AutoGineer
Generated banner for Cloudfront
Generated logo for Cloudfront

Cloudfront

AWSOfficialPublished by AWS

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and origins (creating a distribution, caching, and Flat Rate Pricing (FRP) versus pay-as-you-go pricing); managing custom-domain TLS certificates (ACM in us-east-1); configuring multi-tenant distributions; protecting origins with origin access control (OAC), VPC origins, and origin mutual TLS (mTLS); securing content with signed URLs and cookies, geographic restrictions, viewer mutual TLS, and edge token validation; and observing traffic with standard and real-time logs. Applicable when the customer wants to put CloudFront in front of content, choose pricing, lock an origin, restrict who can view content, or analyze logs. Not applicable for the Route 53 DNS side of a CloudFront custom domain or failover between distributions, or for pure-Route 53 DNS work (see the route53 skill).
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides domain expertise for managing Amazon CloudFront distributions. It covers the full lifecycle of content delivery, from initial architectural decisions and distribution creation to securing origins and content, managing TLS certificates, and configuring traffic observability. The skill acts as a router, directing users to specific reference procedures for tasks such as setting up multi-tenant distributions, implementing origin access control, or choosing between standard and real-time logging. It emphasizes that CloudFront and its associated ACM certificates must be managed in the us-east-1 region.

What it does

  • Guides decisions on when to use CloudFront and how it integrates with other AWS services.
  • Manages custom domain TLS certificates via ACM in us-east-1.
  • Configures origin protection using OAC, VPC origins, and mTLS.
  • Secures content delivery with signed URLs, cookies, and geographic restrictions.
  • Sets up standard and real-time logging for traffic observability.
  • Supports multi-tenant distribution configurations for shared settings.

When to use it

  • When you need to create or configure a CloudFront distribution.
  • When you need to secure your origin so it is only reachable via CloudFront.
  • When you need to manage custom domain certificates for your distribution.
  • When you need to restrict content access based on identity, location, or tokens.
  • When you need to analyze traffic patterns using standard or real-time logs.

Advantages

  • Provides structured procedures for complex configurations like multi-tenant setups.
  • Clarifies the distinction between origin protection and content security.
  • Centralizes guidance on AWS service integrations like WAF and Lambda@Edge.
  • Ensures correct regional configuration for ACM certificates.
  • Offers clear decision frameworks for choosing logging strategies.

Usage examples

“How do I restrict my S3 origin so it can only be accessed through CloudFront?”
The agent will guide you through the protecting-your-origins reference to implement Origin Access Control (OAC) or VPC origins.
“Should I use standard or real-time logs for my CloudFront distribution?”
The agent will help you choose based on your need for complete audit records versus fast, sampled anomaly detection.
“I am getting an error when attaching my ACM certificate to CloudFront.”
The agent will verify if your certificate was requested in us-east-1 and provide steps to correct the region if necessary.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/cloudfront/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip cloudfront.zip -d .agents/skills

Documentation by AWS

Amazon CloudFront

Overview

Domain expertise for configuring Amazon CloudFront content delivery: deciding when to use CloudFront and how it fits the wider architecture, managing custom-domain certificates and multi-tenant distributions, protecting origins, securing content, and observing traffic.

This skill is a router. Each customer task maps to a procedure file under references/. Read the matching reference in full before acting, then follow its constraints and steps. The reference files are self-contained: each carries its own decision tables, constraints, procedure, and troubleshooting.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. CloudFront is a global service; its API calls and the AWS Certificate Manager (ACM) certificates it uses are made in us-east-1 regardless of where the customer's application runs.

Which CloudFront task do you need?

GoalReference
Decide whether CloudFront is the right layer, see how it integrates, create a distribution, tune caching, or choose pricingwhen to use CloudFront
Serve a custom domain over HTTPS, manage ACM certificates, or run many domains with a certificate per tenantmanaging certificates with CloudFront
Make CloudFront the only way to reach the origin (S3 OAC, VPC origins, origin mutual TLS, security groups)protecting your origins
Limit who can view content by identity, location, client certificate, or auth tokensecuring your content
Get visibility into traffic with standard and real-time logs, and analyze themCloudFront observability
Serve multiple domains through shared configuration with per-tenant customization (SaaS, platform)multi-tenant distributions

Routing notes

  • Choosing the layer and creating a distribution vs the rest. Whether CloudFront is the right entry layer, what it integrates with, creating a distribution, caching, and pricing live in the when-to-use reference. The other references assume a distribution exists and configure one aspect of it.

  • Protecting origins vs securing content. Locking the origin so it is reachable only through CloudFront (OAC, VPC origins, origin mTLS) is the protecting-your-origins reference. Restricting which viewers can see content (signed URLs and cookies, geographic restrictions, viewer mTLS, edge token validation) is the securing-your-content reference. They are paired: a content control only holds when the origin is also locked.

  • Viewer mTLS vs origin mTLS. Authenticating the client to CloudFront (viewer mTLS) is content security. Authenticating CloudFront to the origin (origin mTLS) is origin protection. Different controls, different references.

  • Custom domain certificate vs Route 53 DNS cutover. Requesting and validating the ACM certificate and adding the alternate domain name is the managing-certificates reference here. Pointing the domain's DNS at the distribution, including the zone apex alias and any failover, is Route 53 DNS work (see the route53 skill).

Cross-service work

Pointing a custom domain's DNS at a CloudFront distribution, or failing over between distributions with Route 53 records, is cross-service work spanning CloudFront and Route 53. Use this skill for the CloudFront-side configuration only.

Additional Resources

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/networking-and-content-delivery-skills/cloudfront · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download cloudfront.zip