CloudFront

19 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

CloudFrontAnycastIpList # CLOUD CONTROL · AWS::CloudFront::AnycastIpList

CloudFrontAnycastIpList manages AWS::CloudFront::AnycastIpList through the AWS Cloud Control API.

kubectl get cloudfrontanycastiplists · example on GitHub

Example

# CloudFrontAnycastIpList — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontanycastiplist
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontAnycastIpList
metadata:
  name: example-cloudfrontanycastiplist
  namespace: default
spec:
  ipAddressType: ipv4
  ipCount: 2
  ipamCidrConfigs:
  - cidr: 10.0.0.0/16
    ipamPoolArn: arn:aws:iam::123456789012:role/example-role
  name: example-cloudfrontanycastiplist
  providerRef:
    name: example-cloudfrontanycastiplist
    region: us-east-1
  tags:
    items:
    - key: example
      value: example

Spec

Field	Type	Required	Description
`ipAddressType`	enum	—	The IP address type for the Anycast static IP list. Allowed: `ipv4, dualstack`
`ipCount`	integer	yes	The number of IP addresses in the Anycast static IP list.
`ipamCidrConfigs`	array<object>	—	A list of IPAM CIDR configurations that define the IP address ranges, IPAM pools, and associated Anycast IP addresses.
`ipamCidrConfigs[].cidr`	string	yes	The CIDR that specifies the IP address range for this IPAM configuration.
`ipamCidrConfigs[].ipamPoolArn`	string	yes	The Amazon Resource Name (ARN) of the IPAM pool that the CIDR block is assigned to.
`name`	string	yes	The name of the Anycast static IP list.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	object	—	A complex type that contains zero or more ``Tag`` elements.
`tags.items`	array<object>	—	A complex type that contains ``Tag`` elements.
`tags.items[].key`	string	yes
`tags.items[].value`	string	yes

Status

Field	Type	Required	Description
`anycastIpList`	object	—	Read-only: reported by AWS after creation.
`anycastIpList.anycastIps`	array<string>	yes	The static IP addresses that are allocated to the Anycast static IP list.
`anycastIpList.arn`	string	yes	The Amazon Resource Name (ARN) of the Anycast static IP list.
`anycastIpList.id`	string	yes	The ID of the Anycast static IP list.
`anycastIpList.ipAddressType`	enum	—	The IP address type for the Anycast static IP list. Allowed: `ipv4, dualstack`
`anycastIpList.ipCount`	integer	yes	The number of IP addresses in the Anycast static IP list.
`anycastIpList.ipamCidrConfigResults`	array<object>	—	The results for the IPAM CIDRs that defines a specific IP address range, IPAM pool, and associated Anycast IP address.
`anycastIpList.ipamCidrConfigResults[].anycastIp`	string	—	The specified Anycast IP address allocated from the IPAM pool for this CIDR configuration.
`anycastIpList.ipamCidrConfigResults[].cidr`	string	—	The CIDR that specifies the IP address range for this IPAM configuration.
`anycastIpList.ipamCidrConfigResults[].ipamPoolArn`	string	—	The Amazon Resource Name (ARN) of the IPAM pool that the CIDR block is assigned to.
`anycastIpList.ipamCidrConfigResults[].status`	string	—	The current status of the IPAM CIDR configuration.
`anycastIpList.lastModifiedTime`	string	yes	The last time the Anycast static IP list was modified.
`anycastIpList.name`	string	yes	The name of the Anycast static IP list.
`anycastIpList.status`	string	yes	The status of the Anycast static IP list.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`eTag`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamCidrConfigResults`	array<object>	—	Read-only: reported by AWS after creation.
`ipamCidrConfigResults[].anycastIp`	string	—	The specified Anycast IP address allocated from the IPAM pool for this CIDR configuration.
`ipamCidrConfigResults[].cidr`	string	—	The CIDR that specifies the IP address range for this IPAM configuration.
`ipamCidrConfigResults[].ipamPoolArn`	string	—	The Amazon Resource Name (ARN) of the IPAM pool that the CIDR block is assigned to.
`ipamCidrConfigResults[].status`	string	—	The current status of the IPAM CIDR configuration.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontCachePolicy # GA

CloudFrontCachePolicy is the Schema for managing CloudFront cache policies.

kubectl get cloudfrontcachepolicies · example on GitHub

Example

# CloudFrontCachePolicy — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontcachepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontCachePolicy
metadata:
  name: example-cloudfrontcachepolicy
  namespace: default
spec:
  comment: Managed by konfig-konector
  defaultTtl: 1
  maxTtl: 1
  minTtl: 1
  name: example-cloudfrontcachepolicy
  providerRef:
    name: example-cloudfrontcachepolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`comment`	string	—	Comment is an optional description.
`defaultTtl`	integer	—	DefaultTTL is the default TTL in seconds.
`maxTtl`	integer	—	MaxTTL is the maximum TTL in seconds.
`minTtl`	integer	yes	MinTTL is the minimum time-to-live in seconds for cached objects.
`name`	string	yes	Name is the unique name of the cache policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`etag`	string	—	ETag is the ETag for the cache policy.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyId`	string	—	PolicyID is the ID of the cache policy.

CloudFrontCloudFrontOriginAccessIdentity # CLOUD CONTROL · AWS::CloudFront::CloudFrontOriginAccessIdentity

CloudFrontCloudFrontOriginAccessIdentity manages AWS::CloudFront::CloudFrontOriginAccessIdentity through the AWS Cloud Control API.

kubectl get cloudfrontcloudfrontoriginaccessidentities · example on GitHub

Example

# CloudFrontCloudFrontOriginAccessIdentity — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontcloudfrontoriginaccessidentity
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontCloudFrontOriginAccessIdentity
metadata:
  name: example-cloudfrontcloudfrontoriginaccessidentity
  namespace: default
spec:
  cloudFrontOriginAccessIdentityConfig:
    comment: Managed by konfig-konector
  providerRef:
    name: example-cloudfrontcloudfrontoriginaccessidentity
    region: us-east-1

Spec

Field	Type	Required	Description
`cloudFrontOriginAccessIdentityConfig`	object	yes	The current configuration information for the identity.
`cloudFrontOriginAccessIdentityConfig.comment`	string	yes	A comment to describe the origin access identity.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`s3CanonicalUserId`	string	—	Read-only: reported by AWS after creation.

CloudFrontConnectionFunction # CLOUD CONTROL · AWS::CloudFront::ConnectionFunction

CloudFrontConnectionFunction manages AWS::CloudFront::ConnectionFunction through the AWS Cloud Control API.

kubectl get cloudfrontconnectionfunctions · example on GitHub

Example

# CloudFrontConnectionFunction — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontconnectionfunction
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontConnectionFunction
metadata:
  name: example-cloudfrontconnectionfunction
  namespace: default
spec:
  autoPublish: false
  connectionFunctionCode: example
  connectionFunctionConfig:
    comment: Managed by konfig-konector
    keyValueStoreAssociations:
    - keyValueStoreARN: arn:aws:iam::123456789012:role/example-role
    runtime: cloudfront-js-2.0
  name: example-cloudfrontconnectionfunction
  providerRef:
    name: example-cloudfrontconnectionfunction
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`autoPublish`	boolean	—	A flag that determines whether to automatically publish the function to the ``LIVE`` stage when it’s created.
`connectionFunctionCode`	string	yes	The code for the connection function.
`connectionFunctionConfig`	object	yes	Contains configuration information about a CloudFront function.
`connectionFunctionConfig.comment`	string	yes	A comment to describe the function.
`connectionFunctionConfig.keyValueStoreAssociations`	array<object>	—	The configuration for the key value store associations.
`connectionFunctionConfig.keyValueStoreAssociations[].keyValueStoreARN`	string	yes	The Amazon Resource Name (ARN) of the key value store association.
`connectionFunctionConfig.runtime`	enum	yes	The function's runtime environment version. Allowed: `cloudfront-js-2.0`
`name`	string	yes	The connection function name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`connectionFunctionArn`	string	—	Read-only: reported by AWS after creation.
`createdTime`	string	—	Read-only: reported by AWS after creation.
`eTag`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`stage`	enum	—	Read-only: reported by AWS after creation. Allowed: `DEVELOPMENT, LIVE`
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `UNPUBLISHED, DEPLOYED, UNASSOCIATED, PUBLISHING, IN_PROGRESS`

CloudFrontConnectionGroup # CLOUD CONTROL · AWS::CloudFront::ConnectionGroup

CloudFrontConnectionGroup manages AWS::CloudFront::ConnectionGroup through the AWS Cloud Control API.

kubectl get cloudfrontconnectiongroups · example on GitHub

Example

# CloudFrontConnectionGroup — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontconnectiongroup
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontConnectionGroup
metadata:
  name: example-cloudfrontconnectiongroup
  namespace: default
spec:
  enabled: true
  ipv6Enabled: true
  name: example-cloudfrontconnectiongroup
  providerRef:
    name: example-cloudfrontconnectiongroup
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`anycastIpListId`	string	—	The ID of the Anycast static IP list.
`enabled`	boolean	—	Whether the connection group is enabled.
`ipv6Enabled`	boolean	—	IPv6 is enabled for the connection group.
`name`	string	yes	The name of the connection group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	Read-only: reported by AWS after creation.
`eTag`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`isDefault`	boolean	—	Read-only: reported by AWS after creation.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`routingEndpoint`	string	—	Read-only: reported by AWS after creation.
`status`	string	—	Read-only: reported by AWS after creation.

CloudFrontContinuousDeploymentPolicy # CLOUD CONTROL · AWS::CloudFront::ContinuousDeploymentPolicy

CloudFrontContinuousDeploymentPolicy manages AWS::CloudFront::ContinuousDeploymentPolicy through the AWS Cloud Control API.

kubectl get cloudfrontcontinuousdeploymentpolicies · example on GitHub

Example

# CloudFrontContinuousDeploymentPolicy — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontcontinuousdeploymentpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontContinuousDeploymentPolicy
metadata:
  name: example-cloudfrontcontinuousdeploymentpolicy
  namespace: default
spec:
  continuousDeploymentPolicyConfig:
    enabled: true
    singleHeaderPolicyConfig:
      header: example
      value: example
    singleWeightPolicyConfig:
      sessionStickinessConfig:
        idleTTL: 300
        maximumTTL: 300
      weight: 1
    stagingDistributionDnsNames:
    - example
    trafficConfig:
      singleHeaderConfig:
        header: example
        value: example
      singleWeightConfig:
        weight: 1
      type: SingleWeight
    type: SingleWeight
  providerRef:
    name: example-cloudfrontcontinuousdeploymentpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`continuousDeploymentPolicyConfig`	object	yes	Contains the configuration for a continuous deployment policy.
`continuousDeploymentPolicyConfig.enabled`	boolean	yes	A Boolean that indicates whether this continuous deployment policy is enabled (in effect).
`continuousDeploymentPolicyConfig.singleHeaderPolicyConfig`	object	—	This configuration determines which HTTP requests are sent to the staging distribution.
`continuousDeploymentPolicyConfig.singleHeaderPolicyConfig.header`	string	yes
`continuousDeploymentPolicyConfig.singleHeaderPolicyConfig.value`	string	yes
`continuousDeploymentPolicyConfig.singleWeightPolicyConfig`	object	—	This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
`continuousDeploymentPolicyConfig.singleWeightPolicyConfig.sessionStickinessConfig`	object	—	CloudFrontContinuousDeploymentPolicySessionStickinessConfig is a nested property type of AWS::CloudFront::ContinuousDeploymentPolicy.
`continuousDeploymentPolicyConfig.singleWeightPolicyConfig.sessionStickinessConfig.idleTTL`	integer	yes	The amount of time after which you want sessions to cease if no requests are received.
`continuousDeploymentPolicyConfig.singleWeightPolicyConfig.sessionStickinessConfig.maximumTTL`	integer	yes	The maximum amount of time to consider requests from the viewer as being part of the same session.
`continuousDeploymentPolicyConfig.singleWeightPolicyConfig.weight`	number	yes
`continuousDeploymentPolicyConfig.stagingDistributionDnsNames`	array<string>	yes	The CloudFront domain name of the staging distribution.
`continuousDeploymentPolicyConfig.trafficConfig`	object	—	Contains the parameters for routing production traffic from your primary to staging distributions.
`continuousDeploymentPolicyConfig.trafficConfig.singleHeaderConfig`	object	—	Determines which HTTP requests are sent to the staging distribution.
`continuousDeploymentPolicyConfig.trafficConfig.singleHeaderConfig.header`	string	yes	The request header name that you want CloudFront to send to your staging distribution.
`continuousDeploymentPolicyConfig.trafficConfig.singleHeaderConfig.value`	string	yes	The request header value.
`continuousDeploymentPolicyConfig.trafficConfig.singleWeightConfig`	object	—	Contains the percentage of traffic to send to the staging distribution.
`continuousDeploymentPolicyConfig.trafficConfig.singleWeightConfig.sessionStickinessConfig`	object	—	Session stickiness provides the ability to define multiple requests from a single viewer as a single session.
`continuousDeploymentPolicyConfig.trafficConfig.singleWeightConfig.sessionStickinessConfig.idleTTL`	integer	yes	The amount of time after which you want sessions to cease if no requests are received.
`continuousDeploymentPolicyConfig.trafficConfig.singleWeightConfig.sessionStickinessConfig.maximumTTL`	integer	yes	The maximum amount of time to consider requests from the viewer as being part of the same session.
`continuousDeploymentPolicyConfig.trafficConfig.singleWeightConfig.weight`	number	yes	The percentage of traffic to send to a staging distribution, expressed as a decimal number between 0 and 0.15.
`continuousDeploymentPolicyConfig.trafficConfig.type`	enum	yes	The type of traffic configuration. Allowed: `SingleWeight, SingleHeader`
`continuousDeploymentPolicyConfig.type`	enum	—	The type of traffic configuration. Allowed: `SingleWeight, SingleHeader`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontDistribution # GA

CloudFrontDistribution is the Schema for managing CloudFront distributions.

kubectl get cloudfrontdistributions · example on GitHub

Example

# CloudFrontDistribution — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontdistribution
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontDistribution
metadata:
  name: example-cloudfrontdistribution
  namespace: default
spec:
  aliases:
  - example
  comment: Managed by konfig-konector
  defaultCacheBehavior:
    allowedMethods:
    - example
    targetOriginId: example-id
    viewerProtocolPolicy: allow-all
  enabled: true
  origins:
  - domainName: example-cloudfrontdistribution
    id: example-id
    originPath: example
  priceClass: PriceClass_100
  providerRef:
    name: example-cloudfrontdistribution
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`aliases`	array<string>	—	Aliases are the CNAMEs (alternate domain names) for this distribution.
`comment`	string	—	Comment is a description for the distribution.
`defaultCacheBehavior`	object	yes	DefaultCacheBehavior is the default cache behavior configuration.
`defaultCacheBehavior.allowedMethods`	array<string>	—	AllowedMethods are the HTTP methods CloudFront processes and forwards to the origin.
`defaultCacheBehavior.cachePolicyId`	string	—	CachePolicyID is the ID of the cache policy attached to the default cache behavior.
`defaultCacheBehavior.targetOriginId`	string	yes	TargetOriginID specifies the value of the ID for the origin that CloudFront routes requests to.
`defaultCacheBehavior.viewerProtocolPolicy`	enum	yes	ViewerProtocolPolicy defines how you want CloudFront to serve requests. Allowed: `allow-all, https-only, redirect-to-https`
`enabled`	boolean	—	Enabled controls whether the distribution is enabled.
`origins`	array<object>	yes	Origins is the list of origins for this distribution.
`origins[].domainName`	string	yes	DomainName is the DNS domain name of the origin.
`origins[].id`	string	yes	ID is the unique identifier for the origin.
`origins[].originPath`	string	—	OriginPath is an optional element that causes CloudFront to request content from a specific directory.
`priceClass`	enum	—	PriceClass is the price class for this distribution. Allowed: `PriceClass_100, PriceClass_200, PriceClass_All`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are metadata tags for the distribution.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`distributionArn`	string	—	DistributionARN is the ARN of the distribution.
`distributionId`	string	—	DistributionID is the ID of the distribution.
`domainName`	string	—	DomainName is the CloudFront domain name for the distribution.
`etag`	string	—	ETag is the ETag for the distribution (required for updates and deletes).
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the current deployment status of the distribution.

CloudFrontDistributionTenant # CLOUD CONTROL · AWS::CloudFront::DistributionTenant

CloudFrontDistributionTenant manages AWS::CloudFront::DistributionTenant through the AWS Cloud Control API.

kubectl get cloudfrontdistributiontenants · example on GitHub

Example

# CloudFrontDistributionTenant — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontdistributiontenant
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontDistributionTenant
metadata:
  name: example-cloudfrontdistributiontenant
  namespace: default
spec:
  customizations:
    certificate:
      name: example-certificate
    geoRestrictions:
      locations:
      - example
      restrictionType: blacklist
    webAcl:
      action: override
      arn: arn:aws:iam::123456789012:role/example-role
  distributionId: example-id
  domains:
  - example
  enabled: true
  managedCertificateRequest:
    certificateTransparencyLoggingPreference: enabled
    primaryDomainName: example-cloudfrontdistributiontenant
    validationTokenHost: cloudfront
  name: example-cloudfrontdistributiontenant
  parameters:
  - name: example-cloudfrontdistributiontenant
    value: example
  providerRef:
    name: example-cloudfrontdistributiontenant
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`connectionGroupId`	string	—	The ID of the connection group for the distribution tenant.
`customizations`	object	—	Customizations for the distribution tenant.
`customizations.certificate`	object	—	The ACMlong (ACM) certificate.
`customizations.certificate.arn`	string	—	The Amazon Resource Name (ARN) of the ACM certificate.
`customizations.geoRestrictions`	object	—	The geographic restrictions.
`customizations.geoRestrictions.locations`	array<string>	—	The locations for geographic restrictions.
`customizations.geoRestrictions.restrictionType`	enum	—	The method that you want to use to restrict distribution of your content by country: + ``none``: No geographic restriction is enabled, meaning access to content is not restricted by client geo location. Allowed: `blacklist, whitelist, none`
`customizations.webAcl`	object	—	The WAF web ACL.
`customizations.webAcl.action`	enum	—	The action for the WAF web ACL customization. Allowed: `override, disable`
`customizations.webAcl.arn`	string	—	The Amazon Resource Name (ARN) of the WAF web ACL.
`distributionId`	string	yes	The ID of the multi-tenant distribution.
`domains`	array<string>	yes	The domains associated with the distribution tenant.
`enabled`	boolean	—	Indicates whether the distribution tenant is in an enabled state.
`managedCertificateRequest`	object	—	An object that represents the request for the Amazon CloudFront managed ACM certificate.
`managedCertificateRequest.certificateTransparencyLoggingPreference`	enum	—	You can opt out of certificate transparency logging by specifying the ``disabled`` option. Allowed: `enabled, disabled`
`managedCertificateRequest.primaryDomainName`	string	—	The primary domain name associated with the CloudFront managed ACM certificate.
`managedCertificateRequest.validationTokenHost`	enum	—	Specify how the HTTP validation token will be served when requesting the CloudFront managed ACM certificate. Allowed: `cloudfront, self-hosted`
`name`	string	yes	The name of the distribution tenant.
`parameters`	array<object>	—	A list of parameter values to add to the resource.
`parameters[].name`	string	—	The parameter name.
`parameters[].value`	string	—	The parameter value.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	Read-only: reported by AWS after creation.
`domainResults`	array<object>	—	Read-only: reported by AWS after creation.
`domainResults[].domain`	string	—	The specified domain.
`domainResults[].status`	enum	—	Whether the domain is active or inactive. Allowed: `active, inactive`
`eTag`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	Read-only: reported by AWS after creation.

CloudFrontFunction # GA

CloudFrontFunction is the Schema for managing CloudFront functions.

kubectl get cloudfrontfunctions · example on GitHub

Example

# CloudFrontFunction — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontfunction
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontFunction
metadata:
  name: example-cloudfrontfunction
  namespace: default
spec:
  comment: Managed by konfig-konector
  functionCode: example
  name: example-cloudfrontfunction
  providerRef:
    name: example-cloudfrontfunction
    region: us-east-1
  runtime: cloudfront-js-1.0

Spec

Field	Type	Required	Description
`comment`	string	—	Comment is an optional description for the function.
`functionCode`	string	yes	FunctionCode is the function code (base64-encoded or plain text).
`name`	string	yes	Name is the name of the function.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`runtime`	enum	—	Runtime is the function's runtime environment. Allowed: `cloudfront-js-1.0, cloudfront-js-2.0`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`etag`	string	—	ETag is the ETag for the function.
`functionArn`	string	—	FunctionARN is the ARN of the function.
`functionStatus`	string	—	FunctionStatus is the current status of the function.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

CloudFrontKeyGroup # CLOUD CONTROL · AWS::CloudFront::KeyGroup

CloudFrontKeyGroup manages AWS::CloudFront::KeyGroup through the AWS Cloud Control API.

kubectl get cloudfrontkeygroups · example on GitHub

Example

# CloudFrontKeyGroup — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontkeygroup
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontKeyGroup
metadata:
  name: example-cloudfrontkeygroup
  namespace: default
spec:
  keyGroupConfig:
    comment: Managed by konfig-konector
    items:
    - example
    name: example-cloudfrontkeygroup
  providerRef:
    name: example-cloudfrontkeygroup
    region: us-east-1

Spec

Field	Type	Required	Description
`keyGroupConfig`	object	yes	The key group configuration.
`keyGroupConfig.comment`	string	—	A comment to describe the key group.
`keyGroupConfig.items`	array<string>	yes	A list of the identifiers of the public keys in the key group.
`keyGroupConfig.name`	string	yes	A name to identify the key group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontKeyValueStore # CLOUD CONTROL · AWS::CloudFront::KeyValueStore

CloudFrontKeyValueStore manages AWS::CloudFront::KeyValueStore through the AWS Cloud Control API.

kubectl get cloudfrontkeyvaluestores · example on GitHub

Example

# CloudFrontKeyValueStore — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontkeyvaluestore
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontKeyValueStore
metadata:
  name: example-cloudfrontkeyvaluestore
  namespace: default
spec:
  comment: Managed by konfig-konector
  importSource:
    sourceArn: arn:aws:iam::123456789012:role/example-role
    sourceType: example
  name: example-cloudfrontkeyvaluestore
  providerRef:
    name: example-cloudfrontkeyvaluestore
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`comment`	string	—	A comment to describe the Key Value Store.
`importSource`	object	—	The import source for the key value store.
`importSource.sourceArn`	string	yes	The Amazon Resource Name (ARN) of the import source for the key value store.
`importSource.sourceType`	string	yes	The source type of the import source for the key value store.
`name`	string	yes	The name of the key value store.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	Read-only: reported by AWS after creation.

CloudFrontMonitoringSubscription # CLOUD CONTROL · AWS::CloudFront::MonitoringSubscription

CloudFrontMonitoringSubscription manages AWS::CloudFront::MonitoringSubscription through the AWS Cloud Control API.

kubectl get cloudfrontmonitoringsubscriptions · example on GitHub

Example

# CloudFrontMonitoringSubscription — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontmonitoringsubscription
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontMonitoringSubscription
metadata:
  name: example-cloudfrontmonitoringsubscription
  namespace: default
spec:
  distributionId: example-id
  monitoringSubscription:
    realtimeMetricsSubscriptionConfig:
      realtimeMetricsSubscriptionStatus: Enabled
  providerRef:
    name: example-cloudfrontmonitoringsubscription
    region: us-east-1

Spec

Field	Type	Required	Description
`distributionId`	string	yes	The ID of the distribution that you are enabling metrics for.
`monitoringSubscription`	object	yes	A subscription configuration for additional CloudWatch metrics.
`monitoringSubscription.realtimeMetricsSubscriptionConfig`	object	—	A subscription configuration for additional CloudWatch metrics.
`monitoringSubscription.realtimeMetricsSubscriptionConfig.realtimeMetricsSubscriptionStatus`	enum	yes	A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Allowed: `Enabled, Disabled`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontOriginAccessControl # GA

CloudFrontOriginAccessControl is the Schema for managing CloudFront origin access controls.

kubectl get cloudfrontoriginaccesscontrols · example on GitHub

Example

# CloudFrontOriginAccessControl — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontoriginaccesscontrol
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontOriginAccessControl
metadata:
  name: example-cloudfrontoriginaccesscontrol
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-cloudfrontoriginaccesscontrol
  originAccessControlOriginType: s3
  providerRef:
    name: example-cloudfrontoriginaccesscontrol
    region: us-east-1
  signingBehavior: always
  signingProtocol: sigv4

Spec

Field	Type	Required	Description
`description`	string	—	Description is an optional description.
`name`	string	yes	Name is the name for the origin access control.
`originAccessControlOriginType`	enum	yes	OriginAccessControlOriginType is the type of origin this OAC is for. Allowed: `s3, mediastore, mediapackagev2, lambda`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`signingBehavior`	enum	yes	SigningBehavior specifies which requests CloudFront signs. Allowed: `always, never, no-override`
`signingProtocol`	enum	—	SigningProtocol is the signing protocol. Allowed: `sigv4`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`etag`	string	—	ETag is the ETag for the origin access control.
`id`	string	—	ID is the ID of the origin access control.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

CloudFrontOriginRequestPolicy # CLOUD CONTROL · AWS::CloudFront::OriginRequestPolicy

CloudFrontOriginRequestPolicy manages AWS::CloudFront::OriginRequestPolicy through the AWS Cloud Control API.

kubectl get cloudfrontoriginrequestpolicies · example on GitHub

Example

# CloudFrontOriginRequestPolicy — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontoriginrequestpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontOriginRequestPolicy
metadata:
  name: example-cloudfrontoriginrequestpolicy
  namespace: default
spec:
  originRequestPolicyConfig:
    comment: Managed by konfig-konector
    cookiesConfig:
      cookieBehavior: example
      cookies:
      - example
    headersConfig:
      headerBehavior: example
      headers:
      - example
    name: example-cloudfrontoriginrequestpolicy
    queryStringsConfig:
      queryStringBehavior: example
      queryStrings:
      - example
  providerRef:
    name: example-cloudfrontoriginrequestpolicy
    region: us-east-1

Spec

Field	Type	Required	Description
`originRequestPolicyConfig`	object	yes	The origin request policy configuration.
`originRequestPolicyConfig.comment`	string	—	A comment to describe the origin request policy.
`originRequestPolicyConfig.cookiesConfig`	object	yes	The cookies from viewer requests to include in origin requests.
`originRequestPolicyConfig.cookiesConfig.cookieBehavior`	string	yes	Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin.
`originRequestPolicyConfig.cookiesConfig.cookies`	array<string>	—	Contains a list of cookie names.
`originRequestPolicyConfig.headersConfig`	object	yes	The HTTP headers to include in origin requests.
`originRequestPolicyConfig.headersConfig.headerBehavior`	string	yes	Determines whether any HTTP headers are included in requests that CloudFront sends to the origin.
`originRequestPolicyConfig.headersConfig.headers`	array<string>	—	Contains a list of HTTP header names.
`originRequestPolicyConfig.name`	string	yes	A unique name to identify the origin request policy.
`originRequestPolicyConfig.queryStringsConfig`	object	yes	The URL query strings from viewer requests to include in origin requests.
`originRequestPolicyConfig.queryStringsConfig.queryStringBehavior`	string	yes	Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin.
`originRequestPolicyConfig.queryStringsConfig.queryStrings`	array<string>	—	Contains a list of query string names.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontPublicKey # CLOUD CONTROL · AWS::CloudFront::PublicKey

CloudFrontPublicKey manages AWS::CloudFront::PublicKey through the AWS Cloud Control API.

kubectl get cloudfrontpublickeys · example on GitHub

Example

# CloudFrontPublicKey — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontpublickey
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontPublicKey
metadata:
  name: example-cloudfrontpublickey
  namespace: default
spec:
  providerRef:
    name: example-cloudfrontpublickey
    region: us-east-1
  publicKeyConfig:
    callerReference: example
    comment: Managed by konfig-konector
    encodedKey: example
    name: example-cloudfrontpublickey

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`publicKeyConfig`	object	yes	Configuration information about a public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html), or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level
`publicKeyConfig.callerReference`	string	yes	A string included in the request to help make sure that the request can't be replayed.
`publicKeyConfig.comment`	string	—	A comment to describe the public key.
`publicKeyConfig.encodedKey`	string	yes	The public key that you can use with [signed URLs and signed cookies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html), or with [field-level encryption](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html).
`publicKeyConfig.name`	string	yes	A name to help identify the public key.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontRealtimeLogConfig # CLOUD CONTROL · AWS::CloudFront::RealtimeLogConfig

CloudFrontRealtimeLogConfig manages AWS::CloudFront::RealtimeLogConfig through the AWS Cloud Control API.

kubectl get cloudfrontrealtimelogconfigs · example on GitHub

Example

# CloudFrontRealtimeLogConfig — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontrealtimelogconfig
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontRealtimeLogConfig
metadata:
  name: example-cloudfrontrealtimelogconfig
  namespace: default
spec:
  endPoints:
  - kinesisStreamConfig:
      roleArn: arn:aws:iam::123456789012:role/example-role
      streamArn: arn:aws:iam::123456789012:role/example-role
    streamType: example
  fields:
  - example
  name: example-cloudfrontrealtimelogconfig
  providerRef:
    name: example-cloudfrontrealtimelogconfig
    region: us-east-1
  samplingRate: 1

Spec

Field	Type	Required	Description
`endPoints`	array<object>	yes	Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
`endPoints[].kinesisStreamConfig`	object	yes	Contains information about the Amazon Kinesis data stream where you are sending real-time log data in a real-time log configuration.
`endPoints[].kinesisStreamConfig.roleArn`	string	yes	The Amazon Resource Name (ARN) of an IAMlong (IAM) role that CloudFront can use to send real-time log data to your Kinesis data stream.
`endPoints[].kinesisStreamConfig.streamArn`	string	yes	The Amazon Resource Name (ARN) of the Kinesis data stream where you are sending real-time log data.
`endPoints[].streamType`	string	yes	The type of data stream where you are sending real-time log data.
`fields`	array<string>	yes	A list of fields that are included in each real-time log record.
`name`	string	yes	The unique name of this real-time log configuration.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`samplingRate`	number	yes	The sampling rate for this real-time log configuration.

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontResponseHeadersPolicy # CLOUD CONTROL · AWS::CloudFront::ResponseHeadersPolicy

CloudFrontResponseHeadersPolicy manages AWS::CloudFront::ResponseHeadersPolicy through the AWS Cloud Control API.

kubectl get cloudfrontresponseheaderspolicies · example on GitHub

Example

# CloudFrontResponseHeadersPolicy — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontresponseheaderspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontResponseHeadersPolicy
metadata:
  name: example-cloudfrontresponseheaderspolicy
  namespace: default
spec:
  providerRef:
    name: example-cloudfrontresponseheaderspolicy
    region: us-east-1
  responseHeadersPolicyConfig:
    comment: Managed by konfig-konector
    corsConfig:
      accessControlAllowCredentials: false
      accessControlAllowHeaders:
        items:
        - example
      accessControlAllowMethods:
        items:
        - example
      accessControlAllowOrigins:
        items:
        - example
      accessControlExposeHeaders:
        items:
        - example
      accessControlMaxAgeSec: 1
      originOverride: false
    customHeadersConfig:
      items:
      - header: example
        override: false
        value: example
    name: example-cloudfrontresponseheaderspolicy
    removeHeadersConfig:
      items:
      - header: example
    securityHeadersConfig:
      contentSecurityPolicy:
        contentSecurityPolicy: example
        override: false
      contentTypeOptions:
        override: false
      frameOptions:
        frameOption: example
        override: false
      referrerPolicy:
        override: false
        referrerPolicy: example
      strictTransportSecurity:
        accessControlMaxAgeSec: 1
        includeSubdomains: false
        override: false
        preload: false
      xssProtection:
        modeBlock: false
        override: false
        protection: true
        reportUri: example
    serverTimingHeadersConfig:
      enabled: true
      samplingRate: 1

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`responseHeadersPolicyConfig`	object	yes	A response headers policy configuration.
`responseHeadersPolicyConfig.comment`	string	—	A comment to describe the response headers policy.
`responseHeadersPolicyConfig.corsConfig`	object	—	A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).
`responseHeadersPolicyConfig.corsConfig.accessControlAllowCredentials`	boolean	yes	A Boolean that CloudFront uses as the value for the ``Access-Control-Allow-Credentials`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowHeaders`	object	yes	A list of HTTP header names that CloudFront includes as values for the ``Access-Control-Allow-Headers`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowHeaders.items`	array<string>	yes	The list of HTTP header names.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowMethods`	object	yes	A list of HTTP methods that CloudFront includes as values for the ``Access-Control-Allow-Methods`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowMethods.items`	array<string>	yes	The list of HTTP methods.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowOrigins`	object	yes	A list of origins (domain names) that CloudFront can use as the value for the ``Access-Control-Allow-Origin`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.accessControlAllowOrigins.items`	array<string>	yes	The list of origins (domain names).
`responseHeadersPolicyConfig.corsConfig.accessControlExposeHeaders`	object	—	A list of HTTP headers that CloudFront includes as values for the ``Access-Control-Expose-Headers`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.accessControlExposeHeaders.items`	array<string>	yes	The list of HTTP headers.
`responseHeadersPolicyConfig.corsConfig.accessControlMaxAgeSec`	integer	—	A number that CloudFront uses as the value for the ``Access-Control-Max-Age`` HTTP response header.
`responseHeadersPolicyConfig.corsConfig.originOverride`	boolean	yes	A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
`responseHeadersPolicyConfig.customHeadersConfig`	object	—	A configuration for a set of custom HTTP response headers.
`responseHeadersPolicyConfig.customHeadersConfig.items`	array<object>	yes	The list of HTTP response headers and their values.
`responseHeadersPolicyConfig.customHeadersConfig.items[].header`	string	yes	The HTTP response header name.
`responseHeadersPolicyConfig.customHeadersConfig.items[].override`	boolean	yes	A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.
`responseHeadersPolicyConfig.customHeadersConfig.items[].value`	string	yes	The value for the HTTP response header.
`responseHeadersPolicyConfig.name`	string	yes	A name to identify the response headers policy.
`responseHeadersPolicyConfig.removeHeadersConfig`	object	—	A configuration for a set of HTTP headers to remove from the HTTP response.
`responseHeadersPolicyConfig.removeHeadersConfig.items`	array<object>	yes	The list of HTTP header names.
`responseHeadersPolicyConfig.removeHeadersConfig.items[].header`	string	yes	The HTTP header name.
`responseHeadersPolicyConfig.securityHeadersConfig`	object	—	A configuration for a set of security-related HTTP response headers.
`responseHeadersPolicyConfig.securityHeadersConfig.contentSecurityPolicy`	object	—	The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.contentSecurityPolicy.contentSecurityPolicy`	string	yes	The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.contentSecurityPolicy.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``Content-Security-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.contentTypeOptions`	object	—	Determines whether CloudFront includes the ``X-Content-Type-Options`` HTTP response header with its value set to ``nosniff``.
`responseHeadersPolicyConfig.securityHeadersConfig.contentTypeOptions.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``X-Content-Type-Options`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.frameOptions`	object	—	Determines whether CloudFront includes the ``X-Frame-Options`` HTTP response header and the header's value.
`responseHeadersPolicyConfig.securityHeadersConfig.frameOptions.frameOption`	string	yes	The value of the ``X-Frame-Options`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.frameOptions.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``X-Frame-Options`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.referrerPolicy`	object	—	Determines whether CloudFront includes the ``Referrer-Policy`` HTTP response header and the header's value.
`responseHeadersPolicyConfig.securityHeadersConfig.referrerPolicy.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``Referrer-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.referrerPolicy.referrerPolicy`	string	yes	Determines whether CloudFront includes the ``Referrer-Policy`` HTTP response header and the header's value.
`responseHeadersPolicyConfig.securityHeadersConfig.strictTransportSecurity`	object	—	Determines whether CloudFront includes the ``Strict-Transport-Security`` HTTP response header and the header's value.
`responseHeadersPolicyConfig.securityHeadersConfig.strictTransportSecurity.accessControlMaxAgeSec`	integer	yes	A number that CloudFront uses as the value for the ``max-age`` directive in the ``Strict-Transport-Security`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.strictTransportSecurity.includeSubdomains`	boolean	—	A Boolean that determines whether CloudFront includes the ``includeSubDomains`` directive in the ``Strict-Transport-Security`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.strictTransportSecurity.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``Strict-Transport-Security`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.strictTransportSecurity.preload`	boolean	—	A Boolean that determines whether CloudFront includes the ``preload`` directive in the ``Strict-Transport-Security`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.xssProtection`	object	—	Determines whether CloudFront includes the ``X-XSS-Protection`` HTTP response header and the header's value.
`responseHeadersPolicyConfig.securityHeadersConfig.xssProtection.modeBlock`	boolean	—	A Boolean that determines whether CloudFront includes the ``mode=block`` directive in the ``X-XSS-Protection`` header.
`responseHeadersPolicyConfig.securityHeadersConfig.xssProtection.override`	boolean	yes	A Boolean that determines whether CloudFront overrides the ``X-XSS-Protection`` HTTP response header received from the origin with the one specified in this response headers policy.
`responseHeadersPolicyConfig.securityHeadersConfig.xssProtection.protection`	boolean	yes	A Boolean that determines the value of the ``X-XSS-Protection`` HTTP response header.
`responseHeadersPolicyConfig.securityHeadersConfig.xssProtection.reportUri`	string	—	A reporting URI, which CloudFront uses as the value of the ``report`` directive in the ``X-XSS-Protection`` header.
`responseHeadersPolicyConfig.serverTimingHeadersConfig`	object	—	A configuration for enabling the ``Server-Timing`` header in HTTP responses sent from CloudFront.
`responseHeadersPolicyConfig.serverTimingHeadersConfig.enabled`	boolean	yes	A Boolean that determines whether CloudFront adds the ``Server-Timing`` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
`responseHeadersPolicyConfig.serverTimingHeadersConfig.samplingRate`	number	—	A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the ``Server-Timing`` header to.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

CloudFrontTrustStore # CLOUD CONTROL · AWS::CloudFront::TrustStore

CloudFrontTrustStore manages AWS::CloudFront::TrustStore through the AWS Cloud Control API.

kubectl get cloudfronttruststores · example on GitHub

Example

# CloudFrontTrustStore — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfronttruststore
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontTrustStore
metadata:
  name: example-cloudfronttruststore
  namespace: default
spec:
  caCertificatesBundleSource:
    caCertificatesBundleS3Location:
      bucket: example
      key: example
      region: us-east-1
      version: '1.0'
  name: example-cloudfronttruststore
  providerRef:
    name: example-cloudfronttruststore
    region: us-east-1
  tags:
  - key: example
    value: example
  useClientCertificateOCSPEndpoint: false

Spec

Field	Type	Required	Description
`caCertificatesBundleSource`	object	—	A CA certificates bundle source.
`caCertificatesBundleSource.caCertificatesBundleS3Location`	object	yes	The CA certificates bundle location in Amazon S3.
`caCertificatesBundleSource.caCertificatesBundleS3Location.bucket`	string	yes	The S3 bucket.
`caCertificatesBundleSource.caCertificatesBundleS3Location.key`	string	yes	The location's key.
`caCertificatesBundleSource.caCertificatesBundleS3Location.region`	string	yes	The location's Region.
`caCertificatesBundleSource.caCertificatesBundleS3Location.version`	string	—	The location's version.
`name`	string	yes	The trust store's name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes
`useClientCertificateOCSPEndpoint`	boolean	—	A boolean.

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`eTag`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`numberOfCaCertificates`	integer	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `PENDING, ACTIVE, FAILED`

CloudFrontVpcOrigin # CLOUD CONTROL · AWS::CloudFront::VpcOrigin

CloudFrontVpcOrigin manages AWS::CloudFront::VpcOrigin through the AWS Cloud Control API.

kubectl get cloudfrontvpcorigins · example on GitHub

Example

# CloudFrontVpcOrigin — CloudFront
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/cloudfront.html#cloudfrontvpcorigin
apiVersion: aws.konfig.io/v1alpha1
kind: CloudFrontVpcOrigin
metadata:
  name: example-cloudfrontvpcorigin
  namespace: default
spec:
  providerRef:
    name: example-cloudfrontvpcorigin
    region: us-east-1
  tags:
  - key: example
    value: example
  vpcOriginEndpointConfig:
    arn: arn:aws:iam::123456789012:role/example-role
    httpPort: 443
    httpsPort: 443
    ipAddressType: ipv4
    name: example-cloudfrontvpcorigin
    originProtocolPolicy: example
    originSSLProtocols:
    - example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A complex type that contains zero or more ``Tag`` elements.
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcOriginEndpointConfig`	object	yes	The VPC origin endpoint configuration.
`vpcOriginEndpointConfig.arn`	string	yes	The ARN of the CloudFront VPC origin endpoint configuration.
`vpcOriginEndpointConfig.httpPort`	integer	—	The HTTP port for the CloudFront VPC origin endpoint configuration.
`vpcOriginEndpointConfig.httpsPort`	integer	—	The HTTPS port of the CloudFront VPC origin endpoint configuration.
`vpcOriginEndpointConfig.ipAddressType`	enum	—	Allowed: `ipv4, dualstack`
`vpcOriginEndpointConfig.name`	string	yes	The name of the CloudFront VPC origin endpoint configuration.
`vpcOriginEndpointConfig.originProtocolPolicy`	string	—	The origin protocol policy for the CloudFront VPC origin endpoint configuration.
`vpcOriginEndpointConfig.originSSLProtocols`	array<string>	—	Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS.

Status

Field	Type	Required	Description
`accountId`	string	—	Read-only: reported by AWS after creation.
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdTime`	string	—	Read-only: reported by AWS after creation.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastModifiedTime`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	Read-only: reported by AWS after creation.