AWS cli documentation change
Summary
Added multiple examples for creating CloudFront distribution tenants with different certificate configurations (custom, inherited, CloudFront-hosted validation, self-hosted validation). Updated CLI version reference from 2.27.63 to 2.28.0.
Security assessment
The changes add documentation about TLS certificate management and domain validation processes, which are security-related features. However, there is no evidence this addresses a specific security vulnerability - rather it expands documentation for existing security controls.
Diff
diff --git a/cli/latest/reference/cloudfront/create-distribution-tenant.md b/cli/latest/reference/cloudfront/create-distribution-tenant.md index 68ee5973f..c3ee2cc51 100644 --- a//cli/latest/reference/cloudfront/create-distribution-tenant.md +++ b//cli/latest/reference/cloudfront/create-distribution-tenant.md @@ -15 +15 @@ - * [AWS CLI 2.27.63 Command Reference](../../index.html) » + * [AWS CLI 2.28.0 Command Reference](../../index.html) » @@ -434 +434 @@ Unless otherwise stated, all examples have unix-like quotation rules. These exam -**To create a CloudFront distribution tenant** +**Example 1: To create a CloudFront distribution tenant that uses a custom certificate** @@ -436 +436 @@ Unless otherwise stated, all examples have unix-like quotation rules. These exam -The following `create-distribution-tenant` example creates a CloudFront distribution tenant that specifies customizations to disable WAF, add geo-restrictions, and use another certificate. +The following `create-distribution-tenant` example creates a CloudFront distribution tenant that specifies customizations to disable WAF, add geo-restrictions, and uses another TLS certificate. @@ -538 +538,195 @@ Output: -For more information, see [Create a distribution](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-creating-console.html) in the _Amazon CloudFront Developer Guide_. +**Example 2: To create a distribution tenant with an inherited certificate** + +The following `create-distribution-tenant` example creates a distribution tenant and specifies an inherited TLS certificate from the multi-tenant distribution. + + + aws cloudfront create-distribution-tenant \ + --cli-input-json file://tenant.json + + +Contents of `tenant.json`: + + + { + "DistributionId": "E1HVIAU7U12ABC", + "Domains": [ + { + "Domain": "example.com" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "Enabled": true, + "Name": "new-tenant-no-cert" + } + + +Output: + + + { + "ETag": "E23ZP02F0ABC", + "DistributionTenant": { + "Id": "dt_2zhRB0vBe0B72LZCVy1mgzI1AB", + "DistributionId": "E1HVIAU7U12ABC", + "Name": "new-tenant-no-cert", + "Arn": "arn:aws:cloudfront::123456789012:distribution-tenant/dt_2zhRB0vBe0B72LZCVy1mgzI1AB", + "Domains": [ + { + "Domain": "example.com", + "Status": "active" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "ConnectionGroupId": "cg_2yQEwpipGFN0hhA0ZemPabOABC", + "CreatedTime": "2025-07-10T20:59:38.414000+00:00", + "LastModifiedTime": "2025-07-10T20:59:38.414000+00:00", + "Enabled": true, + "Status": "InProgress" + } + } + + +**Example 3: To create a CloudFront distribution tenant using a CloudFront-hosted validation token** + +The following `create-distribution-tenant` example creates a distribution tenant and uses a CloudFront-hosted validation token for your domain name. + + + aws cloudfront create-distribution-tenant \ + --cli-input-json file://tenant.json + + +Contents of `tenant.json`: + + + { + "DistributionId": "E2GJ5J9QN12ABC", + "Domains": [ + { + "Domain": "example.com" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "ConnectionGroupId": "cg_2yQEwpipGFN0hhA0ZemPabOABC", + "Enabled": true, + "Name": "new-tenant-cf-hosted", + "ManagedCertificateRequest": { + "ValidationTokenHost": "cloudfront" + } + } + + +**Important:** To successfully run this command, you must configure a CNAME DNS record that points your new domain (example.com) to the routing endpoint of the connection group that is associated with the distribution tenant. This CNAME record must also be propagated before CloudFront can successfully complete this request. + +Output: + + + { + "ETag": "E23ZP02F0ABC", + "DistributionTenant": { + "Id": "dt_2zhStKrA524GvvTWJX92Ozl1AB", + "DistributionId": "E2GJ5J9QN12ABC", + "Name": "new-tenant-cf-hosted", + "Arn": "arn:aws:cloudfront::123456789012:distribution-tenant/dt_2zhStKrA524GvvTWJX92Ozl1AB", + "Domains": [ + { + "Domain": "example.com", + "Status": "inactive" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "ConnectionGroupId": "cg_2zhSaGatwwXjTjE42nneZzqABC", + "CreatedTime": "2025-07-10T21:13:46.416000+00:00", + "LastModifiedTime": "2025-07-10T21:13:46.416000+00:00", + "Enabled": true, + "Status": "InProgress" + } + } + + +**Example 4: To create a CloudFront distribution tenant using a self-hosted validation token** + +The following `create-distribution-tenant` example creates a CloudFront distribution tenant and uses a self-hosted validation token. + + + aws cloudfront create-distribution-tenant \ + --cli-input-json file://tenant.json + + +Contents of `tenant.json`: + + + { + "DistributionId": "E2GJ5J9QN12ABC", + "Domains": [ + { + "Domain": "example.com" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "Enabled": true, + "Name": "new-tenant-self-hosted", + "ManagedCertificateRequest": { + "ValidationTokenHost": "self-hosted" + } + } + + +Output: + + + { + "ETag": "E23ZP02F0ABC", + "DistributionTenant": { + "Id": "dt_2zhTFBV93OfFJJ3YMdNM5BC1AB", + "DistributionId": "E2GJ5J9QN12ABC", + "Name": "new-tenant-self-hosted", + "Arn": "arn:aws:cloudfront::123456789012:distribution-tenant/dt_2zhTFBV93OfFJJ3YMdNM5BC1AB", + "Domains": [ + { + "Domain": "example.com", + "Status": "inactive" + } + ], + "Parameters": [ + { + "Name": "tenantName", + "Value": "first-tenant" + } + ], + "ConnectionGroupId": "cg_2yQEwpipGFN0hhA0ZemPabOABC", + "CreatedTime": "2025-07-10T21:16:39.828000+00:00",