Amazon CloudFront
App · Cloud Computing · 20 actions
Run your CloudFront CDN from a workflow: clear cached files after a deploy, stand up or retire distributions, tag them, and write, test and publish CloudFront Functions that rewrite requests at the edge.
Actions
| Action | What it does |
|---|---|
| Add tags | Add tags to a distribution or other CloudFront resource. |
| Create a distribution | Put CloudFront in front of a website or other HTTP(S) origin. |
| Create a function | Create a CloudFront function from JavaScript code. |
| Create an invalidation | Remove files from CloudFront's cache so the next request fetches them fresh from the origin. |
| Delete a distribution | Permanently delete a distribution. |
| Delete a function | Permanently delete a function, both stages. |
| Get a distribution | Get one distribution: whether it is enabled, whether a change is still deploying (status InProgress) or done (Deployed), and its origins and cache settings. |
| Get a function | Get a CloudFront function's details: status, runtime, stage and its current ETag. |
| Get an invalidation | Get one invalidation and its status: InProgress, then Completed. |
| List cache policies | List cache policies: AWS's managed ones, such as CachingOptimized, and any made in this account. |
| List distributions | List the CloudFront distributions in the account, one page at a time, with their status, domain name and origins. |
| List functions | List the CloudFront Functions in the account. |
| List invalidations | List a distribution's invalidations, newest first. |
| List origin access controls | List the origin access controls in the account: the settings that let a distribution read a private S3 bucket. |
| List tags | List the tags on a distribution or other CloudFront resource. |
| Publish a function | Copy a function's development code to its live stage. |
| Remove tags | Remove tags, by name, from a distribution or other CloudFront resource. |
| Set distribution enabled | Turn a distribution on or off. |
| Test a function | Run a function against a sample request and return what it produced. |
| Update a function | Replace a function's development code. |
Add tags
Add tags to a distribution or other CloudFront resource. A tag whose name already exists is overwritten; other tags are kept.
Inputs
- Distribution or ARN
resourcetextRequired - The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.
- Tags
tagsobjectRequired - Tag names and values, such as team = web. Up to 50 tags; names up to 128 characters, values up to 256, using letters, digits, spaces and _.:/=+-@.
Outputs
resource_arntexttagsobject- The tags this step wrote.
Example output
{
"resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"tags": {
"team": "web"
}
}Create a distribution
Put CloudFront in front of a website or other HTTP(S) origin. The new distribution gets its own cloudfront.net domain and takes a few minutes to deploy.
Inputs
- Origin domain
origin_domaintextRequired - The host CloudFront fetches content from, such as www.example.com or an S3 website endpoint. A pasted URL is fine; its path becomes the origin path.
- Origin path
origin_pathtext - An optional folder on the origin to serve from, such as /production.
- Origin protocol
origin_protocol_policytext - How CloudFront connects to the origin.One of:
https-only(HTTPS only (recommended)),match-viewer(Match the viewer's protocol),http-only(HTTP only (for origins without HTTPS, such as S3 websites)). Default:https-only. - Viewer protocol
viewer_protocol_policytext - How visitors may connect to the distribution.One of:
redirect-to-https(Redirect HTTP to HTTPS),https-only(HTTPS only (HTTP is refused)),allow-all(HTTP and HTTPS). Default:redirect-to-https. - Cache policy
cache_policy_idtext - How long CloudFront caches responses. Leave empty for CachingOptimized; pick CachingDisabled for dynamic content.
- Comment
commenttext - A name to recognise the distribution by, up to 128 characters.
- Default root object
default_root_objecttext - The file to return for the bare domain, such as index.html. Leave empty to pass / to the origin.
- Enabled
enabledtrue/false - Serve traffic as soon as it is deployed. Off creates it disabled.Default:
true. - Price class
price_classtext - Which edge locations serve it.One of:
PriceClass_All(All edge locations (best performance)),PriceClass_200(North America, Europe, Asia, Middle East and Africa),PriceClass_100(North America and Europe only (lowest cost)). Default:PriceClass_All. - HTTP version
http_versiontext - The newest HTTP version visitors may use.One of:
http2(HTTP/2),http2and3(HTTP/2 and HTTP/3),http3(HTTP/3),http1.1(HTTP/1.1). Default:http2. - IPv6
ipv6_enabledtrue/false - Answer on IPv6 as well as IPv4.Default:
true. - Tags
tagsobject - Tag names and values, such as team = web. Up to 50 tags; names up to 128 characters, values up to 256, using letters, digits, spaces and _.:/=+-@.
Outputs
aliaseslist- Alternate domain names (CNAMEs).
arntextcache_policy_idtextcommenttextdefault_root_objecttextdomain_nametext- The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/falseetagtext- The current version of the distribution's config.
http_versiontextidtext- Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumberipv6_enabledtrue/falselast_modified_timetextoriginslist- Each origin's domain name.
price_classtextstatustext- InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
"aliases": [],
"arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"comment": "Marketing site",
"default_root_object": "index.html",
"domain_name": "d111111abcdef8.cloudfront.net",
"enabled": true,
"etag": "E2QWRUHEXAMPLE",
"http_version": "http2",
"id": "E2QWRUHAPOMQZL",
"in_progress_invalidation_batches": 0,
"ipv6_enabled": true,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"origins": [
"www.example.com"
],
"price_class": "PriceClass_All",
"status": "InProgress",
"viewer_protocol_policy": "redirect-to-https"
}Create a function
Create a CloudFront function from JavaScript code. It starts in the development stage; test it, then publish it to use it on a distribution.
Inputs
- Function name
function_nametextRequired - Up to 64 letters, digits, hyphens and underscores. Must be unique in the account.
- Code
codetextRequired - The function's JavaScript, with a handler(event) function that returns the request or response. Up to 40 KB.
- Runtime
runtimetext - The JavaScript runtime the function runs on.One of:
cloudfront-js-2.0(JavaScript 2.0 (recommended)),cloudfront-js-1.0(JavaScript 1.0). Default:cloudfront-js-2.0. - Comment
commenttext - An optional note about the function, up to 128 characters.
Outputs
arntextcommenttextcreated_timetextetagtextlast_modified_timetextnametextruntimetextstagetext- DEVELOPMENT or LIVE.
statustext
Example output
{
"arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
"comment": "Adds security headers",
"created_time": "2026-09-01T09:00:00+00:00",
"etag": "ETVPDKIKX0DER",
"last_modified_time": "2026-09-01T09:00:00+00:00",
"name": "add-security-headers",
"runtime": "cloudfront-js-2.0",
"stage": "DEVELOPMENT",
"status": "UNPUBLISHED"
}Create an invalidation
Remove files from CloudFront's cache so the next request fetches them fresh from the origin. The first 1,000 paths each month are free; /* counts as one path.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
- Paths
pathslistRequired - The paths to clear, each starting with /, such as /index.html. End one with * to clear everything under it, such as /images/*.
Outputs
caller_referencetextcreate_timetextdistribution_idtextidtextpathsliststatustext- InProgress, then Completed.
Example output
{
"caller_reference": "lodol-0b8d4b5e-5f8f-4c1e-9d0a-2f6c1b7e9a11",
"create_time": "2026-09-01T09:00:00+00:00",
"distribution_id": "E2QWRUHAPOMQZL",
"id": "I2J0I21PCUYOIK",
"paths": [
"/index.html",
"/images/*"
],
"status": "InProgress"
}Delete a distribution
Permanently delete a distribution. It must be disabled first and finished deploying (status Deployed), which takes a few minutes after disabling.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
Outputs
deletedtrue/falsedistribution_idtext
Example output
{
"deleted": true,
"distribution_id": "E2QWRUHAPOMQZL"
}Delete a function
Permanently delete a function, both stages. CloudFront refuses while a distribution still uses it.
Inputs
- Function
function_nametextRequired - The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
Outputs
deletedtrue/falsefunction_nametext
Example output
{
"deleted": true,
"function_name": "add-security-headers"
}Get a distribution
Get one distribution: whether it is enabled, whether a change is still deploying (status InProgress) or done (Deployed), and its origins and cache settings.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
Outputs
aliaseslist- Alternate domain names (CNAMEs).
arntextcache_policy_idtextcommenttextdefault_root_objecttextdomain_nametext- The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/falseetagtext- The current version of the distribution's config.
http_versiontextidtext- Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumberipv6_enabledtrue/falselast_modified_timetextoriginslist- Each origin's domain name.
price_classtextstatustext- InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
"aliases": [],
"arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"comment": "Marketing site",
"default_root_object": "index.html",
"domain_name": "d111111abcdef8.cloudfront.net",
"enabled": true,
"etag": "E2QWRUHEXAMPLE",
"http_version": "http2",
"id": "E2QWRUHAPOMQZL",
"in_progress_invalidation_batches": 0,
"ipv6_enabled": true,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"origins": [
"www.example.com"
],
"price_class": "PriceClass_All",
"status": "Deployed",
"viewer_protocol_policy": "redirect-to-https"
}Get a function
Get a CloudFront function's details: status, runtime, stage and its current ETag.
Inputs
- Function
function_nametextRequired - The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
- Stage
stagetext - Which copy of the function to use.One of:
DEVELOPMENT(Development (the latest saved code)),LIVE(Live (the published code distributions run)). Default:DEVELOPMENT.
Outputs
arntextcommenttextcreated_timetextetagtextlast_modified_timetextnametextruntimetextstagetext- DEVELOPMENT or LIVE.
statustext
Example output
{
"arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
"comment": "Adds security headers",
"created_time": "2026-09-01T09:00:00+00:00",
"etag": "ETVPDKIKX0DER",
"last_modified_time": "2026-09-01T09:00:00+00:00",
"name": "add-security-headers",
"runtime": "cloudfront-js-2.0",
"stage": "DEVELOPMENT",
"status": "UNPUBLISHED"
}Get an invalidation
Get one invalidation and its status: InProgress, then Completed.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
- Invalidation ID
invalidation_idtextRequired - Such as I2J0I21PCUYOIK. 'List invalidations' shows them.
Outputs
caller_referencetextcreate_timetextdistribution_idtextidtextpathsliststatustext- InProgress, then Completed.
Example output
{
"caller_reference": "lodol-0b8d4b5e-5f8f-4c1e-9d0a-2f6c1b7e9a11",
"create_time": "2026-09-01T09:00:00+00:00",
"distribution_id": "E2QWRUHAPOMQZL",
"id": "I2J0I21PCUYOIK",
"paths": [
"/index.html",
"/images/*"
],
"status": "Completed"
}List cache policies
List cache policies: AWS's managed ones, such as CachingOptimized, and any made in this account.
Inputs
- Type
policy_typetext - Whose policies to list. Leave empty for both.One of:
managed(AWS managed only),custom(This account's own only). - Marker
markertext - To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items
max_itemsnumber - How many to return in one page, from 1 to 100.From 1 to 100. Default:
100.
Outputs
cache_policieslistcountnumbernext_markertext- Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
"cache_policies": [
{
"comment": "Policy with caching enabled.",
"default_ttl": 86400,
"id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"last_modified_time": "2021-02-22T21:12:03+00:00",
"max_ttl": 31536000,
"min_ttl": 1,
"name": "Managed-CachingOptimized",
"type": "managed"
}
],
"count": 1,
"next_marker": null
}List distributions
List the CloudFront distributions in the account, one page at a time, with their status, domain name and origins.
Inputs
- Marker
markertext - To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items
max_itemsnumber - How many to return in one page, from 1 to 100.From 1 to 100. Default:
100.
Outputs
countnumberdistributionslistnext_markertext- Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
"count": 1,
"distributions": [
{
"aliases": [],
"arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"comment": "Marketing site",
"domain_name": "d111111abcdef8.cloudfront.net",
"enabled": true,
"http_version": "http2",
"id": "E2QWRUHAPOMQZL",
"ipv6_enabled": true,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"origins": [
"www.example.com"
],
"price_class": "PriceClass_All",
"status": "Deployed",
"viewer_protocol_policy": "redirect-to-https"
}
],
"next_marker": null
}List functions
List the CloudFront Functions in the account.
Inputs
- Stage
stagetext - Only functions in this stage. Leave empty for all.One of:
DEVELOPMENT(Development (the latest saved code)),LIVE(Live (the published code distributions run)). - Marker
markertext - To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items
max_itemsnumber - How many to return in one page, from 1 to 100.From 1 to 100. Default:
100.
Outputs
countnumberfunctionslistnext_markertext- Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
"count": 1,
"functions": [
{
"arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
"comment": "Adds security headers",
"created_time": "2026-09-01T09:00:00+00:00",
"etag": null,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"name": "add-security-headers",
"runtime": "cloudfront-js-2.0",
"stage": "DEVELOPMENT",
"status": "UNPUBLISHED"
}
],
"next_marker": null
}List invalidations
List a distribution's invalidations, newest first.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
- Marker
markertext - To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items
max_itemsnumber - How many to return in one page, from 1 to 100.From 1 to 100. Default:
100.
Outputs
countnumberdistribution_idtextinvalidationslistnext_markertext- Pass this as 'Marker' to fetch the next page. Null on the last page.
Example output
{
"count": 1,
"distribution_id": "E2QWRUHAPOMQZL",
"invalidations": [
{
"create_time": "2026-09-01T09:00:00+00:00",
"id": "I2J0I21PCUYOIK",
"status": "Completed"
}
],
"next_marker": null
}List origin access controls
List the origin access controls in the account: the settings that let a distribution read a private S3 bucket.
Inputs
- Marker
markertext - To fetch the next page, the 'next_marker' an earlier run of this step returned. Leave empty for the first page.
- Max items
max_itemsnumber - How many to return in one page, from 1 to 100.From 1 to 100. Default:
100.
Outputs
countnumbernext_markertext- Pass this as 'Marker' to fetch the next page. Null on the last page.
origin_access_controlslist
Example output
{
"count": 1,
"next_marker": null,
"origin_access_controls": [
{
"description": "",
"id": "E1LTIJZ0EXAMPLE",
"name": "my-bucket-oac",
"origin_type": "s3",
"signing_behavior": "always",
"signing_protocol": "sigv4"
}
]
}List tags
List the tags on a distribution or other CloudFront resource.
Inputs
- Distribution or ARN
resourcetextRequired - The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.
Outputs
resource_arntexttagsobject- Tag name to tag value.
Example output
{
"resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"tags": {
"team": "web"
}
}Publish a function
Copy a function's development code to its live stage. Distributions that use the function start running it within minutes.
Inputs
- Function
function_nametextRequired - The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
Outputs
arntextcommenttextcreated_timetextetagtextlast_modified_timetextnametextruntimetextstagetext- DEVELOPMENT or LIVE.
statustext
Example output
{
"arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
"comment": "Adds security headers",
"created_time": "2026-09-01T09:00:00+00:00",
"etag": null,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"name": "add-security-headers",
"runtime": "cloudfront-js-2.0",
"stage": "LIVE",
"status": "UNASSOCIATED"
}Remove tags
Remove tags, by name, from a distribution or other CloudFront resource. Names it does not have are ignored.
Inputs
- Distribution or ARN
resourcetextRequired - The distribution to tag: pick one or give its id. For another CloudFront resource, such as a function, give its ARN.
- Tag names
tag_keyslistRequired - The names of the tags to remove, such as team.
Outputs
removed_keyslistresource_arntext
Example output
{
"removed_keys": [
"team"
],
"resource_arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL"
}Set distribution enabled
Turn a distribution on or off. Nothing else in its settings changes. A distribution must be off, and finished deploying, before it can be deleted.
Inputs
- Distribution
distribution_idtextRequired - The distribution. Pick one, or give its id (such as E2QWRUHAPOMQZL), its ARN, or the link to its page in the CloudFront console.
- Enabled
enabledtrue/falseRequired - On to serve traffic, off to stop serving it.
Outputs
aliaseslist- Alternate domain names (CNAMEs).
arntextcache_policy_idtextchangedtrue/false- False when it was already in that state.
commenttextdefault_root_objecttextdomain_nametext- The distribution's own host name, such as d111111abcdef8.cloudfront.net.
enabledtrue/falseetagtext- The current version of the distribution's config.
http_versiontextidtext- Such as E2QWRUHAPOMQZL.
in_progress_invalidation_batchesnumberipv6_enabledtrue/falselast_modified_timetextoriginslist- Each origin's domain name.
price_classtextstatustext- InProgress while a change deploys, then Deployed.
viewer_protocol_policytext
Example output
{
"aliases": [],
"arn": "arn:aws:cloudfront::123456789012:distribution/E2QWRUHAPOMQZL",
"cache_policy_id": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"changed": true,
"comment": "Marketing site",
"default_root_object": "index.html",
"domain_name": "d111111abcdef8.cloudfront.net",
"enabled": false,
"etag": "E2QWRUHEXAMPLE",
"http_version": "http2",
"id": "E2QWRUHAPOMQZL",
"in_progress_invalidation_batches": 0,
"ipv6_enabled": true,
"last_modified_time": "2026-09-01T09:00:00+00:00",
"origins": [
"www.example.com"
],
"price_class": "PriceClass_All",
"status": "InProgress",
"viewer_protocol_policy": "redirect-to-https"
}Test a function
Run a function against a sample request and return what it produced. Fill in the method, path and headers, or paste a full test event.
Inputs
- Function
function_nametextRequired - The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
- Stage
stagetext - Which copy of the function to use.One of:
DEVELOPMENT(Development (the latest saved code)),LIVE(Live (the published code distributions run)). Default:DEVELOPMENT. - Event type
event_typetext - Which event the function handles: the request arriving, or the response going back.One of:
viewer-request(Viewer request),viewer-response(Viewer response). Default:viewer-request. - Method
http_methodtext - The sample request's method.One of:
GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS. Default:GET. - Path
uritext - The sample request's path, such as /index.html.Default:
/index.html. - Query string
querystringtext - Optional, such as lang=en&page=2.
- Headers
headersobject - Request header names and values. Host defaults to example.com.
- Full test event (JSON)
event_jsontext - Optional. A complete CloudFront Functions event object; when given, the fields above are ignored.
Outputs
compute_utilizationnumber- Share of the maximum allowed run time used, 0 to 100.
function_nametextlogslistoutputobject- The request or response the function returned.
stagetext
Example output
{
"compute_utilization": 12,
"function_name": "add-security-headers",
"logs": [],
"output": {
"request": {
"headers": {
"host": {
"value": "example.com"
}
},
"method": "GET",
"uri": "/index.html"
}
},
"stage": "DEVELOPMENT"
}Update a function
Replace a function's development code. Distributions keep running the live copy until you publish again.
Inputs
- Function
function_nametextRequired - The CloudFront function. Pick one, or give its name, ARN or the link to its page in the CloudFront console.
- Code
codetextRequired - The function's JavaScript, with a handler(event) function that returns the request or response. Up to 40 KB.
- Runtime
runtimetext - Leave empty to keep the current runtime.One of:
cloudfront-js-2.0(JavaScript 2.0 (recommended)),cloudfront-js-1.0(JavaScript 1.0). - Comment
commenttext - Leave empty to keep the current comment.
Outputs
arntextcommenttextcreated_timetextetagtextlast_modified_timetextnametextruntimetextstagetext- DEVELOPMENT or LIVE.
statustext
Example output
{
"arn": "arn:aws:cloudfront::123456789012:function/add-security-headers",
"comment": "Adds security headers",
"created_time": "2026-09-01T09:00:00+00:00",
"etag": "ETVPDKIKX0DER",
"last_modified_time": "2026-09-01T09:00:00+00:00",
"name": "add-security-headers",
"runtime": "cloudfront-js-2.0",
"stage": "DEVELOPMENT",
"status": "UNPUBLISHED"
}