skills.rest
richardnroman
richardnromanCOMMUNITY
Explore all skills by this author →
GitHub

cloudfront

Configures Amazon CloudFront distributions, certificates, origin protection, content security, and logging.

Updated Jul 21, 2026
Search Tags:#caching#aws#cdn#configure#cloudfront#tls certificates#origin security
One-click install
npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill cloudfront-richardnroman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloudfront
Source: https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform/tree/main/.agents/skills/cloudfront
Command: npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill cloudfront-richardnroman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Configuring Amazon CloudFront correctly involves many interlocking decisions — choosing origins, locking them down, managing ACM certificates in us-east-1, restricting viewer access, and setting up logging — and mistakes like unlocked origins or wrong-Region certificates silently break security or availability. This Skill routes each CloudFront task to a vetted procedure with constraints, decision tables, and troubleshooting guidance. ## Core Features & Use Cases - Distribution setup and pricing: Decide when CloudFront is the right layer, create distributions with the correct origin type, tune cache behaviors and policies, and choose between pay-as-you-go and Flat Rate Pricing. - Certificates and multi-tenant SaaS: Manage ACM certificates in us-east-1, handle live-traffic migrations with HTTP validation, and run many customer domains through multi-tenant distributions with per-tenant certificates. - Origin and content security: Lock origins with OAC, VPC origins, or origin mTLS, and gate viewers with signed URLs/cookies, geographic restrictions, viewer mTLS, or edge token validation. - Use Case: A SaaS provider needs to serve 50 customer domains through one shared CloudFront configuration. The Skill walks through creating a multi-tenant distribution, per-tenant certificates, tenant activation, and testing against the connection group before DNS cutover. ## Quick Start Ask the agent to create a CloudFront distribution in front of your private S3 bucket with origin access control, HTTPS enforcement, and standard logging enabled.

Frequently Asked Questions about cloudfront

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a CloudFront distribution with an S3 origin?▼

Create an origin access control (OAC) set to always sign, then create the distribution referencing the OAC id on a standard S3 bucket origin with a managed cache policy. Finish by writing a scoped bucket policy allowing cloudfront.amazonaws.com for that specific distribution and keep S3 Block Public Access on.

How do I restrict who can view CloudFront content?▼

Choose the control by what you gate on: signed URLs or cookies for identity, geographic restrictions for country, viewer mTLS for client certificates, or a CloudFront Function for token validation. Every control must be paired with origin locking so viewers cannot bypass CloudFront.

CloudFront Functions vs Lambda@Edge — which should I use?▼

Use CloudFront Functions for lightweight viewer-facing logic like URL rewrites, header changes, redirects, and token checks on viewer-request or viewer-response events. Use Lambda@Edge when you need network access, origin-request or origin-response events, or a larger runtime.

Why won't CloudFront attach my ACM certificate?▼

The certificate must be in us-east-1 regardless of where your application runs, because CloudFront is a global service. Request or import the certificate in us-east-1, wait for it to reach Issued, then attach it to the distribution.

What is the difference between CloudFront standard logs and real-time logs?▼

Standard logs are complete records delivered minutes later to S3, CloudWatch Logs, or Firehose with no CloudFront delivery charge. Real-time logs arrive within seconds to a Kinesis data stream but are sampled and best-effort, so counts will not match billing reports.

When should I use a multi-tenant CloudFront distribution?▼

Use a multi-tenant distribution when you manage many domains sharing configuration, such as a SaaS platform. The template holds shared settings, each domain becomes a distribution tenant, and DNS points at the connection group routing endpoint rather than the template.

Related Skills

Explore More Software Engineering Skills→
reason-machinesreason-machines
5

terraform-data-engineering-iac

Provision AWS S3, EC2, and IAM resources for data pipelines using Terraform.

Official
Intermediate
awsaws
2.3k

routing-traffic-with-route53-and-cloudfront

Configure Route 53 alias records and ACM certificates for CloudFront HTTPS routing.

Official
Advanced
awsaws
2.5k

waf

Configures AWS WAF web ACLs, managed rules, rate limits, and bot and fraud protection.

Official
Advanced
randrand
126

discover-protocols

Automate discovery of protocol skills for HTTP, TCP, UDP, and QUIC workflows.

Community
Basic