@quadnix/octo-aws-cdk 0.2.0 → 0.2.1

package/dist/resources/cloudfront-distribution/index.schema.js

@@ -8,594 +8,27 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { BaseResourceSchema, Schema, Validate } from '@quadnix/octo';
+import { CLOUDFRONT_ALLOWED_METHODS, CLOUDFRONT_CACHED_METHODS, CLOUDFRONT_VIEWER_PROTOCOL_POLICIES, CloudFrontBehaviorSchema, CloudFrontFunctionAssociationSchema, } from './cloudfront-behavior.schema.js';
+import { CloudFrontOriginGroupSchema, CloudFrontOriginSchema } from './cloudfront-origin.schema.js';
+import { CLOUDFRONT_MANAGED_CACHE_POLICIES, CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES, CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES, CloudFrontCachePolicySchema, CloudFrontCorsSchema, CloudFrontCustomHeaderSchema, CloudFrontOriginRequestPolicySchema, CloudFrontResponseHeadersPolicySchema, CloudFrontSecurityHeadersSchema, } from './cloudfront-policy.schema.js';
+import { CloudFrontCustomErrorResponseSchema } from './cloudfront-response.schema.js';
+export { CLOUDFRONT_ALLOWED_METHODS, CLOUDFRONT_CACHED_METHODS, CLOUDFRONT_MANAGED_CACHE_POLICIES, CLOUDFRONT_MANAGED_ORIGIN_REQUEST_POLICIES, CLOUDFRONT_MANAGED_RESPONSE_HEADERS_POLICIES, CLOUDFRONT_VIEWER_PROTOCOL_POLICIES, CloudFrontBehaviorSchema, CloudFrontCachePolicySchema, CloudFrontCorsSchema, CloudFrontCustomErrorResponseSchema, CloudFrontCustomHeaderSchema, CloudFrontFunctionAssociationSchema, CloudFrontOriginGroupSchema, CloudFrontOriginRequestPolicySchema, CloudFrontOriginSchema, CloudFrontResponseHeadersPolicySchema, CloudFrontSecurityHeadersSchema, };
+const CLOUDFRONT_HTTP_VERSIONS = ['http1.1', 'http2', 'http2and3'];
+/* eslint-disable spellcheck/spell-checker */
+const CLOUDFRONT_MINIMUM_PROTOCOL_VERSIONS = [
+    'TLSv1',
+    'TLSv1.1_2016',
+    'TLSv1.2_2018',
+    'TLSv1.2_2019',
+    'TLSv1.2_2021',
+    'TLSv1.2_2025',
+    'TLSv1.3_2025',
+    'TLSv1_2016',
+];
 /**
- * One origin the distribution can serve from.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontOriginSchema {
-    constructor() {
-        /**
-         * How many times CloudFront retries the origin before giving up. Between 1 and 3.
-         */
-        this.connectionAttempts = Schema(3);
-        /**
-         * How long CloudFront waits to establish a connection to the origin, in seconds. Between 1 and 10.
-         */
-        this.connectionTimeout = Schema(10);
-        /**
-         * Headers CloudFront adds to every request it sends to this origin.
-         * This is how a load balancer rejects anything that did not arrive through the distribution.
-         */
-        this.customHeaders = Schema({});
-        /**
-         * What kind of origin this is, and the settings that only apply to that kind.
-         *
-         * * `s3` is a bucket reached privately. The distribution emits an origin access control for it,
-         * and builds the hostname from `bucketName` and `bucketRegion` rather than referencing the bucket,
-         * because the bucket's own policy already references this distribution. Granting the distribution
-         * read on the bucket is the bucket's job, driven by an overlay.
-         * * `custom` is anything that speaks HTTP - a load balancer, an EC2 instance, an API, a third
-         * party, or an S3 website endpoint.
-         */
-        this.kind = Schema();
-        /**
-         * How this origin is named by behaviors and origin groups. Unique across origins and origin groups.
-         */
-        this.originId = Schema();
-        /**
-         * A prefix CloudFront prepends to the path before asking the origin for it.
-         * Empty asks the origin for the path the viewer requested.
-         */
-        this.originPath = Schema('');
-    }
-}
-__decorate([
-    Validate({ options: { maxLength: 3, minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginSchema.prototype, "connectionAttempts", void 0);
-__decorate([
-    Validate({ options: { maxLength: 10, minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginSchema.prototype, "connectionTimeout", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => Object.keys(value),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginSchema.prototype, "customHeaders", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value.kind === 's3'
-            ? [value.bucketName, value.bucketRegion]
-            : [value.originProtocolPolicy, ...value.sslProtocols],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginSchema.prototype, "kind", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginSchema.prototype, "originId", void 0);
-/**
- * A primary origin and the origin CloudFront falls back to when the primary answers with one of
- * `failoverStatusCodes`.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontOriginGroupSchema {
-    constructor() {
-        /**
-         * The origin id CloudFront falls back to.
-         */
-        this.failoverOriginId = Schema();
-        /**
-         * The status codes from the primary origin that trigger the failover.
-         */
-        this.failoverStatusCodes = Schema();
-        /**
-         * How this group is named by behaviors. Unique across origins and origin groups.
-         */
-        this.originGroupId = Schema();
-        /**
-         * The origin id CloudFront tries first.
-         */
-        this.primaryOriginId = Schema();
-    }
-}
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginGroupSchema.prototype, "failoverOriginId", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value,
-        options: { maxLength: 599, minLength: 100 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginGroupSchema.prototype, "failoverStatusCodes", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginGroupSchema.prototype, "originGroupId", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginGroupSchema.prototype, "primaryOriginId", void 0);
-/**
- * An edge function CloudFront runs for a behavior. The function itself is not created here - pass
- * the ARN of one that already exists.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontFunctionAssociationSchema {
-    constructor() {
-        /**
-         * The ARN of the CloudFront Function or the Lambda@Edge function version.
-         */
-        this.arn = Schema();
-        /**
-         * Which lifecycle event the function runs on. See {@link ICloudFrontFunctionEventType}.
-         */
-        this.eventType = Schema();
-        /**
-         * Which engine runs it. A `cloudfront-function` is JavaScript at the edge and may only bind to a
-         * viewer event; `lambda-edge` may bind to any of the four.
-         */
-        this.kind = Schema();
-    }
-}
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontFunctionAssociationSchema.prototype, "arn", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontFunctionAssociationSchema.prototype, "eventType", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontFunctionAssociationSchema.prototype, "kind", void 0);
-/**
- * One rule binding a set of paths to an origin, and deciding everything about how those paths are
- * served.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontBehaviorSchema {
-    constructor() {
-        /**
-         * The HTTP methods CloudFront forwards to the origin.
-         * `['GET', 'HEAD']` is a CDN; the full set makes the distribution a reverse proxy.
-         */
-        this.allowedMethods = Schema(['GET', 'HEAD']);
-        /**
-         * The subset of `allowedMethods` whose responses CloudFront caches.
-         */
-        this.cachedMethods = Schema(['GET', 'HEAD']);
-        /**
-         * Which policy decides the cache key and the TTLs. See {@link ICloudFrontPolicyReference}.
-         */
-        this.cachePolicy = Schema();
-        /**
-         * Whether CloudFront compresses the response for viewers that accept it.
-         */
-        this.compress = Schema(true);
-        /**
-         * Edge functions to run for this behavior. See {@link CloudFrontFunctionAssociationSchema}.
-         */
-        this.functionAssociations = Schema([]);
-        /**
-         * Which policy decides what reaches the origin, independently of the cache key.
-         * `null` forwards only what the cache policy already selected.
-         */
-        this.originRequestPolicy = Schema(null);
-        /**
-         * The paths this behavior claims, e.g. `/api/*`. Absent on the default behavior, which claims
-         * everything no other behavior did.
-         */
-        this.pathPattern = Schema(null);
-        /**
-         * Which policy decides the headers CloudFront adds on the way out - CORS, HSTS, and the app's own
-         * content security policy. `null` adds nothing.
-         */
-        this.responseHeadersPolicy = Schema(null);
-        /**
-         * The origin or origin group serving these paths.
-         */
-        this.targetOriginId = Schema();
-        /**
-         * What CloudFront does with a plain HTTP request.
-         */
-        this.viewerProtocolPolicy = Schema('redirect-to-https');
-    }
-}
-__decorate([
-    Validate({
-        destruct: (value) => value,
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "allowedMethods", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value,
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "cachedMethods", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind, value.name],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "cachePolicy", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value,
-        options: { isSchema: { schema: CloudFrontFunctionAssociationSchema } },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "functionAssociations", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value ? [value.kind, value.name] : [],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "originRequestPolicy", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => (value ? [value] : []),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "pathPattern", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value ? [value.kind, value.name] : [],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "responseHeadersPolicy", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "targetOriginId", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontBehaviorSchema.prototype, "viewerProtocolPolicy", void 0);
-/**
- * What the viewer gets when the origin answers with a status code CloudFront was told to handle.
- *
- * The same field set expresses opposite intents. A single-page app maps `403` and `404` to a `200`
- * carrying `/index.html` with a short TTL, so the client-side router can take over; a content site
- * maps them to a real `404` carrying an error page.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontCustomErrorResponseSchema {
-    constructor() {
-        /**
-         * How long CloudFront caches this error before asking the origin again, in seconds.
-         */
-        this.errorCachingMinTtl = Schema(10);
-        /**
-         * The status code the origin answered with.
-         */
-        this.errorCode = Schema();
-        /**
-         * The status code the viewer sees.
-         */
-        this.responseCode = Schema();
-        /**
-         * The object served in place of the error, e.g. `/index.html`.
-         */
-        this.responsePagePath = Schema();
-    }
-}
-__decorate([
-    Validate({ options: { minLength: 0 } }),
-    __metadata("design:type", Object)
-], CloudFrontCustomErrorResponseSchema.prototype, "errorCachingMinTtl", void 0);
-__decorate([
-    Validate({ options: { maxLength: 599, minLength: 100 } }),
-    __metadata("design:type", Object)
-], CloudFrontCustomErrorResponseSchema.prototype, "errorCode", void 0);
-__decorate([
-    Validate({ options: { maxLength: 599, minLength: 100 } }),
-    __metadata("design:type", Object)
-], CloudFrontCustomErrorResponseSchema.prototype, "responseCode", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontCustomErrorResponseSchema.prototype, "responsePagePath", void 0);
-/**
- * A cache policy this distribution declares, referenced by a behavior under
- * `{ kind: 'custom', name }`.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontCachePolicySchema {
-    constructor() {
-        /**
-         * Which cookies are part of the cache key.
-         */
-        this.cookies = Schema({ kind: 'none' });
-        /**
-         * How long CloudFront serves an object without asking the origin, when the origin sent no
-         * caching headers of its own. In seconds.
-         */
-        this.defaultTtl = Schema(86400);
-        /**
-         * Whether CloudFront may store and serve a brotli-compressed copy.
-         */
-        this.enableBrotli = Schema(true);
-        /**
-         * Whether CloudFront may store and serve a gzip-compressed copy.
-         */
-        this.enableGzip = Schema(true);
-        /**
-         * Which request headers are part of the cache key.
-         */
-        this.headers = Schema({ kind: 'none' });
-        /**
-         * The longest CloudFront will serve an object without asking the origin, whatever the origin's
-         * own caching headers said. In seconds.
-         */
-        this.maxTtl = Schema(31536000);
-        /**
-         * The shortest CloudFront will serve an object without asking the origin. In seconds.
-         */
-        this.minTtl = Schema(1);
-        /**
-         * How a behavior names this policy.
-         */
-        this.name = Schema();
-        /**
-         * Which query strings are part of the cache key.
-         */
-        this.queryStrings = Schema({ kind: 'none' });
-    }
-}
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "cookies", void 0);
-__decorate([
-    Validate({ options: { minLength: 0 } }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "defaultTtl", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "headers", void 0);
-__decorate([
-    Validate({ options: { minLength: 0 } }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "maxTtl", void 0);
-__decorate([
-    Validate({ options: { minLength: 0 } }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "minTtl", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "name", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontCachePolicySchema.prototype, "queryStrings", void 0);
-/**
- * An origin request policy this distribution declares, referenced by a behavior under
- * `{ kind: 'custom', name }`.
- *
- * This is what reaches the origin, and it is separate from the cache key on purpose: an origin can
- * be told the viewer's `Authorization` header without every distinct token becoming its own cache
- * entry.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontOriginRequestPolicySchema {
-    constructor() {
-        /**
-         * Which cookies reach the origin.
-         */
-        this.cookies = Schema({ kind: 'none' });
-        /**
-         * Which request headers reach the origin.
-         */
-        this.headers = Schema({ kind: 'none' });
-        /**
-         * How a behavior names this policy.
-         */
-        this.name = Schema();
-        /**
-         * Which query strings reach the origin.
-         */
-        this.queryStrings = Schema({ kind: 'none' });
-    }
-}
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginRequestPolicySchema.prototype, "cookies", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginRequestPolicySchema.prototype, "headers", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontOriginRequestPolicySchema.prototype, "name", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => [value.kind],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontOriginRequestPolicySchema.prototype, "queryStrings", void 0);
-/**
- * The security headers a response headers policy adds. Every field is optional; a `null` field adds
- * nothing for that header.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
+ * @internal
  */
-export class CloudFrontSecurityHeadersSchema {
-    constructor() {
-        /**
-         * The app's own content security policy, verbatim.
-         */
-        this.contentSecurityPolicy = Schema(null);
-        /**
-         * Whether to send `X-Content-Type-Options`, which tells a browser to trust the declared content
-         * type rather than guessing one from the bytes.
-         */
-        this.contentTypeOptions = Schema(true);
-        /**
-         * The value of `X-Frame-Options`, or `null` to send none.
-         */
-        this.frameOptions = Schema('SAMEORIGIN');
-        /**
-         * The value of `Referrer-Policy`, or `null` to send none.
-         */
-        this.referrerPolicy = Schema(null);
-        /**
-         * How long a viewer should keep using HTTPS for this host, in seconds. `null` sends no
-         * `Strict-Transport-Security` header at all.
-         */
-        this.strictTransportSecurityMaxAge = Schema(31536000);
-    }
-}
-__decorate([
-    Validate({
-        destruct: (value) => (value ? [value] : []),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontSecurityHeadersSchema.prototype, "contentSecurityPolicy", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => (value ? [value] : []),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontSecurityHeadersSchema.prototype, "frameOptions", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => (value ? [value] : []),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontSecurityHeadersSchema.prototype, "referrerPolicy", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value === null || value === undefined ? [] : [value],
-        options: { minLength: 0 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontSecurityHeadersSchema.prototype, "strictTransportSecurityMaxAge", void 0);
-/**
- * A response headers policy this distribution declares, referenced by a behavior under
- * `{ kind: 'custom', name }`.
- *
- * @group Resources/CloudFrontDistribution
- *
- * @hideconstructor
- */
-export class CloudFrontResponseHeadersPolicySchema {
-    constructor() {
-        /**
-         * A cross-origin resource sharing configuration, or `null` for none.
-         */
-        this.cors = Schema(null);
-        /**
-         * Headers CloudFront adds verbatim. `override` decides what happens when the origin already sent
-         * one of the same name.
-         */
-        this.customHeaders = Schema([]);
-        /**
-         * How a behavior names this policy.
-         */
-        this.name = Schema();
-        /**
-         * Headers CloudFront strips from the origin's response before the viewer sees it.
-         */
-        this.removeHeaders = Schema([]);
-        /**
-         * The security headers to add, or `null` to add none.
-         * See {@link CloudFrontSecurityHeadersSchema}.
-         */
-        this.securityHeaders = Schema(null);
-    }
-}
-__decorate([
-    Validate({
-        destruct: (value) => value ? [...value.allowHeaders, ...value.allowMethods, ...value.allowOrigins] : [],
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontResponseHeadersPolicySchema.prototype, "cors", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value.flatMap((v) => [v.header, v.value]),
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontResponseHeadersPolicySchema.prototype, "customHeaders", void 0);
-__decorate([
-    Validate({ options: { minLength: 1 } }),
-    __metadata("design:type", Object)
-], CloudFrontResponseHeadersPolicySchema.prototype, "name", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value,
-        options: { minLength: 1 },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontResponseHeadersPolicySchema.prototype, "removeHeaders", void 0);
-__decorate([
-    Validate({
-        destruct: (value) => value ? [value] : [],
-        options: { isSchema: { schema: CloudFrontSecurityHeadersSchema } },
-    }),
-    __metadata("design:type", Object)
-], CloudFrontResponseHeadersPolicySchema.prototype, "securityHeaders", void 0);
+export const CLOUDFRONT_PRICE_CLASSES = ['PriceClass_100', 'PriceClass_200', 'PriceClass_All'];
 /**
  * The `CloudFrontDistributionSchema` class is the schema for the `CloudFrontDistribution` resource,
  * which represents an AWS CloudFront distribution. Terraform provisions it as
@@ -604,68 +37,61 @@ __decorate([
  * [`aws_cloudfront_origin_access_control`](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control)
  * per S3 origin and one terraform resource per policy the distribution declares.
  *
- * The distribution is deliberately open. It carries several origins of mixed kinds, a routing table
- * of behaviors over them, and the security layer around both, so that one module can serve a
- * single-page app out of a bucket while another puts the same resource in front of a load balancer.
- * The opinion about which of those a caller gets belongs to the module, not here.
- *
  * @group Resources/CloudFrontDistribution
  *
  * @hideconstructor
  *
- * @overrideProperty parents - Every managed origin that is not an S3 bucket. The distribution reads
- * such an origin's hostname out of its response, so it is a child of it. An S3 origin runs the other
- * way - the bucket's policy has to name this distribution's ARN, which AWS assigns, so the bucket is
- * the child and this distribution writes the bucket's hostname literally.
+ * @overrideProperty parents - The Lambda functions and ALBs it serves, each attached after
+ * construction, with `addLambdaOrigin()` and `addAlbOrigin()`. An S3 bucket is a child of the
+ * distribution instead.
  * ```mermaid
  * graph TD;
- *   origin((Origin<br>Resource)) --> cloudfront_distribution((CloudFront<br>Distribution))
+ *   alb((ALB)) --> cloudfront_distribution((CloudFront<br>Distribution))
+ *   lambda((Lambda<br>Function)) --> cloudfront_distribution
  *   cloudfront_distribution --> s3_bucket((S3<br>Bucket))
  * ```
  * @overrideProperty resourceId - The resource id is of format `cloudfront-<distribution-name>`.
- * There is no region in it: CloudFront is global, and the provider is found on the account alone.
  */
 export class CloudFrontDistributionSchema extends BaseResourceSchema {
     constructor() {
         super(...arguments);
         /**
          * Input properties.
-         * * `properties.aliases` - The custom domain names the distribution answers on. Each one needs a
-         * DNS record pointing at the distribution, which this resource does not create. Empty serves only
-         * the `*.cloudfront.net` domain CloudFront assigns.
+         * * `properties.aliases` - The custom domain names the distribution answers on, e.g.
+         * `www.example.com`, or `*.example.com` for every host under `example.com`. Each one needs a DNS record pointing at
+         * the distribution, which this resource does not create. Empty serves only the `*.cloudfront.net`
+         * domain CloudFront assigns.
          * * `properties.awsAccountId` - The AWS account id.
          * * `properties.behaviors` - The routing table. Exactly one entry has no `pathPattern` and is the
          * default behavior; the rest are matched in order before it.
          * See {@link CloudFrontBehaviorSchema}.
          * * `properties.cachePolicies` - Cache policies this distribution declares.
          * See {@link CloudFrontCachePolicySchema}.
-         * * `properties.comment` - A human-readable label. It is the only name a distribution carries in
-         * the console.
+         * * `properties.comment` - A human-readable label, at most 128 characters. It is the only name a
+         * distribution carries in the console.
          * * `properties.customErrorResponses` - What the viewer gets for an origin error.
          * See {@link CloudFrontCustomErrorResponseSchema}.
-         * * `properties.defaultRootObject` - The object served for a request to the site root.
+         * * `properties.defaultRootObject` - The object served for a request to the site root, e.g.
+         * `index.html` or `docs/index.html`, never starting with `/`. Empty passes the request to the origin
+         * as it is.
          * * `properties.distributionName` - What names this distribution. Part of its identity.
          * * `properties.enabled` - Whether the distribution serves traffic. Disabling is also the first
          * half of deleting one, which AWS makes a slow operation.
-         * * `properties.geoRestriction` - Which countries may reach the distribution.
-         * * `properties.httpVersion` - The newest HTTP version viewers may negotiate.
-         * * `properties.isIpv6Enabled` - Whether the distribution answers over IP version 6.
-         * * `properties.logging` - Where CloudFront writes its access logs, or `null` for none. The bucket
-         * is not created here.
+         * * `properties.geoRestriction` - Which countries may reach the distribution, each an uppercase
+         * two-letter ISO 3166-1 code, e.g. `DE`.
+         * * `properties.httpVersion` - See {@link ICloudFrontHttpVersion}.
          * * `properties.originGroups` - Fail-over pairs over the origins.
          * See {@link CloudFrontOriginGroupSchema}.
          * * `properties.originRequestPolicies` - Origin request policies this distribution declares.
          * See {@link CloudFrontOriginRequestPolicySchema}.
          * * `properties.origins` - Where content comes from. See {@link CloudFrontOriginSchema}.
-         * * `properties.priceClass` - Which edge locations serve the traffic, which is what the
-         * distribution costs. `PriceClass_100` is North America and Europe alone.
+         * * `properties.priceClass` - See {@link ICloudFrontPriceClass}.
          * * `properties.responseHeadersPolicies` - Response headers policies this distribution declares.
          * See {@link CloudFrontResponseHeadersPolicySchema}.
          * * `properties.viewerCertificate` - The certificate viewers see. `default` serves CloudFront's
          * own, which is valid only for the assigned `*.cloudfront.net` domain; `acm` serves a certificate
-         * of yours, which CloudFront reads from `us-east-1` alone.
-         * * `properties.webAclArn` - The web ACL guarding the distribution, or `null` for none. The
-         * ACL is not created here, and CloudFront reads it from `us-east-1` alone.
+         * of yours, which CloudFront reads from `us-east-1` alone. See
+         * {@link ICloudFrontMinimumProtocolVersion}.
          */
         this.properties = Schema();
         /**
@@ -675,8 +101,6 @@ export class CloudFrontDistributionSchema extends BaseResourceSchema {
          * * `response.DomainName` - The `*.cloudfront.net` domain CloudFront assigned. Point a DNS record
          * at this.
          * * `response.HostedZoneId` - The zone a Route 53 alias record pointing at this distribution needs.
-         * It is the same constant for every CloudFront distribution, and it is published here so that a
-         * DNS module never has to know that.
          */
         this.response = Schema({
             Arn: 'arn:aws:cloudfront::000000000000:distribution/E000000000000',
@@ -688,16 +112,55 @@ export class CloudFrontDistributionSchema extends BaseResourceSchema {
 }
 __decorate([
     Validate([
+        {
+            destruct: (value) => value.aliases,
+            options: { maxLength: 253, regex: /^(\*\.)?([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/i },
+        },
         {
             destruct: (value) => [
-                ...value.aliases,
                 value.awsAccountId,
                 value.distributionName,
-                value.httpVersion,
-                value.priceClass,
             ],
             options: { minLength: 1 },
         },
+        {
+            destruct: (value) => [value.comment],
+            options: { maxLength: 128 },
+        },
+        {
+            destruct: (value) => [value.defaultRootObject],
+            options: { regex: /^(?!\/)\S*$/ },
+        },
+        {
+            destruct: (value) => [value.enabled],
+            options: { custom: (value) => typeof value === 'boolean' },
+        },
+        {
+            destruct: (value) => [value.geoRestriction],
+            options: {
+                custom: (value) => value.kind === 'none' ||
+                    (['allow', 'block'].includes(value.kind) &&
+                        value.countries.length > 0 &&
+                        value.countries.every((country) => /^[A-Z]{2}$/.test(country))),
+            },
+        },
+        {
+            destruct: (value) => [value.httpVersion],
+            options: { custom: (value) => CLOUDFRONT_HTTP_VERSIONS.includes(value) },
+        },
+        {
+            destruct: (value) => [value.priceClass],
+            options: { custom: (value) => CLOUDFRONT_PRICE_CLASSES.includes(value) },
+        },
+        {
+            destruct: (value) => [value.viewerCertificate],
+            options: {
+                custom: (value) => value.kind === 'default' ||
+                    (value.kind === 'acm' &&
+                        /^arn:aws:acm:[a-z0-9-]+:\d{12}:certificate\/[\w-]+$/.test(value.certificateArn) &&
+                        CLOUDFRONT_MINIMUM_PROTOCOL_VERSIONS.includes(value.minimumProtocolVersion)),
+            },
+        },
         {
             destruct: (value) => value.origins,
             options: { isSchema: { schema: CloudFrontOriginSchema } },