alchemy-effect 0.6.0 → 0.6.3

package/src/AWS/CloudFront/Distribution.ts

@@ -0,0 +1,952 @@
+import * as cloudfront from "@distilled.cloud/aws/cloudfront";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+import type { Input } from "../../Input.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+
+const CLOUDFRONT_HOSTED_ZONE_ID = "Z2FDTNDATAQYW2" as const;
+
+class DistributionFunctionAssociationPending extends Data.TaggedError(
+  "DistributionFunctionAssociationPending",
+)<{
+  message: string;
+}> {}
+
+class DistributionPendingDeployment extends Data.TaggedError(
+  "DistributionPendingDeployment",
+)<{
+  message: string;
+}> {}
+
+export interface DistributionOrigin {
+  /**
+   * Unique origin identifier inside the distribution.
+   */
+  id: string;
+  /**
+   * Origin domain name.
+   */
+  domainName: Input<string>;
+  /**
+   * Optional origin path prefix.
+   */
+  originPath?: Input<string>;
+  /**
+   * CloudFront Origin Access Control identifier.
+   */
+  originAccessControlId?: Input<string>;
+  /**
+   * Whether the origin should be modeled as an S3 origin.
+   * @default false
+   */
+  s3Origin?: boolean;
+  /**
+   * Optional custom origin settings.
+   */
+  customOriginConfig?: {
+    httpPort?: number;
+    httpsPort?: number;
+    originProtocolPolicy?: cloudfront.OriginProtocolPolicy;
+    originReadTimeout?: number;
+    originKeepaliveTimeout?: number;
+    originSslProtocols?: cloudfront.SslProtocol[];
+  };
+}
+
+export interface DistributionBehavior {
+  targetOriginId: string;
+  viewerProtocolPolicy?: cloudfront.ViewerProtocolPolicy;
+  allowedMethods?: cloudfront.Method[];
+  cachedMethods?: cloudfront.Method[];
+  compress?: boolean;
+  cachePolicyId?: string;
+  originRequestPolicyId?: string;
+  responseHeadersPolicyId?: string;
+  forwardedValues?: cloudfront.ForwardedValues;
+  minTtl?: number;
+  defaultTtl?: number;
+  maxTtl?: number;
+  functionAssociations?: {
+    functionArn: string;
+    eventType: cloudfront.EventType;
+  }[];
+  lambdaFunctionAssociations?: {
+    lambdaFunctionArn: string;
+    eventType: cloudfront.EventType;
+    includeBody?: boolean;
+  }[];
+}
+
+export interface DistributionViewerCertificate {
+  cloudFrontDefaultCertificate?: boolean;
+  acmCertificateArn?: string;
+  sslSupportMethod?: cloudfront.SSLSupportMethod;
+  minimumProtocolVersion?: cloudfront.MinimumProtocolVersion;
+}
+
+const isFunctionAssociationPending = (error: cloudfront.InvalidArgument) => {
+  const message = error.Message ?? "";
+  return (
+    message.includes("FunctionAssociationArn") &&
+    message.includes("not found or is not published")
+  );
+};
+
+export interface DistributionProps {
+  /**
+   * Alternate domain names routed to this distribution.
+   */
+  aliases?: string[];
+  /**
+   * Default root object served for `/`.
+   */
+  defaultRootObject?: string;
+  /**
+   * CloudFront origin definitions.
+   */
+  origins: Input<DistributionOrigin[]>;
+  /**
+   * Default cache behavior.
+   */
+  defaultCacheBehavior: Input<DistributionBehavior>;
+  /**
+   * Ordered cache behaviors.
+   */
+  orderedCacheBehaviors?: Input<
+    Array<
+      DistributionBehavior & {
+        pathPattern: string;
+      }
+    >
+  >;
+  /**
+   * Custom error response rules.
+   */
+  customErrorResponses?: Input<cloudfront.CustomErrorResponse[]>;
+  /**
+   * Human-readable distribution comment.
+   * @default ""
+   */
+  comment?: string;
+  /**
+   * Whether the distribution should serve traffic.
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Viewer certificate configuration.
+   */
+  viewerCertificate?: Input<DistributionViewerCertificate>;
+  /**
+   * CloudFront price class.
+   */
+  priceClass?: cloudfront.PriceClass;
+  /**
+   * Optional AWS WAF web ACL association.
+   */
+  webAclId?: string;
+  /**
+   * Preferred HTTP version support.
+   */
+  httpVersion?: cloudfront.HttpVersion;
+  /**
+   * Whether IPv6 should be enabled.
+   * @default true
+   */
+  isIpv6Enabled?: boolean;
+  /**
+   * User-defined tags to apply to the distribution.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface Distribution extends Resource<
+  "AWS.CloudFront.Distribution",
+  DistributionProps,
+  {
+    /**
+     * CloudFront distribution identifier.
+     */
+    distributionId: string;
+    /**
+     * ARN of the distribution.
+     */
+    distributionArn: string;
+    /**
+     * CloudFront-assigned domain name.
+     */
+    domainName: string;
+    /**
+     * Route 53 hosted zone ID for CloudFront aliases.
+     */
+    hostedZoneId: string;
+    /**
+     * Current deployment status.
+     */
+    status: string;
+    /**
+     * Configured alternate domain names.
+     */
+    aliases: string[];
+    /**
+     * Current comment.
+     */
+    comment: string;
+    /**
+     * Whether the distribution is enabled.
+     */
+    enabled: boolean;
+    /**
+     * Most recent entity tag for update/delete operations.
+     */
+    etag: string | undefined;
+    /**
+     * Number of invalidation batches still in progress.
+     */
+    inProgressInvalidationBatches: number;
+    /**
+     * Last CloudFront modification timestamp.
+     */
+    lastModifiedTime: Date | undefined;
+    /**
+     * Current tags on the distribution.
+     */
+    tags: Record<string, string>;
+  }
+> {}
+
+/**
+ * A CloudFront distribution.
+ *
+ * `Distribution` manages the CDN layer for static sites and HTTP origins such
+ * as Lambda Function URLs and ALBs. It exposes the distribution domain and
+ * hosted zone ID needed for Route 53 alias records.
+ *
+ * @section Creating Distributions
+ * @example Private S3 Origin
+ * ```typescript
+ * const distribution = yield* Distribution("WebsiteCdn", {
+ *   aliases: ["www.example.com"],
+ *   origins: [
+ *     {
+ *       id: "site",
+ *       domainName: bucket.bucketRegionalDomainName,
+ *       s3Origin: true,
+ *       originAccessControlId: oac.originAccessControlId,
+ *     },
+ *   ],
+ *   defaultCacheBehavior: {
+ *     targetOriginId: "site",
+ *     viewerProtocolPolicy: "redirect-to-https",
+ *     compress: true,
+ *   },
+ *   viewerCertificate: {
+ *     acmCertificateArn: certificate.certificateArn,
+ *     sslSupportMethod: "sni-only",
+ *     minimumProtocolVersion: "TLSv1.2_2021",
+ *   },
+ * });
+ * ```
+ */
+export const Distribution = Resource<Distribution>(
+  "AWS.CloudFront.Distribution",
+);
+
+export const DistributionProvider = () =>
+  Distribution.provider.effect(
+    Effect.gen(function* () {
+      const waitForDeployment = Effect.fn(function* (distributionId: string) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution wait: polling deployment for ${distributionId}`,
+        );
+        return yield* cloudfront.getDistribution({ Id: distributionId }).pipe(
+          Effect.map((response) => response.Distribution),
+          Effect.flatMap((distribution) =>
+            distribution?.Status === "Deployed"
+              ? Effect.gen(function* () {
+                  yield* Effect.logInfo(
+                    `CloudFront Distribution wait: ${distributionId} deployed`,
+                  );
+                  return distribution;
+                })
+              : Effect.gen(function* () {
+                  yield* Effect.logInfo(
+                    `CloudFront Distribution wait: ${distributionId} status=${distribution?.Status ?? "unknown"}`,
+                  );
+                  return yield* Effect.fail(
+                    new DistributionPendingDeployment({
+                      message: `Distribution ${distributionId} is not yet deployed`,
+                    }),
+                  );
+                }),
+          ),
+          Effect.retry({
+            while: (error) => error._tag === "DistributionPendingDeployment",
+            schedule: Schedule.fixed("10 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      const getCurrent = Effect.fn(function* (distributionId: string) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loading distribution ${distributionId}`,
+        );
+        const distribution = yield* cloudfront
+          .getDistribution({ Id: distributionId })
+          .pipe(
+            Effect.map((response) => response.Distribution),
+            Effect.catchTag("NoSuchDistribution", () =>
+              Effect.succeed(undefined),
+            ),
+          );
+
+        if (!distribution?.Id) {
+          yield* Effect.logInfo(
+            `CloudFront Distribution read: distribution ${distributionId} not found`,
+          );
+          return undefined;
+        }
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loading config and tags for ${distributionId}`,
+        );
+        const config = yield* cloudfront.getDistributionConfig({
+          Id: distributionId,
+        });
+        const tags = yield* cloudfront
+          .listTagsForResource({
+            Resource: distribution.ARN,
+          })
+          .pipe(Effect.map((response) => toTagsRecord(response.Tags.Items)));
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: loaded ${distributionId} status=${distribution.Status} enabled=${config.DistributionConfig?.Enabled ?? "unknown"} etag=${config.ETag ?? "missing"} tags=${Object.keys(tags).length}`,
+        );
+        return {
+          distribution,
+          config: config.DistributionConfig!,
+          etag: config.ETag,
+          tags,
+        };
+      });
+
+      const getByCallerReference = Effect.fn(function* (
+        callerReference: string,
+      ) {
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: searching for callerReference=${callerReference}`,
+        );
+        let marker: string | undefined;
+
+        do {
+          const listed = yield* cloudfront.listDistributions({
+            Marker: marker,
+          });
+
+          for (const item of listed.DistributionList?.Items ?? []) {
+            if (!item.Id) continue;
+
+            const config = yield* cloudfront
+              .getDistributionConfig({
+                Id: item.Id,
+              })
+              .pipe(
+                Effect.catchTag("NoSuchDistribution", () =>
+                  Effect.succeed(undefined),
+                ),
+              );
+
+            if (
+              config?.DistributionConfig?.CallerReference === callerReference
+            ) {
+              yield* Effect.logInfo(
+                `CloudFront Distribution read: recovered ${item.Id} for callerReference=${callerReference}`,
+              );
+              return yield* getCurrent(item.Id);
+            }
+          }
+
+          marker = listed.DistributionList?.IsTruncated
+            ? listed.DistributionList.NextMarker
+            : undefined;
+        } while (marker);
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution read: no distribution found for callerReference=${callerReference}`,
+        );
+        return undefined;
+      });
+
+      const waitForDeletionReady = Effect.fn(function* (
+        distributionId: string,
+      ) {
+        class DistributionPendingDeletionReadiness extends Data.TaggedError(
+          "DistributionPendingDeletionReadiness",
+        )<{
+          message: string;
+        }> {}
+
+        yield* Effect.logInfo(
+          `CloudFront Distribution delete: waiting for ${distributionId} to become disabled and deployed`,
+        );
+        return yield* Effect.logInfo(
+          `CloudFront Distribution delete: waiting for ${distributionId} to become disabled and deployed`,
+        ).pipe(
+          Effect.andThen(() => getCurrent(distributionId)),
+          Effect.flatMap(
+            Effect.fnUntraced(function* (current) {
+              if (!current) {
+                yield* Effect.logInfo(
+                  `CloudFront Distribution delete: ${distributionId} already absent while waiting`,
+                );
+                return undefined;
+              }
+
+              if (
+                current.config.Enabled ||
+                current.distribution.Status !== "Deployed"
+              ) {
+                yield* Effect.logInfo(
+                  `CloudFront Distribution delete: ${distributionId} not ready enabled=${current.config.Enabled} status=${current.distribution.Status}`,
+                );
+                return yield* Effect.fail(
+                  new DistributionPendingDeletionReadiness({
+                    message: `Distribution ${distributionId} is not yet ready for deletion`,
+                  }),
+                );
+              }
+
+              yield* Effect.logInfo(
+                `CloudFront Distribution delete: ${distributionId} ready for delete with etag=${current.etag ?? "missing"}`,
+              );
+              return current;
+            }),
+          ),
+          Effect.retry({
+            while: (error) =>
+              error._tag === "DistributionPendingDeletionReadiness",
+            schedule: Schedule.fixed("10 seconds").pipe(
+              Schedule.both(Schedule.recurs(60)),
+            ),
+          }),
+        );
+      });
+
+      return {
+        stables: [
+          "distributionId",
+          "distributionArn",
+          "domainName",
+          "hostedZoneId",
+        ],
+        read: Effect.fn(function* ({ output }) {
+          if (!output?.distributionId) {
+            return undefined;
+          }
+
+          const current = yield* getCurrent(output.distributionId);
+          if (!current) {
+            return undefined;
+          }
+
+          return toAttrs(current.distribution, current.etag, current.tags);
+        }),
+        create: Effect.fn(function* ({ id, instanceId, news, session }) {
+          const tags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+
+          const callerReference = instanceId;
+          const config = toConfig(callerReference, news);
+          yield* Effect.logInfo(
+            `CloudFront Distribution create: callerReference=${callerReference} aliases=${news.aliases?.length ?? 0} origins=${(news.origins as DistributionOrigin[]).length} tags=${Object.keys(tags).length}`,
+          );
+          yield* Effect.logInfo(
+            `CloudFront Distribution create: creating distribution with tags for callerReference=${callerReference}`,
+          );
+          const created = yield* cloudfront
+            .createDistributionWithTags({
+              DistributionConfigWithTags: {
+                DistributionConfig: config,
+                Tags: {
+                  Items: createTagsList(tags),
+                },
+              },
+            })
+            .pipe(
+              Effect.catch((error) =>
+                isAccessDenied(error)
+                  ? Effect.gen(function* () {
+                      yield* Effect.logInfo(
+                        `CloudFront Distribution create: createDistributionWithTags denied, retrying without tags for callerReference=${callerReference}`,
+                      );
+                      const created = yield* cloudfront.createDistribution({
+                        DistributionConfig: config,
+                      });
+
+                      if (
+                        created.Distribution?.ARN &&
+                        Object.keys(tags).length > 0
+                      ) {
+                        yield* Effect.logInfo(
+                          `CloudFront Distribution create: tagging distribution ${created.Distribution.Id} after fallback`,
+                        );
+                        yield* cloudfront.tagResource({
+                          Resource: created.Distribution.ARN,
+                          Tags: {
+                            Items: createTagsList(tags),
+                          },
+                        });
+                      }
+
+                      return created;
+                    })
+                  : Effect.gen(function* () {
+                      yield* Effect.logInfo(
+                        `CloudFront Distribution create: createDistributionWithTags failed for callerReference=${callerReference} error=${String(error)}`,
+                      );
+                      return yield* Effect.fail(error);
+                    }),
+              ),
+            )
+            .pipe(
+              Effect.map((created) => ({
+                distributionId: created.Distribution?.Id,
+                etag: created.ETag,
+                tags,
+              })),
+              Effect.catchTag("DistributionAlreadyExists", () =>
+                Effect.gen(function* () {
+                  yield* Effect.logInfo(
+                    `CloudFront Distribution create: callerReference=${callerReference} already exists, attempting recovery`,
+                  );
+                  const recovered =
+                    yield* getByCallerReference(callerReference);
+                  if (!recovered?.distribution.Id) {
+                    return yield* Effect.fail(
+                      new Error(
+                        `CloudFront distribution with caller reference '${callerReference}' already exists but could not be recovered`,
+                      ),
+                    );
+                  }
+                  return {
+                    distributionId: recovered.distribution.Id,
+                    etag: recovered.etag,
+                    tags: recovered.tags,
+                  };
+                }),
+              ),
+              Effect.catchTag(
+                "InvalidArgument",
+                (
+                  error,
+                ): Effect.Effect<
+                  never,
+                  | cloudfront.InvalidArgument
+                  | DistributionFunctionAssociationPending
+                > =>
+                  isFunctionAssociationPending(error)
+                    ? Effect.logInfo(
+                        "CloudFront Distribution create: function association not yet ready, retrying",
+                      ).pipe(
+                        Effect.andThen(
+                          Effect.fail(
+                            new DistributionFunctionAssociationPending({
+                              message:
+                                error.Message ??
+                                "CloudFront function association pending",
+                            }),
+                          ),
+                        ),
+                      )
+                    : Effect.fail(error),
+              ),
+              Effect.retry({
+                while: (error) =>
+                  error instanceof DistributionFunctionAssociationPending,
+                schedule: Schedule.fixed("5 seconds").pipe(
+                  Schedule.both(Schedule.recurs(24)),
+                ),
+              }),
+            );
+
+          if (!created.distributionId) {
+            return yield* Effect.fail(
+              new Error("createDistribution returned no distribution"),
+            );
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution create: created ${created.distributionId} etag=${created.etag ?? "missing"}, waiting for deployment`,
+          );
+          const deployed = yield* waitForDeployment(created.distributionId);
+          yield* Effect.logInfo(
+            `CloudFront Distribution create: deployed ${created.distributionId} domain=${deployed.DomainName}`,
+          );
+          yield* session.note(created.distributionId);
+          return toAttrs(deployed, created.etag, created.tags);
+        }),
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          yield* Effect.logInfo(
+            `CloudFront Distribution update: distribution=${output.distributionId} aliases=${news.aliases?.length ?? 0}`,
+          );
+          const current = yield* getCurrent(output.distributionId);
+          if (!current) {
+            return yield* Effect.fail(
+              new Error(
+                `CloudFront distribution '${output.distributionId}' was not found`,
+              ),
+            );
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution update: updating config for ${output.distributionId} with etag=${current.etag ?? "missing"}`,
+          );
+          const updated = yield* cloudfront
+            .updateDistribution({
+              Id: output.distributionId,
+              IfMatch: current.etag,
+              DistributionConfig: toConfig(
+                current.config.CallerReference,
+                news,
+              ),
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidArgument",
+                (
+                  error,
+                ): Effect.Effect<
+                  never,
+                  | cloudfront.InvalidArgument
+                  | DistributionFunctionAssociationPending
+                > =>
+                  isFunctionAssociationPending(error)
+                    ? Effect.logInfo(
+                        "CloudFront Distribution update: function association not yet ready, retrying",
+                      ).pipe(
+                        Effect.andThen(
+                          Effect.fail(
+                            new DistributionFunctionAssociationPending({
+                              message:
+                                error.Message ??
+                                "CloudFront function association pending",
+                            }),
+                          ),
+                        ),
+                      )
+                    : Effect.fail(error),
+              ),
+              Effect.retry({
+                while: (error) =>
+                  error instanceof DistributionFunctionAssociationPending,
+                schedule: Schedule.fixed("5 seconds").pipe(
+                  Schedule.both(Schedule.recurs(24)),
+                ),
+              }),
+            );
+
+          const oldTags = {
+            ...(yield* createInternalTags(id)),
+            ...olds.tags,
+          };
+          const newTags = {
+            ...(yield* createInternalTags(id)),
+            ...news.tags,
+          };
+          const { removed, upsert } = diffTags(oldTags, newTags);
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution update: distribution=${output.distributionId} upsertTags=${upsert.length} removedTags=${removed.length}`,
+          );
+
+          if (upsert.length > 0) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution update: tagging ${output.distributionId} with ${upsert.length} tag(s)`,
+            );
+            yield* cloudfront.tagResource({
+              Resource: output.distributionArn,
+              Tags: {
+                Items: upsert,
+              },
+            });
+          }
+
+          if (removed.length > 0) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution update: removing ${removed.length} tag(s) from ${output.distributionId}`,
+            );
+            yield* cloudfront.untagResource({
+              Resource: output.distributionArn,
+              TagKeys: {
+                Items: removed,
+              },
+            });
+          }
+
+          if (!updated.Distribution?.Id) {
+            return yield* Effect.fail(
+              new Error("updateDistribution returned no distribution"),
+            );
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution update: updated ${output.distributionId} etag=${updated.ETag ?? "missing"}, waiting for deployment`,
+          );
+          const deployed = yield* waitForDeployment(updated.Distribution.Id);
+          yield* Effect.logInfo(
+            `CloudFront Distribution update: deployed ${output.distributionId} domain=${deployed.DomainName}`,
+          );
+          yield* session.note(output.distributionId);
+          return toAttrs(deployed, updated.ETag, newTags);
+        }),
+        delete: Effect.fn(function* ({ output }) {
+          yield* Effect.logInfo(
+            `CloudFront Distribution delete: distribution=${output.distributionId}`,
+          );
+          const current = yield* getCurrent(output.distributionId);
+          if (!current) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: ${output.distributionId} already absent`,
+            );
+            return;
+          }
+
+          if (current.config.Enabled) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: disabling ${output.distributionId} before delete`,
+            );
+            yield* cloudfront.updateDistribution({
+              Id: output.distributionId,
+              IfMatch: current.etag,
+              DistributionConfig: {
+                ...current.config,
+                Enabled: false,
+              },
+            });
+          }
+
+          const latest = yield* waitForDeletionReady(output.distributionId);
+          if (!latest) {
+            yield* Effect.logInfo(
+              `CloudFront Distribution delete: ${output.distributionId} disappeared before delete`,
+            );
+            return;
+          }
+
+          yield* Effect.logInfo(
+            `CloudFront Distribution delete: deleting ${output.distributionId} with etag=${latest.etag ?? "missing"}`,
+          );
+          yield* cloudfront
+            .deleteDistribution({
+              Id: output.distributionId,
+              IfMatch: latest.etag,
+            })
+            .pipe(Effect.catchTag("NoSuchDistribution", () => Effect.void));
+        }),
+      };
+    }),
+  );
+
+const toTagsRecord = (tags: cloudfront.Tag[] | undefined) =>
+  Object.fromEntries(
+    (tags ?? [])
+      .filter(
+        (tag): tag is { Key: string; Value: string } =>
+          typeof tag.Key === "string" && typeof tag.Value === "string",
+      )
+      .map((tag) => [tag.Key, tag.Value]),
+  );
+
+const isAccessDenied = (error: unknown) => {
+  const tag = (error as { _tag?: string; name?: string })?._tag;
+  const name = (error as { _tag?: string; name?: string })?.name;
+  const text = String(error);
+  return (
+    tag === "AccessDenied" ||
+    tag === "AccessDeniedException" ||
+    name === "AccessDenied" ||
+    name === "AccessDeniedException" ||
+    text.includes("AccessDenied")
+  );
+};
+
+const toBehavior = (
+  behavior: DistributionBehavior & {
+    pathPattern?: string;
+  },
+): cloudfront.CacheBehavior | cloudfront.DefaultCacheBehavior => ({
+  ...(behavior.pathPattern ? { PathPattern: behavior.pathPattern } : undefined),
+  TargetOriginId: behavior.targetOriginId,
+  ViewerProtocolPolicy: behavior.viewerProtocolPolicy ?? "redirect-to-https",
+  AllowedMethods: behavior.allowedMethods
+    ? {
+        Quantity: behavior.allowedMethods.length,
+        Items: behavior.allowedMethods,
+        CachedMethods: behavior.cachedMethods
+          ? {
+              Quantity: behavior.cachedMethods.length,
+              Items: behavior.cachedMethods,
+            }
+          : undefined,
+      }
+    : undefined,
+  Compress: behavior.compress ?? true,
+  CachePolicyId: behavior.cachePolicyId,
+  OriginRequestPolicyId: behavior.originRequestPolicyId,
+  ResponseHeadersPolicyId: behavior.responseHeadersPolicyId,
+  ForwardedValues: behavior.forwardedValues,
+  MinTTL: behavior.minTtl,
+  DefaultTTL: behavior.defaultTtl,
+  MaxTTL: behavior.maxTtl,
+  FunctionAssociations: behavior.functionAssociations
+    ? {
+        Quantity: behavior.functionAssociations.length,
+        Items: behavior.functionAssociations.map((association) => ({
+          FunctionARN: association.functionArn,
+          EventType: association.eventType,
+        })),
+      }
+    : undefined,
+  LambdaFunctionAssociations: behavior.lambdaFunctionAssociations
+    ? {
+        Quantity: behavior.lambdaFunctionAssociations.length,
+        Items: behavior.lambdaFunctionAssociations.map((association) => ({
+          LambdaFunctionARN: association.lambdaFunctionArn,
+          EventType: association.eventType,
+          IncludeBody: association.includeBody,
+        })),
+      }
+    : undefined,
+});
+
+const toOrigin = (origin: DistributionOrigin): cloudfront.Origin => ({
+  Id: origin.id,
+  DomainName: origin.domainName as string,
+  OriginPath: origin.originPath as string | undefined,
+  OriginAccessControlId: origin.originAccessControlId as string | undefined,
+  S3OriginConfig: origin.s3Origin ? { OriginAccessIdentity: "" } : undefined,
+  CustomOriginConfig: origin.s3Origin
+    ? undefined
+    : {
+        HTTPPort: origin.customOriginConfig?.httpPort ?? 80,
+        HTTPSPort: origin.customOriginConfig?.httpsPort ?? 443,
+        OriginProtocolPolicy:
+          origin.customOriginConfig?.originProtocolPolicy ?? "https-only",
+        OriginSslProtocols: {
+          Quantity: (
+            origin.customOriginConfig?.originSslProtocols ?? ["TLSv1.2"]
+          ).length,
+          Items: origin.customOriginConfig?.originSslProtocols ?? ["TLSv1.2"],
+        },
+        OriginReadTimeout: origin.customOriginConfig?.originReadTimeout,
+        OriginKeepaliveTimeout:
+          origin.customOriginConfig?.originKeepaliveTimeout,
+      },
+});
+
+const toConfig = (
+  callerReference: string,
+  props: DistributionProps,
+): cloudfront.DistributionConfig => ({
+  CallerReference: callerReference,
+  Aliases: props.aliases
+    ? {
+        Quantity: props.aliases.length,
+        Items: props.aliases,
+      }
+    : undefined,
+  DefaultRootObject: props.defaultRootObject,
+  Origins: {
+    Quantity: (props.origins as DistributionOrigin[]).length,
+    Items: (props.origins as DistributionOrigin[]).map(toOrigin),
+  },
+  DefaultCacheBehavior: toBehavior(
+    props.defaultCacheBehavior as DistributionBehavior,
+  ) as cloudfront.DefaultCacheBehavior,
+  CacheBehaviors: props.orderedCacheBehaviors
+    ? {
+        Quantity: (
+          props.orderedCacheBehaviors as Array<
+            DistributionBehavior & { pathPattern: string }
+          >
+        ).length,
+        Items: (
+          props.orderedCacheBehaviors as Array<
+            DistributionBehavior & { pathPattern: string }
+          >
+        ).map((behavior) =>
+          toBehavior(
+            behavior as DistributionBehavior & { pathPattern: string },
+          ),
+        ) as cloudfront.CacheBehavior[],
+      }
+    : undefined,
+  CustomErrorResponses: props.customErrorResponses
+    ? {
+        Quantity: (
+          props.customErrorResponses as cloudfront.CustomErrorResponse[]
+        ).length,
+        Items: props.customErrorResponses as cloudfront.CustomErrorResponse[],
+      }
+    : undefined,
+  Comment: props.comment ?? "",
+  Enabled: props.enabled ?? true,
+  ViewerCertificate: props.viewerCertificate
+    ? {
+        CloudFrontDefaultCertificate: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).cloudFrontDefaultCertificate,
+        ACMCertificateArn: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).acmCertificateArn,
+        SSLSupportMethod: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).sslSupportMethod,
+        MinimumProtocolVersion: (
+          props.viewerCertificate as DistributionViewerCertificate
+        ).minimumProtocolVersion,
+      }
+    : props.aliases && props.aliases.length > 0
+      ? undefined
+      : {
+          CloudFrontDefaultCertificate: true,
+        },
+  Restrictions: {
+    GeoRestriction: {
+      RestrictionType: "none",
+      Quantity: 0,
+    },
+  },
+  PriceClass: props.priceClass,
+  WebACLId: props.webAclId,
+  HttpVersion: props.httpVersion ?? "http2",
+  IsIPV6Enabled: props.isIpv6Enabled ?? true,
+});
+
+const toAttrs = (
+  distribution: cloudfront.Distribution,
+  etag: string | undefined,
+  tags: Record<string, string>,
+): Distribution["Attributes"] => ({
+  distributionId: distribution.Id,
+  distributionArn: distribution.ARN,
+  domainName: distribution.DomainName,
+  hostedZoneId: CLOUDFRONT_HOSTED_ZONE_ID,
+  status: distribution.Status,
+  aliases: distribution.DistributionConfig.Aliases?.Items ?? [],
+  comment:
+    typeof distribution.DistributionConfig.Comment === "string"
+      ? distribution.DistributionConfig.Comment
+      : "",
+  enabled: distribution.DistributionConfig.Enabled,
+  etag,
+  inProgressInvalidationBatches: distribution.InProgressInvalidationBatches,
+  lastModifiedTime: distribution.LastModifiedTime,
+  tags,
+});