AWS AmazonCloudFront documentation change
Summary
Updated documentation to indicate that selectRequestOriginById() and createRequestOriginGroup() now support mutual TLS (mTLS) origins, replacing previous limitations with implementation guidance.
Security assessment
The change documents expanded support for security feature (mTLS) but doesn't address any vulnerability. It enhances documentation of existing security capabilities without indicating any security incident or weakness being fixed.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md b/AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md index 86e2b66db..80997243e 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md +++ b//AmazonCloudFront/latest/DeveloperGuide/helper-functions-origin-modification.md @@ -349,8 +349 @@ If you have a VPC origin configured in your distribution, you can use this metho -###### Notes - - * The `selectRequestOriginById()` function cannot select an origin that has mutual TLS (origin) enabled. Attempting to select a mutual TLS (origin) enabled origin using this function will result in a validation error. - - * If your use case requires dynamic origin selection with mutual TLS (origin), use `updateRequestOrigin()` instead, ensuring all target origins use the same client certificate. - - - +If you have an origin with mutual TLS (mTLS) enabled in your distribution, you can use this method to update your origin to your mTLS-enabled origin. For more information, see [Using CloudFront Functions with origin mutual TLS](./origin-mtls-cloudfront-functions.html). @@ -426,8 +419 @@ If you have a VPC origin configured in your distribution, you can use this metho -###### Notes - - * The `createRequestOriginGroup()` function does not support creating origin groups that include Mutual TLS (origin) enabled origins. Origin groups with Mutual TLS (origin) origins cannot be created dynamically through CloudFront Functions. - - * If you need origin failover capabilities with Mutual TLS (origin), configure origin groups directly in your CloudFront distribution settings rather than creating them dynamically in functions. - - - +If you have an origin with mutual TLS (mTLS) enabled in your distribution, you can use this method to create an origin group that includes your mTLS-enabled origin. For more information, see [Using CloudFront Functions with origin mutual TLS](./origin-mtls-cloudfront-functions.html).