@quadnix/octo-aws-cdk 0.1.0 → 0.2.0

package/dist/resources/cloudfront-distribution/index.schema.js

@@ -0,0 +1,754 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+/**
+ * One origin the distribution can serve from.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontOriginSchema {
+    constructor() {
+        /**
+         * How many times CloudFront retries the origin before giving up. Between 1 and 3.
+         */
+        this.connectionAttempts = Schema(3);
+        /**
+         * How long CloudFront waits to establish a connection to the origin, in seconds. Between 1 and 10.
+         */
+        this.connectionTimeout = Schema(10);
+        /**
+         * Headers CloudFront adds to every request it sends to this origin.
+         * This is how a load balancer rejects anything that did not arrive through the distribution.
+         */
+        this.customHeaders = Schema({});
+        /**
+         * What kind of origin this is, and the settings that only apply to that kind.
+         *
+         * * `s3` is a bucket reached privately. The distribution emits an origin access control for it,
+         * and builds the hostname from `bucketName` and `bucketRegion` rather than referencing the bucket,
+         * because the bucket's own policy already references this distribution. Granting the distribution
+         * read on the bucket is the bucket's job, driven by an overlay.
+         * * `custom` is anything that speaks HTTP - a load balancer, an EC2 instance, an API, a third
+         * party, or an S3 website endpoint.
+         */
+        this.kind = Schema();
+        /**
+         * How this origin is named by behaviors and origin groups. Unique across origins and origin groups.
+         */
+        this.originId = Schema();
+        /**
+         * A prefix CloudFront prepends to the path before asking the origin for it.
+         * Empty asks the origin for the path the viewer requested.
+         */
+        this.originPath = Schema('');
+    }
+}
+__decorate([
+    Validate({ options: { maxLength: 3, minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "connectionAttempts", void 0);
+__decorate([
+    Validate({ options: { maxLength: 10, minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "connectionTimeout", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => Object.keys(value),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "customHeaders", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value.kind === 's3'
+            ? [value.bucketName, value.bucketRegion]
+            : [value.originProtocolPolicy, ...value.sslProtocols],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "kind", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "originId", void 0);
+/**
+ * A primary origin and the origin CloudFront falls back to when the primary answers with one of
+ * `failoverStatusCodes`.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontOriginGroupSchema {
+    constructor() {
+        /**
+         * The origin id CloudFront falls back to.
+         */
+        this.failoverOriginId = Schema();
+        /**
+         * The status codes from the primary origin that trigger the failover.
+         */
+        this.failoverStatusCodes = Schema();
+        /**
+         * How this group is named by behaviors. Unique across origins and origin groups.
+         */
+        this.originGroupId = Schema();
+        /**
+         * The origin id CloudFront tries first.
+         */
+        this.primaryOriginId = Schema();
+    }
+}
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "failoverOriginId", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { maxLength: 599, minLength: 100 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "failoverStatusCodes", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "originGroupId", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "primaryOriginId", void 0);
+/**
+ * An edge function CloudFront runs for a behavior. The function itself is not created here - pass
+ * the ARN of one that already exists.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontFunctionAssociationSchema {
+    constructor() {
+        /**
+         * The ARN of the CloudFront Function or the Lambda@Edge function version.
+         */
+        this.arn = Schema();
+        /**
+         * Which lifecycle event the function runs on. See {@link ICloudFrontFunctionEventType}.
+         */
+        this.eventType = Schema();
+        /**
+         * Which engine runs it. A `cloudfront-function` is JavaScript at the edge and may only bind to a
+         * viewer event; `lambda-edge` may bind to any of the four.
+         */
+        this.kind = Schema();
+    }
+}
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "arn", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "eventType", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontFunctionAssociationSchema.prototype, "kind", void 0);
+/**
+ * One rule binding a set of paths to an origin, and deciding everything about how those paths are
+ * served.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontBehaviorSchema {
+    constructor() {
+        /**
+         * The HTTP methods CloudFront forwards to the origin.
+         * `['GET', 'HEAD']` is a CDN; the full set makes the distribution a reverse proxy.
+         */
+        this.allowedMethods = Schema(['GET', 'HEAD']);
+        /**
+         * The subset of `allowedMethods` whose responses CloudFront caches.
+         */
+        this.cachedMethods = Schema(['GET', 'HEAD']);
+        /**
+         * Which policy decides the cache key and the TTLs. See {@link ICloudFrontPolicyReference}.
+         */
+        this.cachePolicy = Schema();
+        /**
+         * Whether CloudFront compresses the response for viewers that accept it.
+         */
+        this.compress = Schema(true);
+        /**
+         * Edge functions to run for this behavior. See {@link CloudFrontFunctionAssociationSchema}.
+         */
+        this.functionAssociations = Schema([]);
+        /**
+         * Which policy decides what reaches the origin, independently of the cache key.
+         * `null` forwards only what the cache policy already selected.
+         */
+        this.originRequestPolicy = Schema(null);
+        /**
+         * The paths this behavior claims, e.g. `/api/*`. Absent on the default behavior, which claims
+         * everything no other behavior did.
+         */
+        this.pathPattern = Schema(null);
+        /**
+         * Which policy decides the headers CloudFront adds on the way out - CORS, HSTS, and the app's own
+         * content security policy. `null` adds nothing.
+         */
+        this.responseHeadersPolicy = Schema(null);
+        /**
+         * The origin or origin group serving these paths.
+         */
+        this.targetOriginId = Schema();
+        /**
+         * What CloudFront does with a plain HTTP request.
+         */
+        this.viewerProtocolPolicy = Schema('redirect-to-https');
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "allowedMethods", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "cachedMethods", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind, value.name],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "cachePolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { isSchema: { schema: CloudFrontFunctionAssociationSchema } },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "functionAssociations", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value ? [value.kind, value.name] : [],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "originRequestPolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => (value ? [value] : []),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "pathPattern", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value ? [value.kind, value.name] : [],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "responseHeadersPolicy", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "targetOriginId", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontBehaviorSchema.prototype, "viewerProtocolPolicy", void 0);
+/**
+ * What the viewer gets when the origin answers with a status code CloudFront was told to handle.
+ *
+ * The same field set expresses opposite intents. A single-page app maps `403` and `404` to a `200`
+ * carrying `/index.html` with a short TTL, so the client-side router can take over; a content site
+ * maps them to a real `404` carrying an error page.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontCustomErrorResponseSchema {
+    constructor() {
+        /**
+         * How long CloudFront caches this error before asking the origin again, in seconds.
+         */
+        this.errorCachingMinTtl = Schema(10);
+        /**
+         * The status code the origin answered with.
+         */
+        this.errorCode = Schema();
+        /**
+         * The status code the viewer sees.
+         */
+        this.responseCode = Schema();
+        /**
+         * The object served in place of the error, e.g. `/index.html`.
+         */
+        this.responsePagePath = Schema();
+    }
+}
+__decorate([
+    Validate({ options: { minLength: 0 } }),
+    __metadata("design:type", Object)
+], CloudFrontCustomErrorResponseSchema.prototype, "errorCachingMinTtl", void 0);
+__decorate([
+    Validate({ options: { maxLength: 599, minLength: 100 } }),
+    __metadata("design:type", Object)
+], CloudFrontCustomErrorResponseSchema.prototype, "errorCode", void 0);
+__decorate([
+    Validate({ options: { maxLength: 599, minLength: 100 } }),
+    __metadata("design:type", Object)
+], CloudFrontCustomErrorResponseSchema.prototype, "responseCode", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontCustomErrorResponseSchema.prototype, "responsePagePath", void 0);
+/**
+ * A cache policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontCachePolicySchema {
+    constructor() {
+        /**
+         * Which cookies are part of the cache key.
+         */
+        this.cookies = Schema({ kind: 'none' });
+        /**
+         * How long CloudFront serves an object without asking the origin, when the origin sent no
+         * caching headers of its own. In seconds.
+         */
+        this.defaultTtl = Schema(86400);
+        /**
+         * Whether CloudFront may store and serve a brotli-compressed copy.
+         */
+        this.enableBrotli = Schema(true);
+        /**
+         * Whether CloudFront may store and serve a gzip-compressed copy.
+         */
+        this.enableGzip = Schema(true);
+        /**
+         * Which request headers are part of the cache key.
+         */
+        this.headers = Schema({ kind: 'none' });
+        /**
+         * The longest CloudFront will serve an object without asking the origin, whatever the origin's
+         * own caching headers said. In seconds.
+         */
+        this.maxTtl = Schema(31536000);
+        /**
+         * The shortest CloudFront will serve an object without asking the origin. In seconds.
+         */
+        this.minTtl = Schema(1);
+        /**
+         * How a behavior names this policy.
+         */
+        this.name = Schema();
+        /**
+         * Which query strings are part of the cache key.
+         */
+        this.queryStrings = Schema({ kind: 'none' });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "cookies", void 0);
+__decorate([
+    Validate({ options: { minLength: 0 } }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "defaultTtl", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "headers", void 0);
+__decorate([
+    Validate({ options: { minLength: 0 } }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "maxTtl", void 0);
+__decorate([
+    Validate({ options: { minLength: 0 } }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "minTtl", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "name", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontCachePolicySchema.prototype, "queryStrings", void 0);
+/**
+ * An origin request policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`.
+ *
+ * This is what reaches the origin, and it is separate from the cache key on purpose: an origin can
+ * be told the viewer's `Authorization` header without every distinct token becoming its own cache
+ * entry.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontOriginRequestPolicySchema {
+    constructor() {
+        /**
+         * Which cookies reach the origin.
+         */
+        this.cookies = Schema({ kind: 'none' });
+        /**
+         * Which request headers reach the origin.
+         */
+        this.headers = Schema({ kind: 'none' });
+        /**
+         * How a behavior names this policy.
+         */
+        this.name = Schema();
+        /**
+         * Which query strings reach the origin.
+         */
+        this.queryStrings = Schema({ kind: 'none' });
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginRequestPolicySchema.prototype, "cookies", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginRequestPolicySchema.prototype, "headers", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginRequestPolicySchema.prototype, "name", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => [value.kind],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginRequestPolicySchema.prototype, "queryStrings", void 0);
+/**
+ * The security headers a response headers policy adds. Every field is optional; a `null` field adds
+ * nothing for that header.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontSecurityHeadersSchema {
+    constructor() {
+        /**
+         * The app's own content security policy, verbatim.
+         */
+        this.contentSecurityPolicy = Schema(null);
+        /**
+         * Whether to send `X-Content-Type-Options`, which tells a browser to trust the declared content
+         * type rather than guessing one from the bytes.
+         */
+        this.contentTypeOptions = Schema(true);
+        /**
+         * The value of `X-Frame-Options`, or `null` to send none.
+         */
+        this.frameOptions = Schema('SAMEORIGIN');
+        /**
+         * The value of `Referrer-Policy`, or `null` to send none.
+         */
+        this.referrerPolicy = Schema(null);
+        /**
+         * How long a viewer should keep using HTTPS for this host, in seconds. `null` sends no
+         * `Strict-Transport-Security` header at all.
+         */
+        this.strictTransportSecurityMaxAge = Schema(31536000);
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => (value ? [value] : []),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontSecurityHeadersSchema.prototype, "contentSecurityPolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => (value ? [value] : []),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontSecurityHeadersSchema.prototype, "frameOptions", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => (value ? [value] : []),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontSecurityHeadersSchema.prototype, "referrerPolicy", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value === null || value === undefined ? [] : [value],
+        options: { minLength: 0 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontSecurityHeadersSchema.prototype, "strictTransportSecurityMaxAge", void 0);
+/**
+ * A response headers policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontResponseHeadersPolicySchema {
+    constructor() {
+        /**
+         * A cross-origin resource sharing configuration, or `null` for none.
+         */
+        this.cors = Schema(null);
+        /**
+         * Headers CloudFront adds verbatim. `override` decides what happens when the origin already sent
+         * one of the same name.
+         */
+        this.customHeaders = Schema([]);
+        /**
+         * How a behavior names this policy.
+         */
+        this.name = Schema();
+        /**
+         * Headers CloudFront strips from the origin's response before the viewer sees it.
+         */
+        this.removeHeaders = Schema([]);
+        /**
+         * The security headers to add, or `null` to add none.
+         * See {@link CloudFrontSecurityHeadersSchema}.
+         */
+        this.securityHeaders = Schema(null);
+    }
+}
+__decorate([
+    Validate({
+        destruct: (value) => value ? [...value.allowHeaders, ...value.allowMethods, ...value.allowOrigins] : [],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontResponseHeadersPolicySchema.prototype, "cors", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value.flatMap((v) => [v.header, v.value]),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontResponseHeadersPolicySchema.prototype, "customHeaders", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontResponseHeadersPolicySchema.prototype, "name", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontResponseHeadersPolicySchema.prototype, "removeHeaders", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value ? [value] : [],
+        options: { isSchema: { schema: CloudFrontSecurityHeadersSchema } },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontResponseHeadersPolicySchema.prototype, "securityHeaders", void 0);
+/**
+ * The `CloudFrontDistributionSchema` class is the schema for the `CloudFrontDistribution` resource,
+ * which represents an AWS CloudFront distribution. Terraform provisions it as
+ * [`aws_cloudfront_distribution`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution),
+ * alongside an
+ * [`aws_cloudfront_origin_access_control`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control)
+ * per S3 origin and one terraform resource per policy the distribution declares.
+ *
+ * The distribution is deliberately open. It carries several origins of mixed kinds, a routing table
+ * of behaviors over them, and the security layer around both, so that one module can serve a
+ * single-page app out of a bucket while another puts the same resource in front of a load balancer.
+ * The opinion about which of those a caller gets belongs to the module, not here.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ *
+ * @overrideProperty parents - Every managed origin that is not an S3 bucket. The distribution reads
+ * such an origin's hostname out of its response, so it is a child of it. An S3 origin runs the other
+ * way - the bucket's policy has to name this distribution's ARN, which AWS assigns, so the bucket is
+ * the child and this distribution writes the bucket's hostname literally.
+ * ```mermaid
+ * graph TD;
+ *   origin((Origin<br>Resource)) --> cloudfront_distribution((CloudFront<br>Distribution))
+ *   cloudfront_distribution --> s3_bucket((S3<br>Bucket))
+ * ```
+ * @overrideProperty resourceId - The resource id is of format `cloudfront-<distribution-name>`.
+ * There is no region in it: CloudFront is global, and the provider is found on the account alone.
+ */
+export class CloudFrontDistributionSchema extends BaseResourceSchema {
+    constructor() {
+        super(...arguments);
+        /**
+         * Input properties.
+         * * `properties.aliases` - The custom domain names the distribution answers on. Each one needs a
+         * DNS record pointing at the distribution, which this resource does not create. Empty serves only
+         * the `*.cloudfront.net` domain CloudFront assigns.
+         * * `properties.awsAccountId` - The AWS account id.
+         * * `properties.behaviors` - The routing table. Exactly one entry has no `pathPattern` and is the
+         * default behavior; the rest are matched in order before it.
+         * See {@link CloudFrontBehaviorSchema}.
+         * * `properties.cachePolicies` - Cache policies this distribution declares.
+         * See {@link CloudFrontCachePolicySchema}.
+         * * `properties.comment` - A human-readable label. It is the only name a distribution carries in
+         * the console.
+         * * `properties.customErrorResponses` - What the viewer gets for an origin error.
+         * See {@link CloudFrontCustomErrorResponseSchema}.
+         * * `properties.defaultRootObject` - The object served for a request to the site root.
+         * * `properties.distributionName` - What names this distribution. Part of its identity.
+         * * `properties.enabled` - Whether the distribution serves traffic. Disabling is also the first
+         * half of deleting one, which AWS makes a slow operation.
+         * * `properties.geoRestriction` - Which countries may reach the distribution.
+         * * `properties.httpVersion` - The newest HTTP version viewers may negotiate.
+         * * `properties.isIpv6Enabled` - Whether the distribution answers over IP version 6.
+         * * `properties.logging` - Where CloudFront writes its access logs, or `null` for none. The bucket
+         * is not created here.
+         * * `properties.originGroups` - Fail-over pairs over the origins.
+         * See {@link CloudFrontOriginGroupSchema}.
+         * * `properties.originRequestPolicies` - Origin request policies this distribution declares.
+         * See {@link CloudFrontOriginRequestPolicySchema}.
+         * * `properties.origins` - Where content comes from. See {@link CloudFrontOriginSchema}.
+         * * `properties.priceClass` - Which edge locations serve the traffic, which is what the
+         * distribution costs. `PriceClass_100` is North America and Europe alone.
+         * * `properties.responseHeadersPolicies` - Response headers policies this distribution declares.
+         * See {@link CloudFrontResponseHeadersPolicySchema}.
+         * * `properties.viewerCertificate` - The certificate viewers see. `default` serves CloudFront's
+         * own, which is valid only for the assigned `*.cloudfront.net` domain; `acm` serves a certificate
+         * of yours, which CloudFront reads from `us-east-1` alone.
+         * * `properties.webAclArn` - The web ACL guarding the distribution, or `null` for none. The
+         * ACL is not created here, and CloudFront reads it from `us-east-1` alone.
+         */
+        this.properties = Schema();
+        /**
+         * Saved response.
+         * * `response.Arn` - The ARN of the distribution. A bucket admitting this distribution names it.
+         * * `response.DistributionId` - The distribution id, which is what an invalidation is issued against.
+         * * `response.DomainName` - The `*.cloudfront.net` domain CloudFront assigned. Point a DNS record
+         * at this.
+         * * `response.HostedZoneId` - The zone a Route 53 alias record pointing at this distribution needs.
+         * It is the same constant for every CloudFront distribution, and it is published here so that a
+         * DNS module never has to know that.
+         */
+        this.response = Schema({
+            Arn: 'arn:aws:cloudfront::000000000000:distribution/E000000000000',
+            DistributionId: 'E000000000000',
+            DomainName: 'd000000000000.cloudfront.net',
+            HostedZoneId: 'Z2FDTNDATAQYW2',
+        });
+    }
+}
+__decorate([
+    Validate([
+        {
+            destruct: (value) => [
+                ...value.aliases,
+                value.awsAccountId,
+                value.distributionName,
+                value.httpVersion,
+                value.priceClass,
+            ],
+            options: { minLength: 1 },
+        },
+        {
+            destruct: (value) => value.origins,
+            options: { isSchema: { schema: CloudFrontOriginSchema } },
+        },
+        {
+            destruct: (value) => value.originGroups,
+            options: { isSchema: { schema: CloudFrontOriginGroupSchema } },
+        },
+        {
+            destruct: (value) => value.behaviors,
+            options: { isSchema: { schema: CloudFrontBehaviorSchema } },
+        },
+        {
+            destruct: (value) => value.customErrorResponses,
+            options: { isSchema: { schema: CloudFrontCustomErrorResponseSchema } },
+        },
+        {
+            destruct: (value) => value.cachePolicies,
+            options: { isSchema: { schema: CloudFrontCachePolicySchema } },
+        },
+        {
+            destruct: (value) => value.originRequestPolicies,
+            options: { isSchema: { schema: CloudFrontOriginRequestPolicySchema } },
+        },
+        {
+            destruct: (value) => value.responseHeadersPolicies,
+            options: { isSchema: { schema: CloudFrontResponseHeadersPolicySchema } },
+        },
+    ]),
+    __metadata("design:type", Object)
+], CloudFrontDistributionSchema.prototype, "properties", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => {
+            const subjects = [];
+            if (value.Arn) {
+                subjects.push(value.Arn);
+            }
+            if (value.DistributionId) {
+                subjects.push(value.DistributionId);
+            }
+            if (value.DomainName) {
+                subjects.push(value.DomainName);
+            }
+            if (value.HostedZoneId) {
+                subjects.push(value.HostedZoneId);
+            }
+            return subjects;
+        },
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontDistributionSchema.prototype, "response", void 0);
+//# sourceMappingURL=index.schema.js.map