AWS cli documentation change
Summary
Added code example for create-connection-group command with Anycast IP list configuration
Security assessment
Network configuration example without explicit security context or protections
Diff
diff --git a/cli/v1/userguide/cli_cloudfront_code_examples.md b/cli/v1/userguide/cli_cloudfront_code_examples.md index 2a6cdac0c..4c8da3f98 100644 --- a//cli/v1/userguide/cli_cloudfront_code_examples.md +++ b//cli/v1/userguide/cli_cloudfront_code_examples.md @@ -25,0 +26,64 @@ Each example includes a link to the complete source code, where you can find ins +The following code example shows how to use `associate-distribution-tenant-web-acl`. + +**AWS CLI** + + +**To associate a web ACL with a CloudFront distribution tenant** + +The following `associate-distribution-tenant-web-acl` example associates a web ACL with a CloudFront distribution with ETag `E13V1IB3VIYABC`. + + + aws cloudfront associate-distribution-tenant-web-acl \ + --id dt_2wjDZi3hD1ivOXf6rpZJO1AB \ + --if-match E13V1IB3VIYABC \ + --web-acl-arn arn:aws:wafv2:us-east-1:123456789012:global/webacl/web-global-example/626900da-5f64-418b-ba9b-743f37123ABC + + +Output: + + + { + "ETag": "E1VC38T7YXBABC", + "Id": "dt_2wjDZi3hD1ivOXf6rpZJO1AB", + "WebACLArn": "arn:aws:wafv2:us-east-1:123456789012:global/webacl/web-global-example/626900da-5f64-418b-ba9b-743f37123ABC" + } + +For more information, see [Use AWS WAF protections](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html) in the _Amazon CloudFront Developer Guide_. + + * For API details, see [AssociateDistributionTenantWebAcl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudfront/associate-distribution-tenant-web-acl.html) in _AWS CLI Command Reference_. + + + + +The following code example shows how to use `associate-distribution-web-acl`. + +**AWS CLI** + + +**To associate a web ACL with a CloudFront distribution** + +The following `associate-distribution-web-acl` example associates a web ACL with a CloudFront distribution. + + + aws cloudfront associate-distribution-web-acl \ + --id E1XNX8R2GOAABC \ + --if-match E2YWS1C2J3OABC \ + --web-acl-arn arn:aws:wafv2:us-east-1:123456789012:global/webacl/web-global-example/626900da-5f64-418b-ba9b-743f3746cABC + + +Output: + + + { + "ETag": "E3QE7ED60U0ABC", + "Id": "E1XNX8R2GOAABC", + "WebACLArn": "arn:aws:wafv2:us-east-1:123456789012:global/webacl/web-global-example/626900da-5f64-418b-ba9b-743f3746cABC" + } + +For more information, see [Use AWS WAF protections](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html) in the _Amazon CloudFront Developer Guide_. + + * For API details, see [AssociateDistributionWebAcl](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudfront/associate-distribution-web-acl.html) in _AWS CLI Command Reference_. + + + + @@ -76,0 +141,167 @@ Whether you provide the OAI configuration with a command line argument or a JSON +The following code example shows how to use `create-connection-group`. + +**AWS CLI** + + +**To create a connection group in CloudFront** + +The following `create-connection-group` example creates an enabled connection group, specifies an Anycast static IP list, and disables IPv6. + + + aws cloudfront create-connection-group \ + --name cg-with-anycast-ip-list \ + --no-ipv6-enabled \ + --enabled \ + --anycast-ip-list-id aip_CCkW6gKrDiBD4n78123ABC \ + --tags "Items=[{Key=abc,Value=123}]" + + +Output: + + + { + "ETag": "E23ZP02F085ABC", + "ConnectionGroup": { + "Id": "cg_2yb6uj74B4PCbfhT31WFdiSABC", + "Name": "cg-with-anycast-ip-list", + "Arn": "arn:aws:cloudfront::123456789012:connection-group/cg_2yb6uj74B4PCbfhT31WFdiSABC", + "CreatedTime": "2025-06-16T16:25:50.061000+00:00", + "LastModifiedTime": "2025-06-16T16:25:50.061000+00:00", + "Tags": { + "Items": [ + { + "Key": "abc", + "Value": "123" + } + ] + }, + "Ipv6Enabled": false, + "RoutingEndpoint": "dj6xusxq65abc.cloudfront.net", + "AnycastIpListId": "aip_CCkW6gKrDiBD4n78123ABC", + "Status": "InProgress", + "Enabled": true, + "IsDefault": false + } + } + +For more information, see [Create custom connection group (optional)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-connection-group.html) in the _Amazon CloudFront Developer Guide_. + + * For API details, see [CreateConnectionGroup](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudfront/create-connection-group.html) in _AWS CLI Command Reference_. + + + + +The following code example shows how to use `create-distribution-tenant`. + +**AWS CLI** + + +**To create a CloudFront distribution tenant** + +The following `create-distribution-tenant` example creates a CloudFront distribution tenant that specifies customizations to disable WAF, add geo-restrictions, and use another certificate. + + + aws cloudfront create-distribution-tenant \ + --cli-input-json file://tenant.json + + +Contents of `tenant.json`: + + + { + "DistributionId": "E1XNX8R2GOAABC", + "Domains": [ + { + "Domain": "example.com" + } + ], + "Parameters": [ + { + "Name": "testParam", + "Value": "defaultValue" + } + ], + "ConnectionGroupId": "cg_2whCJoXMYCjHcxaLGrkllvyABC", + "Enabled": false, + "Tags": { + "Items": [ + { + "Key": "tag", + "Value": "tagValue" + } + ] + }, + "Name": "new-tenant-customizations", + "Customizations": { + "GeoRestrictions": { + "Locations": ["DE"], + "RestrictionType": "whitelist" + }, + "WebAcl": { + "Action": "disable" + }, + "Certificate": { + "Arn": "arn:aws:acm:us-east-1:123456789012:certificate/ec53f564-ea5a-4e4a-a0a2-e3c989449abc" + } + } + } + +Output: + + + { + "ETag": "E23ZP02F085ABC", + "DistributionTenant": { + "Id": "dt_2yN5tYwVbPKr7m2IB69M1yp1AB", + "DistributionId": "E1XNX8R2GOAABC", + "Name": "new-tenant-customizations", + "Arn": "arn:aws:cloudfront::123456789012:distribution-tenant/dt_2yN5tYwVbPKr7m2IB69M1yp1AB", + "Domains": [ + { + "Domain": "example.com", + "Status": "active" + } + ], + "Tags": { + "Items": [ + { + "Key": "tag", + "Value": "tagValue" + }