> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudFront

> AWS CloudFront CDN distribution in front of an HTTP/S origin (ALB, app host, or S3 website), with configurable caching, price class, custom domains, and geo restrictions

Qovery creates it in the AWS account of the environment's cluster, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `aws-cloudfront` |
| Category | Networking & Edge |
| Provider | AWS |
| Engine | terraform |
| Major versions (latest release) | `default` (1.0.7) |
| Source | [AWS/cloudfront/default](https://github.com/Qovery/service-catalog/tree/AWS/cloudfront/default/1.0.7/AWS/cloudfront/default) |

> [!TIP]
>
> **New to this?** You don't need to know Kubernetes or Terraform. Qovery sets up AWS CloudFront in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **AWS CloudFront** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-cloudfront")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "aws-cloudfront",
>   "tag": "AWS/cloudfront/default/1.0.7",
>   "icon": "app://qovery-console/cloudfront",
>   "variables": [
>     {
>       "name": "origin_domain_name",
>       "value": "REPLACE_WITH_ORIGIN_DOMAIN_NAME"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint AWS CloudFront (aws-cloudfront) to one of my Qovery environments and deploy it. Ask me for origin_domain_name.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/aws-cloudfront.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `AWS/cloudfront/default/1.0.7`, the manifest the Console form is built from.

> [accordion] All 17 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `origin_domain_name` | string | Yes | | | Hostname CloudFront pulls from (e.g. an ALB or S3 website endpoint). No scheme or path. |
> | `comment` | string | | `Managed by Qovery blueprint` | | Free text shown in the AWS console |
> | `enabled` | bool | | `true` | | Whether the distribution accepts end-user requests |
> | `is_ipv6_enabled` | bool | | `true` | | Enable IPv6 for the distribution |
> | `default_root_object` | string | | | | Object returned for requests to the root URL (e.g. index.html). Empty = none. |
> | `price_class` | string | | `PriceClass_100` | | Edge location price class |
> | `origin_protocol_policy` | string | | `https-only` | | How CloudFront connects to the origin |
> | `origin_http_port` | number | | `80` | | Origin HTTP port |
> | `origin_https_port` | number | | `443` | | Origin HTTPS port |
> | `viewer_protocol_policy` | string | | `redirect-to-https` | | How viewers connect to CloudFront |
> | `min_ttl` | number | | `0` | | In seconds |
> | `default_ttl` | number | | `3600` | | In seconds, for responses without Cache-Control or Expires headers |
> | `max_ttl` | number | | `86400` | | In seconds; must be ≥ min\_ttl |
> | `aliases` | string | | | | Empty = the default \*.cloudfront.net domain. Otherwise comma-separated custom domains (CNAMEs); requires acm\_certificate\_arn. |
> | `acm_certificate_arn` | string | | | | Empty = default CloudFront certificate. Set it for the custom domains; must be in us-east-1. |
> | `geo_restriction_type` | string | | `none` | | Geo restriction mode |
> | `geo_restriction_locations` | string | | | | Comma-separated ISO 3166-1-alpha-2 country codes (e.g. US,FR). Required when geo\_restriction\_type is not none. |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 7 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `distribution_id` | | CloudFront distribution ID |
> | `distribution_arn` | | CloudFront distribution ARN |
> | `domain_name` | | CloudFront domain name (the \*.cloudfront.net hostname to point traffic at) |
> | `url` | | Full HTTPS URL of the distribution (https\://\<domain\_name>) |
> | `hosted_zone_id` | | CloudFront hosted zone ID (use for a Route53 alias record) |
> | `status` | | Distribution deployment status |
> | `etag` | | Current version identifier (ETag) of the distribution |

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/AWS/cloudfront/default/1.0.7/AWS/cloudfront/default/README.md).

Creates an AWS CloudFront distribution in front of a single HTTP/S origin (an ALB, application host, or S3 website endpoint) with configurable caching, price class, optional custom domains, and geo restrictions.

By default the distribution serves over the CloudFront-managed `*.cloudfront.net` certificate; set `aliases` + `acm_certificate_arn` (certificate must be in **us-east-1**) to serve custom domains.

### Credentials

Uses the Qovery cluster's AWS credentials (`credentials.default: cluster`). The credentials must allow the CloudFront and (when using ACM) certificate actions listed under [Required IAM permissions](#required-aws-iam-permissions).

### Variables

#### Required

| Name | Type | Description |
| - | - | - |
| `origin_domain_name` | string | Origin hostname CloudFront pulls from (e.g. an ALB, app host, or S3 website endpoint). Bare hostname, no scheme or path. |

#### Distribution

| Name | Type | Default | Description |
| - | - | - | - |
| `comment` | string | `Managed by Qovery blueprint` | Distribution comment shown in the AWS console |
| `enabled` | bool | `true` | Whether the distribution accepts end-user requests |
| `is_ipv6_enabled` | bool | `true` | Enable IPv6 |
| `default_root_object` | string | | Object returned for the root URL (e.g. `index.html`) |
| `price_class` | string | `PriceClass_100` | `PriceClass_100`, `PriceClass_200`, or `PriceClass_All` |

#### Origin

| Name | Type | Default | Description |
| - | - | - | - |
| `origin_protocol_policy` | string | `https-only` | `http-only`, `https-only`, or `match-viewer` |
| `origin_http_port` | number | `80` | Origin HTTP port |
| `origin_https_port` | number | `443` | Origin HTTPS port |

#### Caching / viewer

| Name | Type | Default | Description |
| - | - | - | - |
| `viewer_protocol_policy` | string | `redirect-to-https` | `allow-all`, `https-only`, or `redirect-to-https` |
| `min_ttl` | number | `0` | Minimum cache TTL (seconds) |
| `default_ttl` | number | `3600` | Default cache TTL (seconds) |
| `max_ttl` | number | `86400` | Maximum cache TTL (seconds); must be `>= min_ttl` |

#### Custom domain & geo

| Name | Type | Default | Description |
| - | - | - | - |
| `aliases` | string | | Comma-separated custom domains (CNAMEs). Requires `acm_certificate_arn`. |
| `acm_certificate_arn` | string | | ACM cert ARN for the custom domains (**must be in us-east-1**). |
| `geo_restriction_type` | string | `none` | `none`, `whitelist`, or `blacklist` |
| `geo_restriction_locations` | string | | Comma-separated ISO country codes (e.g. `US,FR`). Required when type is not `none`. |

### Outputs

| Name | Description |
| - | - |
| `distribution_id` | CloudFront distribution ID |
| `distribution_arn` | CloudFront distribution ARN |
| `domain_name` | CloudFront domain name (`*.cloudfront.net`) to point traffic at |
| `url` | Full HTTPS URL of the distribution (`https://<domain_name>`) |
| `hosted_zone_id` | CloudFront hosted zone ID (for a Route53 alias record) |
| `status` | Distribution deployment status |
| `etag` | Current version identifier (ETag) |

### Notes

* Caching uses the self-contained `forwarded_values` config (query string forwarded, cookies not), so the blueprint doesn't depend on a managed cache policy id. The AWS provider is pinned to `~> 5.0`.
* CloudFront is a global service; the provider `region` (from the cluster) only configures the AWS client.

### Required AWS IAM permissions

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateDistribution",
        "cloudfront:GetDistribution",
        "cloudfront:UpdateDistribution",
        "cloudfront:DeleteDistribution",
        "cloudfront:TagResource",
        "cloudfront:UntagResource",
        "cloudfront:ListTagsForResource",
        "acm:DescribeCertificate",
        "acm:ListCertificates"
      ],
      "Resource": "*"
    }
  ]
}
```


## Related topics

- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [AWS EKS](https://www.qovery.com/docs/configuration/integrations/kubernetes/eks/managed.md)
- [Cloud Credentials](https://www.qovery.com/docs/configuration/organization/cloud-credentials.md)
- [AWS ECR](https://www.qovery.com/docs/configuration/integrations/container-registries/aws-ecr.md)
- [AWS EKS Anywhere](https://www.qovery.com/docs/configuration/integrations/kubernetes/eks/eks-anywhere.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.