AWS AmazonCloudFront documentation change
Summary
Added documentation for selectRequestOriginById() and createRequestOriginGroup() methods to support origin selection and origin group creation for failover scenarios
Security assessment
The changes introduce new methods for origin management and failover configuration. While VPC origins are mentioned, this refers to existing security capabilities rather than addressing vulnerabilities or adding new security features.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md b/AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md index c57c478f2..13722f316 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md +++ b//AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md @@ -5 +5 @@ -Choose between CloudFront Functions and Lambda@EdgeupdateRequestOrigin() method +Choose between CloudFront Functions and Lambda@EdgeupdateRequestOrigin() methodselectRequestOriginById() methodcreateRequestOriginGroup() method @@ -283,0 +284,80 @@ In the following example, the origin in the distribution has Origin Shield enabl +## selectRequestOriginById() method + +Use `selectRequestOriginById()` to update an existing origin by selecting a different origin that's already configured in your distribution. This method uses all the same settings that are defined by the updated origin. + +This method only accepts origins that are already defined in the same distribution used when running the function. Origins are referenced by the origin ID, which is the origin name that you defined when setting up the origin. + +If you have a VPC origin configured in your distribution, you can use this method to update your origin to your VPC origin. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). + +**Request** + + + selectRequestOriginById(origin_id) + +In the preceding example, `origin_id` is a string that points to the origin name of an origin in the distribution that's running the function. + +###### Example – Select Amazon S3 request origin + +The following example selects the origin named `amzn-s3-demo-bucket-in-us-east-1` from the list of origins associated with the distribution, and applies the configuration settings of the `amzn-s3-demo-bucket-in-us-east-1` origin to the request. + + + cf.selectRequestOriginById("amzn-s3-demo-bucket-in-us-east-1"); + +###### Example – Select Application Load Balancer request origin + +The following example selects an Application Load Balancer origin named `myALB-prod` from the list of origins associated with the distribution, and applies the configuration settings of `myALB-prod` to the request. + + + cf.selectRequestOriginById("myALB-prod"); + +## createRequestOriginGroup() method + +Use `createRequestOriginGroup()` to define two origins to use as an [origin group](./high_availability_origin_failover.html#concept_origin_groups.creating) for failover in scenarios that require high availability. + +An origin group includes two origins (a primary and a secondary) and a failover criteria that you specify. You create an origin group to support origin failover in CloudFront. When you create or update an origin group using this method, you can specify the origin group instead of a single origin. CloudFront will failover from the primary origin to the secondary origin, using the failover criteria. + +If you have a VPC origin configured in your distribution, you can use this method to create an origin group using a VPC origin. For more information, see [Restrict access with VPC origins](./private-content-vpc-origins.html). + +### Request + + + createRequestOriginGroup({origin_group_properties}) + +In the preceding example, the `origin_group_properties` can contain the following: + +**originIds (required)** + + +Array of `origin_ids`, where the `origin_id` is a string that points to the origin name of an origin in the distribution running the function. You must provide two origins as part of the array. The first origin in the list is the primary origin and the second serves as the second origin for failover purposes. + +**selectionCriteria (optional)** + + +Select whether to use the `default` origin failover criteria or to use the `media-quality-score` based failover logic. Valid values are as follows: + + * `default` uses the failover criteria, based on the status codes that are specified in the `failoverCriteria`. If you don't set `selectionCriteria` in the function, `default` will be used. + + * `media-quality-score` is used when the media aware routing capability is being used. + + + + +**failoverCriteria (required)** + + +An array of status codes that, when returned from the primary origin, will trigger CloudFront to failover to the secondary origin. If you overwrite an existing origin group, this array will overwrite all failover status codes that are set in the origin group's original configuration. + +When you use `media-quality-score` `selectionCriteria`, CloudFront will attempt to route requests based on the media quality score. If the selected origin returns an error code set in this array, CloudFront will failover to the other origin. + +###### Example – Create request origin group + +The following example creates an origin group for a request using the origin IDs. These origin IDs come from the origin group configuration for the distribution used to run this function. + + + cf.createRequestOriginGroup({ + originIds: ["us-east-1-s3-origin", "us-west-2-s3-origin"], + failoverCriteria: { + statusCodes: [500, 502, 503, 504] + } + }); +