ConnectionAttempts

No

N/A

The number of times that CloudFront attempts to connect to the origin. Minimum is 1, maximum is 3, default is 3.

ConnectionTimeout

No

N/A

The number of seconds that CloudFront waits when trying to establish a connection to the origin. Minimum is 1 second, maximum is 10 seconds, default is 10 seconds.

CustomOriginConfig

Conditional

N/A

Used when an origin is not an S3 bucket. Not applicable.

DomainName

Yes

"${stack}data.sagebase.org.s3.us-east-1.amazonaws.com"

Required, this is the domain name of the origin.

Id

Yes

"${stack}data.sagebase.org"

A unique identifier for the origin to be used in the cache behavior portion of the template.

OriginAccessControlId

No

{"Ref": "OriginAccessControl"}

OriginAccessControl Object

Identifies the origin access control, which is used to give permissions to get objects from the S3 bucket origin.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html

OriginCustomHeaders

No

N/A

A list of header names and values that CloudFront adds to the request to the origin. Not applicable.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html

OriginPath

No

N/A

An optional path that CloudFront appends to the origin domain name when a request is sent to the origin. Not applicable.

OriginShield

No

N/A

An additional layer of caching in the CloudFront caching infrastructure. None of the use cases described by AWS fit ours.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html

S3OriginConfig

Conditional

S3OriginConfig Object

Use S3OriginConfig to specify an Amazon S3 bucket that is not configured with static website hosting. If not included get error message "Invalid request provided: Exactly one of CustomOriginConfig and S3OriginConfig must be specified".

AcmCertificateArn

Conditional

"${DataCdnCertificateArn}"

ACM SSL certificate for the Alias defined in DistributionConfig.

CloudFrontDefaultCertificate

Conditional

N/A

Only required if the default CloudFront domain name is used.

IamCertificateId

Conditional

N/A

Only required if the SSL certificate is stored in IAM

MinimumProtocolVersion

Conditional

“TLSv1.2_2021”

SslSupportMethod

Conditional

“sni-only”

Recommended by AWS. Accepts HTTPS connections from only viewers that support Server Name Indication, which is an extension to TLS that allows clients to indicate the host they are attempting to connect to during the handshake process.

Description

No

"Origin Access Control for origin ${stack}data.sagebase.org"

Describes the origin access control.

Name

Yes

"${stack}data-origin-access-control"

Identifies the origin access control.

OriginAccessControlOriginType

Yes

s3

The type of origin this access control is for.

SigningBehavior

Yes

always

Specifies if CloudFront overwrites Authorization header from the viewer request in its request to the origin if it exists. Not applicable since we won’t be checking authorization with the signed URL.

SigningProtocol

Yes

sigv4

The only valid value is sigv4.

AliasTarget

No

AliasTarget Object

CidrRoutingConfig

No

N/A

Not applicable

Comment

No

"Record set for the CloudFront distribution for ${stack}data.sagebase.org"

Failover

No

N/A

For configuring failover if once resource goes down. Not applicable.

GeoLocation

No

N/A

Lets you control how Route 53 responds to DNS queries based on geographic origin. Not applicable.

HealthCheckId

No

N/A

Not possible with CloudFront.

HostedZoneId

No

N/A

HostedZoneName used instead.

HostedZoneName

No

"${stack}.sagebase.org."

The name of the hosted zone where the record is created.

MultiValueAnswer

No

N/A

For routing traffic randomly to multiple resources. Not applicable.

Name

Yes

"data.${stack}.sagebase.org"

Region

No

N/A

For latency based resource record sets only.

ResourceRecords

No

N/A

Omitted if AliasTarget is used.

SetIdentifier

No

N/A

For differentiating among multiple resource record sets. Not applicable.

TTL

No

N/A

Omitted when using an alias resource record set.

Type

Yes

“A”

“A” is used for CloudFront distributions.

Weight

No

N/A

For weighted resource record sets only.

DNSName

Yes

{ "Fn::GetAtt": ["CloudFront", "DomainName"] }

For a CloudFront distribution, the domain name.

EvaluateTargetHealth

No

N/A

Cannot be set for CloudFront distributions.

HostedZoneId

Yes

“Z2FDTNDATAQYW2"

Always the hosted zone ID when an alias record is created for a CloudFront distribution.