aws-cdk-lib 2.175.1__py3-none-any.whl → 2.177.0__py3-none-any.whl

aws_cdk/aws_cleanrooms/__init__.py

@@ -857,7 +857,7 @@ class CfnCollaboration(
         :param name: A human-readable identifier provided by the collaboration owner. Display names are not unique.
         :param query_log_status: An indicator as to whether query logging has been enabled or disabled for the collaboration.
         :param analytics_engine: The analytics engine for the collaboration.
-        :param creator_ml_member_abilities: 
+        :param creator_ml_member_abilities: The ML member abilities for a collaboration member.
         :param creator_payment_configuration: An object representing the collaboration member's payment responsibilities set by the collaboration creator.
         :param data_encryption_metadata: The settings for client-side encryption for cryptographic computing.
         :param tags: An optional label that you can assign to a resource when you create it. Each tag consists of a key and an optional value, both of which you define. When you use tagging, you can also use tag-based access control in IAM policies to control access to this resource.
@@ -1046,6 +1046,7 @@ class CfnCollaboration(
     def creator_ml_member_abilities(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.MLMemberAbilitiesProperty"]]:
+        '''The ML member abilities for a collaboration member.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.MLMemberAbilitiesProperty"]], jsii.get(self, "creatorMlMemberAbilities"))
 
     @creator_ml_member_abilities.setter
@@ -1228,8 +1229,9 @@ class CfnCollaboration(
             *,
             custom_ml_member_abilities: typing.Sequence[builtins.str],
         ) -> None:
-            '''
-            :param custom_ml_member_abilities: 
+            '''The ML member abilities for a collaboration member.
+
+            :param custom_ml_member_abilities: The custom ML member abilities for a collaboration member.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-mlmemberabilities.html
             :exampleMetadata: fixture=_generated
@@ -1253,7 +1255,8 @@ class CfnCollaboration(
 
         @builtins.property
         def custom_ml_member_abilities(self) -> typing.List[builtins.str]:
-            '''
+            '''The custom ML member abilities for a collaboration member.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-mlmemberabilities.html#cfn-cleanrooms-collaboration-mlmemberabilities-custommlmemberabilities
             '''
             result = self._values.get("custom_ml_member_abilities")
@@ -1286,9 +1289,10 @@ class CfnCollaboration(
             model_inference: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnCollaboration.ModelInferencePaymentConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             model_training: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnCollaboration.ModelTrainingPaymentConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''
-            :param model_inference: 
-            :param model_training: 
+            '''An object representing the collaboration member's machine learning payment responsibilities set by the collaboration creator.
+
+            :param model_inference: The payment responsibilities accepted by the member for model inference.
+            :param model_training: The payment responsibilities accepted by the member for model training.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-mlpaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -1322,7 +1326,8 @@ class CfnCollaboration(
         def model_inference(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.ModelInferencePaymentConfigProperty"]]:
-            '''
+            '''The payment responsibilities accepted by the member for model inference.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-mlpaymentconfig.html#cfn-cleanrooms-collaboration-mlpaymentconfig-modelinference
             '''
             result = self._values.get("model_inference")
@@ -1332,7 +1337,8 @@ class CfnCollaboration(
         def model_training(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.ModelTrainingPaymentConfigProperty"]]:
-            '''
+            '''The payment responsibilities accepted by the member for model training.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-mlpaymentconfig.html#cfn-cleanrooms-collaboration-mlpaymentconfig-modeltraining
             '''
             result = self._values.get("model_training")
@@ -1375,7 +1381,7 @@ class CfnCollaboration(
             :param account_id: The identifier used to reference members of the collaboration. Currently only supports AWS account ID.
             :param display_name: The member's display name.
             :param member_abilities: The abilities granted to the collaboration member. *Allowed Values* : ``CAN_QUERY`` | ``CAN_RECEIVE_RESULTS``
-            :param ml_member_abilities: 
+            :param ml_member_abilities: The ML abilities granted to the collaboration member.
             :param payment_configuration: The collaboration member's payment responsibilities set by the collaboration creator. If the collaboration creator hasn't specified anyone as the member paying for query compute costs, then the member who can query is the default payer.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-memberspecification.html
@@ -1468,7 +1474,8 @@ class CfnCollaboration(
         def ml_member_abilities(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.MLMemberAbilitiesProperty"]]:
-            '''
+            '''The ML abilities granted to the collaboration member.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-memberspecification.html#cfn-cleanrooms-collaboration-memberspecification-mlmemberabilities
             '''
             result = self._values.get("ml_member_abilities")
@@ -1509,8 +1516,9 @@ class CfnCollaboration(
             *,
             is_responsible: typing.Union[builtins.bool, _IResolvable_da3f097b],
         ) -> None:
-            '''
-            :param is_responsible: 
+            '''An object representing the collaboration member's model inference payment responsibilities set by the collaboration creator.
+
+            :param is_responsible: Indicates whether the collaboration creator has configured the collaboration member to pay for model inference costs ( ``TRUE`` ) or has not configured the collaboration member to pay for model inference costs ( ``FALSE`` ). Exactly one member can be configured to pay for model inference costs. An error is returned if the collaboration creator sets a ``TRUE`` value for more than one member in the collaboration. If the collaboration creator hasn't specified anyone as the member paying for model inference costs, then the member who can query is the default payer. An error is returned if the collaboration creator sets a ``FALSE`` value for the member who can query.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-modelinferencepaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -1534,7 +1542,12 @@ class CfnCollaboration(
 
         @builtins.property
         def is_responsible(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
-            '''
+            '''Indicates whether the collaboration creator has configured the collaboration member to pay for model inference costs ( ``TRUE`` ) or has not configured the collaboration member to pay for model inference costs ( ``FALSE`` ).
+
+            Exactly one member can be configured to pay for model inference costs. An error is returned if the collaboration creator sets a ``TRUE`` value for more than one member in the collaboration.
+
+            If the collaboration creator hasn't specified anyone as the member paying for model inference costs, then the member who can query is the default payer. An error is returned if the collaboration creator sets a ``FALSE`` value for the member who can query.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-modelinferencepaymentconfig.html#cfn-cleanrooms-collaboration-modelinferencepaymentconfig-isresponsible
             '''
             result = self._values.get("is_responsible")
@@ -1563,8 +1576,9 @@ class CfnCollaboration(
             *,
             is_responsible: typing.Union[builtins.bool, _IResolvable_da3f097b],
         ) -> None:
-            '''
-            :param is_responsible: 
+            '''An object representing the collaboration member's model training payment responsibilities set by the collaboration creator.
+
+            :param is_responsible: Indicates whether the collaboration creator has configured the collaboration member to pay for model training costs ( ``TRUE`` ) or has not configured the collaboration member to pay for model training costs ( ``FALSE`` ). Exactly one member can be configured to pay for model training costs. An error is returned if the collaboration creator sets a ``TRUE`` value for more than one member in the collaboration. If the collaboration creator hasn't specified anyone as the member paying for model training costs, then the member who can query is the default payer. An error is returned if the collaboration creator sets a ``FALSE`` value for the member who can query.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-modeltrainingpaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -1588,7 +1602,12 @@ class CfnCollaboration(
 
         @builtins.property
         def is_responsible(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
-            '''
+            '''Indicates whether the collaboration creator has configured the collaboration member to pay for model training costs ( ``TRUE`` ) or has not configured the collaboration member to pay for model training costs ( ``FALSE`` ).
+
+            Exactly one member can be configured to pay for model training costs. An error is returned if the collaboration creator sets a ``TRUE`` value for more than one member in the collaboration.
+
+            If the collaboration creator hasn't specified anyone as the member paying for model training costs, then the member who can query is the default payer. An error is returned if the collaboration creator sets a ``FALSE`` value for the member who can query.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-modeltrainingpaymentconfig.html#cfn-cleanrooms-collaboration-modeltrainingpaymentconfig-isresponsible
             '''
             result = self._values.get("is_responsible")
@@ -1624,7 +1643,7 @@ class CfnCollaboration(
             '''An object representing the collaboration member's payment responsibilities set by the collaboration creator.
 
             :param query_compute: The collaboration member's payment responsibilities set by the collaboration creator for query compute costs.
-            :param machine_learning: 
+            :param machine_learning: An object representing the collaboration member's machine learning payment responsibilities set by the collaboration creator.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-paymentconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -1677,7 +1696,8 @@ class CfnCollaboration(
         def machine_learning(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnCollaboration.MLPaymentConfigProperty"]]:
-            '''
+            '''An object representing the collaboration member's machine learning payment responsibilities set by the collaboration creator.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-collaboration-paymentconfiguration.html#cfn-cleanrooms-collaboration-paymentconfiguration-machinelearning
             '''
             result = self._values.get("machine_learning")
@@ -1797,7 +1817,7 @@ class CfnCollaborationProps:
         :param name: A human-readable identifier provided by the collaboration owner. Display names are not unique.
         :param query_log_status: An indicator as to whether query logging has been enabled or disabled for the collaboration.
         :param analytics_engine: The analytics engine for the collaboration.
-        :param creator_ml_member_abilities: 
+        :param creator_ml_member_abilities: The ML member abilities for a collaboration member.
         :param creator_payment_configuration: An object representing the collaboration member's payment responsibilities set by the collaboration creator.
         :param data_encryption_metadata: The settings for client-side encryption for cryptographic computing.
         :param tags: An optional label that you can assign to a resource when you create it. Each tag consists of a key and an optional value, both of which you define. When you use tagging, you can also use tag-based access control in IAM policies to control access to this resource.
@@ -1988,7 +2008,8 @@ class CfnCollaborationProps:
     def creator_ml_member_abilities(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnCollaboration.MLMemberAbilitiesProperty]]:
-        '''
+        '''The ML member abilities for a collaboration member.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cleanrooms-collaboration.html#cfn-cleanrooms-collaboration-creatormlmemberabilities
         '''
         result = self._values.get("creator_ml_member_abilities")
@@ -6686,9 +6707,10 @@ class CfnMembership(
             model_inference: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMembership.MembershipModelInferencePaymentConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             model_training: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMembership.MembershipModelTrainingPaymentConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''
-            :param model_inference: 
-            :param model_training: 
+            '''An object representing the collaboration member's machine learning payment responsibilities set by the collaboration creator.
+
+            :param model_inference: The payment responsibilities accepted by the member for model inference.
+            :param model_training: The payment responsibilities accepted by the member for model training.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmlpaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -6722,7 +6744,8 @@ class CfnMembership(
         def model_inference(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMembership.MembershipModelInferencePaymentConfigProperty"]]:
-            '''
+            '''The payment responsibilities accepted by the member for model inference.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmlpaymentconfig.html#cfn-cleanrooms-membership-membershipmlpaymentconfig-modelinference
             '''
             result = self._values.get("model_inference")
@@ -6732,7 +6755,8 @@ class CfnMembership(
         def model_training(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMembership.MembershipModelTrainingPaymentConfigProperty"]]:
-            '''
+            '''The payment responsibilities accepted by the member for model training.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmlpaymentconfig.html#cfn-cleanrooms-membership-membershipmlpaymentconfig-modeltraining
             '''
             result = self._values.get("model_training")
@@ -6760,8 +6784,9 @@ class CfnMembership(
             *,
             is_responsible: typing.Union[builtins.bool, _IResolvable_da3f097b],
         ) -> None:
-            '''
-            :param is_responsible: 
+            '''An object representing the collaboration member's model inference payment responsibilities set by the collaboration creator.
+
+            :param is_responsible: Indicates whether the collaboration member has accepted to pay for model inference costs ( ``TRUE`` ) or has not accepted to pay for model inference costs ( ``FALSE`` ). If the collaboration creator has not specified anyone to pay for model inference costs, then the member who can query is the default payer. An error message is returned for the following reasons: - If you set the value to ``FALSE`` but you are responsible to pay for model inference costs. - If you set the value to ``TRUE`` but you are not responsible to pay for model inference costs.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmodelinferencepaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -6785,7 +6810,15 @@ class CfnMembership(
 
         @builtins.property
         def is_responsible(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
-            '''
+            '''Indicates whether the collaboration member has accepted to pay for model inference costs ( ``TRUE`` ) or has not accepted to pay for model inference costs ( ``FALSE`` ).
+
+            If the collaboration creator has not specified anyone to pay for model inference costs, then the member who can query is the default payer.
+
+            An error message is returned for the following reasons:
+
+            - If you set the value to ``FALSE`` but you are responsible to pay for model inference costs.
+            - If you set the value to ``TRUE`` but you are not responsible to pay for model inference costs.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmodelinferencepaymentconfig.html#cfn-cleanrooms-membership-membershipmodelinferencepaymentconfig-isresponsible
             '''
             result = self._values.get("is_responsible")
@@ -6814,8 +6847,9 @@ class CfnMembership(
             *,
             is_responsible: typing.Union[builtins.bool, _IResolvable_da3f097b],
         ) -> None:
-            '''
-            :param is_responsible: 
+            '''An object representing the collaboration member's model training payment responsibilities set by the collaboration creator.
+
+            :param is_responsible: Indicates whether the collaboration member has accepted to pay for model training costs ( ``TRUE`` ) or has not accepted to pay for model training costs ( ``FALSE`` ). If the collaboration creator has not specified anyone to pay for model training costs, then the member who can query is the default payer. An error message is returned for the following reasons: - If you set the value to ``FALSE`` but you are responsible to pay for model training costs. - If you set the value to ``TRUE`` but you are not responsible to pay for model training costs.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmodeltrainingpaymentconfig.html
             :exampleMetadata: fixture=_generated
@@ -6839,7 +6873,15 @@ class CfnMembership(
 
         @builtins.property
         def is_responsible(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
-            '''
+            '''Indicates whether the collaboration member has accepted to pay for model training costs ( ``TRUE`` ) or has not accepted to pay for model training costs ( ``FALSE`` ).
+
+            If the collaboration creator has not specified anyone to pay for model training costs, then the member who can query is the default payer.
+
+            An error message is returned for the following reasons:
+
+            - If you set the value to ``FALSE`` but you are responsible to pay for model training costs.
+            - If you set the value to ``TRUE`` but you are not responsible to pay for model training costs.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershipmodeltrainingpaymentconfig.html#cfn-cleanrooms-membership-membershipmodeltrainingpaymentconfig-isresponsible
             '''
             result = self._values.get("is_responsible")
@@ -6875,7 +6917,7 @@ class CfnMembership(
             '''An object representing the payment responsibilities accepted by the collaboration member.
 
             :param query_compute: The payment responsibilities accepted by the collaboration member for query compute costs.
-            :param machine_learning: 
+            :param machine_learning: The payment responsibilities accepted by the collaboration member for machine learning costs.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershippaymentconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -6928,7 +6970,8 @@ class CfnMembership(
         def machine_learning(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMembership.MembershipMLPaymentConfigProperty"]]:
-            '''
+            '''The payment responsibilities accepted by the collaboration member for machine learning costs.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cleanrooms-membership-membershippaymentconfiguration.html#cfn-cleanrooms-membership-membershippaymentconfiguration-machinelearning
             '''
             result = self._values.get("machine_learning")

aws_cdk/aws_cloudformation/__init__.py

@@ -3115,7 +3115,7 @@ class CfnMacro(
         :param function_name: The Amazon Resource Name (ARN) of the underlying Lambda function that you want CloudFormation to invoke when the macro is run.
         :param name: The name of the macro. The name of the macro must be unique across all macros in the account.
         :param description: A description of the macro.
-        :param log_group_name: The CloudWatch Logs group to which CloudFormation sends error logging information when invoking the macro's underlying Lambda function.
+        :param log_group_name: The CloudWatch Logs group to which CloudFormation sends error logging information when invoking the macro's underlying Lambda function. This will be an existing CloudWatch Logs LogGroup. Neither CloudFormation or Lambda will create the group.
         :param log_role_arn: The ARN of the role CloudFormation should assume when sending log entries to CloudWatch Logs .
         '''
         if __debug__:
@@ -3267,7 +3267,7 @@ class CfnMacroProps:
         :param function_name: The Amazon Resource Name (ARN) of the underlying Lambda function that you want CloudFormation to invoke when the macro is run.
         :param name: The name of the macro. The name of the macro must be unique across all macros in the account.
         :param description: A description of the macro.
-        :param log_group_name: The CloudWatch Logs group to which CloudFormation sends error logging information when invoking the macro's underlying Lambda function.
+        :param log_group_name: The CloudWatch Logs group to which CloudFormation sends error logging information when invoking the macro's underlying Lambda function. This will be an existing CloudWatch Logs LogGroup. Neither CloudFormation or Lambda will create the group.
         :param log_role_arn: The ARN of the role CloudFormation should assume when sending log entries to CloudWatch Logs .
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-macro.html
@@ -3342,6 +3342,8 @@ class CfnMacroProps:
     def log_group_name(self) -> typing.Optional[builtins.str]:
         '''The CloudWatch Logs group to which CloudFormation sends error logging information when invoking the macro's underlying Lambda function.
 
+        This will be an existing CloudWatch Logs LogGroup. Neither CloudFormation or Lambda will create the group.
+
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-macro.html#cfn-cloudformation-macro-loggroupname
         '''
         result = self._values.get("log_group_name")

aws_cdk/aws_cloudfront/__init__.py

@@ -1347,6 +1347,8 @@ class AccessLevel(enum.Enum):
 
     READ = "READ"
     '''Grants read permissions to CloudFront Distribution.'''
+    LIST = "LIST"
+    '''Grants list permissions to CloudFront Distribution.'''
     WRITE = "WRITE"
     '''Grants write permission to CloudFront Distribution.'''
     DELETE = "DELETE"
@@ -2699,6 +2701,8 @@ class CfnAnycastIpList(
 ):
     '''An Anycast static IP list.
 
+    For more information, see `Request Anycast static IPs to use for allowlisting <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/request-static-ips.html>`_ in the *Amazon CloudFront Developer Guide* .
+
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-anycastiplist.html
     :cloudformationResource: AWS::CloudFront::AnycastIpList
     :exampleMetadata: fixture=_generated
@@ -2880,6 +2884,8 @@ class CfnAnycastIpList(
         ) -> None:
             '''An Anycast static IP list.
 
+            For more information, see `Request Anycast static IPs to use for allowlisting <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/request-static-ips.html>`_ in the *Amazon CloudFront Developer Guide* .
+
             :param anycast_ips: The static IP addresses that are allocated to the Anycast static IP list.
             :param arn: The Amazon Resource Name (ARN) of the Anycast static IP list.
             :param id: The ID of the Anycast static IP list.
@@ -21519,7 +21525,7 @@ class ResponseHeadersCorsBehavior:
 
         :param access_control_allow_credentials: A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.
         :param access_control_allow_headers: A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header. You can specify ``['*']`` to allow all headers.
-        :param access_control_allow_methods: A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.
+        :param access_control_allow_methods: A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header. Allowed methods: ``'GET'``, ``'DELETE'``, ``'HEAD'``, ``'OPTIONS'``, ``'PATCH'``, ``'POST'``, and ``'PUT'``. You can specify ``['ALL']`` to allow all methods.
         :param access_control_allow_origins: A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header. You can specify ``['*']`` to allow all origins.
         :param origin_override: A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
         :param access_control_expose_headers: A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header. You can specify ``['*']`` to expose all headers. Default: - no headers exposed
@@ -21614,7 +21620,11 @@ class ResponseHeadersCorsBehavior:
 
     @builtins.property
     def access_control_allow_methods(self) -> typing.List[builtins.str]:
-        '''A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.'''
+        '''A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.
+
+        Allowed methods: ``'GET'``, ``'DELETE'``, ``'HEAD'``, ``'OPTIONS'``, ``'PATCH'``, ``'POST'``, and ``'PUT'``.
+        You can specify ``['ALL']`` to allow all methods.
+        '''
         result = self._values.get("access_control_allow_methods")
         assert result is not None, "Required property 'access_control_allow_methods' is missing"
         return typing.cast(typing.List[builtins.str], result)

aws_cdk/aws_cloudfront/experimental/__init__.py

@@ -412,7 +412,7 @@ class EdgeFunction(
         :param filter_encryption: Add Customer managed KMS key to encrypt Filter Criteria. Default: - none
         :param filters: Add filter criteria to Event Source. Default: - none
         :param kafka_bootstrap_servers: A list of host and port pairs that are the addresses of the Kafka brokers in a self managed "bootstrap" Kafka cluster that a Kafka client connects to initially to bootstrap itself. They are in the format ``abc.example.com:9096``. Default: - none
-        :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a lenght between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
+        :param kafka_consumer_group_id: The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. The value must have a length between 1 and 200 and full the pattern '[a-zA-Z0-9-/*:_+=.@-]*'. For more information, see `Customizable consumer group ID <https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id>`_. Default: - none
         :param kafka_topic: The name of the Kafka topic. Default: - no topic
         :param max_batching_window: The maximum amount of time to gather records before invoking the function. Maximum of Duration.minutes(5) Default: Duration.seconds(0)
         :param max_concurrency: The maximum concurrency setting limits the number of concurrent instances of the function that an Amazon SQS event source can invoke. Default: - No specific limit.

aws_cdk/aws_cloudfront_origins/__init__.py

@@ -74,7 +74,7 @@ cloudfront.Distribution(self, "myDist",
 
 When creating a standard S3 origin using `origins.S3BucketOrigin.withOriginAccessControl()`, an [Origin Access Control resource](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html) is automatically created with the origin type set to `s3` and signing behavior set to `always`.
 
-You can grant read, write or delete access to the OAC using the `originAccessLevels` property:
+You can grant read, list, write or delete access to the OAC using the `originAccessLevels` property:
 
 ```python
 my_bucket = s3.Bucket(self, "myBucket")
@@ -83,6 +83,8 @@ s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
 )
 ```
 
+For details of list permission, see [Setting up OAC with LIST permission](#setting-up-oac-with-list-permission).
+
 You can also pass in a custom S3 origin access control:
 
 ```python
@@ -336,6 +338,29 @@ See CloudFront docs on [Giving the origin access control permission to access th
 > Note: If your bucket previously used OAI, you will need to manually remove the policy statement
 > that gives the OAI access to your bucket after setting up OAC.
 
+#### Setting up OAC with LIST permission
+
+By default, S3 origin returns 403 Forbidden HTTP response when the requested object does not exist.
+When you want to receive 404 Not Found, specify `AccessLevel.LIST` in `originAccessLevels` to add `s3:ListBucket` permission in the bucket policy.
+
+This is useful to distinguish between responses blocked by WAF (403) and responses where the file does not exist (404).
+
+```python
+my_bucket = s3.Bucket(self, "myBucket")
+s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
+    origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
+)
+cloudfront.Distribution(self, "distribution",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=s3_origin
+    ),
+    default_root_object="index.html"
+)
+```
+
+When the origin is associated to the default behavior, it is highly recommended to specify `defaultRootObject` distribution property.
+Without it, the root path `https://xxxx.cloudfront.net/` will return the list of the S3 object keys.
+
 #### Setting up an OAI (legacy)
 
 Setup an S3 origin with origin access identity (legacy) as follows:
@@ -3171,7 +3196,13 @@ class S3BucketOriginWithOACProps(S3BucketOriginBaseProps):
 
             my_bucket = s3.Bucket(self, "myBucket")
             s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
-                origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.WRITE, cloudfront.AccessLevel.DELETE]
+                origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.LIST]
+            )
+            cloudfront.Distribution(self, "distribution",
+                default_behavior=cloudfront.BehaviorOptions(
+                    origin=s3_origin
+                ),
+                default_root_object="index.html"
             )
         '''
         if __debug__: