AWS AmazonCloudFront documentation change
Summary
Added domain ownership verification requirements for distribution tenants
Security assessment
Documentation now explicitly states domain verification requirements when using certificates not covering entered domains, which is a security best practice but not a response to a specific vulnerability.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.md b/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.md index 3d03d8d93..e49c6ad14 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.md +++ b//AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.md @@ -11 +11 @@ This topic explains how to use the CloudFront console to create a distribution. -###### Overview of creating a distribution +###### Overview @@ -29 +29 @@ You are responsible for ensuring the security of your origin server. You must en - * For a detailed procedure that creates a distribution in the CloudFront console, see Create a distribution. + * For a detailed procedure that creates a distribution in the CloudFront console, see Create a CloudFront distribution in the console. @@ -33 +33 @@ You are responsible for ensuring the security of your origin server. You must en - 4. (Optional) If you use the CloudFront console to create your distribution, create more cache behaviors or origins for the distribution. For more information about behaviors and origins, see [To update a CloudFront distribution](./HowToUpdateDistribution.html#HowToUpdateDistributionProcedure). + 4. (Optional) If you use the CloudFront console to create your distribution, create more cache behaviors or origins for the distribution. For more information about behaviors and origins, see [To update a multi-tenant distribution](./HowToUpdateDistribution.html#HowToUpdateDistributionProcedure). @@ -65 +65,131 @@ Note the following: -###### To create a distribution (console) +You can create CloudFront multi-tenant distributions with settings that can be reused across multiple distribution tenants. With a multi-tenant distribution, you can have CloudFront configure your distribution settings for you, based on your content origin type. For more details about the preconfigured settings, see [CloudFront multi-tenant distribution reference](./template-preconfigured-origin-settings.html). You can also create distributions with settings that can be reused across multiple distribution tenants. For more information, see [Understand how multi-tenant distributions work](./distribution-config-options.html). Alternatively, you can use a standard distribution and manually configure your own distribution settings. + +Multi-tenant + + +###### To create a multi-tenant distribution + + 1. Sign in to the AWS Management Console and open the CloudFront console at [https://console.aws.amazon.com/cloudfront/v4/home](https://console.aws.amazon.com/cloudfront/v4/home). + + 2. In the navigation pane, choose **Distributions** , then choose **Create distribution**. + + 3. Choose **Multi-tenant architecture** , **Next**. + + 4. Enter a **Distribution name** for the multi-tenant distribution. The name will appear as the value for the `Name` key. You can change this value later. You can add up to 50 tags for your multi-tenant distribution. For more information, see [Tag a distribution](./tagging.html) . + + 5. (Optional) For **Wildcard certificate** , choose the AWS Certificate Manager (ACM) certificate that will cover all subdomains under the root domain, such as `*.example.com`. The certificate must be in the US East (N. Virginia) Region. + + 6. Choose **Next**. + + 7. On the **Specify origin** page, select the origin type that CloudFront will get your content from. CloudFront will use the recommended settings for that origin type for your multi-tenant distribution. For more information about the recommended settings, see [CloudFront multi-tenant distribution reference](./template-preconfigured-origin-settings.html). + + 8. For **Origin** , under the origin type that you selected, choose or enter the origin to use. + + 9. For **Origin path** , enter the forward slash (`/`) character, followed by the origin path. + + 10. (Optional) To add a parameter, choose **Insert parameter** for either the origin domain name or origin path. You can enter up to two parameters for each field. + + 1. Choose **Create new parameter**. + + 2. On the **Create new parameter** dialog box, for **Parameter name** , enter a unique name for the parameter and, optionally, a description. + + 3. For **Required parameter** , select the checkbox to make this parameter value required at the distribution tenant level. If it's not required, enter a **Default value** that the distribution tenant will inherit. + + 4. Choose **Create parameter**. This parameter appears in the corresponding field. + + 11. For **Options** , choose one of the following options: + + * **Use recommended origin settings** – Use the default recommended cache and origin settings for the origin type that you selected. + + * **Customize origin settings** – Customize the cache and origin settings. If you choose this option, specify your own values that appear. + + 12. Choose **Next**. + + 13. On the **Enable security protections** page, choose whether to enable AWS WAF security protections. You can customize the web ACL for specific distribution tenants later. For more information, see [Enable AWS WAF for a new distribution](./WAF-one-click.html#enable-waf-new-distribution). + + 14. Choose **Next** , **Create distribution**. + + 15. On the **Distributions** page, your multi-tenant distribution appears in the list of resources. You can choose the **All distributions** dropdown to filter by standard distribution or multi-tenant distribution. You can also choose the **Type** column to filter by standard or multi-tenant distribution. + + + + +By default, CloudFront creates a connection group for you. The connection group controls how viewer requests for content connect to CloudFront. You can customize some routing settings in the connection group. For more information, see [Understand how multi-tenant distributions work](./distribution-config-options.html). + +You can create additional distribution tenants using the multi-tenant distribution as a template. + +###### To create a distribution tenant + + 1. Sign in to the AWS Management Console and open the CloudFront console at [https://console.aws.amazon.com/cloudfront/v4/home](https://console.aws.amazon.com/cloudfront/v4/home). + + 2. In the navigation pane, do one of the following: + + * Choose **Distributions** , choose a multi-tenant distribution, and then choose **Create tenant**. + + * Choose **Distribution tenants** and then choose **Create tenant**. + + 3. For **Distribution tenant name** , enter the name. The name must be unique in your AWS account and can't be changed after you create it. + + 4. For **Template distribution** , choose a multi-tenant distribution ID from the list. + + 5. For **Manage tags** , add up to 50 key-value pairs for the distribution tenant. For more information, see [Tag a distribution](./tagging.html). **** + + 6. Choose **Next**. + + 7. On the **Add domains** page, for **Certificate** , choose if you want a **Custom TLS certificate** for your distribution tenant. The certificate verifies whether you're authorized to use the domain name. The certificate must exist in the US East (N. Virginia) Region. + + 8. For **Domains** , enter your domain name. You can add up to 5 domains per distribution tenant. + +###### Note + +If you entered a domain name that isn't covered by a certificate, you will need to verify that you own the domain. You can still create the distribution tenant for now and verify domain ownership later. For more information, see [Request certificates for your CloudFront distribution tenant](./managed-cloudfront-certificates.html). + + 9. Choose **Next**. + + 10. On the **Define parameters** page, the parameters that you specified in the multi-tenant distribution appear. For required parameters, enter a value next to the parameter name and save your changes. + + 11. To add another parameter, choose **Add parameter** and enter a name and value. + + 12. Choose **Next**. + + 13. (Optional) For **Security customization** , if you choose to **Override distribution settings** , select the option for your use case. + + 14. (Optional) For **Geographic restrictions customization** , if you choose to **Override distribution settings** , select the appropriate **Restriction type** and **Countries** for the distribution tenant. For more information, see [Restrict the geographic distribution of your content](./georestrictions.html). + + 15. Choose **Next**. + + 16. Choose **Create distribution tenant**. + + + + +You can find all your distribution tenants on the **Distribution tenants** page. You can filter by the following: + +###### Association + + * Distribution ID + + * Certificate ID + + * Connection group ID + + * Web ACL ID + + + + +###### Properties + + * Name + + * Domain + + + + +You can edit your distribution tenants to customize specific settings. For more information, see [Distribution tenant customizations](./tenant-customization.html). + +Standard + + +###### To create a standard distribution @@ -126 +256 @@ For more information about creating a distribution, see the following links. - * For information about updating a distribution (for example, to add or change cache behaviors), see [Update a distribution](./HowToUpdateDistribution.html). + * For information about updating a distribution (for example, to add cache behaviors to standard distributions, or to customize distribution tenants), see [Update a distribution](./HowToUpdateDistribution.html). @@ -139 +269 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configure distributions +Create custom connection group (optional)