CloudFront Edge

Public hostnames to serve through CloudFront.

How long, in seconds, CloudFront waits for a response from the origin. Valid range: 1-120.

Define reusable cache policies as a YAML map. Behaviors reference each policy by its key. ```yaml static_assets: min_ttl: 0 default_ttl: 86400 max_ttl: 31536000 ``` Every policy includes `Host`. `enable_accept_encoding_gzip` and `enable_accept_encoding_brotli` default to `true`.

Define path-based cache behaviors as a YAML list evaluated in order. ```yaml - path_pattern: "/_next/static/*" cache_policy_key: static_assets compress: true ``` `compress` defaults to `true` and enables CloudFront edge compression.

CloudFront custom error responses as a YAML list (`error_code`, optional `response_code`, `response_page_path`, and `error_caching_min_ttl`). Applies to the whole distribution.

Validate client certificates from callers connecting to CloudFront.

Required rejects callers without a valid certificate. Optional requests one but still allows callers without it.

Public CA certificate bundle used to validate client certificates. Provide a PEM bundle under the ca.crt key; do not include private keys.

Advertise the accepted CA names during the TLS handshake so callers can present a matching certificate.

Accept expired client certificates, while still checking they were issued by a trusted CA.

CIDR blocks allowed to reach CloudFront. Leave empty to allow all sources.

Looks for common web app attacks such as XSS, path traversal, oversized requests, and other OWASP-style issues.

Looks for request patterns linked to known exploits or attempts to find vulnerable apps.

Checks whether the request comes from an IP AWS has linked to bots, DDoS, scanning, or other abuse.

Checks whether the request comes through VPNs, proxies, Tor, or hosting providers that can hide who is calling.

Attach an externally managed CloudFront-scoped AWS WAF WebACL by ARN instead of configuring rules here.

Deliver CloudFront standard access logs to an existing S3 bucket.

Existing S3 bucket ARN for CloudFront standard access logs.

Deliver AWS WAF request logs to an existing S3 bucket.

Existing same-account S3 bucket ARN for AWS WAF request logs. AWS requires the bucket name to start with `aws-waf-logs-`; see [AWS WAF S3 logging requirements](https://docs.aws.amazon.com/waf/latest/developerguide/logging-s3.html).

Reuse an externally managed CloudFront VPC origin by ID. Leave empty to create one from the environment's Ryvn-managed internal load balancer.

AWS load balancer tags as a YAML map, used to find the VPC origin's load balancer. Leave empty to use the environment's Ryvn-managed internal load balancer.

Name for the created VPC origin. Leave empty for a generated name. A short endpoint fingerprint suffix is always appended.

CloudFront price class.

Collect CloudFront real-time metrics.

Wait for CloudFront to finish deploying before this completes.

Disable the distribution instead of deleting it when this blueprint is removed.

CloudFront distribution ID.

CloudFront distribution ARN.

CloudFront distribution DNS name.

CloudFront VPC origin ID. Reference it from another installation's Existing VPC Origin ID input to share one VPC origin across distributions.

AWS WAFv2 WebACL ARN attached to the CloudFront distribution, when configured.

External DNS annotation to add to a service installation networking ingress so DNS targets the CloudFront distribution.

DNS records to create yourself when this blueprint isn't managing Route53.