git:20260223.c6d4db1 to git:20260323.935227a

---

name: aws-cloudformation-cloudfront

description: Provides AWS CloudFormation patterns for CloudFront distributions, origins (ALB, S3, Lambda@Edge, VPC Origins), CacheBehaviors, Functions, SecurityHeaders, parameters, Outputs and cross-stack references. Use when creating CloudFront distributions with CloudFormation, configuring multiple origins, implementing caching strategies, managing custom domains with ACM, configuring WAF, and optimizing performance.

allowed-tools: Read, Write, Bash

---

# AWS CloudFormation CloudFront CDN

## Overview

## When to Use

Use this skill when:

- Creating new CloudFront distributions with CloudFormation

- Configuring multiple origins (ALB, S3, API Gateway, Lambda@Edge, VPC Origins)

- Implementing caching strategies with CacheBehaviors and Cache Policies

- Configuring custom domains with ACM certificates

- Implementing SecurityHeaders (CSP, HSTS, XSS protection)

- Configuring CloudFront Functions and Lambda@Edge

- Managing Geo-restrictions and Price Classes

- Integrating WAF with CloudFront

- Organizing templates with Parameters, Outputs, Mappings, Conditions

- Implementing cross-stack references with export/import

- Using Transform for macros and reuse

## Instructions

Follow these steps to create CloudFront distributions with CloudFormation:

```yaml

Parameters:

DomainName:

Type: String

Default: cdn.example.com

Description: Custom domain name for CloudFront distribution

CertificateArn:

Type: AWS::ACM::Certificate::Arn

Description: ACM certificate ARN for HTTPS

PriceClass:

Type: String

Default: PriceClass_All

AllowedValues:

- PriceClass_All

- PriceClass_100

- PriceClass_200

Description: CloudFront price class

OriginDomainName:

Type: String

Description: Domain name of the origin (ALB or S3)

```

```yaml

Resources:

# S3 Bucket

StaticBucket:

Type: AWS::S3::Bucket

Properties:

BucketName: !Sub "static-assets-${AWS::AccountId}-${AWS::Region}"

PublicAccessBlockConfiguration:

BlockPublicAcls: true

BlockPublicPolicy: true

Properties:

```

```yaml

Resources:

CloudFrontDistribution:

Type: AWS::CloudFront::Distribution

Properties:

DistributionConfig:

Origins:

- Id: S3Origin

DomainName: !GetAtt StaticBucket.RegionalDomainName

S3OriginConfig:

OriginAccessIdentity: ""

DefaultCacheBehavior:

ViewerProtocolPolicy: redirect-to-https

AllowedMethods:

- GET

- HEAD

CachedMethods:

- GET

- HEAD

Compress: true

```

```yaml

Resources:

ApiCachePolicy:

Type: AWS::CloudFront::CachePolicy

Properties:

CachePolicyConfig:

DefaultTTL: 300

MaxTTL: 600

MinTTL: 60

CloudFrontDistribution:

Type: AWS::CloudFront::Distribution

Properties:

DistributionConfig:

CacheBehaviors:

- PathPattern: "/api/*"

TargetOriginId: ApiOrigin

CachePolicyId: !GetAtt ApiCachePolicy.Id

```

```yaml

Resources:

SecurityHeadersPolicy:

Type: AWS::CloudFront::ResponseHeadersPolicy

Properties:

ResponseHeadersPolicyConfig:

Name: !Sub "${AWS::StackName}-security-headers"

SecurityHeadersConfig:

StrictTransportSecurity:

AccessControlMaxAgeSec: 31536000

IncludeSubdomains: true

Override: true

Override: true

Properties:

```

```yaml

Resources:

RewritePathFunction:

Type: AWS::CloudFront::Function

Properties:

Name: !Sub "${AWS::StackName}-rewrite-path"

FunctionCode: |

function handler(event) {

var request = event.request;

return request;

}

Runtime: cloudfront-js-1.0

AutoPublish: true

```

```yaml

Resources:

Properties:

CloudFrontDistribution:

Type: AWS::CloudFront::Distribution

Properties:

DistributionConfig:

```

```yaml

```

## Best Practices

### Security

- Always use HTTPS with minimum TLS 1.2

- Implement SecurityHeaders with HSTS, XSS protection

- Use WAF for protection against common attacks

- Configure appropriate Access-Control for CORS

- Limit origin access with OAI/OAC

- Use Signed URLs for private content

- Implement rate limiting

- Configure geo-restrictions if needed

### Performance

- Use appropriate PriceClass to optimize costs

- Configure Cache TTL based on content type

- Enable compression (Gzip/Brotli)

- Use CloudFront Functions for lightweight operations

- Optimize header forwarding (do not forward unnecessary headers)

- Consider Origin Shield to reduce load on origins

- Use multiple origins with path patterns

### Monitoring

- Enable CloudWatch metrics and alarms

- Configure real-time logs for troubleshooting

- Monitor cache hit ratio

- Configure alerts for error rate and latency

- Use CloudFront reports for traffic analysis

### Deployment

- Use change sets before deployment

- Test templates with cfn-lint

- Organize stacks by lifecycle and ownership

- Implement blue/green deployments with weighted aliases

- Use StackSets for multi-region deployment

## Related Resources

- [AWS CloudFront Documentation](https://docs.aws.amazon.com/cloudfront/)

- [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/)

- [CloudFront Developer Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/)

- [CloudFront Best Practices](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html)

- [CloudFormation Stack Policies](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html)

- [CloudFormation Drift Detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html)

- [CloudFormation Change Sets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html)