AWS AmazonCloudFront documentation change
Summary
Updated terminology from 'mutual TLS (origin)' to 'origin mutual TLS' or 'mTLS' throughout the document for consistency. Added clarification about switching between mTLS origins requiring the same client certificate and conditional disabling of mTLS.
Security assessment
The changes update terminology but do not address any specific security vulnerability. The document continues to describe security features (mutual TLS authentication between CloudFront and origins) but doesn't introduce new security fixes or vulnerability disclosures. The clarification about certificate requirements improves security documentation accuracy.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/origin-mtls-cloudfront-functions.md b/AmazonCloudFront/latest/DeveloperGuide/origin-mtls-cloudfront-functions.md index 6582e882c..73d07e2fe 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/origin-mtls-cloudfront-functions.md +++ b//AmazonCloudFront/latest/DeveloperGuide/origin-mtls-cloudfront-functions.md @@ -7 +7 @@ Supported CloudFront Functions operationsUnsupported CloudFront Functions operat -# Using CloudFront Functions with mutual TLS (origin) +# Using CloudFront Functions with origin mutual TLS @@ -9 +9 @@ Supported CloudFront Functions operationsUnsupported CloudFront Functions operat -CloudFront Functions provides lightweight, serverless compute at the edge to customize content delivery. When using mutual TLS (origin) with CloudFront Functions, there are specific behaviors and limitations to be aware of regarding origin selection and manipulation. +CloudFront Functions provides lightweight, serverless compute at the edge to customize content delivery. When using origin mutual TLS with CloudFront Functions, there are specific behaviors and limitations to be aware of regarding origin selection and manipulation. @@ -13 +13 @@ CloudFront Functions provides lightweight, serverless compute at the edge to cus -CloudFront Functions can interact with mutual TLS (origin) enabled origins in the following ways: +CloudFront Functions can interact with mTLS-enabled origins in the following ways: @@ -17 +17 @@ CloudFront Functions can interact with mutual TLS (origin) enabled origins in th -The updateRequestOrigin() function supports limited modifications when working with mutual TLS (origin) enabled origins: +The updateRequestOrigin() function supports limited modifications when working with mTLS-enabled origins: @@ -19 +19 @@ The updateRequestOrigin() function supports limited modifications when working w - * **Switching between mutual TLS (origin) origins:** You can update the request to route to a different origin that uses mutual TLS (origin), provided both origins use the **same client certificate**. This allows you to implement custom routing logic while maintaining mutual TLS authentication. + * **Switching between origin mTLS origins:** You can update the request to route to a different origin that uses origin mTLS, provided both origins use the **same client certificate**. This allows you to implement custom routing logic while maintaining mutual TLS authentication. @@ -21 +21 @@ The updateRequestOrigin() function supports limited modifications when working w - * **Disabling mutual TLS (origin):** You can switch from a mutual TLS (origin) enabled origin to a non-mutual TLS origin by setting `mTLSConfig: 'off'` in the function. This provides flexibility to conditionally disable mutual TLS authentication based on request characteristics. + * **Disabling origin mTLS:** You can switch from a mTLS-enabled origin to a non-mTLS origin by setting `mTLSConfig: 'off'` in the function. This provides flexibility to conditionally disable mutual TLS authentication based on request characteristics. @@ -26 +26 @@ The updateRequestOrigin() function supports limited modifications when working w -#### Example: Switching between mutual TLS (origin) origins with the same certificate +#### Example: Switching between origin mTLS origins with the same certificate @@ -44 +44 @@ The updateRequestOrigin() function supports limited modifications when working w -#### Example: Conditionally disabling mutual TLS (origin) +#### Example: Conditionally disabling origin mTLS @@ -64 +64 @@ The updateRequestOrigin() function supports limited modifications when working w -The following CloudFront Functions operations do not support mutual TLS (origin) enabled origins at general availability: +The following CloudFront Functions operations do not support mTLS-enabled origins at general availability: @@ -68 +68 @@ The following CloudFront Functions operations do not support mutual TLS (origin) -The `selectRequestOriginById()` function cannot select an origin that has mutual TLS (origin) enabled. Attempting to select a mutual TLS (origin) enabled origin using this function will result in a validation error. +The `selectRequestOriginById()` function cannot select an origin that has origin mTLS enabled. Attempting to select a mTLS-enabled origin using this function will result in a validation error. @@ -70 +70 @@ The `selectRequestOriginById()` function cannot select an origin that has mutual -If your use case requires dynamic origin selection with mutual TLS (origin), use `updateRequestOrigin()` instead, ensuring all target origins use the same client certificate. +If your use case requires dynamic origin selection with origin mTLS, use `updateRequestOrigin()` instead, ensuring all target origins use the same client certificate. @@ -74 +74 @@ If your use case requires dynamic origin selection with mutual TLS (origin), use -The `createRequestOriginGroup()` function does not support creating origin groups that include mutual TLS (origin) enabled origins. Origin groups with mutual TLS (origin) origins cannot be created dynamically through CloudFront Functions. +The `createRequestOriginGroup()` function does not support creating origin groups that include mTLS-enabled origins. Origin groups with origin mTLS origins cannot be created dynamically through CloudFront Functions. @@ -76 +76 @@ The `createRequestOriginGroup()` function does not support creating origin group -If you need origin failover capabilities with mutual TLS (origin), configure origin groups directly in your CloudFront distribution settings rather than creating them dynamically in functions. +If you need origin failover capabilities with origin mTLS, configure origin groups directly in your CloudFront distribution settings rather than creating them dynamically in functions. @@ -84 +84 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Enable mutual TLS(origin) for CloudFront distributions +Enable origin mutual TLS for CloudFront distributions