Amazon CloudFront

App · Cloud Computing · 20 actions

Run your CloudFront CDN from a workflow: clear cached files after a deploy, stand up or retire distributions, tag them, and write, test and publish CloudFront Functions that rewrite requests at the edge.

Actions

ActionWhat it does
Add tagsAdd tags to a distribution or other CloudFront resource.
Create a distributionPut CloudFront in front of a website or other HTTP(S) origin.
Create a functionCreate a CloudFront function from JavaScript code.
Create an invalidationRemove files from CloudFront's cache so the next request fetches them fresh from the origin.
Delete a distributionPermanently delete a distribution.
Delete a functionPermanently delete a function, both stages.
Get a distributionGet one distribution: whether it is enabled, whether a change is still deploying (status InProgress) or done (Deployed), and its origins and cache settings.
Get a functionGet a CloudFront function's details: status, runtime, stage and its current ETag.
Get an invalidationGet one invalidation and its status: InProgress, then Completed.
List cache policiesList cache policies: AWS's managed ones, such as CachingOptimized, and any made in this account.
List distributionsList the CloudFront distributions in the account, one page at a time, with their status, domain name and origins.
List functionsList the CloudFront Functions in the account.
List invalidationsList a distribution's invalidations, newest first.
List origin access controlsList the origin access controls in the account: the settings that let a distribution read a private S3 bucket.
List tagsList the tags on a distribution or other CloudFront resource.
Publish a functionCopy a function's development code to its live stage.
Remove tagsRemove tags, by name, from a distribution or other CloudFront resource.
Set distribution enabledTurn a distribution on or off.
Test a functionRun a function against a sample request and return what it produced.
Update a functionReplace a function's development code.

Add tags

Add tags to a distribution or other CloudFront resource. A tag whose name already exists is overwritten; other tags are kept.

Inputs

Distribution or ARNresourcetextRequired
The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.
TagstagsobjectRequired
Tag names and values, such as team = web. Up to 50 tags; names up to 128 characters, values up to 256, using letters, digits, spaces and _.:/=+-@.

Outputs

resource_arntext
tagsobject
The tags this step wrote.
Example output
{
  "resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
  "tags": {
    "team": "web"
  }
}

Create a distribution

Put CloudFront in front of a website or other HTTP(S) origin. The new distribution gets its own cloudfront.net domain and takes a few minutes to deploy.

Inputs

Origin domainorigin_domaintextRequired
The host CloudFront fetches content from, such as www.example.com or an S3 website endpoint. A pasted URL is fine; its path becomes the origin path.
Origin pathorigin_pathtext
An optional folder on the origin to serve from, such as /production.
Origin protocolorigin_protocol_policytext
How CloudFront connects to the origin.One of: https-only (HTTPS only (recommended)), match-viewer (Match the viewer's protocol), http-only (HTTP only (for origins without HTTPS, such as S3 websites)). Default: https-only.
Viewer protocolviewer_protocol_policytext
How visitors may connect to the distribution.One of: redirect-to-https (Redirect HTTP to HTTPS), https-only (HTTPS only (HTTP is refused)), allow-all (HTTP and HTTPS). Default: redirect-to-https.
Cache policycache_policy_idtext
How long CloudFront caches responses. Leave empty for CachingOptimized; pick CachingDisabled for dynamic content.
Commentcommenttext
A name to recognise the distribution by, up to 128 characters.
Default root objectdefault_root_objecttext
The file to return for the bare domain, such as index.html. Leave empty to pass / to the origin.
Enabledenabledtrue/false
Serve traffic as soon as it is deployed. Off creates it disabled.Default: true.
Price classprice_classtext
Which edge locations serve it.One of: PriceClass_All (All edge locations (best performance)), PriceClass_200 (North America, Europe, Asia, Middle East and Africa), PriceClass_100 (North America and Europe only (lowest cost)). Default: PriceClass_All.
HTTP versionhttp_versiontext
The newest HTTP version visitors may use.One of: http2 (HTTP/2), http2and3 (HTTP/2 and HTTP/3), http3 (HTTP/3), http1.1 (HTTP/1.1). Default: http2.
IPv6ipv6_enabledtrue/false
Answer on IPv6 as well as IPv4.Default: true.
Tagstagsobject
Tag names and values, such as team = web. Up to 50 tags; names up to 128 characters, values up to 256, using letters, digits, spaces and _.:/=+-@.

Outputs

aliaseslist
Alternate domain names (CNAMEs).
arntext
cache_policy_idtext
commenttext
default_root_objecttext
domain_nametext
The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/false
etagtext
The current version of the distribution's config.
http_versiontext
idtext
Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumber
ipv6_enabledtrue/false
last_modified_timetext
originslist
Each origin's domain name.
price_classtext
statustext
InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
  "aliases": [],
  "arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
  "cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
  "comment": "Marketing site",
  "default_root_object": "index.html",
  "domain_name": "d111111abcdef8.cloudfront.net",
  "enabled": true,
  "etag": "E2QWRUHEXAMPLE",
  "http_version": "http2",
  "id": "E2QWRUHAPOMQZL",
  "in_progress_invalidation_batches": 0,
  "ipv6_enabled": true,
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "origins": [
    "www.example.com"
  ],
  "price_class": "PriceClass_All",
  "status": "InProgress",
  "viewer_protocol_policy": "redirect-to-https"
}

Create a function

Create a CloudFront function from JavaScript code. It starts in the development stage; test it, then publish it to use it on a distribution.

Inputs

Function namefunction_nametextRequired
Up to 64 letters, digits, hyphens and underscores. Must be unique in the account.
CodecodetextRequired
The function's JavaScript, with a handler(event) function that returns the request or response. Up to 40 KB.
Runtimeruntimetext
The JavaScript runtime the function runs on.One of: cloudfront-js-2.0 (JavaScript 2.0 (recommended)), cloudfront-js-1.0 (JavaScript 1.0). Default: cloudfront-js-2.0.
Commentcommenttext
An optional note about the function, up to 128 characters.

Outputs

arntext
commenttext
created_timetext
etagtext
last_modified_timetext
nametext
runtimetext
stagetext
DEVELOPMENT or LIVE.
statustext
Example output
{
  "arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
  "comment": "Adds security headers",
  "created_time": "2026-09-01T09:00:00+00:00",
  "etag": "ETVPDKIKX0DER",
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "name": "add-security-headers",
  "runtime": "cloudfront-js-2.0",
  "stage": "DEVELOPMENT",
  "status": "UNPUBLISHED"
}

Create an invalidation

Remove files from CloudFront's cache so the next request fetches them fresh from the origin. The first 1,000 paths each month are free; /* counts as one path.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
PathspathslistRequired
The paths to clear, each starting with /, such as /index.html. End one with * to clear everything under it, such as /images/*.

Outputs

caller_referencetext
create_timetext
distribution_idtext
idtext
pathslist
statustext
InProgress, then Completed.
Example output
{
  "caller_reference": "lodol-0b8d4b5e-5f8f-4c1e-9d0a-2f6c1b7e9a11",
  "create_time": "2026-09-01T09:00:00+00:00",
  "distribution_id": "E2QWRUHAPOMQZL",
  "id": "I2J0I21PCUYOIK",
  "paths": [
    "/index.html",
    "/images/*"
  ],
  "status": "InProgress"
}

Delete a distribution

Permanently delete a distribution. It must be disabled first and finished deploying (status Deployed), which takes a few minutes after disabling.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.

Outputs

deletedtrue/false
distribution_idtext
Example output
{
  "deleted": true,
  "distribution_id": "E2QWRUHAPOMQZL"
}

Delete a function

Permanently delete a function, both stages. CloudFront refuses while a distribution still uses it.

Inputs

Functionfunction_nametextRequired
The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.

Outputs

deletedtrue/false
function_nametext
Example output
{
  "deleted": true,
  "function_name": "add-security-headers"
}

Get a distribution

Get one distribution: whether it is enabled, whether a change is still deploying (status InProgress) or done (Deployed), and its origins and cache settings.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.

Outputs

aliaseslist
Alternate domain names (CNAMEs).
arntext
cache_policy_idtext
commenttext
default_root_objecttext
domain_nametext
The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/false
etagtext
The current version of the distribution's config.
http_versiontext
idtext
Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumber
ipv6_enabledtrue/false
last_modified_timetext
originslist
Each origin's domain name.
price_classtext
statustext
InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
  "aliases": [],
  "arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
  "cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
  "comment": "Marketing site",
  "default_root_object": "index.html",
  "domain_name": "d111111abcdef8.cloudfront.net",
  "enabled": true,
  "etag": "E2QWRUHEXAMPLE",
  "http_version": "http2",
  "id": "E2QWRUHAPOMQZL",
  "in_progress_invalidation_batches": 0,
  "ipv6_enabled": true,
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "origins": [
    "www.example.com"
  ],
  "price_class": "PriceClass_All",
  "status": "Deployed",
  "viewer_protocol_policy": "redirect-to-https"
}

Get a function

Get a CloudFront function's details: status, runtime, stage and its current ETag.

Inputs

Functionfunction_nametextRequired
The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
Stagestagetext
Which copy of the function to use.One of: DEVELOPMENT (Development (the latest saved code)), LIVE (Live (the published code distributions run)). Default: DEVELOPMENT.

Outputs

arntext
commenttext
created_timetext
etagtext
last_modified_timetext
nametext
runtimetext
stagetext
DEVELOPMENT or LIVE.
statustext
Example output
{
  "arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
  "comment": "Adds security headers",
  "created_time": "2026-09-01T09:00:00+00:00",
  "etag": "ETVPDKIKX0DER",
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "name": "add-security-headers",
  "runtime": "cloudfront-js-2.0",
  "stage": "DEVELOPMENT",
  "status": "UNPUBLISHED"
}

Get an invalidation

Get one invalidation and its status: InProgress, then Completed.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
Invalidation IDinvalidation_idtextRequired
Such as I2J0I21PCUYOIK. 'List invalidations' shows them.

Outputs

caller_referencetext
create_timetext
distribution_idtext
idtext
pathslist
statustext
InProgress, then Completed.
Example output
{
  "caller_reference": "lodol-0b8d4b5e-5f8f-4c1e-9d0a-2f6c1b7e9a11",
  "create_time": "2026-09-01T09:00:00+00:00",
  "distribution_id": "E2QWRUHAPOMQZL",
  "id": "I2J0I21PCUYOIK",
  "paths": [
    "/index.html",
    "/images/*"
  ],
  "status": "Completed"
}

List cache policies

List cache policies: AWS's managed ones, such as CachingOptimized, and any made in this account.

Inputs

Typepolicy_typetext
Whose policies to list. Leave empty for both.One of: managed (AWS managed only), custom (This account's own only).
Markermarkertext
To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber
How many to return in one page, from 1 to 100.From 1 to 100. Default: 100.

Outputs

cache_policieslist
countnumber
next_markertext
Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
  "cache_policies": [
    {
      "comment": "Policy with caching enabled.",
      "default_ttl": 86400,
      "id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
      "last_modified_time": "2021-02-22T21:12:03+00:00",
      "max_ttl": 31536000,
      "min_ttl": 1,
      "name": "Managed-CachingOptimized",
      "type": "managed"
    }
  ],
  "count": 1,
  "next_marker": null
}

List distributions

List the CloudFront distributions in the account, one page at a time, with their status, domain name and origins.

Inputs

Markermarkertext
To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber
How many to return in one page, from 1 to 100.From 1 to 100. Default: 100.

Outputs

countnumber
distributionslist
next_markertext
Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
  "count": 1,
  "distributions": [
    {
      "aliases": [],
      "arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
      "cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
      "comment": "Marketing site",
      "domain_name": "d111111abcdef8.cloudfront.net",
      "enabled": true,
      "http_version": "http2",
      "id": "E2QWRUHAPOMQZL",
      "ipv6_enabled": true,
      "last_modified_time": "2026-09-01T09:00:00+00:00",
      "origins": [
        "www.example.com"
      ],
      "price_class": "PriceClass_All",
      "status": "Deployed",
      "viewer_protocol_policy": "redirect-to-https"
    }
  ],
  "next_marker": null
}

List functions

List the CloudFront Functions in the account.

Inputs

Stagestagetext
Only functions in this stage. Leave empty for all.One of: DEVELOPMENT (Development (the latest saved code)), LIVE (Live (the published code distributions run)).
Markermarkertext
To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber
How many to return in one page, from 1 to 100.From 1 to 100. Default: 100.

Outputs

countnumber
functionslist
next_markertext
Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
  "count": 1,
  "functions": [
    {
      "arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
      "comment": "Adds security headers",
      "created_time": "2026-09-01T09:00:00+00:00",
      "etag": null,
      "last_modified_time": "2026-09-01T09:00:00+00:00",
      "name": "add-security-headers",
      "runtime": "cloudfront-js-2.0",
      "stage": "DEVELOPMENT",
      "status": "UNPUBLISHED"
    }
  ],
  "next_marker": null
}

List invalidations

List a distribution's invalidations, newest first.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
Markermarkertext
To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber
How many to return in one page, from 1 to 100.From 1 to 100. Default: 100.

Outputs

countnumber
distribution_idtext
invalidationslist
next_markertext
Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
  "count": 1,
  "distribution_id": "E2QWRUHAPOMQZL",
  "invalidations": [
    {
      "create_time": "2026-09-01T09:00:00+00:00",
      "id": "I2J0I21PCUYOIK",
      "status": "Completed"
    }
  ],
  "next_marker": null
}

List origin access controls

List the origin access controls in the account: the settings that let a distribution read a private S3 bucket.

Inputs

Markermarkertext
To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
Max itemsmax_itemsnumber
How many to return in one page, from 1 to 100.From 1 to 100. Default: 100.

Outputs

countnumber
next_markertext
Pass this as 'Marker' to fetch the next page. Null on the last page.
origin_access_controlslist
Example output
{
  "count": 1,
  "next_marker": null,
  "origin_access_controls": [
    {
      "description": "",
      "id": "E1LTIJZ0EXAMPLE",
      "name": "my-bucket-oac",
      "origin_type": "s3",
      "signing_behavior": "always",
      "signing_protocol": "sigv4"
    }
  ]
}

List tags

List the tags on a distribution or other CloudFront resource.

Inputs

Distribution or ARNresourcetextRequired
The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.

Outputs

resource_arntext
tagsobject
Tag name to tag value.
Example output
{
  "resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
  "tags": {
    "team": "web"
  }
}

Publish a function

Copy a function's development code to its live stage. Distributions that use the function start running it within minutes.

Inputs

Functionfunction_nametextRequired
The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.

Outputs

arntext
commenttext
created_timetext
etagtext
last_modified_timetext
nametext
runtimetext
stagetext
DEVELOPMENT or LIVE.
statustext
Example output
{
  "arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
  "comment": "Adds security headers",
  "created_time": "2026-09-01T09:00:00+00:00",
  "etag": null,
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "name": "add-security-headers",
  "runtime": "cloudfront-js-2.0",
  "stage": "LIVE",
  "status": "UNASSOCIATED"
}

Remove tags

Remove tags, by name, from a distribution or other CloudFront resource. Names it does not have are ignored.

Inputs

Distribution or ARNresourcetextRequired
The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.
Tag namestag_keyslistRequired
The names of the tags to remove, such as team.

Outputs

removed_keyslist
resource_arntext
Example output
{
  "removed_keys": [
    "team"
  ],
  "resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL"
}

Set distribution enabled

Turn a distribution on or off. Nothing else in its settings changes. A distribution must be off, and finished deploying, before it can be deleted.

Inputs

Distributiondistribution_idtextRequired
The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
Enabledenabledtrue/falseRequired
On to serve traffic, off to stop serving it.

Outputs

aliaseslist
Alternate domain names (CNAMEs).
arntext
cache_policy_idtext
changedtrue/false
False when it was already in that state.
commenttext
default_root_objecttext
domain_nametext
The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/false
etagtext
The current version of the distribution's config.
http_versiontext
idtext
Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumber
ipv6_enabledtrue/false
last_modified_timetext
originslist
Each origin's domain name.
price_classtext
statustext
InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
  "aliases": [],
  "arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
  "cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
  "changed": true,
  "comment": "Marketing site",
  "default_root_object": "index.html",
  "domain_name": "d111111abcdef8.cloudfront.net",
  "enabled": false,
  "etag": "E2QWRUHEXAMPLE",
  "http_version": "http2",
  "id": "E2QWRUHAPOMQZL",
  "in_progress_invalidation_batches": 0,
  "ipv6_enabled": true,
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "origins": [
    "www.example.com"
  ],
  "price_class": "PriceClass_All",
  "status": "InProgress",
  "viewer_protocol_policy": "redirect-to-https"
}

Test a function

Run a function against a sample request and return what it produced. Fill in the method, path and headers, or paste a full test event.

Inputs

Functionfunction_nametextRequired
The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
Stagestagetext
Which copy of the function to use.One of: DEVELOPMENT (Development (the latest saved code)), LIVE (Live (the published code distributions run)). Default: DEVELOPMENT.
Event typeevent_typetext
Which event the function handles: the request arriving, or the response going back.One of: viewer-request (Viewer request), viewer-response (Viewer response). Default: viewer-request.
Methodhttp_methodtext
The sample request's method.One of: GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS. Default: GET.
Pathuritext
The sample request's path, such as /index.html.Default: /index.html.
Query stringquerystringtext
Optional, such as lang=en&page=2.
Headersheadersobject
Request header names and values. Host defaults to example.com.
Full test event (JSON)event_jsontext
Optional. A complete CloudFront Functions event object; when given, the fields above are ignored.

Outputs

compute_utilizationnumber
Share of the maximum allowed run time used, 0 to 100.
function_nametext
logslist
outputobject
The request or response the function returned.
stagetext
Example output
{
  "compute_utilization": 12,
  "function_name": "add-security-headers",
  "logs": [],
  "output": {
    "request": {
      "headers": {
        "host": {
          "value": "example.com"
        }
      },
      "method": "GET",
      "uri": "/index.html"
    }
  },
  "stage": "DEVELOPMENT"
}

Update a function

Replace a function's development code. Distributions keep running the live copy until you publish again.

Inputs

Functionfunction_nametextRequired
The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
CodecodetextRequired
The function's JavaScript, with a handler(event) function that returns the request or response. Up to 40 KB.
Runtimeruntimetext
Leave empty to keep the current runtime.One of: cloudfront-js-2.0 (JavaScript 2.0 (recommended)), cloudfront-js-1.0 (JavaScript 1.0).
Commentcommenttext
Leave empty to keep the current comment.

Outputs

arntext
commenttext
created_timetext
etagtext
last_modified_timetext
nametext
runtimetext
stagetext
DEVELOPMENT or LIVE.
statustext
Example output
{
  "arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
  "comment": "Adds security headers",
  "created_time": "2026-09-01T09:00:00+00:00",
  "etag": "ETVPDKIKX0DER",
  "last_modified_time": "2026-09-01T09:00:00+00:00",
  "name": "add-security-headers",
  "runtime": "cloudfront-js-2.0",
  "stage": "DEVELOPMENT",
  "status": "UNPUBLISHED"
}

On this page