AWS CloudFront

Qovery creates it in the AWS account of the environment’s cluster, as a Blueprint service in one of your environments.


Catalog name	`aws-cloudfront`
Category	Networking & Edge
Provider	AWS
Engine	terraform
Major versions (latest release)	`default` (1.0.7)
Source	AWS/cloudfront/default

New to this? You don’t need to know Kubernetes or Terraform. Qovery sets up AWS CloudFront in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

Create it

Console
CLI and API
Coding agent

Open the environment, then New service › Blueprint.
Find AWS CloudFront in the catalog and pick the major version.
Fill in the variables. Required ones are marked; the others use their defaults.
Create the service, and deploy it now or later.

List the catalog to get the latest tag, then create the service from it. qovery api signs the requests with your CLI session.

ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"

qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-cloudfront")'

cat > blueprint.json <<'EOF'
{
  "name": "aws-cloudfront",
  "tag": "AWS/cloudfront/default/1.0.7",
  "icon": "app://qovery-console/cloudfront",
  "variables": [
    {
      "name": "origin_domain_name",
      "value": "REPLACE_WITH_ORIGIN_DOMAIN_NAME"
    }
  ],
  "spec_overrides": {
    "engine_version": "1.9.7"
  }
}
EOF
BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
rm blueprint.json   # it can hold secret values
qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment

Replace each REPLACE_WITH_ value. Add optional variables to variables the same way.

Paste this into Claude Code, Cursor, Codex or another coding agent with the Qovery agent skills installed (curl -fsSL https://skill.qovery.com/install.sh | bash).

Prompt

Add the Qovery Blueprint AWS CloudFront (aws-cloudfront) to one of my Qovery environments and deploy it. Ask me for origin_domain_name.
Ask me before deploying to a production environment.
Docs: https://www.qovery.com/docs/configuration/blueprints/aws-cloudfront.md

You don’t add any file to your repository. Qovery creates the Blueprint from the Console or the API.

Variables and outputs

Generated from qbm.yml at AWS/cloudfront/default/1.0.7, the manifest the Console form is built from.

All 17 variables

Name	Type	Required	Default	Description
`origin_domain_name`	string	Yes		Hostname CloudFront pulls from (e.g. an ALB or S3 website endpoint). No scheme or path.
`comment`	string		`Managed by Qovery blueprint`	Free text shown in the AWS console
`enabled`	bool		`true`	Whether the distribution accepts end-user requests
`is_ipv6_enabled`	bool		`true`	Enable IPv6 for the distribution
`default_root_object`	string			Object returned for requests to the root URL (e.g. index.html). Empty = none.
`price_class`	string		`PriceClass_100`	Edge location price class
`origin_protocol_policy`	string		`https-only`	How CloudFront connects to the origin
`origin_http_port`	number		`80`	Origin HTTP port
`origin_https_port`	number		`443`	Origin HTTPS port
`viewer_protocol_policy`	string		`redirect-to-https`	How viewers connect to CloudFront
`min_ttl`	number		`0`	In seconds
`default_ttl`	number		`3600`	In seconds, for responses without Cache-Control or Expires headers
`max_ttl`	number		`86400`	In seconds; must be ≥ min_ttl
`aliases`	string			Empty = the default *.cloudfront.net domain. Otherwise comma-separated custom domains (CNAMEs); requires acm_certificate_arn.
`acm_certificate_arn`	string			Empty = default CloudFront certificate. Set it for the custom domains; must be in us-east-1.
`geo_restriction_type`	string		`none`	Geo restriction mode
`geo_restriction_locations`	string			Comma-separated ISO 3166-1-alpha-2 country codes (e.g. US,FR). Required when geo_restriction_type is not none.

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint’s name; see Aliases Qovery creates for outputs for the naming rules and the cases where no alias is created.

All 7 outputs

Name	Secret	Description
`distribution_id`		CloudFront distribution ID
`distribution_arn`		CloudFront distribution ARN
`domain_name`		CloudFront domain name (the *.cloudfront.net hostname to point traffic at)
`url`		Full HTTPS URL of the distribution (https://<domain_name>)
`hosted_zone_id`		CloudFront hosted zone ID (use for a Route53 alias record)
`status`		Distribution deployment status
`etag`		Current version identifier (ETag) of the distribution

Reference

From the Blueprint’s README. Creates an AWS CloudFront distribution in front of a single HTTP/S origin (an ALB, application host, or S3 website endpoint) with configurable caching, price class, optional custom domains, and geo restrictions. By default the distribution serves over the CloudFront-managed *.cloudfront.net certificate; set aliases + acm_certificate_arn (certificate must be in us-east-1) to serve custom domains.

Credentials

Uses the Qovery cluster’s AWS credentials (credentials.default: cluster). The credentials must allow the CloudFront and (when using ACM) certificate actions listed under Required IAM permissions.

Variables

Required

Name	Type	Description
`origin_domain_name`	string	Origin hostname CloudFront pulls from (e.g. an ALB, app host, or S3 website endpoint). Bare hostname, no scheme or path.

Distribution

Name	Type	Default	Description
`comment`	string	`Managed by Qovery blueprint`	Distribution comment shown in the AWS console
`enabled`	bool	`true`	Whether the distribution accepts end-user requests
`is_ipv6_enabled`	bool	`true`	Enable IPv6
`default_root_object`	string		Object returned for the root URL (e.g. `index.html`)
`price_class`	string	`PriceClass_100`	`PriceClass_100`, `PriceClass_200`, or `PriceClass_All`

Origin

Name	Type	Default	Description
`origin_protocol_policy`	string	`https-only`	`http-only`, `https-only`, or `match-viewer`
`origin_http_port`	number	`80`	Origin HTTP port
`origin_https_port`	number	`443`	Origin HTTPS port

Caching / viewer

Name	Type	Default	Description
`viewer_protocol_policy`	string	`redirect-to-https`	`allow-all`, `https-only`, or `redirect-to-https`
`min_ttl`	number	`0`	Minimum cache TTL (seconds)
`default_ttl`	number	`3600`	Default cache TTL (seconds)
`max_ttl`	number	`86400`	Maximum cache TTL (seconds); must be `>= min_ttl`

Custom domain & geo

Name	Type	Default	Description
`aliases`	string		Comma-separated custom domains (CNAMEs). Requires `acm_certificate_arn`.
`acm_certificate_arn`	string		ACM cert ARN for the custom domains (must be in us-east-1).
`geo_restriction_type`	string	`none`	`none`, `whitelist`, or `blacklist`
`geo_restriction_locations`	string		Comma-separated ISO country codes (e.g. `US,FR`). Required when type is not `none`.

Outputs

Name	Description
`distribution_id`	CloudFront distribution ID
`distribution_arn`	CloudFront distribution ARN
`domain_name`	CloudFront domain name (`*.cloudfront.net`) to point traffic at
`url`	Full HTTPS URL of the distribution (`https://<domain_name>`)
`hosted_zone_id`	CloudFront hosted zone ID (for a Route53 alias record)
`status`	Distribution deployment status
`etag`	Current version identifier (ETag)

Notes

Caching uses the self-contained forwarded_values config (query string forwarded, cookies not), so the blueprint doesn’t depend on a managed cache policy id. The AWS provider is pinned to ~> 5.0.
CloudFront is a global service; the provider region (from the cluster) only configures the AWS client.

Required AWS IAM permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateDistribution",
        "cloudfront:GetDistribution",
        "cloudfront:UpdateDistribution",
        "cloudfront:DeleteDistribution",
        "cloudfront:TagResource",
        "cloudfront:UntagResource",
        "cloudfront:ListTagsForResource",
        "acm:DescribeCertificate",
        "acm:ListCertificates"
      ],
      "Resource": "*"
    }
  ]
}

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

AWS CloudFront

Create it

Variables and outputs

Reference

Credentials

Variables

Required

Distribution

Origin

Caching / viewer

Custom domain & geo

Outputs

Notes

Required AWS IAM permissions

​Create it

​Variables and outputs

​Reference

​Credentials

​Variables

​Required

​Distribution

​Origin

​Caching / viewer

​Custom domain & geo

​Outputs

​Notes

​Required AWS IAM permissions

Create it

Variables and outputs

Reference

Credentials

Variables

Required

Distribution

Origin

Caching / viewer

Custom domain & geo

Outputs

Notes

Required AWS IAM permissions