AWS cli documentation change
Summary
Added two new examples (3 and 4) demonstrating CloudFront multi-tenant distribution configurations with and without TLS certificates. Updated CLI version references from 2.27.63 to 2.28.0.
Security assessment
The changes add documentation for security-related configurations (TLS certificate usage with 'sni-only' SSL method and TLSv1.2_2021 minimum protocol) in Example 3, but there's no evidence of addressing a specific security vulnerability. Example 4 shows a less secure configuration without certificates but documents standard functionality rather than fixing an issue.
Diff
diff --git a/cli/latest/reference/cloudfront/create-distribution.md b/cli/latest/reference/cloudfront/create-distribution.md index 85c23b8d8..51e25aa98 100644 --- a//cli/latest/reference/cloudfront/create-distribution.md +++ b//cli/latest/reference/cloudfront/create-distribution.md @@ -15 +15 @@ - * [AWS CLI 2.27.63 Command Reference](../../index.html) » + * [AWS CLI 2.28.0 Command Reference](../../index.html) » @@ -1939 +1939 @@ Unless otherwise stated, all examples have unix-like quotation rules. These exam -The following example creates a distribution for an S3 bucket named `amzn-s3-demo-bucket`, and also specifies `index.html` as the default root object, using command line arguments. +The following `create-distribution` example creates a distribution for an S3 bucket named `amzn-s3-demo-bucket`, and also specifies `index.html` as the default root object, using command line arguments. @@ -2068 +2068 @@ Output: -The following example creates a distribution for an S3 bucket named `amzn-s3-demo-bucket`, and also specifies `index.html` as the default root object, using a JSON file. +The following `create-distribution` example creates a distribution for an S3 bucket named `amzn-s3-demo-bucket`, and also specifies `index.html` as the default root object, using a JSON file. @@ -2179,0 +2180,402 @@ See Example 1 for sample output. +**Example 3: To create a CloudFront multi-tenant distribution with a certificate** + +The following `create-distribution` example creates a CloudFront distribution with multi-tenant support and a specifies a TLS certificate. + + + aws cloudfront create-distribution \ + --distribution-config file://dist-config.json + + +Contents of `dist-config.json`: + + + { + "CallerReference": "cli-example-with-cert", + "Comment": "CLI example distribution", + "DefaultRootObject": "index.html", + "Origins": { + "Quantity": 1, + "Items": [ + { + "Id": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "DomainName": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "OriginPath": "/{{tenantName}}", + "CustomHeaders": { + "Quantity": 0 + }, + "S3OriginConfig": { + "OriginAccessIdentity": "" + } + } + ] + }, + "DefaultCacheBehavior": { + "TargetOriginId": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e5ABC", + "ViewerProtocolPolicy": "allow-all", + "AllowedMethods": { + "Quantity": 2, + "Items": ["HEAD", "GET"], + "CachedMethods": { + "Quantity": 2, + "Items": ["HEAD", "GET"] + } + } + }, + "Enabled": true, + "ViewerCertificate": { + "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/191306a1-db01-49ca-90ef-fc414ee5dabc", + "SSLSupportMethod": "sni-only" + }, + "HttpVersion": "http2", + "ConnectionMode": "tenant-only", + "TenantConfig": { + "ParameterDefinitions": [ + { + "Name": "tenantName", + "Definition": { + "StringSchema": { + "Comment": "tenantName parameter", + "DefaultValue": "root", + "Required": false + } + } + } + ] + } + } + + +Output: + + + { + "Location": "https://cloudfront.amazonaws.com/2020-05-31/distribution/E1HVIAU7UABC", + "ETag": "E20LT7R1BABC", + "Distribution": { + "Id": "E1HVIAU7U12ABC", + "ARN": "arn:aws:cloudfront::123456789012:distribution/E1HVIAU7U12ABC", + "Status": "InProgress", + "LastModifiedTime": "2025-07-10T20:33:31.117000+00:00", + "InProgressInvalidationBatches": 0, + "DomainName": "example.com", + "ActiveTrustedSigners": { + "Enabled": false, + "Quantity": 0 + }, + "ActiveTrustedKeyGroups": { + "Enabled": false, + "Quantity": 0 + }, + "DistributionConfig": { + "CallerReference": "cli-example-with-cert", + "DefaultRootObject": "index.html", + "Origins": { + "Quantity": 1, + "Items": [ + { + "Id": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "DomainName": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "OriginPath": "/{{tenantName}}", + "CustomHeaders": { + "Quantity": 0 + }, + "S3OriginConfig": { + "OriginAccessIdentity": "" + }, + "ConnectionAttempts": 3, + "ConnectionTimeout": 10, + "OriginShield": { + "Enabled": false + }, + "OriginAccessControlId": "" + } + ] + }, + "OriginGroups": { + "Quantity": 0 + }, + "DefaultCacheBehavior": { + "TargetOriginId": "amzn-s3-demo-bucket.s3.us-east-1.amazonaws.com", + "TrustedKeyGroups": { + "Enabled": false, + "Quantity": 0 + }, + "ViewerProtocolPolicy": "allow-all", + "AllowedMethods": { + "Quantity": 2, + "Items": ["HEAD", "GET"], + "CachedMethods": { + "Quantity": 2, + "Items": ["HEAD", "GET"] + } + }, + "Compress": false, + "LambdaFunctionAssociations": { + "Quantity": 0 + }, + "FunctionAssociations": { + "Quantity": 0 + }, + "FieldLevelEncryptionId": "", + "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e5ABC", + "GrpcConfig": { + "Enabled": false + } + }, + "CacheBehaviors": { + "Quantity": 0 + }, + "CustomErrorResponses": { + "Quantity": 0 + }, + "Comment": "CLI example distribution", + "Logging": { + "Enabled": false, + "IncludeCookies": false, + "Bucket": "", + "Prefix": "" + }, + "Enabled": true, + "ViewerCertificate": { + "CloudFrontDefaultCertificate": false, + "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/1954f095-11b6-4daf-9952-0c308a00abc", + "SSLSupportMethod": "sni-only", + "MinimumProtocolVersion": "TLSv1.2_2021", + "Certificate": "arn:aws:acm:us-east-1:123456789012:certificate/1954f095-11b6-4daf-9952-0c308a00abc", + "CertificateSource": "acm" + }, + "Restrictions": { + "GeoRestriction": { + "RestrictionType": "none", + "Quantity": 0 + } + }, + "WebACLId": "", + "HttpVersion": "http2", + "TenantConfig": { + "ParameterDefinitions": [ + { + "Name": "tenantName", + "Definition": { + "StringSchema": { + "Comment": "tenantName parameter", + "DefaultValue": "root", + "Required": false + }