLY"
)

type OriginRequestCookieBehavior 

type OriginRequestCookieBehavior interface {
	// The behavior of cookies: allow all, none or an allow list.
	Behavior() *string
	// The cookies to allow, if the behavior is an allow list.
	Cookies() *[]*string
}

Determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom origin request policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myOriginRequestPolicy := cloudfront.NewOriginRequestPolicy(this, jsii.String("OriginRequestPolicy"), &originRequestPolicyProps{
	originRequestPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	cookieBehavior: cloudfront.originRequestCookieBehavior.none(),
	headerBehavior: cloudfront.originRequestHeaderBehavior.all(jsii.String("CloudFront-Is-Android-Viewer")),
	queryStringBehavior: cloudfront.originRequestQueryStringBehavior.allowList(jsii.String("username")),
})

cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: myOriginRequestPolicy,
	},
})

func OriginRequestCookieBehavior_All 

func OriginRequestCookieBehavior_All() OriginRequestCookieBehavior

All cookies in viewer requests are included in requests that CloudFront sends to the origin.

func OriginRequestCookieBehavior_AllowList 

func OriginRequestCookieBehavior_AllowList(cookies ...*string) OriginRequestCookieBehavior

Only the provided `cookies` are included in requests that CloudFront sends to the origin.

func OriginRequestCookieBehavior_None 

func OriginRequestCookieBehavior_None() OriginRequestCookieBehavior

Cookies in viewer requests are not included in requests that CloudFront sends to the origin.

Any cookies that are listed in a CachePolicy are still included in origin requests.

type OriginRequestHeaderBehavior 

type OriginRequestHeaderBehavior interface {
	// The behavior of headers: allow all, none or an allow list.
	Behavior() *string
	// The headers for the allow list or the included CloudFront headers, if applicable.
	Headers() *[]*string
}

Determines whether any HTTP headers (and if so, which headers) are included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom origin request policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myOriginRequestPolicy := cloudfront.NewOriginRequestPolicy(this, jsii.String("OriginRequestPolicy"), &originRequestPolicyProps{
	originRequestPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	cookieBehavior: cloudfront.originRequestCookieBehavior.none(),
	headerBehavior: cloudfront.originRequestHeaderBehavior.all(jsii.String("CloudFront-Is-Android-Viewer")),
	queryStringBehavior: cloudfront.originRequestQueryStringBehavior.allowList(jsii.String("username")),
})

cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: myOriginRequestPolicy,
	},
})

func OriginRequestHeaderBehavior_All 

func OriginRequestHeaderBehavior_All(cloudfrontHeaders ...*string) OriginRequestHeaderBehavior

All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin.

Additionally, any additional CloudFront headers provided are included; the additional headers are added by CloudFront. See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-cloudfront-headers.html

func OriginRequestHeaderBehavior_AllowList 

func OriginRequestHeaderBehavior_AllowList(headers ...*string) OriginRequestHeaderBehavior

Listed headers are included in requests that CloudFront sends to the origin.

func OriginRequestHeaderBehavior_None 

func OriginRequestHeaderBehavior_None() OriginRequestHeaderBehavior

HTTP headers are not included in requests that CloudFront sends to the origin.

Any headers that are listed in a CachePolicy are still included in origin requests.

type OriginRequestPolicy 

type OriginRequestPolicy interface {
	awscdk.Resource
	IOriginRequestPolicy
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The tree node.
	Node() constructs.Node
	// The ID of the origin request policy.
	OriginRequestPolicyId() *string
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A Origin Request Policy configuration.

Example: 

// Using an existing origin request policy for a Distribution
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: cloudfront.originRequestPolicy_CORS_S3_ORIGIN(),
	},
})

func NewOriginRequestPolicy 

func NewOriginRequestPolicy(scope constructs.Construct, id *string, props *OriginRequestPolicyProps) OriginRequestPolicy

type OriginRequestPolicyProps 

type OriginRequestPolicyProps struct {
	// A comment to describe the origin request policy.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// The cookies from viewer requests to include in origin requests.
	CookieBehavior OriginRequestCookieBehavior `field:"optional" json:"cookieBehavior" yaml:"cookieBehavior"`
	// The HTTP headers to include in origin requests.
	//
	// These can include headers from viewer requests and additional headers added by CloudFront.
	HeaderBehavior OriginRequestHeaderBehavior `field:"optional" json:"headerBehavior" yaml:"headerBehavior"`
	// A unique name to identify the origin request policy.
	//
	// The name must only include '-', '_', or alphanumeric characters.
	OriginRequestPolicyName *string `field:"optional" json:"originRequestPolicyName" yaml:"originRequestPolicyName"`
	// The URL query strings from viewer requests to include in origin requests.
	QueryStringBehavior OriginRequestQueryStringBehavior `field:"optional" json:"queryStringBehavior" yaml:"queryStringBehavior"`
}

Properties for creating a Origin Request Policy.

Example: 

// Creating a custom origin request policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myOriginRequestPolicy := cloudfront.NewOriginRequestPolicy(this, jsii.String("OriginRequestPolicy"), &originRequestPolicyProps{
	originRequestPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	cookieBehavior: cloudfront.originRequestCookieBehavior.none(),
	headerBehavior: cloudfront.originRequestHeaderBehavior.all(jsii.String("CloudFront-Is-Android-Viewer")),
	queryStringBehavior: cloudfront.originRequestQueryStringBehavior.allowList(jsii.String("username")),
})

cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: myOriginRequestPolicy,
	},
})

type OriginRequestQueryStringBehavior 

type OriginRequestQueryStringBehavior interface {
	// The behavior of query strings -- allow all, none, or only an allow list.
	Behavior() *string
	// The query strings to allow, if the behavior is an allow list.
	QueryStrings() *[]*string
}

Determines whether any URL query strings in viewer requests (and if so, which query strings) are included in requests that CloudFront sends to the origin.

Example: 

// Creating a custom origin request policy for a Distribution -- all parameters optional
var bucketOrigin s3Origin

myOriginRequestPolicy := cloudfront.NewOriginRequestPolicy(this, jsii.String("OriginRequestPolicy"), &originRequestPolicyProps{
	originRequestPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	cookieBehavior: cloudfront.originRequestCookieBehavior.none(),
	headerBehavior: cloudfront.originRequestHeaderBehavior.all(jsii.String("CloudFront-Is-Android-Viewer")),
	queryStringBehavior: cloudfront.originRequestQueryStringBehavior.allowList(jsii.String("username")),
})

cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		originRequestPolicy: myOriginRequestPolicy,
	},
})

func OriginRequestQueryStringBehavior_All 

func OriginRequestQueryStringBehavior_All() OriginRequestQueryStringBehavior

All query strings in viewer requests are included in requests that CloudFront sends to the origin.

func OriginRequestQueryStringBehavior_AllowList 

func OriginRequestQueryStringBehavior_AllowList(queryStrings ...*string) OriginRequestQueryStringBehavior

Only the provided `queryStrings` are included in requests that CloudFront sends to the origin.

func OriginRequestQueryStringBehavior_None 

func OriginRequestQueryStringBehavior_None() OriginRequestQueryStringBehavior

Query strings in viewer requests are not included in requests that CloudFront sends to the origin.

Any query strings that are listed in a CachePolicy are still included in origin requests.

type OriginSslPolicy 

type OriginSslPolicy string
const (
	OriginSslPolicy_SSL_V3   OriginSslPolicy = "SSL_V3"
	OriginSslPolicy_TLS_V1   OriginSslPolicy = "TLS_V1"
	OriginSslPolicy_TLS_V1_1 OriginSslPolicy = "TLS_V1_1"
	OriginSslPolicy_TLS_V1_2 OriginSslPolicy = "TLS_V1_2"
)

type PriceClass 

type PriceClass string

The price class determines how many edge locations CloudFront will use for your distribution.

See https://aws.amazon.com/cloudfront/pricing/ for full list of supported regions. 

const (
	// USA, Canada, Europe, & Israel.
	PriceClass_PRICE_CLASS_100 PriceClass = "PRICE_CLASS_100"
	// PRICE_CLASS_100 + South Africa, Kenya, Middle East, Japan, Singapore, South Korea, Taiwan, Hong Kong, & Philippines.
	PriceClass_PRICE_CLASS_200 PriceClass = "PRICE_CLASS_200"
	// All locations.
	PriceClass_PRICE_CLASS_ALL PriceClass = "PRICE_CLASS_ALL"
)

type PublicKey 

type PublicKey interface {
	awscdk.Resource
	IPublicKey
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The ID of the key group.
	PublicKeyId() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A Public Key Configuration.

Example: 

// Validating signed URLs or signed cookies with Trusted Key Groups

// public key in PEM format
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewDistribution(this, jsii.String("Dist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
		trustedKeyGroups: []iKeyGroup{
			keyGroup,
		},
	},
})

func NewPublicKey 

func NewPublicKey(scope constructs.Construct, id *string, props *PublicKeyProps) PublicKey

type PublicKeyProps 

type PublicKeyProps struct {
	// The public key that you can use with signed URLs and signed cookies, or with field-level encryption.
	//
	// The `encodedKey` parameter must include `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html
	//
	EncodedKey *string `field:"required" json:"encodedKey" yaml:"encodedKey"`
	// A comment to describe the public key.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A name to identify the public key.
	PublicKeyName *string `field:"optional" json:"publicKeyName" yaml:"publicKeyName"`
}

Properties for creating a Public Key.

Example: 

// Validating signed URLs or signed cookies with Trusted Key Groups

// public key in PEM format
var publicKey string

pubKey := cloudfront.NewPublicKey(this, jsii.String("MyPubKey"), &publicKeyProps{
	encodedKey: publicKey,
})

keyGroup := cloudfront.NewKeyGroup(this, jsii.String("MyKeyGroup"), &keyGroupProps{
	items: []iPublicKey{
		pubKey,
	},
})

cloudfront.NewDistribution(this, jsii.String("Dist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewHttpOrigin(jsii.String("www.example.com")),
		trustedKeyGroups: []iKeyGroup{
			keyGroup,
		},
	},
})

type ResponseCustomHeader added in v2.1.0 

type ResponseCustomHeader struct {
	// The HTTP response header name.
	Header *string `field:"required" json:"header" yaml:"header"`
	// A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.
	Override *bool `field:"required" json:"override" yaml:"override"`
	// The value for the HTTP response header.
	Value *string `field:"required" json:"value" yaml:"value"`
}

An HTTP response header name and its value.

CloudFront includes this header in HTTP responses that it sends for requests that match a cache behavior that’s associated with this response headers policy.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import "github.com/aws/aws-cdk-go/awscdk"

responseCustomHeader := &responseCustomHeader{
	header: jsii.String("header"),
	override: jsii.Boolean(false),
	value: jsii.String("value"),
}

type ResponseCustomHeadersBehavior added in v2.1.0 

type ResponseCustomHeadersBehavior struct {
	// The list of HTTP response headers and their values.
	CustomHeaders *[]*ResponseCustomHeader `field:"required" json:"customHeaders" yaml:"customHeaders"`
}

Configuration for a set of HTTP response headers that are sent for requests that match a cache behavior that’s associated with this response headers policy.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersContentSecurityPolicy added in v2.1.0 

type ResponseHeadersContentSecurityPolicy struct {
	// The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.
	ContentSecurityPolicy *string `field:"required" json:"contentSecurityPolicy" yaml:"contentSecurityPolicy"`
	// A Boolean that determines whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
}

The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersContentTypeOptions added in v2.1.0 

type ResponseHeadersContentTypeOptions struct {
	// A Boolean that determines whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
}

Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersCorsBehavior added in v2.1.0 

type ResponseHeadersCorsBehavior struct {
	// A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.
	AccessControlAllowCredentials *bool `field:"required" json:"accessControlAllowCredentials" yaml:"accessControlAllowCredentials"`
	// A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.
	//
	// You can specify `['*']` to allow all headers.
	AccessControlAllowHeaders *[]*string `field:"required" json:"accessControlAllowHeaders" yaml:"accessControlAllowHeaders"`
	// A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.
	AccessControlAllowMethods *[]*string `field:"required" json:"accessControlAllowMethods" yaml:"accessControlAllowMethods"`
	// A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.
	//
	// You can specify `['*']` to allow all origins.
	AccessControlAllowOrigins *[]*string `field:"required" json:"accessControlAllowOrigins" yaml:"accessControlAllowOrigins"`
	// A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
	OriginOverride *bool `field:"required" json:"originOverride" yaml:"originOverride"`
	// A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.
	//
	// You can specify `['*']` to expose all headers.
	AccessControlExposeHeaders *[]*string `field:"optional" json:"accessControlExposeHeaders" yaml:"accessControlExposeHeaders"`
	// A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.
	AccessControlMaxAge awscdk.Duration `field:"optional" json:"accessControlMaxAge" yaml:"accessControlMaxAge"`
}

Configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

CloudFront adds these headers to HTTP responses that it sends for CORS requests that match a cache behavior associated with this response headers policy.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersFrameOptions added in v2.1.0 

type ResponseHeadersFrameOptions struct {
	// The value of the X-Frame-Options HTTP response header.
	FrameOption HeadersFrameOption `field:"required" json:"frameOption" yaml:"frameOption"`
	// A Boolean that determines whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
}

Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersPolicy added in v2.1.0 

type ResponseHeadersPolicy interface {
	awscdk.Resource
	IResponseHeadersPolicy
	// The environment this resource belongs to.
	//
	// For resources that are created and managed by the CDK
	// (generally, those created by creating new class instances like Role, Bucket, etc.),
	// this is always the same as the environment of the stack they belong to;
	// however, for imported resources
	// (those obtained from static methods like fromRoleArn, fromBucketName, etc.),
	// that might be different than the stack they were imported into.
	Env() *awscdk.ResourceEnvironment
	// The tree node.
	Node() constructs.Node
	// Returns a string-encoded token that resolves to the physical name that should be passed to the CloudFormation resource.
	//
	// This value will resolve to one of the following:
	// - a concrete value (e.g. `"my-awesome-bucket"`)
	// - `undefined`, when a name should be generated by CloudFormation
	// - a concrete name generated automatically during synthesis, in
	//    cross-environment scenarios.
	PhysicalName() *string
	// The ID of the response headers policy.
	ResponseHeadersPolicyId() *string
	// The stack in which this resource is defined.
	Stack() awscdk.Stack
	// Apply the given removal policy to this resource.
	//
	// The Removal Policy controls what happens to this resource when it stops
	// being managed by CloudFormation, either because you've removed it from the
	// CDK application or because you've made a change that requires the resource
	// to be replaced.
	//
	// The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
	// account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
	ApplyRemovalPolicy(policy awscdk.RemovalPolicy)
	GeneratePhysicalName() *string
	// Returns an environment-sensitive token that should be used for the resource's "ARN" attribute (e.g. `bucket.bucketArn`).
	//
	// Normally, this token will resolve to `arnAttr`, but if the resource is
	// referenced across environments, `arnComponents` will be used to synthesize
	// a concrete ARN with the resource's physical name. Make sure to reference
	// `this.physicalName` in `arnComponents`.
	GetResourceArnAttribute(arnAttr *string, arnComponents *awscdk.ArnComponents) *string
	// Returns an environment-sensitive token that should be used for the resource's "name" attribute (e.g. `bucket.bucketName`).
	//
	// Normally, this token will resolve to `nameAttr`, but if the resource is
	// referenced across environments, it will be resolved to `this.physicalName`,
	// which will be a concrete name.
	GetResourceNameAttribute(nameAttr *string) *string
	// Returns a string representation of this construct.
	ToString() *string
}

A Response Headers Policy configuration.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

func NewResponseHeadersPolicy added in v2.1.0 

func NewResponseHeadersPolicy(scope constructs.Construct, id *string, props *ResponseHeadersPolicyProps) ResponseHeadersPolicy

type ResponseHeadersPolicyProps added in v2.1.0 

type ResponseHeadersPolicyProps struct {
	// A comment to describe the response headers policy.
	Comment *string `field:"optional" json:"comment" yaml:"comment"`
	// A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).
	CorsBehavior *ResponseHeadersCorsBehavior `field:"optional" json:"corsBehavior" yaml:"corsBehavior"`
	// A configuration for a set of custom HTTP response headers.
	CustomHeadersBehavior *ResponseCustomHeadersBehavior `field:"optional" json:"customHeadersBehavior" yaml:"customHeadersBehavior"`
	// A unique name to identify the response headers policy.
	ResponseHeadersPolicyName *string `field:"optional" json:"responseHeadersPolicyName" yaml:"responseHeadersPolicyName"`
	// A configuration for a set of security-related HTTP response headers.
	SecurityHeadersBehavior *ResponseSecurityHeadersBehavior `field:"optional" json:"securityHeadersBehavior" yaml:"securityHeadersBehavior"`
}

Properties for creating a Response Headers Policy.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersReferrerPolicy added in v2.1.0 

type ResponseHeadersReferrerPolicy struct {
	// A Boolean that determines whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
	// The value of the Referrer-Policy HTTP response header.
	ReferrerPolicy HeadersReferrerPolicy `field:"required" json:"referrerPolicy" yaml:"referrerPolicy"`
}

Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersStrictTransportSecurity added in v2.1.0 

type ResponseHeadersStrictTransportSecurity struct {
	// A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.
	AccessControlMaxAge awscdk.Duration `field:"required" json:"accessControlMaxAge" yaml:"accessControlMaxAge"`
	// A Boolean that determines whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
	// A Boolean that determines whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header.
	IncludeSubdomains *bool `field:"optional" json:"includeSubdomains" yaml:"includeSubdomains"`
	// A Boolean that determines whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header.
	Preload *bool `field:"optional" json:"preload" yaml:"preload"`
}

Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseHeadersXSSProtection added in v2.1.0 

type ResponseHeadersXSSProtection struct {
	// A Boolean that determines whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.
	Override *bool `field:"required" json:"override" yaml:"override"`
	// A Boolean that determines the value of the X-XSS-Protection HTTP response header.
	//
	// When this setting is true, the value of the X-XSS-Protection header is 1.
	// When this setting is false, the value of the X-XSS-Protection header is 0.
	Protection *bool `field:"required" json:"protection" yaml:"protection"`
	// A Boolean that determines whether CloudFront includes the mode=block directive in the X-XSS-Protection header.
	ModeBlock *bool `field:"optional" json:"modeBlock" yaml:"modeBlock"`
	// A reporting URI, which CloudFront uses as the value of the report directive in the X-XSS-Protection header.
	//
	// You cannot specify a ReportUri when ModeBlock is true.
	ReportUri *string `field:"optional" json:"reportUri" yaml:"reportUri"`
}

Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type ResponseSecurityHeadersBehavior added in v2.1.0 

type ResponseSecurityHeadersBehavior struct {
	// The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.
	ContentSecurityPolicy *ResponseHeadersContentSecurityPolicy `field:"optional" json:"contentSecurityPolicy" yaml:"contentSecurityPolicy"`
	// Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.
	ContentTypeOptions *ResponseHeadersContentTypeOptions `field:"optional" json:"contentTypeOptions" yaml:"contentTypeOptions"`
	// Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.
	FrameOptions *ResponseHeadersFrameOptions `field:"optional" json:"frameOptions" yaml:"frameOptions"`
	// Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.
	ReferrerPolicy *ResponseHeadersReferrerPolicy `field:"optional" json:"referrerPolicy" yaml:"referrerPolicy"`
	// Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.
	StrictTransportSecurity *ResponseHeadersStrictTransportSecurity `field:"optional" json:"strictTransportSecurity" yaml:"strictTransportSecurity"`
	// Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.
	XssProtection *ResponseHeadersXSSProtection `field:"optional" json:"xssProtection" yaml:"xssProtection"`
}

Configuration for a set of security-related HTTP response headers.

CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior associated with this response headers policy.

Example: 

// Using an existing managed response headers policy
var bucketOrigin s3Origin

cloudfront.NewDistribution(this, jsii.String("myDistManagedPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: cloudfront.responseHeadersPolicy_CORS_ALLOW_ALL_ORIGINS(),
	},
})

// Creating a custom response headers policy -- all parameters optional
myResponseHeadersPolicy := cloudfront.NewResponseHeadersPolicy(this, jsii.String("ResponseHeadersPolicy"), &responseHeadersPolicyProps{
	responseHeadersPolicyName: jsii.String("MyPolicy"),
	comment: jsii.String("A default policy"),
	corsBehavior: &responseHeadersCorsBehavior{
		accessControlAllowCredentials: jsii.Boolean(false),
		accessControlAllowHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlAllowMethods: []*string{
			jsii.String("GET"),
			jsii.String("POST"),
		},
		accessControlAllowOrigins: []*string{
			jsii.String("*"),
		},
		accessControlExposeHeaders: []*string{
			jsii.String("X-Custom-Header-1"),
			jsii.String("X-Custom-Header-2"),
		},
		accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
		originOverride: jsii.Boolean(true),
	},
	customHeadersBehavior: &responseCustomHeadersBehavior{
		customHeaders: []responseCustomHeader{
			&responseCustomHeader{
				header: jsii.String("X-Amz-Date"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(true),
			},
			&responseCustomHeader{
				header: jsii.String("X-Amz-Security-Token"),
				value: jsii.String("some-value"),
				override: jsii.Boolean(false),
			},
		},
	},
	securityHeadersBehavior: &responseSecurityHeadersBehavior{
		contentSecurityPolicy: &responseHeadersContentSecurityPolicy{
			contentSecurityPolicy: jsii.String("default-src https:;"),
			override: jsii.Boolean(true),
		},
		contentTypeOptions: &responseHeadersContentTypeOptions{
			override: jsii.Boolean(true),
		},
		frameOptions: &responseHeadersFrameOptions{
			frameOption: cloudfront.headersFrameOption_DENY,
			override: jsii.Boolean(true),
		},
		referrerPolicy: &responseHeadersReferrerPolicy{
			referrerPolicy: cloudfront.headersReferrerPolicy_NO_REFERRER,
			override: jsii.Boolean(true),
		},
		strictTransportSecurity: &responseHeadersStrictTransportSecurity{
			accessControlMaxAge: awscdk.Duration.seconds(jsii.Number(600)),
			includeSubdomains: jsii.Boolean(true),
			override: jsii.Boolean(true),
		},
		xssProtection: &responseHeadersXSSProtection{
			protection: jsii.Boolean(true),
			modeBlock: jsii.Boolean(true),
			reportUri: jsii.String("https://example.com/csp-report"),
			override: jsii.Boolean(true),
		},
	},
})
cloudfront.NewDistribution(this, jsii.String("myDistCustomPolicy"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: bucketOrigin,
		responseHeadersPolicy: myResponseHeadersPolicy,
	},
})

type S3OriginConfig 

type S3OriginConfig struct {
	// The source bucket to serve content from.
	S3BucketSource awss3.IBucket `field:"required" json:"s3BucketSource" yaml:"s3BucketSource"`
	// The optional Origin Access Identity of the origin identity cloudfront will use when calling your s3 bucket.
	OriginAccessIdentity IOriginAccessIdentity `field:"optional" json:"originAccessIdentity" yaml:"originAccessIdentity"`
	// Any additional headers to pass to the origin.
	OriginHeaders *map[string]*string `field:"optional" json:"originHeaders" yaml:"originHeaders"`
	// The relative path to the origin root to use for sources.
	OriginPath *string `field:"optional" json:"originPath" yaml:"originPath"`
	// When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
}

S3 origin configuration for CloudFront.

Example: 

var sourceBucket bucket

viewerCertificate := cloudfront.viewerCertificate.fromIamCertificate(jsii.String("MYIAMROLEIDENTIFIER"), &viewerCertificateOptions{
	aliases: []*string{
		jsii.String("MYALIAS"),
	},
})

cloudfront.NewCloudFrontWebDistribution(this, jsii.String("MyCfWebDistribution"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: sourceBucket,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: viewerCertificate,
})

type SSLMethod 

type SSLMethod string

The SSL method CloudFront will use for your distribution.

Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates 

which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present
multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites

(or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.

If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).

See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/

Example: 

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromIamCertificate(jsii.String("certificateId"), &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_SSL_V3,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})

const (
	SSLMethod_SNI SSLMethod = "SNI"
	SSLMethod_VIP SSLMethod = "VIP"
)

type SecurityPolicyProtocol 

type SecurityPolicyProtocol string

The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify.

Example: 

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromIamCertificate(jsii.String("certificateId"), &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_SSL_V3,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})

const (
	SecurityPolicyProtocol_SSL_V3        SecurityPolicyProtocol = "SSL_V3"
	SecurityPolicyProtocol_TLS_V1        SecurityPolicyProtocol = "TLS_V1"
	SecurityPolicyProtocol_TLS_V1_2016   SecurityPolicyProtocol = "TLS_V1_2016"
	SecurityPolicyProtocol_TLS_V1_1_2016 SecurityPolicyProtocol = "TLS_V1_1_2016"
	SecurityPolicyProtocol_TLS_V1_2_2018 SecurityPolicyProtocol = "TLS_V1_2_2018"
	SecurityPolicyProtocol_TLS_V1_2_2019 SecurityPolicyProtocol = "TLS_V1_2_2019"
	SecurityPolicyProtocol_TLS_V1_2_2021 SecurityPolicyProtocol = "TLS_V1_2_2021"
)

type SourceConfiguration 

type SourceConfiguration struct {
	// The behaviors associated with this source.
	//
	// At least one (default) behavior must be included.
	Behaviors *[]*Behavior `field:"required" json:"behaviors" yaml:"behaviors"`
	// The number of times that CloudFront attempts to connect to the origin.
	//
	// You can specify 1, 2, or 3 as the number of attempts.
	ConnectionAttempts *float64 `field:"optional" json:"connectionAttempts" yaml:"connectionAttempts"`
	// The number of seconds that CloudFront waits when trying to establish a connection to the origin.
	//
	// You can specify a number of seconds between 1 and 10 (inclusive).
	ConnectionTimeout awscdk.Duration `field:"optional" json:"connectionTimeout" yaml:"connectionTimeout"`
	// A custom origin source - for all non-s3 sources.
	CustomOriginSource *CustomOriginConfig `field:"optional" json:"customOriginSource" yaml:"customOriginSource"`
	// HTTP status code to failover to second origin.
	FailoverCriteriaStatusCodes *[]FailoverStatusCode `field:"optional" json:"failoverCriteriaStatusCodes" yaml:"failoverCriteriaStatusCodes"`
	// A custom origin source for failover in case the s3OriginSource returns invalid status code.
	FailoverCustomOriginSource *CustomOriginConfig `field:"optional" json:"failoverCustomOriginSource" yaml:"failoverCustomOriginSource"`
	// An s3 origin source for failover in case the s3OriginSource returns invalid status code.
	FailoverS3OriginSource *S3OriginConfig `field:"optional" json:"failoverS3OriginSource" yaml:"failoverS3OriginSource"`
	// When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.
	// See: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
	//
	OriginShieldRegion *string `field:"optional" json:"originShieldRegion" yaml:"originShieldRegion"`
	// An s3 origin source - if you're using s3 for your assets.
	S3OriginSource *S3OriginConfig `field:"optional" json:"s3OriginSource" yaml:"s3OriginSource"`
}

A source configuration is a wrapper for CloudFront origins and behaviors.

An origin is what CloudFront will "be in front of" - that is, CloudFront will pull it's assets from an origin.

If you're using s3 as a source - pass the `s3Origin` property, otherwise, pass the `customOriginSource` property.

One or the other must be passed, and it is invalid to pass both in the same SourceConfiguration.

Example: 

// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import cdk "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"
import "github.com/aws/aws-cdk-go/awscdk"

var bucket bucket
var function_ function
var keyGroup keyGroup
var originAccessIdentity originAccessIdentity
var version version

sourceConfiguration := &sourceConfiguration{
	behaviors: []behavior{
		&behavior{
			allowedMethods: awscdk.Aws_cloudfront.cloudFrontAllowedMethods_GET_HEAD,
			cachedMethods: awscdk.*Aws_cloudfront.cloudFrontAllowedCachedMethods_GET_HEAD,
			compress: jsii.Boolean(false),
			defaultTtl: cdk.duration.minutes(jsii.Number(30)),
			forwardedValues: &forwardedValuesProperty{
				queryString: jsii.Boolean(false),

				// the properties below are optional
				cookies: &cookiesProperty{
					forward: jsii.String("forward"),

					// the properties below are optional
					whitelistedNames: []*string{
						jsii.String("whitelistedNames"),
					},
				},
				headers: []*string{
					jsii.String("headers"),
				},
				queryStringCacheKeys: []*string{
					jsii.String("queryStringCacheKeys"),
				},
			},
			functionAssociations: []functionAssociation{
				&functionAssociation{
					eventType: awscdk.*Aws_cloudfront.functionEventType_VIEWER_REQUEST,
					function: function_,
				},
			},
			isDefaultBehavior: jsii.Boolean(false),
			lambdaFunctionAssociations: []lambdaFunctionAssociation{
				&lambdaFunctionAssociation{
					eventType: awscdk.*Aws_cloudfront.lambdaEdgeEventType_ORIGIN_REQUEST,
					lambdaFunction: version,

					// the properties below are optional
					includeBody: jsii.Boolean(false),
				},
			},
			maxTtl: cdk.*duration.minutes(jsii.Number(30)),
			minTtl: cdk.*duration.minutes(jsii.Number(30)),
			pathPattern: jsii.String("pathPattern"),
			trustedKeyGroups: []iKeyGroup{
				keyGroup,
			},
			trustedSigners: []*string{
				jsii.String("trustedSigners"),
			},
			viewerProtocolPolicy: awscdk.*Aws_cloudfront.viewerProtocolPolicy_HTTPS_ONLY,
		},
	},

	// the properties below are optional
	connectionAttempts: jsii.Number(123),
	connectionTimeout: cdk.*duration.minutes(jsii.Number(30)),
	customOriginSource: &customOriginConfig{
		domainName: jsii.String("domainName"),

		// the properties below are optional
		allowedOriginSSLVersions: []originSslPolicy{
			awscdk.*Aws_cloudfront.*originSslPolicy_SSL_V3,
		},
		httpPort: jsii.Number(123),
		httpsPort: jsii.Number(123),
		originHeaders: map[string]*string{
			"originHeadersKey": jsii.String("originHeaders"),
		},
		originKeepaliveTimeout: cdk.*duration.minutes(jsii.Number(30)),
		originPath: jsii.String("originPath"),
		originProtocolPolicy: awscdk.*Aws_cloudfront.originProtocolPolicy_HTTP_ONLY,
		originReadTimeout: cdk.*duration.minutes(jsii.Number(30)),
		originShieldRegion: jsii.String("originShieldRegion"),
	},
	failoverCriteriaStatusCodes: []failoverStatusCode{
		awscdk.*Aws_cloudfront.*failoverStatusCode_FORBIDDEN,
	},
	failoverCustomOriginSource: &customOriginConfig{
		domainName: jsii.String("domainName"),

		// the properties below are optional
		allowedOriginSSLVersions: []*originSslPolicy{
			awscdk.*Aws_cloudfront.*originSslPolicy_SSL_V3,
		},
		httpPort: jsii.Number(123),
		httpsPort: jsii.Number(123),
		originHeaders: map[string]*string{
			"originHeadersKey": jsii.String("originHeaders"),
		},
		originKeepaliveTimeout: cdk.*duration.minutes(jsii.Number(30)),
		originPath: jsii.String("originPath"),
		originProtocolPolicy: awscdk.*Aws_cloudfront.*originProtocolPolicy_HTTP_ONLY,
		originReadTimeout: cdk.*duration.minutes(jsii.Number(30)),
		originShieldRegion: jsii.String("originShieldRegion"),
	},
	failoverS3OriginSource: &s3OriginConfig{
		s3BucketSource: bucket,

		// the properties below are optional
		originAccessIdentity: originAccessIdentity,
		originHeaders: map[string]*string{
			"originHeadersKey": jsii.String("originHeaders"),
		},
		originPath: jsii.String("originPath"),
		originShieldRegion: jsii.String("originShieldRegion"),
	},
	originShieldRegion: jsii.String("originShieldRegion"),
	s3OriginSource: &s3OriginConfig{
		s3BucketSource: bucket,

		// the properties below are optional
		originAccessIdentity: originAccessIdentity,
		originHeaders: map[string]*string{
			"originHeadersKey": jsii.String("originHeaders"),
		},
		originPath: jsii.String("originPath"),
		originShieldRegion: jsii.String("originShieldRegion"),
	},
}

type ViewerCertificate 

type ViewerCertificate interface {
	Aliases() *[]*string
	Props() *CfnDistribution_ViewerCertificateProperty
}

Viewer certificate configuration class.

Example: 

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromIamCertificate(jsii.String("certificateId"), &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_SSL_V3,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})

func ViewerCertificate_FromAcmCertificate 

func ViewerCertificate_FromAcmCertificate(certificate awscertificatemanager.ICertificate, options *ViewerCertificateOptions) ViewerCertificate

Generate an AWS Certificate Manager (ACM) viewer certificate configuration.

func ViewerCertificate_FromCloudFrontDefaultCertificate 

func ViewerCertificate_FromCloudFrontDefaultCertificate(aliases ...*string) ViewerCertificate

Generate a viewer certifcate configuration using the CloudFront default certificate (e.g. d111111abcdef8.cloudfront.net) and a {@link SecurityPolicyProtocol.TLS_V1} security policy.

func ViewerCertificate_FromIamCertificate 

func ViewerCertificate_FromIamCertificate(iamCertificateId *string, options *ViewerCertificateOptions) ViewerCertificate

Generate an IAM viewer certificate configuration.

type ViewerCertificateOptions 

type ViewerCertificateOptions struct {
	// Domain names on the certificate (both main domain name and Subject Alternative names).
	Aliases *[]*string `field:"optional" json:"aliases" yaml:"aliases"`
	// The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.
	//
	// CloudFront serves your objects only to browsers or devices that support at
	// least the SSL version that you specify.
	SecurityPolicy SecurityPolicyProtocol `field:"optional" json:"securityPolicy" yaml:"securityPolicy"`
	// How CloudFront should serve HTTPS requests.
	//
	// See the notes on SSLMethod if you wish to use other SSL termination types.
	// See: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ViewerCertificate.html
	//
	SslMethod SSLMethod `field:"optional" json:"sslMethod" yaml:"sslMethod"`
}

Example: 

s3BucketSource := s3.NewBucket(this, jsii.String("Bucket"))

distribution := cloudfront.NewCloudFrontWebDistribution(this, jsii.String("AnAmazingWebsiteProbably"), &cloudFrontWebDistributionProps{
	originConfigs: []sourceConfiguration{
		&sourceConfiguration{
			s3OriginSource: &s3OriginConfig{
				s3BucketSource: s3BucketSource,
			},
			behaviors: []behavior{
				&behavior{
					isDefaultBehavior: jsii.Boolean(true),
				},
			},
		},
	},
	viewerCertificate: cloudfront.viewerCertificate.fromIamCertificate(jsii.String("certificateId"), &viewerCertificateOptions{
		aliases: []*string{
			jsii.String("example.com"),
		},
		securityPolicy: cloudfront.securityPolicyProtocol_SSL_V3,
		 // default
		sslMethod: cloudfront.sSLMethod_SNI,
	}),
})

type ViewerProtocolPolicy 

type ViewerProtocolPolicy string

How HTTPs should be handled with your distribution.

Example: 

// Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
var myBucket bucket

myWebDistribution := cloudfront.NewDistribution(this, jsii.String("myDist"), &distributionProps{
	defaultBehavior: &behaviorOptions{
		origin: origins.NewS3Origin(myBucket),
		allowedMethods: cloudfront.allowedMethods_ALLOW_ALL(),
		viewerProtocolPolicy: cloudfront.viewerProtocolPolicy_REDIRECT_TO_HTTPS,
	},
})

const (
	// HTTPS only.
	ViewerProtocolPolicy_HTTPS_ONLY ViewerProtocolPolicy = "HTTPS_ONLY"
	// Will redirect HTTP requests to HTTPS.
	ViewerProtocolPolicy_REDIRECT_TO_HTTPS ViewerProtocolPolicy = "REDIRECT_TO_HTTPS"
	// Both HTTP and HTTPS supported.
	ViewerProtocolPolicy_ALLOW_ALL ViewerProtocolPolicy = "ALLOW_ALL"
)

Source Files

View all Source files

Directories

Path Synopsis
internal

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.