2024/04/11 - Amazon CloudFront - 5 updated api methods
Changes CloudFront origin access control extends support to AWS Lambda function URLs and AWS Elemental MediaPackage v2 origins.
{'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}
Response {'OriginAccessControl': {'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}}
Creates a new origin access control in CloudFront. After you create an origin access control, you can add it to an origin in a CloudFront distribution so that CloudFront sends authenticated (signed) requests to the origin.
This makes it possible to block public access to the origin, allowing viewers (users) to access the origin's content only through CloudFront.
For more information about using a CloudFront origin access control, see Restricting access to an Amazon Web Services origin in the Amazon CloudFront Developer Guide.
See also: AWS API Documentation
Request Syntax
client.create_origin_access_control(
OriginAccessControlConfig={
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
}
)
dict
[REQUIRED]
Contains the origin access control.
Name (string) -- [REQUIRED]
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) -- [REQUIRED]
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) -- [REQUIRED]
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) -- [REQUIRED]
The type of origin that this origin access control is for.
dict
Response Syntax
{
'OriginAccessControl': {
'Id': 'string',
'OriginAccessControlConfig': {
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
}
},
'Location': 'string',
'ETag': 'string'
}
Response Structure
(dict) --
OriginAccessControl (dict) --
Contains an origin access control.
Id (string) --
The unique identifier of the origin access control.
OriginAccessControlConfig (dict) --
The origin access control.
Name (string) --
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) --
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) --
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) --
The type of origin that this origin access control is for.
Location (string) --
The URL of the origin access control.
ETag (string) --
The version identifier for the current version of the origin access control.
{'OriginAccessControl': {'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}}
Gets a CloudFront origin access control, including its unique identifier.
See also: AWS API Documentation
Request Syntax
client.get_origin_access_control(
Id='string'
)
string
[REQUIRED]
The unique identifier of the origin access control.
dict
Response Syntax
{
'OriginAccessControl': {
'Id': 'string',
'OriginAccessControlConfig': {
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
}
},
'ETag': 'string'
}
Response Structure
(dict) --
OriginAccessControl (dict) --
Contains an origin access control, including its unique identifier.
Id (string) --
The unique identifier of the origin access control.
OriginAccessControlConfig (dict) --
The origin access control.
Name (string) --
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) --
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) --
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) --
The type of origin that this origin access control is for.
ETag (string) --
The version identifier for the current version of the origin access control.
{'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}
Gets a CloudFront origin access control configuration.
See also: AWS API Documentation
Request Syntax
client.get_origin_access_control_config(
Id='string'
)
string
[REQUIRED]
The unique identifier of the origin access control.
dict
Response Syntax
{
'OriginAccessControlConfig': {
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
},
'ETag': 'string'
}
Response Structure
(dict) --
OriginAccessControlConfig (dict) --
Contains an origin access control configuration.
Name (string) --
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) --
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) --
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) --
The type of origin that this origin access control is for.
ETag (string) --
The version identifier for the current version of the origin access control.
{'OriginAccessControlList': {'Items': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}}
Gets the list of CloudFront origin access controls in this Amazon Web Services account.
You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send another request that specifies the NextMarker value from the current response as the Marker value in the next request.
See also: AWS API Documentation
Request Syntax
client.list_origin_access_controls(
Marker='string',
MaxItems='string'
)
string
Use this field when paginating results to indicate where to begin in your list of origin access controls. The response includes the items in the list that occur after the marker. To get the next page of the list, set this field's value to the value of NextMarker from the current page's response.
string
The maximum number of origin access controls that you want in the response.
dict
Response Syntax
{
'OriginAccessControlList': {
'Marker': 'string',
'NextMarker': 'string',
'MaxItems': 123,
'IsTruncated': True|False,
'Quantity': 123,
'Items': [
{
'Id': 'string',
'Description': 'string',
'Name': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
},
]
}
}
Response Structure
(dict) --
OriginAccessControlList (dict) --
A list of origin access controls.
Marker (string) --
The value of the Marker field that was provided in the request.
NextMarker (string) --
If there are more items in the list than are in this response, this element is present. It contains the value to use in the Marker field of another request to continue listing origin access controls.
MaxItems (integer) --
The maximum number of origin access controls requested.
IsTruncated (boolean) --
If there are more items in the list than are in this response, this value is true.
Quantity (integer) --
The number of origin access controls returned in the response.
Items (list) --
Contains the origin access controls in the list.
(dict) --
A CloudFront origin access control.
Id (string) --
The unique identifier of the origin access control.
Description (string) --
A description of the origin access control.
Name (string) --
A unique name that identifies the origin access control.
SigningProtocol (string) --
The signing protocol of the origin access control. The signing protocol determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) --
A value that specifies which requests CloudFront signs (adds authentication information to). This field can have one of the following values:
never – CloudFront doesn't sign any origin requests.
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if necessary.
no-override – If the viewer request doesn't contain the Authorization header, CloudFront signs the origin request. If the viewer request contains the Authorization header, CloudFront doesn't sign the origin request, but instead passes along the Authorization header that it received in the viewer request.
OriginAccessControlOriginType (string) --
The type of origin that this origin access control is for.
{'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}
Response {'OriginAccessControl': {'OriginAccessControlConfig': {'OriginAccessControlOriginType': {'lambda',
'mediapackagev2'}}}}
Updates a CloudFront origin access control.
See also: AWS API Documentation
Request Syntax
client.update_origin_access_control(
OriginAccessControlConfig={
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
},
Id='string',
IfMatch='string'
)
dict
[REQUIRED]
An origin access control.
Name (string) -- [REQUIRED]
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) -- [REQUIRED]
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) -- [REQUIRED]
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) -- [REQUIRED]
The type of origin that this origin access control is for.
string
[REQUIRED]
The unique identifier of the origin access control that you are updating.
string
The current version ( ETag value) of the origin access control that you are updating.
dict
Response Syntax
{
'OriginAccessControl': {
'Id': 'string',
'OriginAccessControlConfig': {
'Name': 'string',
'Description': 'string',
'SigningProtocol': 'sigv4',
'SigningBehavior': 'never'|'always'|'no-override',
'OriginAccessControlOriginType': 's3'|'mediastore'|'mediapackagev2'|'lambda'
}
},
'ETag': 'string'
}
Response Structure
(dict) --
OriginAccessControl (dict) --
The origin access control after it has been updated.
Id (string) --
The unique identifier of the origin access control.
OriginAccessControlConfig (dict) --
The origin access control.
Name (string) --
A name to identify the origin access control. You can specify up to 64 characters.
Description (string) --
A description of the origin access control.
SigningProtocol (string) --
The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is sigv4.
SigningBehavior (string) --
Specifies which requests CloudFront signs (adds authentication information to). Specify always for the most common use case. For more information, see origin access control advanced settings in the Amazon CloudFront Developer Guide.
This field can have one of the following values:
always – CloudFront signs all origin requests, overwriting the Authorization header from the viewer request if one exists.
never – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
no-override – If the viewer request doesn't contain the Authorization header, then CloudFront signs the origin request. If the viewer request contains the Authorization header, then CloudFront doesn't sign the origin request and instead passes along the Authorization header from the viewer request. WARNING: To pass along the Authorization header from the viewer request, you must add the Authorization header to a cache policy for all cache behaviors that use origins associated with this origin access control.
OriginAccessControlOriginType (string) --
The type of origin that this origin access control is for.
ETag (string) --
The new version of the origin access control after it has been updated.