@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/resources/cloudfront-distribution/cloudfront-origin.schema.js

@@ -0,0 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Schema, Validate } from '@quadnix/octo';
+/**
+ * One origin the distribution can serve from.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontOriginSchema {
+    constructor() {
+        /**
+         * How many times CloudFront retries the origin before giving up. Between 1 and 3.
+         */
+        this.connectionAttempts = Schema(3);
+        /**
+         * How long CloudFront waits to establish a connection to the origin, in seconds. Between 1 and 10.
+         */
+        this.connectionTimeout = Schema(10);
+        /**
+         * Headers CloudFront adds to every request it sends to this origin.
+         * This is how a load balancer rejects anything that did not arrive through the distribution.
+         */
+        this.customHeaders = Schema({});
+        /**
+         * What kind of origin this is, and the settings that only apply to that kind.
+         *
+         * * `s3` is a bucket reached privately, through an origin access control the distribution creates.
+         * Read access on the bucket is granted by the bucket, not here.
+         * * `lambda` is the URL of a Lambda function, reached over HTTPS through an origin access control the
+         * distribution creates. The function admits the distribution, not this origin. `resourceId` is the
+         * function's, set by `CloudFrontDistribution.addLambdaOrigin()` when it attaches the function.
+         * * `alb` is an internet-facing ALB, reached over HTTP on port 80, the only listener octo's ALB
+         * has. `resourceId` is the ALB's, set by `CloudFrontDistribution.addAlbOrigin()` when it attaches the ALB.
+         * * `custom` is a hostname octo does not manage - a legacy origin, or a third party.
+         */
+        this.kind = Schema();
+        /**
+         * A name you choose for this origin, e.g. `website`. Behaviors and origin groups refer to it.
+         * Unique across origins and origin groups.
+         */
+        this.originId = Schema();
+        /**
+         * A prefix CloudFront prepends to the path before asking the origin for it.
+         * Empty asks the origin for the path the viewer requested.
+         */
+        this.originPath = Schema('');
+    }
+}
+__decorate([
+    Validate({ options: { maxLength: 3, minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "connectionAttempts", void 0);
+__decorate([
+    Validate({ options: { maxLength: 10, minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "connectionTimeout", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => Object.keys(value),
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "customHeaders", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value.kind === 's3'
+            ? [value.bucketName, value.bucketRegion]
+            : value.kind === 'lambda' || value.kind === 'alb'
+                ? [value.resourceId ?? []].flat()
+                : [value.domainName, value.originProtocolPolicy, ...value.sslProtocols],
+        options: { minLength: 1 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "kind", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginSchema.prototype, "originId", void 0);
+/**
+ * A primary origin and the origin CloudFront falls back to when the primary answers with one of
+ * `failoverStatusCodes`.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export class CloudFrontOriginGroupSchema {
+    constructor() {
+        /**
+         * The `originId` of one of this distribution's origins, which CloudFront falls back to.
+         */
+        this.failoverOriginId = Schema();
+        /**
+         * The status codes from the primary origin that trigger the failover.
+         */
+        this.failoverStatusCodes = Schema();
+        /**
+         * A name you choose for this group, e.g. `website-with-failover`. Behaviors refer to it.
+         * Unique across origins and origin groups.
+         */
+        this.originGroupId = Schema();
+        /**
+         * The `originId` of one of this distribution's origins, which CloudFront tries first.
+         */
+        this.primaryOriginId = Schema();
+    }
+}
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "failoverOriginId", void 0);
+__decorate([
+    Validate({
+        destruct: (value) => value,
+        options: { maxLength: 599, minLength: 100 },
+    }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "failoverStatusCodes", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "originGroupId", void 0);
+__decorate([
+    Validate({ options: { minLength: 1 } }),
+    __metadata("design:type", Object)
+], CloudFrontOriginGroupSchema.prototype, "primaryOriginId", void 0);
+//# sourceMappingURL=cloudfront-origin.schema.js.map

package/dist/resources/cloudfront-distribution/cloudfront-origin.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudfront-origin.schema.js","sourceRoot":"","sources":["../../../src/resources/cloudfront-distribution/cloudfront-origin.schema.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAAnC;QACE;;WAEG;QAEH,uBAAkB,GAAI,MAAM,CAAS,CAAC,CAAC,CAAC;QAExC;;WAEG;QAEH,sBAAiB,GAAI,MAAM,CAAS,EAAE,CAAC,CAAC;QAExC;;;WAGG;QAKH,kBAAa,GAAI,MAAM,CAA4B,EAAE,CAAC,CAAC;QAEvD;;;;;;;;;;;WAWG;QAUH,SAAI,GAAG,MAAM,EAcV,CAAC;QAEJ;;;WAGG;QAEH,aAAQ,GAAG,MAAM,EAAU,CAAC;QAE5B;;;WAGG;QACH,eAAU,GAAI,MAAM,CAAS,EAAE,CAAC,CAAC;IACnC,CAAC;CAAA;AAnEC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;kEACd;AAMxC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;iEACf;AAUxC;IAJC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAA8C,EAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAM,CAAC;QAC3F,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;6DACqD;AAuBvD;IATC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAqC,EAAY,EAAE,CAC5D,KAAK,CAAC,IAAI,KAAK,IAAI;YACjB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;gBAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACjC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,oBAAoB,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC;QAC7E,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;KAC1B,CAAC;;oDAeE;AAOJ;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;wDACZ;AAS9B;;;;;;;GAOG;AACH,MAAM,OAAO,2BAA2B;IAAxC;QACE;;WAEG;QAEH,qBAAgB,GAAG,MAAM,EAAU,CAAC;QAEpC;;WAEG;QAKH,wBAAmB,GAAG,MAAM,EAAY,CAAC;QAEzC;;;WAGG;QAEH,kBAAa,GAAG,MAAM,EAAU,CAAC;QAEjC;;WAEG;QAEH,oBAAe,GAAG,MAAM,EAAU,CAAC;IACrC,CAAC;CAAA;AAvBC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;qEACJ;AASpC;IAJC,QAAQ,CAAC;QACR,QAAQ,EAAE,CAAC,KAAyD,EAAY,EAAE,CAAC,KAAK;QACxF,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE;KAC5C,CAAC;;wEACuC;AAOzC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;kEACP;AAMjC;IADC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;;oEACL"}

package/dist/resources/cloudfront-distribution/cloudfront-policy.schema.d.ts

@@ -0,0 +1,361 @@
+declare const CLOUDFRONT_CORS_METHODS: readonly ["ALL", "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"];
+/**
+ * An HTTP method a CORS policy may allow. `ALL` allows every method.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontCorsMethod = (typeof CLOUDFRONT_CORS_METHODS)[number];
+declare const CLOUDFRONT_FRAME_OPTIONS: readonly ["DENY", "SAMEORIGIN"];
+/**
+ * A value of `X-Frame-Options`.
+ * * `DENY` - No site may show the page in a frame, this one included.
+ * * `SAMEORIGIN` - Only pages of this site may show the page in a frame.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontFrameOption = (typeof CLOUDFRONT_FRAME_OPTIONS)[number];
+/**
+ * @internal
+ */
+export declare const CLOUDFRONT_MANAGED_CACHE_POLICIES: readonly ["Managed-CachingDisabled", "Managed-CachingOptimized", "Managed-CachingOptimizedForUncompressedObjects", "UseOriginCacheControlHeaders", "UseOriginCacheControlHeaders-QueryStrings"];
+/**
+ * An AWS managed cache policy a behavior may name.
+ * [AWS: managed cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html).
+ * * `Managed-CachingDisabled` - Caches nothing. For APIs and dynamic apps.
+ * * `Managed-CachingOptimized` - Caches for a day by default, keyed on the path alone. For static
+ * content.
+ * * `Managed-CachingOptimizedForUncompressedObjects` - `Managed-CachingOptimized` for a behavior that
+ * does not compress.
+ * * `UseOriginCacheControlHeaders` - Caches for as long as the origin's `Cache-Control` says, keyed on
+ * the path, `Host`, `Origin`, and every cookie.
+ * * `UseOriginCacheControlHeaders-QueryStrings` - `UseOriginCacheControlHeaders`, with the query
+ * string in the key too.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontManagedCachePolicy = (typeof CLOUDFRONT_MANAGED_CACHE_POLICIES)[number];
+/**
+ * @internal
+ */
+export declare const CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES: readonly ["Managed-AllViewer", "Managed-AllViewerAndCloudFrontHeaders-2022-06", "Managed-AllViewerExceptHostHeader", "Managed-CORS-CustomOrigin", "Managed-CORS-S3Origin", "Managed-HostHeaderOnly", "Managed-UserAgentRefererHeaders"];
+/**
+ * An AWS managed origin request policy a behavior may name.
+ * [AWS: managed origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html).
+ * * `Managed-AllViewer` - Forwards every header, cookie, and query string the viewer sent. For a
+ * load balancer.
+ * * `Managed-AllViewerAndCloudFrontHeaders-2022-06` - `Managed-AllViewer`, plus CloudFront's own
+ * headers, such as the viewer's country.
+ * * `Managed-AllViewerExceptHostHeader` - `Managed-AllViewer` without `Host`. For API Gateway and
+ * Lambda function URLs, which reject any host but their own.
+ * * `Managed-CORS-CustomOrigin` - Forwards `Origin`, for a custom origin that answers CORS.
+ * * `Managed-CORS-S3Origin` - Forwards `Origin` and the CORS request headers, for a bucket that
+ * answers CORS.
+ * * `Managed-HostHeaderOnly` - Forwards `Host` alone.
+ * * `Managed-UserAgentRefererHeaders` - Forwards `User-Agent` and `Referer` alone.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontManagedOriginRequestPolicy = (typeof CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES)[number];
+/**
+ * @internal
+ */
+export declare const CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES: readonly ["Managed-CORS-and-SecurityHeadersPolicy", "Managed-CORS-With-Preflight", "Managed-CORS-with-preflight-and-SecurityHeadersPolicy", "Managed-SecurityHeadersPolicy", "Managed-SimpleCORS"];
+/**
+ * An AWS managed response headers policy a behavior may name.
+ * [AWS: managed response headers policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-response-headers-policies.html).
+ * * `Managed-CORS-and-SecurityHeadersPolicy` - `Managed-SimpleCORS` and `Managed-SecurityHeadersPolicy`
+ * together.
+ * * `Managed-CORS-With-Preflight` - Allows every origin and every method, answering preflight
+ * requests too.
+ * * `Managed-CORS-with-preflight-and-SecurityHeadersPolicy` - `Managed-CORS-With-Preflight` and
+ * `Managed-SecurityHeadersPolicy` together.
+ * * `Managed-SecurityHeadersPolicy` - Adds HSTS for a year, `X-Content-Type-Options: nosniff`,
+ * `X-Frame-Options: SAMEORIGIN`, `Referrer-Policy: strict-origin-when-cross-origin`, and
+ * `X-XSS-Protection: 1; mode=block`. The origin's own values win, except for
+ * `X-Content-Type-Options`.
+ * * `Managed-SimpleCORS` - Allows every origin, for requests that need no preflight.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontManagedResponseHeadersPolicy = (typeof CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES)[number];
+declare const CLOUDFRONT_REFERRER_POLICIES: readonly ["no-referrer", "no-referrer-when-downgrade", "origin", "origin-when-cross-origin", "same-origin", "strict-origin", "strict-origin-when-cross-origin", "unsafe-url"];
+/**
+ * A value of `Referrer-Policy`, which decides how much of the page's URL a browser sends in
+ * `Referer` when leaving it.
+ * * `no-referrer` - Nothing.
+ * * `no-referrer-when-downgrade` - The full URL, except from HTTPS to HTTP.
+ * * `origin` - Only the origin, e.g. `https://example.com/`.
+ * * `origin-when-cross-origin` - The full URL within the site; only the origin to other sites.
+ * * `same-origin` - The full URL within the site; nothing to other sites.
+ * * `strict-origin` - Only the origin, and nothing from HTTPS to HTTP.
+ * * `strict-origin-when-cross-origin` - The full URL within the site; only the origin to other
+ * sites, and nothing from HTTPS to HTTP. What browsers do when no policy is sent.
+ * * `unsafe-url` - The full URL, always.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontReferrerPolicy = (typeof CLOUDFRONT_REFERRER_POLICIES)[number];
+/**
+ * Where a behavior reads a cache, origin request, or response headers policy from.
+ * * `managed` names one of AWS's own policies, from the list of the slot it fills, e.g.
+ * {@link ICloudFrontManagedCachePolicy}.
+ * * `custom` names one of the policies this distribution declares in its own properties.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontPolicyReference<M extends string = string> = {
+    kind: 'custom';
+    name: string;
+} | {
+    kind: 'managed';
+    name: M;
+};
+/**
+ * Which headers, cookies, or query strings of the viewer's request a policy selects.
+ * * `none` - Nothing.
+ * * `allowList` - Only the names in `values`, e.g. `['Authorization']`. Names only, never values.
+ * * `all` - Everything the viewer sent. Not accepted for a cache policy's `headers`.
+ * * `allViewerAndWhitelistCloudFront` - Every header the viewer sent, plus CloudFront's own. Only
+ * accepted for an origin request policy's `headers`.
+ *
+ * Header names are not case-sensitive. Cookie and query string names are, and so are their values:
+ * `?lang=en` and `?lang=EN` are two different requests to CloudFront.
+ *
+ * @group Resources/CloudFrontDistribution
+ */
+export type ICloudFrontValueSelection = {
+    kind: 'all' | 'allViewerAndWhitelistCloudFront' | 'none';
+} | {
+    kind: 'allowList';
+    values: string[];
+};
+/**
+ * A cache policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`. It decides the cache key - what makes two requests different objects -
+ * and how long an object stays cached.
+ *
+ * Everything in the cache key also reaches the origin. With all three TTLs at `0`, nothing is cached.
+ * [AWS: cache policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cache-key-understand-cache-policy.html).
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontCachePolicySchema {
+    /**
+     * Which cookies are part of the cache key. See {@link ICloudFrontValueSelection}.
+     */
+    cookies?: ICloudFrontValueSelection | undefined;
+    /**
+     * How long an object stays cached when the origin sent neither `Cache-Control` nor `Expires`, in
+     * seconds.
+     */
+    defaultTtl?: number | undefined;
+    /**
+     * Whether CloudFront caches a brotli-compressed copy for viewers that accept one. A behavior's
+     * `compress` serves brotli only when this is `true`.
+     */
+    enableBrotli?: boolean | undefined;
+    /**
+     * Whether CloudFront caches a gzip-compressed copy for viewers that accept one. A behavior's
+     * `compress` serves gzip only when this is `true`.
+     */
+    enableGzip?: boolean | undefined;
+    /**
+     * Which request headers are part of the cache key. See {@link ICloudFrontValueSelection}.
+     */
+    headers?: ICloudFrontValueSelection | undefined;
+    /**
+     * The longest an object stays cached when the origin's `Cache-Control` or `Expires` asks for
+     * longer, in seconds.
+     */
+    maxTtl?: number | undefined;
+    /**
+     * The shortest an object stays cached, in seconds. Above `0`, it holds even when the origin sends
+     * `no-cache`, `no-store`, or `private`.
+     */
+    minTtl?: number | undefined;
+    /**
+     * How a behavior names this policy. It is also the policy's name in AWS, which must be unique
+     * across the account.
+     */
+    name: string;
+    /**
+     * Which query strings are part of the cache key. Their order matters too: `?a=1&b=2` and
+     * `?b=2&a=1` are cached apart. See {@link ICloudFrontValueSelection}.
+     */
+    queryStrings?: ICloudFrontValueSelection | undefined;
+}
+/**
+ * An origin request policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`.
+ *
+ * It decides what reaches the origin beyond what the cache policy already sends, without adding it
+ * to the cache key, e.g. forward the viewer's `Authorization` header without every distinct token
+ * becoming its own cache entry.
+ * [AWS: origin request policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-request-understand-origin-request-policy.html).
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontOriginRequestPolicySchema {
+    /**
+     * Which cookies reach the origin. See {@link ICloudFrontValueSelection}.
+     */
+    cookies?: ICloudFrontValueSelection | undefined;
+    /**
+     * Which request headers reach the origin. See {@link ICloudFrontValueSelection}.
+     */
+    headers?: ICloudFrontValueSelection | undefined;
+    /**
+     * How a behavior names this policy. It is also the policy's name in AWS, which must be unique
+     * across the account.
+     */
+    name: string;
+    /**
+     * Which query strings reach the origin. See {@link ICloudFrontValueSelection}.
+     */
+    queryStrings?: ICloudFrontValueSelection | undefined;
+}
+/**
+ * The CORS headers a response headers policy adds, which let a page on another origin call this
+ * distribution from a browser. They replace any CORS headers the origin sent.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontCorsSchema {
+    /**
+     * Whether to send `Access-Control-Allow-Credentials: true`, which lets the calling page send
+     * cookies and `Authorization`, and read the response. A browser refuses such a response when the
+     * allowed origin is `*`, so name the origins in `allowOrigins`.
+     */
+    allowCredentials: boolean;
+    /**
+     * The request headers the calling page may send, e.g. `['Content-Type', 'Authorization']`.
+     * A name may use `*` for any run of characters, e.g. `x-app-*`. `*` alone allows every header
+     * except `Authorization`, which must be named. Header names are not case-sensitive.
+     */
+    allowHeaders: string[];
+    /**
+     * The methods the calling page may use. See {@link ICloudFrontCorsMethod}.
+     */
+    allowMethods: ("ALL" | "DELETE" | "GET" | "HEAD" | "POST" | "PUT" | "OPTIONS" | "PATCH")[];
+    /**
+     * The origins allowed to call, each a scheme, a host, and a port when it is not the default, e.g.
+     * `https://app.example.com`. Write them in lowercase, as browsers send them.
+     * * `*` allows every origin.
+     * * `*` may stand for the leftmost subdomains, e.g. `https://*.example.com`, which matches
+     * `https://www.example.com` and `https://a.b.example.com`, but not `https://example.com`.
+     * * `*` may stand for port digits, e.g. `https://example.com:*`.
+     * * An origin without a scheme, e.g. `example.com`, matches both `http` and `https`.
+     */
+    allowOrigins: string[];
+    /**
+     * How long a browser may reuse the answer to a preflight request, in seconds. Browsers cap it:
+     * Chrome at `7200`, Firefox at `86400`.
+     */
+    maxAgeSeconds: number;
+}
+/**
+ * A header a response headers policy adds to every response.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontCustomHeaderSchema {
+    /**
+     * The header's name, e.g. `Permissions-Policy`. Not case-sensitive.
+     */
+    header: string;
+    /**
+     * Whether this value replaces one the origin sent under the same name. `false` keeps the
+     * origin's value, and adds this one only to responses that have none.
+     */
+    override: boolean;
+    /**
+     * The header's value, verbatim, e.g. `camera=(), microphone=()`. Whether its case matters is up
+     * to the header.
+     */
+    value: string;
+}
+/**
+ * The security headers a response headers policy adds. A `null` field adds nothing for that header.
+ * Every header set here replaces one the origin sent under the same name.
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontSecurityHeadersSchema {
+    /**
+     * The value of `Content-Security-Policy`, verbatim, e.g.
+     * `default-src 'self'; img-src 'self' https://images.example.com`. At most 1783 characters.
+     */
+    contentSecurityPolicy?: string | null | undefined;
+    /**
+     * Whether to send `X-Content-Type-Options`, which stops a browser from treating a response as a
+     * content type other than the one it declares.
+     */
+    contentTypeOptions?: boolean | undefined;
+    /**
+     * The value of `X-Frame-Options`. See {@link ICloudFrontFrameOption}.
+     */
+    frameOptions?: "DENY" | "SAMEORIGIN" | null | undefined;
+    /**
+     * The value of `Referrer-Policy`. See {@link ICloudFrontReferrerPolicy}.
+     */
+    referrerPolicy?: "no-referrer" | "no-referrer-when-downgrade" | "origin" | "origin-when-cross-origin" | "same-origin" | "strict-origin" | "strict-origin-when-cross-origin" | "unsafe-url" | null | undefined;
+    /**
+     * The `max-age` of `Strict-Transport-Security`: how long a browser keeps using HTTPS for this host,
+     * in seconds. The header also covers every host below this one, and cannot be
+     * added to the lists of HTTPS-only hosts that browsers ship with.
+     */
+    strictTransportSecurityMaxAge?: number | null | undefined;
+}
+/**
+ * A response headers policy this distribution declares, referenced by a behavior under
+ * `{ kind: 'custom', name }`. It changes the headers of every response on the way to the viewer,
+ * whether it came from the cache or the origin.
+ *
+ * CloudFront removes `removeHeaders` first, then adds everything else, so a header both removed and
+ * added is sent with this policy's value.
+ * [AWS: response headers policies](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-response-headers-policies.html).
+ *
+ * @group Resources/CloudFrontDistribution
+ *
+ * @hideconstructor
+ */
+export declare class CloudFrontResponseHeadersPolicySchema {
+    /**
+     * The CORS headers to add. See {@link CloudFrontCorsSchema}.
+     */
+    cors?: CloudFrontCorsSchema | null | undefined;
+    /**
+     * Headers to add that have no field of their own, e.g. `Permissions-Policy`.
+     * See {@link CloudFrontCustomHeaderSchema}.
+     */
+    customHeaders?: CloudFrontCustomHeaderSchema[] | undefined;
+    /**
+     * How a behavior names this policy. It is also the policy's name in AWS, which must be unique
+     * across the account.
+     */
+    name: string;
+    /**
+     * Names of headers to strip from the origin's response, e.g. `['Server', 'X-Powered-By']`. Not
+     * case-sensitive. With `Server` or `Date` removed, CloudFront sends its own instead.
+     *
+     * AWS refuses connection-level headers and CloudFront's own, such as `Connection`,
+     * `Content-Length`, `Transfer-Encoding`, `Via`, and any header starting `X-Amz-Cf-` or `X-Edge-`.
+     * [The full list](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-response-headers-policies.html#remove-headers-disallowed).
+     */
+    removeHeaders?: string[] | undefined;
+    /**
+     * The security headers to add. See {@link CloudFrontSecurityHeadersSchema}.
+     */
+    securityHeaders?: CloudFrontSecurityHeadersSchema | null | undefined;
+}
+export {};