Aws/cloudfront

@swamp/aws/cloudfrontv2026.10.25.1· AGPL-3.0-or-later· 1d agoBEHAVIORS

01README

AWS CLOUDFRONT infrastructure models

02Release Notes

Updated: anycast_ip_list, connection_function, distribution, distribution_tenant, field_level_encryption_profile, vpc_origin

03Behaviors21

@swamp/aws/cloudfront/anycast-ip-listv2026.10.25.1anycast_ip_list.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AnycastIpList?	object	no
IpCount	number	yes	The number of IP addresses in the Anycast static IP list.
IpAddressType?	enum	no	The IP address type for the Anycast static IP list.
IpamCidrConfigs?	array	no	A list of IPAM CIDR configurations that define the IP address ranges, IPAM pools, and associated Anycast IP addresses.
Name	string	yes	The name of the Anycast static IP list.
Tags?	object	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront AnycastIpList

fn get(identifier: string)

Get a CloudFront AnycastIpList

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront AnycastIpList

fn update()

Update a CloudFront AnycastIpList

fn delete(identifier: string)

Delete a CloudFront AnycastIpList

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront AnycastIpList

fn sync()

Sync CloudFront AnycastIpList state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront AnycastIpList resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront AnycastIpList resource state

@swamp/aws/cloudfront/cache-policyv2026.10.23.1cache_policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CachePolicyConfig	object	yes	The cache policy configuration.

fn create()

Create a CloudFront CachePolicy

fn get(identifier: string)

Get a CloudFront CachePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront CachePolicy

fn update()

Update a CloudFront CachePolicy

fn delete(identifier: string)

Delete a CloudFront CachePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront CachePolicy

fn sync()

Sync CloudFront CachePolicy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront CachePolicy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront CachePolicy resource state

@swamp/aws/cloudfront/cloud-front-origin-access-identityv2026.10.23.1cloud_front_origin_access_identity.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CloudFrontOriginAccessIdentityConfig	object	yes	The current configuration information for the identity.

fn create()

Create a CloudFront CloudFrontOriginAccessIdentity

fn get(identifier: string)

Get a CloudFront CloudFrontOriginAccessIdentity

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront CloudFrontOriginAccessIdentity

fn update()

Update a CloudFront CloudFrontOriginAccessIdentity

fn delete(identifier: string)

Delete a CloudFront CloudFrontOriginAccessIdentity

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront CloudFrontOriginAccessIdentity

fn sync()

Sync CloudFront CloudFrontOriginAccessIdentity state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront CloudFrontOriginAccessIdentity resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront CloudFrontOriginAccessIdentity resource state

@swamp/aws/cloudfront/connection-functionv2026.10.25.1connection_function.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The connection function name.
ConnectionFunctionCode	string	yes	The code for the connection function.
ConnectionFunctionConfig	object	yes	Contains configuration information about a CloudFront function.
AutoPublish?	boolean	no	A flag that determines whether to automatically publish the function to the LIVE stage when it’s created. To automatically publish to the LIVE stage, set this property to true.
Tags?	array	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront ConnectionFunction

fn get(identifier: string)

Get a CloudFront ConnectionFunction

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ConnectionFunction

fn update()

Update a CloudFront ConnectionFunction

fn delete(identifier: string)

Delete a CloudFront ConnectionFunction

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ConnectionFunction

fn sync()

Sync CloudFront ConnectionFunction state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront ConnectionFunction resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront ConnectionFunction resource state

@swamp/aws/cloudfront/connection-groupv2026.10.23.1connection_group.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the connection group.
Tags?	array	no	A complex type that contains zero or more Tag elements.
Ipv6Enabled?	boolean	no	IPv6 is enabled for the connection group.
AnycastIpListId?	string	no	The ID of the Anycast static IP list.
Enabled?	boolean	no	Whether the connection group is enabled.

fn create()

Create a CloudFront ConnectionGroup

fn get(identifier: string)

Get a CloudFront ConnectionGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ConnectionGroup

fn update()

Update a CloudFront ConnectionGroup

fn delete(identifier: string)

Delete a CloudFront ConnectionGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ConnectionGroup

fn sync()

Sync CloudFront ConnectionGroup state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront ConnectionGroup resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront ConnectionGroup resource state

@swamp/aws/cloudfront/continuous-deployment-policyv2026.10.23.1continuous_deployment_policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ContinuousDeploymentPolicyConfig	object	yes	Contains the configuration for a continuous deployment policy.

fn create()

Create a CloudFront ContinuousDeploymentPolicy

fn get(identifier: string)

Get a CloudFront ContinuousDeploymentPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ContinuousDeploymentPolicy

fn update()

Update a CloudFront ContinuousDeploymentPolicy

fn delete(identifier: string)

Delete a CloudFront ContinuousDeploymentPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ContinuousDeploymentPolicy

fn sync()

Sync CloudFront ContinuousDeploymentPolicy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront ContinuousDeploymentPolicy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront ContinuousDeploymentPolicy resource state

@swamp/aws/cloudfront/distributionv2026.10.25.1distribution.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DistributionConfig	object	yes	The distribution's configuration.
Tags?	array	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront Distribution

fn get(identifier: string)

Get a CloudFront Distribution

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront Distribution

fn update()

Update a CloudFront Distribution

fn delete(identifier: string)

Delete a CloudFront Distribution

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront Distribution

fn sync()

Sync CloudFront Distribution state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront Distribution resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront Distribution resource state

@swamp/aws/cloudfront/distribution-tenantv2026.10.25.1distribution_tenant.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DistributionId	string	yes	The ID of the multi-tenant distribution.
Name	string	yes	The name of the distribution tenant.
Tags?	array	no	A complex type that contains zero or more Tag elements.
Customizations?	object	no	Customizations for the distribution tenant. For each distribution tenant, you can specify the geographic restrictions, and the Amazon Resource Names (ARNs) for the ACM certificate and WAF web ACL. These are specific values that you can override or disable from the multi-tenant distribution that was used to create the distribution tenant.
Parameters?	array	no	A list of parameter values to add to the resource. A parameter is specified as a key-value pair. A valid parameter value must exist for any parameter that is marked as required in the multi-tenant distribution.
ConnectionGroupId?	string	no	The ID of the connection group for the distribution tenant. If you don't specify a connection group, CloudFront uses the default connection group.
Enabled?	boolean	no	Indicates whether the distribution tenant is in an enabled state. If disabled, the distribution tenant won't serve traffic.
Domains	array	yes	The domains associated with the distribution tenant.
ManagedCertificateRequest?	object	no	An object that represents the request for the Amazon CloudFront managed ACM certificate.

fn create()

Create a CloudFront DistributionTenant

fn get(identifier: string)

Get a CloudFront DistributionTenant

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront DistributionTenant

fn update()

Update a CloudFront DistributionTenant

fn delete(identifier: string)

Delete a CloudFront DistributionTenant

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront DistributionTenant

fn sync()

Sync CloudFront DistributionTenant state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront DistributionTenant resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront DistributionTenant resource state

@swamp/aws/cloudfront/field-level-encryption-configv2026.10.23.1field_level_encryption_config.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CallerReference	string	yes	A unique value that identifies the create request. Any string unique within the account works; CloudFront refuses to change it once set, so supplying a different value replaces the configuration. It is also the only value CloudFront returns that identifies a configuration as this stack's, so cleaning up after a failed create depends on the template keeping it.
Comment?	string	no	An optional comment describing the field-level encryption configuration. CloudFront stores an omitted comment and an explicitly empty one identically as an empty string, and Read normalizes that empty string back to absent -- so omitting Comment round-trips, while asking for an empty string does not and would report perpetual drift. `minLength: 1` refuses the empty string at template validation; omission is the way to express no comment. The service documents a maximum of 128 characters, and `ma
QueryArgProfileConfig	object	yes	How CloudFront handles query arguments, including the profile paired with each one.
ContentTypeProfileConfig	object	yes	How CloudFront handles content types, including the profile paired with each one.

fn create()

Create a CloudFront FieldLevelEncryptionConfig

fn get(identifier: string)

Get a CloudFront FieldLevelEncryptionConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront FieldLevelEncryptionConfig

fn update()

Update a CloudFront FieldLevelEncryptionConfig

fn delete(identifier: string)

Delete a CloudFront FieldLevelEncryptionConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront FieldLevelEncryptionConfig

fn sync()

Sync CloudFront FieldLevelEncryptionConfig state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront FieldLevelEncryptionConfig resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront FieldLevelEncryptionConfig resource state

@swamp/aws/cloudfront/field-level-encryption-profilev2026.10.25.1field_level_encryption_profile.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
FieldLevelEncryptionProfileConfig	object	yes	The configuration of a field-level encryption profile.

fn create()

Create a CloudFront FieldLevelEncryptionProfile

fn get(identifier: string)

Get a CloudFront FieldLevelEncryptionProfile

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront FieldLevelEncryptionProfile

fn update()

Update a CloudFront FieldLevelEncryptionProfile

fn delete(identifier: string)

Delete a CloudFront FieldLevelEncryptionProfile

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront FieldLevelEncryptionProfile

fn sync()

Sync CloudFront FieldLevelEncryptionProfile state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront FieldLevelEncryptionProfile resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront FieldLevelEncryptionProfile resource state

@swamp/aws/cloudfront/functionv2026.10.23.1function.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AutoPublish?	boolean	no	A flag that determines whether to automatically publish the function to the LIVE stage when it’s created. To automatically publish to the LIVE stage, set this property to true.
FunctionCode	string	yes	The function code. For more information about writing a CloudFront function, see [Writing function code for CloudFront Functions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html) in the Amazon CloudFront Developer Guide.
FunctionConfig	object	yes	Contains configuration information about a CloudFront function.
Name	string	yes	A name to identify the function.
Tags?	array	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront Function

fn get(identifier: string)

Get a CloudFront Function

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront Function

fn update()

Update a CloudFront Function

fn delete(identifier: string)

Delete a CloudFront Function

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront Function

fn sync()

Sync CloudFront Function state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront Function resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront Function resource state

@swamp/aws/cloudfront/key-groupv2026.10.23.1key_group.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
KeyGroupConfig	object	yes	The key group configuration.

fn create()

Create a CloudFront KeyGroup

fn get(identifier: string)

Get a CloudFront KeyGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront KeyGroup

fn update()

Update a CloudFront KeyGroup

fn delete(identifier: string)

Delete a CloudFront KeyGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront KeyGroup

fn sync()

Sync CloudFront KeyGroup state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront KeyGroup resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront KeyGroup resource state

@swamp/aws/cloudfront/key-value-storev2026.10.23.1key_value_store.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The name of the key value store.
Comment?	string	no	A comment to describe the Key Value Store. Omitting Comment from the template during updates will clear the existing comment (set to empty string). To preserve an existing comment, you must explicitly include it in the template.
ImportSource?	object	no	The import source for the key value store.
Tags?	array	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront KeyValueStore

fn get(identifier: string)

Get a CloudFront KeyValueStore

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront KeyValueStore

fn update()

Update a CloudFront KeyValueStore

fn delete(identifier: string)

Delete a CloudFront KeyValueStore

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront KeyValueStore

fn sync()

Sync CloudFront KeyValueStore state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront KeyValueStore resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront KeyValueStore resource state

@swamp/aws/cloudfront/monitoring-subscriptionv2026.10.23.1monitoring_subscription.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DistributionId	string	yes	The ID of the distribution that you are enabling metrics for.
MonitoringSubscription	object	yes	A subscription configuration for additional CloudWatch metrics.

fn create()

Create a CloudFront MonitoringSubscription

fn get(identifier: string)

Get a CloudFront MonitoringSubscription

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront MonitoringSubscription

fn delete(identifier: string)

Delete a CloudFront MonitoringSubscription

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront MonitoringSubscription

fn sync()

Sync CloudFront MonitoringSubscription state from AWS

Resources

state(infinite)— CloudFront MonitoringSubscription resource state

@swamp/aws/cloudfront/origin-access-controlv2026.10.23.1origin_access_control.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
OriginAccessControlConfig	object	yes	The origin access control.

fn create()

Create a CloudFront OriginAccessControl

fn get(identifier: string)

Get a CloudFront OriginAccessControl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront OriginAccessControl

fn update()

Update a CloudFront OriginAccessControl

fn delete(identifier: string)

Delete a CloudFront OriginAccessControl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront OriginAccessControl

fn sync()

Sync CloudFront OriginAccessControl state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront OriginAccessControl resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront OriginAccessControl resource state

@swamp/aws/cloudfront/origin-request-policyv2026.10.23.1origin_request_policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
OriginRequestPolicyConfig	object	yes	The origin request policy configuration.

fn create()

Create a CloudFront OriginRequestPolicy

fn get(identifier: string)

Get a CloudFront OriginRequestPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront OriginRequestPolicy

fn update()

Update a CloudFront OriginRequestPolicy

fn delete(identifier: string)

Delete a CloudFront OriginRequestPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront OriginRequestPolicy

fn sync()

Sync CloudFront OriginRequestPolicy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront OriginRequestPolicy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront OriginRequestPolicy resource state

@swamp/aws/cloudfront/public-keyv2026.10.23.1public_key.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
PublicKeyConfig	object	yes	Configuration information about a public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html), or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html).

fn create()

Create a CloudFront PublicKey

fn get(identifier: string)

Get a CloudFront PublicKey

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront PublicKey

fn update()

Update a CloudFront PublicKey

fn delete(identifier: string)

Delete a CloudFront PublicKey

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront PublicKey

fn sync()

Sync CloudFront PublicKey state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront PublicKey resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront PublicKey resource state

@swamp/aws/cloudfront/realtime-log-configv2026.10.23.1realtime_log_config.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
EndPoints	array	yes	Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
Fields	array	yes	A list of fields that are included in each real-time log record. In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream. For more information about fields, see [Real-time log configuration fields](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields) in the Amazon CloudFront Developer Guide.
Name	string	yes	The unique name of this real-time log configuration.
SamplingRate	number	yes	The sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.

fn create()

Create a CloudFront RealtimeLogConfig

fn get(identifier: string)

Get a CloudFront RealtimeLogConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront RealtimeLogConfig

fn update()

Update a CloudFront RealtimeLogConfig

fn delete(identifier: string)

Delete a CloudFront RealtimeLogConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront RealtimeLogConfig

fn sync()

Sync CloudFront RealtimeLogConfig state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront RealtimeLogConfig resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront RealtimeLogConfig resource state

@swamp/aws/cloudfront/response-headers-policyv2026.10.23.1response_headers_policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResponseHeadersPolicyConfig	object	yes	A response headers policy configuration.

fn create()

Create a CloudFront ResponseHeadersPolicy

fn get(identifier: string)

Get a CloudFront ResponseHeadersPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ResponseHeadersPolicy

fn update()

Update a CloudFront ResponseHeadersPolicy

fn delete(identifier: string)

Delete a CloudFront ResponseHeadersPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront ResponseHeadersPolicy

fn sync()

Sync CloudFront ResponseHeadersPolicy state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront ResponseHeadersPolicy resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront ResponseHeadersPolicy resource state

@swamp/aws/cloudfront/trust-storev2026.10.23.1trust_store.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	The trust store's name.
CaCertificatesBundleSource?	object	no	A CA certificates bundle source.
UseClientCertificateOCSPEndpoint?	boolean	no	A boolean. When true, performs real-time certificate revocation checks by querying the OCSP endpoint specified within the client certificate.
Tags?	array	no	A complex type that contains zero or more Tag elements.

fn create()

Create a CloudFront TrustStore

fn get(identifier: string)

Get a CloudFront TrustStore

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront TrustStore

fn update()

Update a CloudFront TrustStore

fn delete(identifier: string)

Delete a CloudFront TrustStore

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront TrustStore

fn sync()

Sync CloudFront TrustStore state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront TrustStore resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront TrustStore resource state

@swamp/aws/cloudfront/vpc-originv2026.10.25.1vpc_origin.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Tags?	array	no	A complex type that contains zero or more Tag elements.
VpcOriginEndpointConfig	object	yes	The VPC origin endpoint configuration.

fn create()

Create a CloudFront VpcOrigin

fn get(identifier: string)

Get a CloudFront VpcOrigin

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront VpcOrigin

fn update()

Update a CloudFront VpcOrigin

fn delete(identifier: string)

Delete a CloudFront VpcOrigin

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the CloudFront VpcOrigin

fn sync()

Sync CloudFront VpcOrigin state from AWS

fn list(maxPages?: number, resourceModel?: string)

List CloudFront VpcOrigin resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

Resources

state(infinite)— CloudFront VpcOrigin resource state

04Previous Versions19

2026.10.24.1AGPL-3.0-or-laterOct 24, 2026

2026.10.23.1AGPL-3.0-or-laterOct 24, 2026

Updated: anycast_ip_list, cache_policy, cloud_front_origin_access_identity, connection_function, connection_group, continuous_deployment_policy, distribution, distribution_tenant, field_level_encryption_config, field_level_encryption_profile, function, key_group, key_value_store, monitoring_subscription, origin_access_control, origin_request_policy, public_key, realtime_log_config, response_headers_policy, trust_store, vpc_origin

2026.10.15.1AGPL-3.0-or-later(was none)Oct 15, 2026

Added: field_level_encryption_config

Added 1 behaviors

2026.10.13.1Oct 13, 2026

Updated: anycast_ip_list, cache_policy, cloud_front_origin_access_identity, connection_function, connection_group, continuous_deployment_policy, distribution, distribution_tenant, field_level_encryption_profile, function, key_group, key_value_store, monitoring_subscription, origin_access_control, origin_request_policy, public_key, realtime_log_config, response_headers_policy, trust_store, vpc_origin

2026.10.08.1Oct 8, 2026

2026.10.06.1Oct 6, 2026

2026.10.04.1Oct 4, 2026

2026.10.03.1Oct 3, 2026

2026.10.02.1Oct 2, 2026

2026.10.01.1Oct 1, 2026

2026.09.30.1Sep 30, 2026

2026.09.29.1Sep 29, 2026

2026.09.28.1Sep 28, 2026

2026.09.27.1Sep 27, 2026

2026.09.26.1Sep 26, 2026

2026.09.25.1Sep 25, 2026

Added: field_level_encryption_profile

Added 1 behaviors

2026.09.24.1Sep 24, 2026

2026.09.23.1Sep 23, 2026

Updated: origin_access_control

2026.09.21.1Sep 21, 2026

05Stats

100 / 100

Downloads

1,027

Archive size

4.2 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Docs keep secrets in a vault1/1earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License2/2earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64 windows · x86_64

07Labels

#aws #cloudfront #cloud #infrastructure