Aliases

No

N/A

For CNAMEs for static website, not applicable["data.${stack}.sagebase.org"]

RecordSet Object

Alias used so an SSL Certificate can be set to specify minimum TLS versions.

CacheBehaviors

No

N/A

Covered by default cache behavior

CNAMEs

No

N/A

Not applicable.

Comment

No

“CloudFront distribution for ${stack}data.sagebase.org”

Gives info about distribution.

ContinuousDeploymentPolicyId

No

N/A

Continuous deployment is for distributing traffic for a custom domain name to two different CF distributions. Not applicable.

CustomErrorResponses

No

N/A

For replacing status code in 4xx and 5xx range with custom error messages. No use case for this.

CustomOrigin

No

N/A

Legacy. Covered under Origin.

DefaultCacheBehavior

Yes

DefaultCacheBehavior Object

Required - describes default caches behavior.

DefaultRootObject

No

N/A

Returns a default object when the user sends a request using the root URL and doesn’t include the object. Not applicable to our case since we are signing the URLs and users will always specify an object.

Enabled

Yes

True

Enables the distribution

HttpVersion

No

http2and3

Defaults to HTTP 1.1 , but due to security concerns with HTTP 1.1, will require either HTTP 2 or 3.

IPV6Enabled

No

False

Since we won’t create signed URLs that use IPV6, this is not Not applicable.

Logging

No

Logging Object

Will allow tracking for data requests.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html

OriginGroups

No

N/A

Only used when multiple origins are used. Not applicable.

Origins

No

[Origin Object]

Specifies where data will be pulled from.

PriceClass

No

“PriceClass_100”

Serves objects from the CloudFront edge location that has the lowest latency among the edge locations in the price class. Cost to transfer data out to internet from CloudFront compared to from S3 is only less for North America/Europe, which are the only two regions in Price Class 100. “If you select a price class that does not include all locations, some of your viewers, especially those in geographic locations that are not in your price class, may experience higher latency than if your content were being served from all Amazon CloudFront locations.“

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PriceClass.html

https://aws.amazon.com/cloudfront/pricing/

https://aws.amazon.com/s3/pricing/

Restrictions

No

N/A

Restrictions only relate to countries where content is distributed. Not applicable

S3Origin

No

N/A

Legacy. Not applicable.

Staging

No

N/A

Indicates if this is a staging distribution. Not applicable.

ViewerCertificate

No

ViewerCertificate Object

Gives ability to set minimum TLS version.

WebACLId

No

N/A

Current signed URLs through S3 do not use a Web ACL.

AllowedMethods

No

GET, HEAD

Controls which HTTP methods are processed and forwarded to S3. No other methods are required for our use case.

CachedMethods

No

N/A

Not applicable if managed cache policy is CachingDisabled.

CachePolicyId

Conditional

“4135ea2d-6df8-44a3-9df3-4b5a84be39ad"

CachingDisabled. Will open Jira ticket to explore choices for cache settings.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html

Compress

No

N/A

CloudFront doesn’t compress object when caching is disabled.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html

DefaultTTL

No

N/A

Deprecated

FieldLevelEncryptionId

No

N/A

For encrypting data uploaded through CloudFront. Not applicable.

ForwardedValues

Conditional

N/A

Deprecated

FunctionAssociations

No

N/A

Not applicable because no functions will be associated with the distribution.

LambdaFunctionAssociations

No

N/A

Not applicable because no Lambda functions will be associated with the distribution.

MaxTTL

No

N/A

Deprecated

MinTTL

No

N/A

Deprecated

OriginRequestPolicyId

No

{"Ref": "OriginRequestPolicy"}

OriginRequestPolicy Object

"b689b0a8-53d0-40ab-baf2-68738e2966ac"

Need to be able to forward headers and query strings from the viewer request so we can override the response-content-disposition and response-content-type when creating the signed URL and pass other headers such as Range. By default no query strings are forwarded.https://docs.aws.or headers are forwarded. The chosen policy does not pass the host header, which allows CloudFront to use the S3 origin’s domain as the host in its request to the S3 origin.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html

RealtimeLogConfigArn

No

N/A

Not applicable. Will be using standard log. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html

ResponseHeadersPolicyId

No

N/A

The managed response header policies are applicable to static websites, not our use case.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/modifying-response-headers.html

SmoothStreaming

No

N/A

This is for media files, so not applicable.

TargetOriginId

Yes

"${stack}data.sagebase.org"

The value of ID for the origin.

TrustedKeyGroups

No

{"Ref": "CloudFrontPublicKeyGroup"}

KeyGroup Object

List of key groups that CloudFront can use to validate signed URLs or signed cookies.

TrustedSigners

No

N/A

Using TrustedKeyGroups, so not applicable.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html

ViewerProtocolPolicy

Yes

https-only

All signed URLs will use HTTPS.