CloudFront — Amazon CloudFront

AWS docs: https://docs.aws.amazon.com/cloudfront/latest/APIReference/Welcome.html

CloudFront uses a REST API with XML request/response bodies. All endpoints use the /2020-05-31 path prefix.

---

Summary

Category	✅ Supported	⚠️ Partial	🚧 WIP	❌ Unsupported
Distributions	7	0	0	0
Invalidations	3	0	0	0
OAC / OAI	11	0	0	0
Tagging	3	0	0	0
Policies	18	0	0	0
Proxy	1	0	0	0
Functions	8	0	0	0
Keys & Crypto	12	0	0	0
Monitoring	8	0	0	0
FLE	12	0	0	0
Deployment	6	0	0	0

---

Distribution operations

Operation	Status	Notes
CreateDistribution	✅	CallerReference idempotency; Status always “Deployed”
GetDistribution	✅	Returns ETag header
GetDistributionConfig	✅	Returns DistributionConfig portion + ETag
UpdateDistribution	✅	Requires If-Match ETag; bumps version
DeleteDistribution	✅	Requires If-Match + Enabled=false; cascade TODO
ListDistributions	✅	Marker/MaxItems pagination via serviceutil.Paginate
CreateDistributionWithTags	✅	Creates distribution + tags atomically; _custom_id_ tag support

Invalidation operations

Operation	Status	Notes
CreateInvalidation	✅	Supports path and tag (#tag) invalidations; Status instantly “Completed”
GetInvalidation	✅	Returns invalidation by distribution + invalidation ID
ListInvalidations	✅	Marker/MaxItems pagination

Origin Access Control operations

Operation	Status	Notes
CreateOriginAccessControl	✅	Generates ID, returns ETag
GetOriginAccessControl	✅	Returns OAC by ID with ETag
UpdateOriginAccessControl	✅	Requires If-Match ETag; bumps version
DeleteOriginAccessControl	✅	Requires If-Match ETag
ListOriginAccessControls	✅	Marker/MaxItems pagination

Origin Access Identity (legacy) operations

Operation	Status	Notes
CreateCloudFrontOriginAccessIdentity	✅	CallerReference required; generates S3CanonicalUserId
GetCloudFrontOriginAccessIdentity	✅	Returns OAI by ID with ETag
GetCloudFrontOriginAccessIdentityConfig	✅	Returns config portion + ETag
UpdateCloudFrontOriginAccessIdentity	✅	Requires If-Match ETag; bumps version
DeleteCloudFrontOriginAccessIdentity	✅	Requires If-Match ETag
ListCloudFrontOriginAccessIdentities	✅	Marker/MaxItems pagination

Tagging operations

Operation	Status	Notes
ListTagsForResource	✅	Returns tags by resource ARN
TagResource	✅	Merges tags into existing set
UntagResource	✅	Removes specified tag keys

Cache Policy operations

Operation	Status	Notes
CreateCachePolicy	✅	Generates ID, returns ETag
GetCachePolicy	✅	Returns policy by ID with ETag
GetCachePolicyConfig	✅	Returns config portion + ETag
UpdateCachePolicy	✅	Requires If-Match ETag; bumps version
DeleteCachePolicy	✅	Requires If-Match ETag
ListCachePolicies	✅	Marker/MaxItems pagination

Origin Request Policy operations

Operation	Status	Notes
CreateOriginRequestPolicy	✅	Generates ID, returns ETag
GetOriginRequestPolicy	✅	Returns policy by ID with ETag
GetOriginRequestPolicyConfig	✅	Returns config portion + ETag
UpdateOriginRequestPolicy	✅	Requires If-Match ETag; bumps version
DeleteOriginRequestPolicy	✅	Requires If-Match ETag
ListOriginRequestPolicies	✅	Marker/MaxItems pagination

Response Headers Policy operations

Operation	Status	Notes
CreateResponseHeadersPolicy	✅	Generates ID, returns ETag
GetResponseHeadersPolicy	✅	Returns policy by ID with ETag
GetResponseHeadersPolicyConfig	✅	Returns config portion + ETag
UpdateResponseHeadersPolicy	✅	Requires If-Match ETag; bumps version
DeleteResponseHeadersPolicy	✅	Requires If-Match ETag
ListResponseHeadersPolicies	✅	Marker/MaxItems pagination

Origin Proxy (emulator extension)

Operation	Status	Notes
ProxyRequest	✅	/_overcast/cloudfront/distributions/{distId}/* — forwards to configured origins with path matching

The origin proxy is an emulator-only extension (not part of the real CloudFront API). It forwards HTTP requests through a distribution’s configured origins:

• S3 origins are rewritten to the local emulator endpoint
• Custom origins are forwarded to their configured domain
• DefaultRootObject is applied for / requests
• CacheBehavior path patterns are matched to select the correct origin
• CloudFront response headers (X-Amz-Cf-Pop, X-Amz-Cf-Id, Via, X-Cache) are added

CloudFront Functions operations

Operation	Status	Notes
CreateFunction	✅	Stores code + config; Stage=DEVELOPMENT; returns ETag
DescribeFunction	✅	Returns FunctionSummary with metadata
GetFunction	✅	Returns raw function code (base64) with ETag
UpdateFunction	✅	Requires If-Match ETag; bumps version
DeleteFunction	✅	Requires If-Match ETag
ListFunctions	✅	Filters by Stage query param; MaxItems pagination
TestFunction	✅	Returns mock success result (no JS execution)
PublishFunction	✅	Promotes DEVELOPMENT → LIVE stage

Key Group & Public Key operations

Operation	Status	Notes
CreateKeyGroup	✅	Generates ID, returns ETag
GetKeyGroup	✅	Returns key group by ID with ETag
GetKeyGroupConfig	✅	Returns config portion + ETag
UpdateKeyGroup	✅	Requires If-Match ETag; bumps version
DeleteKeyGroup	✅	Requires If-Match ETag
ListKeyGroups	✅	MaxItems pagination
CreatePublicKey	✅	CallerReference dedup; generates ID + ETag
GetPublicKey	✅	Returns public key by ID with ETag
GetPublicKeyConfig	✅	Returns config portion + ETag
UpdatePublicKey	✅	Requires If-Match ETag; bumps version
DeletePublicKey	✅	Requires If-Match ETag
ListPublicKeys	✅	MaxItems pagination

Monitoring & Realtime operations

Operation	Status	Notes
CreateMonitoringSubscription	✅	Per-distribution; requires existing distribution
GetMonitoringSubscription	✅	Returns subscription by distribution ID
DeleteMonitoringSubscription	✅	Removes subscription for distribution
CreateRealtimeLogConfig	✅	Name-based; generates ARN; duplicate name check
GetRealtimeLogConfig	✅	Lookup by Name or ARN in request body
UpdateRealtimeLogConfig	✅	Updates by Name in request body
DeleteRealtimeLogConfig	✅	Deletes by Name or ARN in request body
ListRealtimeLogConfigs	✅	MaxItems pagination

Field-Level Encryption operations

Operation	Status	Notes
CreateFieldLevelEncryptionConfig	✅	CallerReference required; generates ID
GetFieldLevelEncryption	✅	Returns FLE config by ID with ETag
GetFieldLevelEncryptionConfig	✅	Returns config portion + ETag
UpdateFieldLevelEncryptionConfig	✅	Requires If-Match ETag; bumps version
DeleteFieldLevelEncryption	✅	Requires If-Match ETag
ListFieldLevelEncryptionConfigs	✅	MaxItems pagination
CreateFieldLevelEncryptionProfile	✅	CallerReference required; generates ID
GetFieldLevelEncryptionProfile	✅	Returns FLE profile by ID with ETag
GetFieldLevelEncryptionProfileConfig	✅	Returns config portion + ETag
UpdateFieldLevelEncryptionProfile	✅	Requires If-Match ETag; bumps version
DeleteFieldLevelEncryptionProfile	✅	Requires If-Match ETag
ListFieldLevelEncryptionProfiles	✅	MaxItems pagination

Continuous Deployment Policy operations

Operation	Status	Notes
CreateContinuousDeploymentPolicy	✅	Generates ID, returns ETag
GetContinuousDeploymentPolicy	✅	Returns policy by ID with ETag
GetContinuousDeploymentPolicyConfig	✅	Returns config portion + ETag
UpdateContinuousDeploymentPolicy	✅	Requires If-Match ETag; bumps version
DeleteContinuousDeploymentPolicy	✅	Requires If-Match ETag
ListContinuousDeploymentPolicies	✅	MaxItems pagination

---

Notes

• Error responses use the XML format matching the real CloudFront API.
• Distributions set Status: "Deployed" immediately — no async provisioning delay.
• DomainName is synthetic: {id}.cloudfront.net (not routable).
• ETag is a quoted version counter ("1", "2", etc.) — not a hash.
• CallerReference idempotency: same ref + identical config returns existing distribution.
• Delete requires Enabled: false + matching ETag (If-Match header).
• Tag-based invalidation: paths prefixed with # (e.g. #product:electronics) invalidate cached objects by cache tag. Tags are parsed from the origin response header specified in CacheTagConfig.HeaderName and must be ASCII visible characters (33-126), max 256 chars, no spaces/commas. Path and tag invalidations can be mixed in a single batch.

Summary

Category	✅ Supported
Distributions	7
Invalidations	3
OAC / OAI	11
Tagging	3
Policies	18
Proxy	1
Functions	8
Keys & Crypto	12
Monitoring	8
FLE	12
Deployment	6

---

Endpoints

Distributions

Operation	Status	Notes	AWS Docs
CreateDistribution	✅ Supported	CallerReference idempotency; Status always “Deployed”	docs
GetDistribution	✅ Supported	Returns ETag header	docs
GetDistributionConfig	✅ Supported	Returns DistributionConfig portion + ETag	docs
UpdateDistribution	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteDistribution	✅ Supported	Requires If-Match + Enabled=false	docs
ListDistributions	✅ Supported	Marker/MaxItems pagination via serviceutil.Paginate	docs
CreateDistributionWithTags	✅ Supported	Creates distribution + tags atomically; custom_id tag support	docs

Invalidations

Operation	Status	Notes	AWS Docs
CreateInvalidation	✅ Supported	Supports path and tag invalidations (#tag); Status instantly “Completed”	docs
GetInvalidation	✅ Supported	Returns invalidation by distribution + invalidation ID	docs
ListInvalidations	✅ Supported	Marker/MaxItems pagination	docs

OAC / OAI

Operation	Status	Notes	AWS Docs
CreateOriginAccessControl	✅ Supported	Generates ID, returns ETag	docs
GetOriginAccessControl	✅ Supported	Returns OAC by ID with ETag	docs
UpdateOriginAccessControl	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteOriginAccessControl	✅ Supported	Requires If-Match ETag	docs
ListOriginAccessControls	✅ Supported	Marker/MaxItems pagination	docs
CreateCloudFrontOriginAccessIdentity	✅ Supported	CallerReference required; generates S3CanonicalUserId	docs
GetCloudFrontOriginAccessIdentity	✅ Supported	Returns OAI by ID with ETag	docs
GetCloudFrontOriginAccessIdentityConfig	✅ Supported	Returns config portion + ETag	docs
UpdateCloudFrontOriginAccessIdentity	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteCloudFrontOriginAccessIdentity	✅ Supported	Requires If-Match ETag	docs
ListCloudFrontOriginAccessIdentities	✅ Supported	Marker/MaxItems pagination	docs

Tagging

Operation	Status	Notes	AWS Docs
ListTagsForResource	✅ Supported	Returns tags by resource ARN	docs
TagResource	✅ Supported	Merges tags into existing set	docs
UntagResource	✅ Supported	Removes specified tag keys	docs

Policies

Operation	Status	Notes	AWS Docs
CreateCachePolicy	✅ Supported	Generates ID, returns ETag	docs
GetCachePolicy	✅ Supported	Returns policy by ID with ETag	docs
GetCachePolicyConfig	✅ Supported	Returns config portion + ETag	docs
UpdateCachePolicy	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteCachePolicy	✅ Supported	Requires If-Match ETag	docs
ListCachePolicies	✅ Supported	Marker/MaxItems pagination	docs
CreateOriginRequestPolicy	✅ Supported	Generates ID, returns ETag	docs
GetOriginRequestPolicy	✅ Supported	Returns policy by ID with ETag	docs
GetOriginRequestPolicyConfig	✅ Supported	Returns config portion + ETag	docs
UpdateOriginRequestPolicy	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteOriginRequestPolicy	✅ Supported	Requires If-Match ETag	docs
ListOriginRequestPolicies	✅ Supported	Marker/MaxItems pagination	docs
CreateResponseHeadersPolicy	✅ Supported	Generates ID, returns ETag	docs
GetResponseHeadersPolicy	✅ Supported	Returns policy by ID with ETag	docs
GetResponseHeadersPolicyConfig	✅ Supported	Returns config portion + ETag	docs
UpdateResponseHeadersPolicy	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteResponseHeadersPolicy	✅ Supported	Requires If-Match ETag	docs
ListResponseHeadersPolicies	✅ Supported	Marker/MaxItems pagination	docs

Proxy

Operation	Status	Notes	AWS Docs
ProxyRequest	✅ Supported	Emulator extension: forwards to configured origins with path matching	docs

Functions

Operation	Status	Notes	AWS Docs
CreateFunction	✅ Supported	Stores code + config; Stage=DEVELOPMENT; returns ETag	docs
DescribeFunction	✅ Supported	Returns FunctionSummary with metadata	docs
GetFunction	✅ Supported	Returns raw function code (base64) with ETag	docs
UpdateFunction	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteFunction	✅ Supported	Requires If-Match ETag	docs
ListFunctions	✅ Supported	Filters by Stage query param; MaxItems pagination	docs
TestFunction	✅ Supported	Returns mock success result (no JS execution)	docs
PublishFunction	✅ Supported	Promotes DEVELOPMENT → LIVE stage	docs

Keys & Crypto

Operation	Status	Notes	AWS Docs
CreateKeyGroup	✅ Supported	Generates ID, returns ETag	docs
GetKeyGroup	✅ Supported	Returns key group by ID with ETag	docs
GetKeyGroupConfig	✅ Supported	Returns config portion + ETag	docs
UpdateKeyGroup	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteKeyGroup	✅ Supported	Requires If-Match ETag	docs
ListKeyGroups	✅ Supported	MaxItems pagination	docs
CreatePublicKey	✅ Supported	CallerReference dedup; generates ID + ETag	docs
GetPublicKey	✅ Supported	Returns public key by ID with ETag	docs
GetPublicKeyConfig	✅ Supported	Returns config portion + ETag	docs
UpdatePublicKey	✅ Supported	Requires If-Match ETag; bumps version	docs
DeletePublicKey	✅ Supported	Requires If-Match ETag	docs
ListPublicKeys	✅ Supported	MaxItems pagination	docs

Monitoring

Operation	Status	Notes	AWS Docs
CreateMonitoringSubscription	✅ Supported	Per-distribution; requires existing distribution	docs
GetMonitoringSubscription	✅ Supported	Returns subscription by distribution ID	docs
DeleteMonitoringSubscription	✅ Supported	Removes subscription for distribution	docs
CreateRealtimeLogConfig	✅ Supported	Name-based; generates ARN; duplicate name check	docs
GetRealtimeLogConfig	✅ Supported	Lookup by Name or ARN in request body	docs
UpdateRealtimeLogConfig	✅ Supported	Updates by Name in request body	docs
DeleteRealtimeLogConfig	✅ Supported	Deletes by Name or ARN in request body	docs
ListRealtimeLogConfigs	✅ Supported	MaxItems pagination	docs

FLE

Operation	Status	Notes	AWS Docs
CreateFieldLevelEncryptionConfig	✅ Supported	CallerReference required; generates ID	docs
GetFieldLevelEncryption	✅ Supported	Returns FLE config by ID with ETag	docs
GetFieldLevelEncryptionConfig	✅ Supported	Returns config portion + ETag	docs
UpdateFieldLevelEncryptionConfig	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteFieldLevelEncryption	✅ Supported	Requires If-Match ETag	docs
ListFieldLevelEncryptionConfigs	✅ Supported	MaxItems pagination	docs
CreateFieldLevelEncryptionProfile	✅ Supported	CallerReference required; generates ID	docs
GetFieldLevelEncryptionProfile	✅ Supported	Returns FLE profile by ID with ETag	docs
GetFieldLevelEncryptionProfileConfig	✅ Supported	Returns config portion + ETag	docs
UpdateFieldLevelEncryptionProfile	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteFieldLevelEncryptionProfile	✅ Supported	Requires If-Match ETag	docs
ListFieldLevelEncryptionProfiles	✅ Supported	MaxItems pagination	docs

Deployment

Operation	Status	Notes	AWS Docs
CreateContinuousDeploymentPolicy	✅ Supported	Generates ID, returns ETag	docs
GetContinuousDeploymentPolicy	✅ Supported	Returns policy by ID with ETag	docs
GetContinuousDeploymentPolicyConfig	✅ Supported	Returns config portion + ETag	docs
UpdateContinuousDeploymentPolicy	✅ Supported	Requires If-Match ETag; bumps version	docs
DeleteContinuousDeploymentPolicy	✅ Supported	Requires If-Match ETag	docs
ListContinuousDeploymentPolicies	✅ Supported	MaxItems pagination	docs