aws-cdk-lib 2.179.0__py3-none-any.whl → 2.181.0__py3-none-any.whl

aws_cdk/aws_cloudfront/__init__.py

@@ -70,6 +70,15 @@ cloudfront.Distribution(self, "myDist",
 )
 ```
 
+### VPC origins
+
+You can use CloudFront to deliver content from applications that are hosted in your virtual private cloud (VPC) private subnets.
+You can use Application Load Balancers (ALBs), Network Load Balancers (NLBs), and EC2 instances in private subnets as VPC origins.
+
+Learn more about [Restrict access with VPC origins](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html).
+
+See the README of the `aws-cdk-lib/aws-cloudfront-origins` module for more information on setting up VPC origins.
+
 ### Domain Names and Certificates
 
 When you create a distribution, CloudFront assigns a domain name for the distribution, for example: `d111111abcdef8.cloudfront.net`; this value can
@@ -796,6 +805,29 @@ cloudfront.Distribution(self, "myCdn",
 )
 ```
 
+### gRPC
+
+CloudFront supports gRPC, an open-source remote procedure call (RPC) framework built on HTTP/2. gRPC offers bi-directional streaming and
+binary protocol that buffers payloads, making it suitable for applications that require low latency communications.
+
+To enable your distribution to handle gRPC requests, you must include HTTP/2 as one of the supported HTTP versions and allow HTTP methods,
+including POST.
+
+See [Using gRPC with CloudFront distributions](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-using-grpc.html)
+in the CloudFront User Guide.
+
+Example:
+
+```python
+cloudfront.Distribution(self, "myCdn",
+    default_behavior=cloudfront.BehaviorOptions(
+        origin=origins.HttpOrigin("www.example.com"),
+        allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,  # `AllowedMethods.ALLOW_ALL` is required if `enableGrpc` is true
+        enable_grpc=True
+    )
+)
+```
+
 ## Migrating from the original CloudFrontWebDistribution to the newer Distribution construct
 
 It's possible to migrate a distribution from the original to the modern API.
@@ -1318,6 +1350,11 @@ from ..aws_cloudwatch import (
     MetricOptions as _MetricOptions_1788b62f,
     Unit as _Unit_61bc6f70,
 )
+from ..aws_ec2 import IInstance as _IInstance_ab239e7c
+from ..aws_elasticloadbalancingv2 import (
+    IApplicationLoadBalancer as _IApplicationLoadBalancer_4cbd50ab,
+    INetworkLoadBalancer as _INetworkLoadBalancer_96e17101,
+)
 from ..aws_iam import (
     Grant as _Grant_a7ae64f8,
     IGrantable as _IGrantable_71c4f5de,
@@ -1340,13 +1377,13 @@ class AccessLevel(enum.Enum):
     Example::
 
         my_bucket = s3.Bucket(self, "myBucket")
-        s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket,
-            origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.WRITE, cloudfront.AccessLevel.DELETE]
-        )
+        s3_origin = origins.S3BucketOrigin.with_origin_access_control(my_bucket, origin_access_levels=[cloudfront.AccessLevel.READ, cloudfront.AccessLevel.READ_VERSIONED, cloudfront.AccessLevel.WRITE, cloudfront.AccessLevel.DELETE])
     '''
 
     READ = "READ"
     '''Grants read permissions to CloudFront Distribution.'''
+    READ_VERSIONED = "READ_VERSIONED"
+    '''Grants versioned read permissions to CloudFront Distribution.'''
     LIST = "LIST"
     '''Grants list permissions to CloudFront Distribution.'''
     WRITE = "WRITE"
@@ -1364,6 +1401,7 @@ class AccessLevel(enum.Enum):
         "cache_policy": "cachePolicy",
         "compress": "compress",
         "edge_lambdas": "edgeLambdas",
+        "enable_grpc": "enableGrpc",
         "function_associations": "functionAssociations",
         "origin_request_policy": "originRequestPolicy",
         "realtime_log_config": "realtimeLogConfig",
@@ -1382,6 +1420,7 @@ class AddBehaviorOptions:
         cache_policy: typing.Optional["ICachePolicy"] = None,
         compress: typing.Optional[builtins.bool] = None,
         edge_lambdas: typing.Optional[typing.Sequence[typing.Union["EdgeLambda", typing.Dict[builtins.str, typing.Any]]]] = None,
+        enable_grpc: typing.Optional[builtins.bool] = None,
         function_associations: typing.Optional[typing.Sequence[typing.Union["FunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
         origin_request_policy: typing.Optional["IOriginRequestPolicy"] = None,
         realtime_log_config: typing.Optional["IRealtimeLogConfig"] = None,
@@ -1397,6 +1436,7 @@ class AddBehaviorOptions:
         :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
         :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
         :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
+        :param enable_grpc: Enables your CloudFront distribution to receive gRPC requests and to proxy them directly to your origins. If the ``enableGrpc`` is set to true, the following restrictions apply: - The ``allowedMethods`` property must be ``AllowedMethods.ALLOW_ALL`` to include POST method because gRPC only supports POST method. - The ``httpVersion`` property must be ``HttpVersion.HTTP2`` or ``HttpVersion.HTTP2_AND_3`` because gRPC only supports versions including HTTP/2. - The ``edgeLambdas`` property can't be specified because gRPC is not supported with Lambda@Edge. Default: false
         :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
         :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
         :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
@@ -1424,6 +1464,7 @@ class AddBehaviorOptions:
             check_type(argname="argument cache_policy", value=cache_policy, expected_type=type_hints["cache_policy"])
             check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
             check_type(argname="argument edge_lambdas", value=edge_lambdas, expected_type=type_hints["edge_lambdas"])
+            check_type(argname="argument enable_grpc", value=enable_grpc, expected_type=type_hints["enable_grpc"])
             check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
             check_type(argname="argument origin_request_policy", value=origin_request_policy, expected_type=type_hints["origin_request_policy"])
             check_type(argname="argument realtime_log_config", value=realtime_log_config, expected_type=type_hints["realtime_log_config"])
@@ -1442,6 +1483,8 @@ class AddBehaviorOptions:
             self._values["compress"] = compress
         if edge_lambdas is not None:
             self._values["edge_lambdas"] = edge_lambdas
+        if enable_grpc is not None:
+            self._values["enable_grpc"] = enable_grpc
         if function_associations is not None:
             self._values["function_associations"] = function_associations
         if origin_request_policy is not None:
@@ -1512,6 +1555,23 @@ class AddBehaviorOptions:
         result = self._values.get("edge_lambdas")
         return typing.cast(typing.Optional[typing.List["EdgeLambda"]], result)
 
+    @builtins.property
+    def enable_grpc(self) -> typing.Optional[builtins.bool]:
+        '''Enables your CloudFront distribution to receive gRPC requests and to proxy them directly to your origins.
+
+        If the ``enableGrpc`` is set to true, the following restrictions apply:
+
+        - The ``allowedMethods`` property must be ``AllowedMethods.ALLOW_ALL`` to include POST method because gRPC only supports POST method.
+        - The ``httpVersion`` property must be ``HttpVersion.HTTP2`` or ``HttpVersion.HTTP2_AND_3`` because gRPC only supports versions including HTTP/2.
+        - The ``edgeLambdas`` property can't be specified because gRPC is not supported with Lambda@Edge.
+
+        :default: false
+
+        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-using-grpc.html
+        '''
+        result = self._values.get("enable_grpc")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def function_associations(
         self,
@@ -1961,6 +2021,7 @@ class Behavior:
         "cache_policy": "cachePolicy",
         "compress": "compress",
         "edge_lambdas": "edgeLambdas",
+        "enable_grpc": "enableGrpc",
         "function_associations": "functionAssociations",
         "origin_request_policy": "originRequestPolicy",
         "realtime_log_config": "realtimeLogConfig",
@@ -1980,6 +2041,7 @@ class BehaviorOptions(AddBehaviorOptions):
         cache_policy: typing.Optional["ICachePolicy"] = None,
         compress: typing.Optional[builtins.bool] = None,
         edge_lambdas: typing.Optional[typing.Sequence[typing.Union["EdgeLambda", typing.Dict[builtins.str, typing.Any]]]] = None,
+        enable_grpc: typing.Optional[builtins.bool] = None,
         function_associations: typing.Optional[typing.Sequence[typing.Union["FunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
         origin_request_policy: typing.Optional["IOriginRequestPolicy"] = None,
         realtime_log_config: typing.Optional["IRealtimeLogConfig"] = None,
@@ -1996,6 +2058,7 @@ class BehaviorOptions(AddBehaviorOptions):
         :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
         :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
         :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
+        :param enable_grpc: Enables your CloudFront distribution to receive gRPC requests and to proxy them directly to your origins. If the ``enableGrpc`` is set to true, the following restrictions apply: - The ``allowedMethods`` property must be ``AllowedMethods.ALLOW_ALL`` to include POST method because gRPC only supports POST method. - The ``httpVersion`` property must be ``HttpVersion.HTTP2`` or ``HttpVersion.HTTP2_AND_3`` because gRPC only supports versions including HTTP/2. - The ``edgeLambdas`` property can't be specified because gRPC is not supported with Lambda@Edge. Default: false
         :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
         :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
         :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
@@ -2009,21 +2072,17 @@ class BehaviorOptions(AddBehaviorOptions):
 
         Example::
 
-            # Adding an existing Lambda@Edge function created in a different stack
-            # to a CloudFront distribution.
-            # s3_bucket: s3.Bucket
+            # Creates a distribution from an Application Load Balancer
+            # vpc: ec2.Vpc
             
-            function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")
-            
-            cloudfront.Distribution(self, "distro",
-                default_behavior=cloudfront.BehaviorOptions(
-                    origin=origins.S3Origin(s3_bucket),
-                    edge_lambdas=[cloudfront.EdgeLambda(
-                        function_version=function_version,
-                        event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
-                    )
-                    ]
-                )
+            # Create an application load balancer in a VPC. 'internetFacing' can be 'false'.
+            alb = elbv2.ApplicationLoadBalancer(self, "ALB",
+                vpc=vpc,
+                internet_facing=False,
+                vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED)
+            )
+            cloudfront.Distribution(self, "myDist",
+                default_behavior=cloudfront.BehaviorOptions(origin=origins.VpcOrigin.with_application_load_balancer(alb))
             )
         '''
         if __debug__:
@@ -2033,6 +2092,7 @@ class BehaviorOptions(AddBehaviorOptions):
             check_type(argname="argument cache_policy", value=cache_policy, expected_type=type_hints["cache_policy"])
             check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
             check_type(argname="argument edge_lambdas", value=edge_lambdas, expected_type=type_hints["edge_lambdas"])
+            check_type(argname="argument enable_grpc", value=enable_grpc, expected_type=type_hints["enable_grpc"])
             check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
             check_type(argname="argument origin_request_policy", value=origin_request_policy, expected_type=type_hints["origin_request_policy"])
             check_type(argname="argument realtime_log_config", value=realtime_log_config, expected_type=type_hints["realtime_log_config"])
@@ -2054,6 +2114,8 @@ class BehaviorOptions(AddBehaviorOptions):
             self._values["compress"] = compress
         if edge_lambdas is not None:
             self._values["edge_lambdas"] = edge_lambdas
+        if enable_grpc is not None:
+            self._values["enable_grpc"] = enable_grpc
         if function_associations is not None:
             self._values["function_associations"] = function_associations
         if origin_request_policy is not None:
@@ -2124,6 +2186,23 @@ class BehaviorOptions(AddBehaviorOptions):
         result = self._values.get("edge_lambdas")
         return typing.cast(typing.Optional[typing.List["EdgeLambda"]], result)
 
+    @builtins.property
+    def enable_grpc(self) -> typing.Optional[builtins.bool]:
+        '''Enables your CloudFront distribution to receive gRPC requests and to proxy them directly to your origins.
+
+        If the ``enableGrpc`` is set to true, the following restrictions apply:
+
+        - The ``allowedMethods`` property must be ``AllowedMethods.ALLOW_ALL`` to include POST method because gRPC only supports POST method.
+        - The ``httpVersion`` property must be ``HttpVersion.HTTP2`` or ``HttpVersion.HTTP2_AND_3`` because gRPC only supports versions including HTTP/2.
+        - The ``edgeLambdas`` property can't be specified because gRPC is not supported with Lambda@Edge.
+
+        :default: false
+
+        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-using-grpc.html
+        '''
+        result = self._values.get("enable_grpc")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def function_associations(
         self,
@@ -8781,7 +8860,7 @@ class CfnDistribution(
             :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
             :param origin_shield: CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
             :param s3_origin_config: Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting. To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.
-            :param vpc_origin_config: 
+            :param vpc_origin_config: The VPC origin configuration.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html
             :exampleMetadata: fixture=_generated
@@ -8999,7 +9078,8 @@ class CfnDistribution(
         def vpc_origin_config(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.VpcOriginConfigProperty"]]:
-            '''
+            '''The VPC origin configuration.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-vpcoriginconfig
             '''
             result = self._values.get("vpc_origin_config")
@@ -9512,10 +9592,11 @@ class CfnDistribution(
             origin_keepalive_timeout: typing.Optional[jsii.Number] = None,
             origin_read_timeout: typing.Optional[jsii.Number] = None,
         ) -> None:
-            '''
-            :param vpc_origin_id: 
-            :param origin_keepalive_timeout: Default: - 5
-            :param origin_read_timeout: Default: - 30
+            '''An Amazon CloudFront VPC origin configuration.
+
+            :param vpc_origin_id: The VPC origin ID.
+            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
+            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html
             :exampleMetadata: fixture=_generated
@@ -9549,7 +9630,8 @@ class CfnDistribution(
 
         @builtins.property
         def vpc_origin_id(self) -> builtins.str:
-            '''
+            '''The VPC origin ID.
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-vpcoriginid
             '''
             result = self._values.get("vpc_origin_id")
@@ -9558,7 +9640,12 @@ class CfnDistribution(
 
         @builtins.property
         def origin_keepalive_timeout(self) -> typing.Optional[jsii.Number]:
-            '''
+            '''Specifies how long, in seconds, CloudFront persists its connection to the origin.
+
+            The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+
+            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+
             :default: - 5
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originkeepalivetimeout
@@ -9568,7 +9655,12 @@ class CfnDistribution(
 
         @builtins.property
         def origin_read_timeout(self) -> typing.Optional[jsii.Number]:
-            '''
+            '''Specifies how long, in seconds, CloudFront waits for a response from the origin.
+
+            This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.
+
+            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+
             :default: - 30
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originreadtimeout
@@ -16050,8 +16142,8 @@ class CfnVpcOrigin(
 
             :param arn: The ARN of the CloudFront VPC origin endpoint configuration.
             :param name: The name of the CloudFront VPC origin endpoint configuration.
-            :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. Default: - 80
-            :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. Default: - 443
+            :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. The default value is ``80`` . Default: - 80
+            :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. The default value is ``443`` . Default: - 443
             :param origin_protocol_policy: The origin protocol policy for the CloudFront VPC origin endpoint configuration. Default: - "match-viewer"
             :param origin_ssl_protocols: 
 
@@ -16120,6 +16212,8 @@ class CfnVpcOrigin(
         def http_port(self) -> typing.Optional[jsii.Number]:
             '''The HTTP port for the CloudFront VPC origin endpoint configuration.
 
+            The default value is ``80`` .
+
             :default: - 80
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-vpcorigin-vpcoriginendpointconfig.html#cfn-cloudfront-vpcorigin-vpcoriginendpointconfig-httpport
@@ -16131,6 +16225,8 @@ class CfnVpcOrigin(
         def https_port(self) -> typing.Optional[jsii.Number]:
             '''The HTTPS port of the CloudFront VPC origin endpoint configuration.
 
+            The default value is ``443`` .
+
             :default: - 443
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-vpcorigin-vpcoriginendpointconfig.html#cfn-cloudfront-vpcorigin-vpcoriginendpointconfig-httpsport
@@ -16968,21 +17064,17 @@ class DistributionProps:
 
         Example::
 
-            # Adding an existing Lambda@Edge function created in a different stack
-            # to a CloudFront distribution.
-            # s3_bucket: s3.Bucket
+            # Creates a distribution from an Application Load Balancer
+            # vpc: ec2.Vpc
             
-            function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")
-            
-            cloudfront.Distribution(self, "distro",
-                default_behavior=cloudfront.BehaviorOptions(
-                    origin=origins.S3Origin(s3_bucket),
-                    edge_lambdas=[cloudfront.EdgeLambda(
-                        function_version=function_version,
-                        event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
-                    )
-                    ]
-                )
+            # Create an application load balancer in a VPC. 'internetFacing' can be 'false'.
+            alb = elbv2.ApplicationLoadBalancer(self, "ALB",
+                vpc=vpc,
+                internet_facing=False,
+                vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED)
+            )
+            cloudfront.Distribution(self, "myDist",
+                default_behavior=cloudfront.BehaviorOptions(origin=origins.VpcOrigin.with_application_load_balancer(alb))
             )
         '''
         if isinstance(default_behavior, dict):
@@ -18923,6 +19015,70 @@ class _IResponseHeadersPolicyProxy:
 typing.cast(typing.Any, IResponseHeadersPolicy).__jsii_proxy_class__ = lambda : _IResponseHeadersPolicyProxy
 
 
+@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IVpcOrigin")
+class IVpcOrigin(_IResource_c80c4260, typing_extensions.Protocol):
+    '''Represents a VPC origin.'''
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginArn")
+    def vpc_origin_arn(self) -> builtins.str:
+        '''The VPC origin ARN.
+
+        :attribute: true
+        '''
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginId")
+    def vpc_origin_id(self) -> builtins.str:
+        '''The VPC origin ID.
+
+        :attribute: true
+        '''
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="domainName")
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.'''
+        ...
+
+
+class _IVpcOriginProxy(
+    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
+):
+    '''Represents a VPC origin.'''
+
+    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IVpcOrigin"
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginArn")
+    def vpc_origin_arn(self) -> builtins.str:
+        '''The VPC origin ARN.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "vpcOriginArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginId")
+    def vpc_origin_id(self) -> builtins.str:
+        '''The VPC origin ID.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "vpcOriginId"))
+
+    @builtins.property
+    @jsii.member(jsii_name="domainName")
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "domainName"))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IVpcOrigin).__jsii_proxy_class__ = lambda : _IVpcOriginProxy
+
+
 class ImportSource(
     metaclass=jsii.JSIIAbstractClass,
     jsii_type="aws-cdk-lib.aws_cloudfront.ImportSource",
@@ -20101,6 +20257,12 @@ class OriginBase(
     ) -> typing.Optional[CfnDistribution.S3OriginConfigProperty]:
         return typing.cast(typing.Optional[CfnDistribution.S3OriginConfigProperty], jsii.invoke(self, "renderS3OriginConfig", []))
 
+    @jsii.member(jsii_name="renderVpcOriginConfig")
+    def _render_vpc_origin_config(
+        self,
+    ) -> typing.Optional[CfnDistribution.VpcOriginConfigProperty]:
+        return typing.cast(typing.Optional[CfnDistribution.VpcOriginConfigProperty], jsii.invoke(self, "renderVpcOriginConfig", []))
+
 
 class _OriginBaseProxy(OriginBase):
     pass
@@ -20750,8 +20912,6 @@ class OriginProtocolPolicy(enum.Enum):
 
     Example::
 
-        import aws_cdk.aws_elasticloadbalancingv2 as elbv2
-        
         # load_balancer: elbv2.ApplicationLoadBalancer
         
         origin = origins.LoadBalancerV2Origin(load_balancer,
@@ -24381,148 +24541,776 @@ class ViewerProtocolPolicy(enum.Enum):
     '''Both HTTP and HTTPS supported.'''
 
 
-class AssetImportSource(
-    ImportSource,
+@jsii.implements(IVpcOrigin, _ITaggableV2_4e6798f8)
+class VpcOrigin(
+    _Resource_45bc6135,
     metaclass=jsii.JSIIMeta,
-    jsii_type="aws-cdk-lib.aws_cloudfront.AssetImportSource",
+    jsii_type="aws-cdk-lib.aws_cloudfront.VpcOrigin",
 ):
-    '''An import source from a local file.
+    '''A CloudFront VPC Origin configuration.
 
+    :resource: AWS::CloudFront::VpcOrigin
     :exampleMetadata: fixture=_generated
 
     Example::
 
         # The code below shows an example of how to instantiate this type.
         # The values are placeholders you should change.
-        import aws_cdk as cdk
         from aws_cdk import aws_cloudfront as cloudfront
-        from aws_cdk import aws_iam as iam
-        from aws_cdk import aws_kms as kms
-        
-        # docker_image: cdk.DockerImage
-        # grantable: iam.IGrantable
-        # key: kms.Key
-        # local_bundling: cdk.ILocalBundling
         
-        asset_import_source = cloudfront.AssetImportSource.from_asset("path",
-            asset_hash="assetHash",
-            asset_hash_type=cdk.AssetHashType.SOURCE,
-            bundling=cdk.BundlingOptions(
-                image=docker_image,
+        # vpc_origin_endpoint: cloudfront.VpcOriginEndpoint
         
-                # the properties below are optional
-                bundling_file_access=cdk.BundlingFileAccess.VOLUME_COPY,
-                command=["command"],
-                entrypoint=["entrypoint"],
-                environment={
-                    "environment_key": "environment"
-                },
-                local=local_bundling,
-                network="network",
-                output_type=cdk.BundlingOutput.ARCHIVED,
-                platform="platform",
-                security_opt="securityOpt",
-                user="user",
-                volumes=[cdk.DockerVolume(
-                    container_path="containerPath",
-                    host_path="hostPath",
+        vpc_origin = cloudfront.VpcOrigin(self, "MyVpcOrigin",
+            endpoint=vpc_origin_endpoint,
         
-                    # the properties below are optional
-                    consistency=cdk.DockerVolumeConsistency.CONSISTENT
-                )],
-                volumes_from=["volumesFrom"],
-                working_directory="workingDirectory"
-            ),
-            deploy_time=False,
-            exclude=["exclude"],
-            follow_symlinks=cdk.SymlinkFollowMode.NEVER,
-            ignore_mode=cdk.IgnoreMode.GLOB,
-            readers=[grantable],
-            source_kMSKey=key
+            # the properties below are optional
+            http_port=123,
+            https_port=123,
+            origin_ssl_protocols=[cloudfront.OriginSslPolicy.SSL_V3],
+            protocol_policy=cloudfront.OriginProtocolPolicy.HTTP_ONLY,
+            vpc_origin_name="vpcOriginName"
         )
     '''
 
     def __init__(
         self,
-        path: builtins.str,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
         *,
-        deploy_time: typing.Optional[builtins.bool] = None,
-        readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
-        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
-        asset_hash: typing.Optional[builtins.str] = None,
-        asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
-        bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
-        exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
-        follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
-        ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
+        endpoint: "VpcOriginEndpoint",
+        http_port: typing.Optional[jsii.Number] = None,
+        https_port: typing.Optional[jsii.Number] = None,
+        origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+        protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+        vpc_origin_name: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
-        :param path: the path to the local file.
-        :param deploy_time: Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false
-        :param readers: A list of principals that should be able to read this asset from S3. You can use ``asset.grantRead(principal)`` to grant read permissions later. Default: - No principals that can read file asset.
-        :param source_kms_key: The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.
-        :param asset_hash: Specify a custom hash for this asset. If ``assetHashType`` is set it must be set to ``AssetHashType.CUSTOM``. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on ``assetHashType``
-        :param asset_hash_type: Specifies the type of hash to calculate for this asset. If ``assetHash`` is configured, this option must be ``undefined`` or ``AssetHashType.CUSTOM``. Default: - the default is ``AssetHashType.SOURCE``, but if ``assetHash`` is explicitly specified this value defaults to ``AssetHashType.CUSTOM``.
-        :param bundling: Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at ``/asset-input``. The Docker container is responsible for putting content at ``/asset-output``. The content at ``/asset-output`` will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise
-        :param exclude: File paths matching the patterns will be excluded. See ``ignoreMode`` to set the matching behavior. Has no effect on Assets bundled using the ``bundling`` property. Default: - nothing is excluded
-        :param follow_symlinks: A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER
-        :param ignore_mode: The ignore behavior to use for ``exclude`` patterns. Default: IgnoreMode.GLOB
+        :param scope: -
+        :param id: -
+        :param endpoint: The VPC origin endpoint.
+        :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. Default: 80
+        :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. Default: 443
+        :param origin_ssl_protocols: A list that contains allowed SSL/TLS protocols for this distribution. Default: - TLSv1.2
+        :param protocol_policy: The origin protocol policy for the CloudFront VPC origin endpoint configuration. Default: OriginProtocolPolicy.MATCH_VIEWER
+        :param vpc_origin_name: The name of the CloudFront VPC origin endpoint configuration. Default: - generated from the ``id``
         '''
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__62441d3d3228ae5fb69aaca12e603944f07f9335dae80f70ce3b04e8e353f020)
-            check_type(argname="argument path", value=path, expected_type=type_hints["path"])
-        options = _AssetOptions_2aa69621(
-            deploy_time=deploy_time,
-            readers=readers,
-            source_kms_key=source_kms_key,
-            asset_hash=asset_hash,
-            asset_hash_type=asset_hash_type,
-            bundling=bundling,
-            exclude=exclude,
-            follow_symlinks=follow_symlinks,
-            ignore_mode=ignore_mode,
+            type_hints = typing.get_type_hints(_typecheckingstub__998be59ed4f6babe6930bce84041b072a68877dd129a90f3f7ff729f39569e9c)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = VpcOriginProps(
+            endpoint=endpoint,
+            http_port=http_port,
+            https_port=https_port,
+            origin_ssl_protocols=origin_ssl_protocols,
+            protocol_policy=protocol_policy,
+            vpc_origin_name=vpc_origin_name,
         )
 
-        jsii.create(self.__class__, self, [path, options])
-
-    @builtins.property
-    @jsii.member(jsii_name="path")
-    def path(self) -> builtins.str:
-        '''the path to the local file.'''
-        return typing.cast(builtins.str, jsii.get(self, "path"))
-
-
-@jsii.implements(ICachePolicy)
-class CachePolicy(
-    _Resource_45bc6135,
-    metaclass=jsii.JSIIMeta,
-    jsii_type="aws-cdk-lib.aws_cloudfront.CachePolicy",
-):
-    '''A Cache Policy configuration.
-
-    :link: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
-    :resource: AWS::CloudFront::CachePolicy
-    :exampleMetadata: infused
+        jsii.create(self.__class__, self, [scope, id, props])
 
-    Example::
+    @jsii.member(jsii_name="fromVpcOriginArn")
+    @builtins.classmethod
+    def from_vpc_origin_arn(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        vpc_origin_arn: builtins.str,
+    ) -> IVpcOrigin:
+        '''Import an existing VPC origin from its ARN.
 
-        # Using an existing cache policy for a Distribution
-        # bucket_origin: origins.S3Origin
-        
-        cloudfront.Distribution(self, "myDistManagedPolicy",
-            default_behavior=cloudfront.BehaviorOptions(
-                origin=bucket_origin,
-                cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED
-            )
-        )
-    '''
+        :param scope: -
+        :param id: -
+        :param vpc_origin_arn: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4c9f072fdf3e48d903220d18d2af9c155e6769b7577c4d4f171830da0f9d5163)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument vpc_origin_arn", value=vpc_origin_arn, expected_type=type_hints["vpc_origin_arn"])
+        return typing.cast(IVpcOrigin, jsii.sinvoke(cls, "fromVpcOriginArn", [scope, id, vpc_origin_arn]))
 
-    def __init__(
-        self,
+    @jsii.member(jsii_name="fromVpcOriginAttributes")
+    @builtins.classmethod
+    def from_vpc_origin_attributes(
+        cls,
         scope: _constructs_77d1e7e8.Construct,
         id: builtins.str,
         *,
-        cache_policy_name: typing.Optional[builtins.str] = None,
+        domain_name: typing.Optional[builtins.str] = None,
+        vpc_origin_arn: typing.Optional[builtins.str] = None,
+        vpc_origin_id: typing.Optional[builtins.str] = None,
+    ) -> IVpcOrigin:
+        '''Import an existing VPC origin from its attributes.
+
+        :param scope: -
+        :param id: -
+        :param domain_name: The domain name of the CloudFront VPC origin endpoint configuration. Default: - No domain name configured
+        :param vpc_origin_arn: The ARN of the VPC origin. At least one of vpcOriginArn and vpcOriginId must be provided. Default: - derived from ``vpcOriginId``.
+        :param vpc_origin_id: The ID of the VPC origin. At least one of vpcOriginArn and vpcOriginId must be provided. Default: - derived from ``vpcOriginArn``.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0ba8097a17cca24c063a5fd81fd0d90aa0e067cd79f2834ac88e9247a2ba1e93)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        attrs = VpcOriginAttributes(
+            domain_name=domain_name,
+            vpc_origin_arn=vpc_origin_arn,
+            vpc_origin_id=vpc_origin_id,
+        )
+
+        return typing.cast(IVpcOrigin, jsii.sinvoke(cls, "fromVpcOriginAttributes", [scope, id, attrs]))
+
+    @jsii.member(jsii_name="fromVpcOriginId")
+    @builtins.classmethod
+    def from_vpc_origin_id(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        vpc_origin_id: builtins.str,
+    ) -> IVpcOrigin:
+        '''Import an existing VPC origin from its ID.
+
+        :param scope: -
+        :param id: -
+        :param vpc_origin_id: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7df1a8ecdd841e03add189e788ca2b0ecd250cd46a247318d3eacced6a3db276)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+            check_type(argname="argument vpc_origin_id", value=vpc_origin_id, expected_type=type_hints["vpc_origin_id"])
+        return typing.cast(IVpcOrigin, jsii.sinvoke(cls, "fromVpcOriginId", [scope, id, vpc_origin_id]))
+
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''TagManager to set, remove and format tags.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginArn")
+    def vpc_origin_arn(self) -> builtins.str:
+        '''The VPC origin ARN.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "vpcOriginArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="vpcOriginId")
+    def vpc_origin_id(self) -> builtins.str:
+        '''The VPC origin ID.
+
+        :attribute: true
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "vpcOriginId"))
+
+    @builtins.property
+    @jsii.member(jsii_name="domainName")
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "domainName"))
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cloudfront.VpcOriginAttributes",
+    jsii_struct_bases=[],
+    name_mapping={
+        "domain_name": "domainName",
+        "vpc_origin_arn": "vpcOriginArn",
+        "vpc_origin_id": "vpcOriginId",
+    },
+)
+class VpcOriginAttributes:
+    def __init__(
+        self,
+        *,
+        domain_name: typing.Optional[builtins.str] = None,
+        vpc_origin_arn: typing.Optional[builtins.str] = None,
+        vpc_origin_id: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''The properties to import from the VPC origin.
+
+        :param domain_name: The domain name of the CloudFront VPC origin endpoint configuration. Default: - No domain name configured
+        :param vpc_origin_arn: The ARN of the VPC origin. At least one of vpcOriginArn and vpcOriginId must be provided. Default: - derived from ``vpcOriginId``.
+        :param vpc_origin_id: The ID of the VPC origin. At least one of vpcOriginArn and vpcOriginId must be provided. Default: - derived from ``vpcOriginArn``.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cloudfront as cloudfront
+            
+            vpc_origin_attributes = cloudfront.VpcOriginAttributes(
+                domain_name="domainName",
+                vpc_origin_arn="vpcOriginArn",
+                vpc_origin_id="vpcOriginId"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__0e378056dfebabd64eec79fbd87a1a7a2c3b26bf2ab9463d659e417bf92f74c5)
+            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
+            check_type(argname="argument vpc_origin_arn", value=vpc_origin_arn, expected_type=type_hints["vpc_origin_arn"])
+            check_type(argname="argument vpc_origin_id", value=vpc_origin_id, expected_type=type_hints["vpc_origin_id"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if domain_name is not None:
+            self._values["domain_name"] = domain_name
+        if vpc_origin_arn is not None:
+            self._values["vpc_origin_arn"] = vpc_origin_arn
+        if vpc_origin_id is not None:
+            self._values["vpc_origin_id"] = vpc_origin_id
+
+    @builtins.property
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.
+
+        :default: - No domain name configured
+        '''
+        result = self._values.get("domain_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def vpc_origin_arn(self) -> typing.Optional[builtins.str]:
+        '''The ARN of the VPC origin.
+
+        At least one of vpcOriginArn and vpcOriginId must be provided.
+
+        :default: - derived from ``vpcOriginId``.
+        '''
+        result = self._values.get("vpc_origin_arn")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def vpc_origin_id(self) -> typing.Optional[builtins.str]:
+        '''The ID of the VPC origin.
+
+        At least one of vpcOriginArn and vpcOriginId must be provided.
+
+        :default: - derived from ``vpcOriginArn``.
+        '''
+        result = self._values.get("vpc_origin_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "VpcOriginAttributes(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class VpcOriginEndpoint(
+    metaclass=jsii.JSIIAbstractClass,
+    jsii_type="aws-cdk-lib.aws_cloudfront.VpcOriginEndpoint",
+):
+    '''Represents the VPC origin endpoint.
+
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        from aws_cdk import aws_cloudfront as cloudfront
+        from aws_cdk import aws_elasticloadbalancingv2 as elbv2
+        
+        # application_load_balancer: elbv2.ApplicationLoadBalancer
+        
+        vpc_origin_endpoint = cloudfront.VpcOriginEndpoint.application_load_balancer(application_load_balancer)
+    '''
+
+    def __init__(self) -> None:
+        jsii.create(self.__class__, self, [])
+
+    @jsii.member(jsii_name="applicationLoadBalancer")
+    @builtins.classmethod
+    def application_load_balancer(
+        cls,
+        alb: _IApplicationLoadBalancer_4cbd50ab,
+    ) -> "VpcOriginEndpoint":
+        '''A VPC origin endpoint from an Application Load Balancer.
+
+        :param alb: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__6a95d20ca8db6bfe1227b47fc98da59fed8dbab051c0e8b028b9b3285672ddce)
+            check_type(argname="argument alb", value=alb, expected_type=type_hints["alb"])
+        return typing.cast("VpcOriginEndpoint", jsii.sinvoke(cls, "applicationLoadBalancer", [alb]))
+
+    @jsii.member(jsii_name="ec2Instance")
+    @builtins.classmethod
+    def ec2_instance(cls, instance: _IInstance_ab239e7c) -> "VpcOriginEndpoint":
+        '''A VPC origin endpoint from an EC2 instance.
+
+        :param instance: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__1338909f764189d3d71094278189d5e4d05d08b426fd2d58a1734ef150a07bd4)
+            check_type(argname="argument instance", value=instance, expected_type=type_hints["instance"])
+        return typing.cast("VpcOriginEndpoint", jsii.sinvoke(cls, "ec2Instance", [instance]))
+
+    @jsii.member(jsii_name="networkLoadBalancer")
+    @builtins.classmethod
+    def network_load_balancer(
+        cls,
+        nlb: _INetworkLoadBalancer_96e17101,
+    ) -> "VpcOriginEndpoint":
+        '''A VPC origin endpoint from an Network Load Balancer.
+
+        :param nlb: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__818863b0770e9bfeaa545f403f7b87c64ea9684eae160350df445cf51fc06101)
+            check_type(argname="argument nlb", value=nlb, expected_type=type_hints["nlb"])
+        return typing.cast("VpcOriginEndpoint", jsii.sinvoke(cls, "networkLoadBalancer", [nlb]))
+
+    @builtins.property
+    @jsii.member(jsii_name="endpointArn")
+    @abc.abstractmethod
+    def endpoint_arn(self) -> builtins.str:
+        '''The ARN of the CloudFront VPC origin endpoint configuration.'''
+        ...
+
+    @builtins.property
+    @jsii.member(jsii_name="domainName")
+    @abc.abstractmethod
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.
+
+        :default: - No domain name configured
+        '''
+        ...
+
+
+class _VpcOriginEndpointProxy(VpcOriginEndpoint):
+    @builtins.property
+    @jsii.member(jsii_name="endpointArn")
+    def endpoint_arn(self) -> builtins.str:
+        '''The ARN of the CloudFront VPC origin endpoint configuration.'''
+        return typing.cast(builtins.str, jsii.get(self, "endpointArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="domainName")
+    def domain_name(self) -> typing.Optional[builtins.str]:
+        '''The domain name of the CloudFront VPC origin endpoint configuration.
+
+        :default: - No domain name configured
+        '''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "domainName"))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
+typing.cast(typing.Any, VpcOriginEndpoint).__jsii_proxy_class__ = lambda : _VpcOriginEndpointProxy
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cloudfront.VpcOriginOptions",
+    jsii_struct_bases=[],
+    name_mapping={
+        "http_port": "httpPort",
+        "https_port": "httpsPort",
+        "origin_ssl_protocols": "originSslProtocols",
+        "protocol_policy": "protocolPolicy",
+        "vpc_origin_name": "vpcOriginName",
+    },
+)
+class VpcOriginOptions:
+    def __init__(
+        self,
+        *,
+        http_port: typing.Optional[jsii.Number] = None,
+        https_port: typing.Optional[jsii.Number] = None,
+        origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+        protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+        vpc_origin_name: typing.Optional[builtins.str] = None,
+    ) -> None:
+        '''VPC origin endpoint configuration.
+
+        :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. Default: 80
+        :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. Default: 443
+        :param origin_ssl_protocols: A list that contains allowed SSL/TLS protocols for this distribution. Default: - TLSv1.2
+        :param protocol_policy: The origin protocol policy for the CloudFront VPC origin endpoint configuration. Default: OriginProtocolPolicy.MATCH_VIEWER
+        :param vpc_origin_name: The name of the CloudFront VPC origin endpoint configuration. Default: - generated from the ``id``
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cloudfront as cloudfront
+            
+            vpc_origin_options = cloudfront.VpcOriginOptions(
+                http_port=123,
+                https_port=123,
+                origin_ssl_protocols=[cloudfront.OriginSslPolicy.SSL_V3],
+                protocol_policy=cloudfront.OriginProtocolPolicy.HTTP_ONLY,
+                vpc_origin_name="vpcOriginName"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__a89a687db27974ad058448847b73db0fc172703d38e1e97a3712f7c6fa7a797a)
+            check_type(argname="argument http_port", value=http_port, expected_type=type_hints["http_port"])
+            check_type(argname="argument https_port", value=https_port, expected_type=type_hints["https_port"])
+            check_type(argname="argument origin_ssl_protocols", value=origin_ssl_protocols, expected_type=type_hints["origin_ssl_protocols"])
+            check_type(argname="argument protocol_policy", value=protocol_policy, expected_type=type_hints["protocol_policy"])
+            check_type(argname="argument vpc_origin_name", value=vpc_origin_name, expected_type=type_hints["vpc_origin_name"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if http_port is not None:
+            self._values["http_port"] = http_port
+        if https_port is not None:
+            self._values["https_port"] = https_port
+        if origin_ssl_protocols is not None:
+            self._values["origin_ssl_protocols"] = origin_ssl_protocols
+        if protocol_policy is not None:
+            self._values["protocol_policy"] = protocol_policy
+        if vpc_origin_name is not None:
+            self._values["vpc_origin_name"] = vpc_origin_name
+
+    @builtins.property
+    def http_port(self) -> typing.Optional[jsii.Number]:
+        '''The HTTP port for the CloudFront VPC origin endpoint configuration.
+
+        :default: 80
+        '''
+        result = self._values.get("http_port")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def https_port(self) -> typing.Optional[jsii.Number]:
+        '''The HTTPS port of the CloudFront VPC origin endpoint configuration.
+
+        :default: 443
+        '''
+        result = self._values.get("https_port")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def origin_ssl_protocols(self) -> typing.Optional[typing.List[OriginSslPolicy]]:
+        '''A list that contains allowed SSL/TLS protocols for this distribution.
+
+        :default: - TLSv1.2
+        '''
+        result = self._values.get("origin_ssl_protocols")
+        return typing.cast(typing.Optional[typing.List[OriginSslPolicy]], result)
+
+    @builtins.property
+    def protocol_policy(self) -> typing.Optional[OriginProtocolPolicy]:
+        '''The origin protocol policy for the CloudFront VPC origin endpoint configuration.
+
+        :default: OriginProtocolPolicy.MATCH_VIEWER
+        '''
+        result = self._values.get("protocol_policy")
+        return typing.cast(typing.Optional[OriginProtocolPolicy], result)
+
+    @builtins.property
+    def vpc_origin_name(self) -> typing.Optional[builtins.str]:
+        '''The name of the CloudFront VPC origin endpoint configuration.
+
+        :default: - generated from the ``id``
+        '''
+        result = self._values.get("vpc_origin_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "VpcOriginOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cloudfront.VpcOriginProps",
+    jsii_struct_bases=[VpcOriginOptions],
+    name_mapping={
+        "http_port": "httpPort",
+        "https_port": "httpsPort",
+        "origin_ssl_protocols": "originSslProtocols",
+        "protocol_policy": "protocolPolicy",
+        "vpc_origin_name": "vpcOriginName",
+        "endpoint": "endpoint",
+    },
+)
+class VpcOriginProps(VpcOriginOptions):
+    def __init__(
+        self,
+        *,
+        http_port: typing.Optional[jsii.Number] = None,
+        https_port: typing.Optional[jsii.Number] = None,
+        origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+        protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+        vpc_origin_name: typing.Optional[builtins.str] = None,
+        endpoint: VpcOriginEndpoint,
+    ) -> None:
+        '''VPC origin endpoint configuration.
+
+        :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. Default: 80
+        :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. Default: 443
+        :param origin_ssl_protocols: A list that contains allowed SSL/TLS protocols for this distribution. Default: - TLSv1.2
+        :param protocol_policy: The origin protocol policy for the CloudFront VPC origin endpoint configuration. Default: OriginProtocolPolicy.MATCH_VIEWER
+        :param vpc_origin_name: The name of the CloudFront VPC origin endpoint configuration. Default: - generated from the ``id``
+        :param endpoint: The VPC origin endpoint.
+
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cloudfront as cloudfront
+            
+            # vpc_origin_endpoint: cloudfront.VpcOriginEndpoint
+            
+            vpc_origin_props = cloudfront.VpcOriginProps(
+                endpoint=vpc_origin_endpoint,
+            
+                # the properties below are optional
+                http_port=123,
+                https_port=123,
+                origin_ssl_protocols=[cloudfront.OriginSslPolicy.SSL_V3],
+                protocol_policy=cloudfront.OriginProtocolPolicy.HTTP_ONLY,
+                vpc_origin_name="vpcOriginName"
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b3781ce8dabcabae80ad6471ada771087884081a0e2fb504e9e94b69b06bd9bd)
+            check_type(argname="argument http_port", value=http_port, expected_type=type_hints["http_port"])
+            check_type(argname="argument https_port", value=https_port, expected_type=type_hints["https_port"])
+            check_type(argname="argument origin_ssl_protocols", value=origin_ssl_protocols, expected_type=type_hints["origin_ssl_protocols"])
+            check_type(argname="argument protocol_policy", value=protocol_policy, expected_type=type_hints["protocol_policy"])
+            check_type(argname="argument vpc_origin_name", value=vpc_origin_name, expected_type=type_hints["vpc_origin_name"])
+            check_type(argname="argument endpoint", value=endpoint, expected_type=type_hints["endpoint"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "endpoint": endpoint,
+        }
+        if http_port is not None:
+            self._values["http_port"] = http_port
+        if https_port is not None:
+            self._values["https_port"] = https_port
+        if origin_ssl_protocols is not None:
+            self._values["origin_ssl_protocols"] = origin_ssl_protocols
+        if protocol_policy is not None:
+            self._values["protocol_policy"] = protocol_policy
+        if vpc_origin_name is not None:
+            self._values["vpc_origin_name"] = vpc_origin_name
+
+    @builtins.property
+    def http_port(self) -> typing.Optional[jsii.Number]:
+        '''The HTTP port for the CloudFront VPC origin endpoint configuration.
+
+        :default: 80
+        '''
+        result = self._values.get("http_port")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def https_port(self) -> typing.Optional[jsii.Number]:
+        '''The HTTPS port of the CloudFront VPC origin endpoint configuration.
+
+        :default: 443
+        '''
+        result = self._values.get("https_port")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def origin_ssl_protocols(self) -> typing.Optional[typing.List[OriginSslPolicy]]:
+        '''A list that contains allowed SSL/TLS protocols for this distribution.
+
+        :default: - TLSv1.2
+        '''
+        result = self._values.get("origin_ssl_protocols")
+        return typing.cast(typing.Optional[typing.List[OriginSslPolicy]], result)
+
+    @builtins.property
+    def protocol_policy(self) -> typing.Optional[OriginProtocolPolicy]:
+        '''The origin protocol policy for the CloudFront VPC origin endpoint configuration.
+
+        :default: OriginProtocolPolicy.MATCH_VIEWER
+        '''
+        result = self._values.get("protocol_policy")
+        return typing.cast(typing.Optional[OriginProtocolPolicy], result)
+
+    @builtins.property
+    def vpc_origin_name(self) -> typing.Optional[builtins.str]:
+        '''The name of the CloudFront VPC origin endpoint configuration.
+
+        :default: - generated from the ``id``
+        '''
+        result = self._values.get("vpc_origin_name")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def endpoint(self) -> VpcOriginEndpoint:
+        '''The VPC origin endpoint.'''
+        result = self._values.get("endpoint")
+        assert result is not None, "Required property 'endpoint' is missing"
+        return typing.cast(VpcOriginEndpoint, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "VpcOriginProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class AssetImportSource(
+    ImportSource,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_cloudfront.AssetImportSource",
+):
+    '''An import source from a local file.
+
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        import aws_cdk as cdk
+        from aws_cdk import aws_cloudfront as cloudfront
+        from aws_cdk import aws_iam as iam
+        from aws_cdk import aws_kms as kms
+        
+        # docker_image: cdk.DockerImage
+        # grantable: iam.IGrantable
+        # key: kms.Key
+        # local_bundling: cdk.ILocalBundling
+        
+        asset_import_source = cloudfront.AssetImportSource.from_asset("path",
+            asset_hash="assetHash",
+            asset_hash_type=cdk.AssetHashType.SOURCE,
+            bundling=cdk.BundlingOptions(
+                image=docker_image,
+        
+                # the properties below are optional
+                bundling_file_access=cdk.BundlingFileAccess.VOLUME_COPY,
+                command=["command"],
+                entrypoint=["entrypoint"],
+                environment={
+                    "environment_key": "environment"
+                },
+                local=local_bundling,
+                network="network",
+                output_type=cdk.BundlingOutput.ARCHIVED,
+                platform="platform",
+                security_opt="securityOpt",
+                user="user",
+                volumes=[cdk.DockerVolume(
+                    container_path="containerPath",
+                    host_path="hostPath",
+        
+                    # the properties below are optional
+                    consistency=cdk.DockerVolumeConsistency.CONSISTENT
+                )],
+                volumes_from=["volumesFrom"],
+                working_directory="workingDirectory"
+            ),
+            deploy_time=False,
+            exclude=["exclude"],
+            follow_symlinks=cdk.SymlinkFollowMode.NEVER,
+            ignore_mode=cdk.IgnoreMode.GLOB,
+            readers=[grantable],
+            source_kMSKey=key
+        )
+    '''
+
+    def __init__(
+        self,
+        path: builtins.str,
+        *,
+        deploy_time: typing.Optional[builtins.bool] = None,
+        readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
+        source_kms_key: typing.Optional[_IKey_5f11635f] = None,
+        asset_hash: typing.Optional[builtins.str] = None,
+        asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
+        bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
+        exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
+        follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
+        ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
+    ) -> None:
+        '''
+        :param path: the path to the local file.
+        :param deploy_time: Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false
+        :param readers: A list of principals that should be able to read this asset from S3. You can use ``asset.grantRead(principal)`` to grant read permissions later. Default: - No principals that can read file asset.
+        :param source_kms_key: The ARN of the KMS key used to encrypt the handler code. Default: - the default server-side encryption with Amazon S3 managed keys(SSE-S3) key will be used.
+        :param asset_hash: Specify a custom hash for this asset. If ``assetHashType`` is set it must be set to ``AssetHashType.CUSTOM``. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on ``assetHashType``
+        :param asset_hash_type: Specifies the type of hash to calculate for this asset. If ``assetHash`` is configured, this option must be ``undefined`` or ``AssetHashType.CUSTOM``. Default: - the default is ``AssetHashType.SOURCE``, but if ``assetHash`` is explicitly specified this value defaults to ``AssetHashType.CUSTOM``.
+        :param bundling: Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at ``/asset-input``. The Docker container is responsible for putting content at ``/asset-output``. The content at ``/asset-output`` will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise
+        :param exclude: File paths matching the patterns will be excluded. See ``ignoreMode`` to set the matching behavior. Has no effect on Assets bundled using the ``bundling`` property. Default: - nothing is excluded
+        :param follow_symlinks: A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER
+        :param ignore_mode: The ignore behavior to use for ``exclude`` patterns. Default: IgnoreMode.GLOB
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__62441d3d3228ae5fb69aaca12e603944f07f9335dae80f70ce3b04e8e353f020)
+            check_type(argname="argument path", value=path, expected_type=type_hints["path"])
+        options = _AssetOptions_2aa69621(
+            deploy_time=deploy_time,
+            readers=readers,
+            source_kms_key=source_kms_key,
+            asset_hash=asset_hash,
+            asset_hash_type=asset_hash_type,
+            bundling=bundling,
+            exclude=exclude,
+            follow_symlinks=follow_symlinks,
+            ignore_mode=ignore_mode,
+        )
+
+        jsii.create(self.__class__, self, [path, options])
+
+    @builtins.property
+    @jsii.member(jsii_name="path")
+    def path(self) -> builtins.str:
+        '''the path to the local file.'''
+        return typing.cast(builtins.str, jsii.get(self, "path"))
+
+
+@jsii.implements(ICachePolicy)
+class CachePolicy(
+    _Resource_45bc6135,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_cloudfront.CachePolicy",
+):
+    '''A Cache Policy configuration.
+
+    :link: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
+    :resource: AWS::CloudFront::CachePolicy
+    :exampleMetadata: infused
+
+    Example::
+
+        # Using an existing cache policy for a Distribution
+        # bucket_origin: origins.S3Origin
+        
+        cloudfront.Distribution(self, "myDistManagedPolicy",
+            default_behavior=cloudfront.BehaviorOptions(
+                origin=bucket_origin,
+                cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED
+            )
+        )
+    '''
+
+    def __init__(
+        self,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        cache_policy_name: typing.Optional[builtins.str] = None,
         comment: typing.Optional[builtins.str] = None,
         cookie_behavior: typing.Optional[CacheCookieBehavior] = None,
         default_ttl: typing.Optional[_Duration_4839e8c3] = None,
@@ -25013,6 +25801,7 @@ class Distribution(
         cache_policy: typing.Optional[ICachePolicy] = None,
         compress: typing.Optional[builtins.bool] = None,
         edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
+        enable_grpc: typing.Optional[builtins.bool] = None,
         function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
         origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
         realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
@@ -25030,6 +25819,7 @@ class Distribution(
         :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
         :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
         :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
+        :param enable_grpc: Enables your CloudFront distribution to receive gRPC requests and to proxy them directly to your origins. If the ``enableGrpc`` is set to true, the following restrictions apply: - The ``allowedMethods`` property must be ``AllowedMethods.ALLOW_ALL`` to include POST method because gRPC only supports POST method. - The ``httpVersion`` property must be ``HttpVersion.HTTP2`` or ``HttpVersion.HTTP2_AND_3`` because gRPC only supports versions including HTTP/2. - The ``edgeLambdas`` property can't be specified because gRPC is not supported with Lambda@Edge. Default: false
         :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
         :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
         :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
@@ -25048,6 +25838,7 @@ class Distribution(
             cache_policy=cache_policy,
             compress=compress,
             edge_lambdas=edge_lambdas,
+            enable_grpc=enable_grpc,
             function_associations=function_associations,
             origin_request_policy=origin_request_policy,
             realtime_log_config=realtime_log_config,
@@ -26238,6 +27029,7 @@ __all__ = [
     "IPublicKey",
     "IRealtimeLogConfig",
     "IResponseHeadersPolicy",
+    "IVpcOrigin",
     "ImportSource",
     "InlineImportSource",
     "KeyGroup",
@@ -26295,6 +27087,11 @@ __all__ = [
     "ViewerCertificate",
     "ViewerCertificateOptions",
     "ViewerProtocolPolicy",
+    "VpcOrigin",
+    "VpcOriginAttributes",
+    "VpcOriginEndpoint",
+    "VpcOriginOptions",
+    "VpcOriginProps",
     "experimental",
 ]
 
@@ -26310,6 +27107,7 @@ def _typecheckingstub__65772d6db92564a1181169ceb316d515431097e5d91750c338502393d
     cache_policy: typing.Optional[ICachePolicy] = None,
     compress: typing.Optional[builtins.bool] = None,
     edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
+    enable_grpc: typing.Optional[builtins.bool] = None,
     function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
     origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
     realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
@@ -26348,6 +27146,7 @@ def _typecheckingstub__4eb7e06f76f798ae0a32c303cbe5f500a4fd80b03804aa96894c0cddc
     cache_policy: typing.Optional[ICachePolicy] = None,
     compress: typing.Optional[builtins.bool] = None,
     edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
+    enable_grpc: typing.Optional[builtins.bool] = None,
     function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
     origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
     realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
@@ -28598,6 +29397,97 @@ def _typecheckingstub__d1fca8e67199164c4d795df93e2e45befd6c6e688025259d033408b16
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__998be59ed4f6babe6930bce84041b072a68877dd129a90f3f7ff729f39569e9c(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    endpoint: VpcOriginEndpoint,
+    http_port: typing.Optional[jsii.Number] = None,
+    https_port: typing.Optional[jsii.Number] = None,
+    origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+    protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+    vpc_origin_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4c9f072fdf3e48d903220d18d2af9c155e6769b7577c4d4f171830da0f9d5163(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    vpc_origin_arn: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__0ba8097a17cca24c063a5fd81fd0d90aa0e067cd79f2834ac88e9247a2ba1e93(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    domain_name: typing.Optional[builtins.str] = None,
+    vpc_origin_arn: typing.Optional[builtins.str] = None,
+    vpc_origin_id: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__7df1a8ecdd841e03add189e788ca2b0ecd250cd46a247318d3eacced6a3db276(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    vpc_origin_id: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__0e378056dfebabd64eec79fbd87a1a7a2c3b26bf2ab9463d659e417bf92f74c5(
+    *,
+    domain_name: typing.Optional[builtins.str] = None,
+    vpc_origin_arn: typing.Optional[builtins.str] = None,
+    vpc_origin_id: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6a95d20ca8db6bfe1227b47fc98da59fed8dbab051c0e8b028b9b3285672ddce(
+    alb: _IApplicationLoadBalancer_4cbd50ab,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1338909f764189d3d71094278189d5e4d05d08b426fd2d58a1734ef150a07bd4(
+    instance: _IInstance_ab239e7c,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__818863b0770e9bfeaa545f403f7b87c64ea9684eae160350df445cf51fc06101(
+    nlb: _INetworkLoadBalancer_96e17101,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a89a687db27974ad058448847b73db0fc172703d38e1e97a3712f7c6fa7a797a(
+    *,
+    http_port: typing.Optional[jsii.Number] = None,
+    https_port: typing.Optional[jsii.Number] = None,
+    origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+    protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+    vpc_origin_name: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__b3781ce8dabcabae80ad6471ada771087884081a0e2fb504e9e94b69b06bd9bd(
+    *,
+    http_port: typing.Optional[jsii.Number] = None,
+    https_port: typing.Optional[jsii.Number] = None,
+    origin_ssl_protocols: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
+    protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
+    vpc_origin_name: typing.Optional[builtins.str] = None,
+    endpoint: VpcOriginEndpoint,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__62441d3d3228ae5fb69aaca12e603944f07f9335dae80f70ce3b04e8e353f020(
     path: builtins.str,
     *,
@@ -28731,6 +29621,7 @@ def _typecheckingstub__f94c33f8f74d148b7c436f42a002e770c6ad95241e489b963596aea62
     cache_policy: typing.Optional[ICachePolicy] = None,
     compress: typing.Optional[builtins.bool] = None,
     edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
+    enable_grpc: typing.Optional[builtins.bool] = None,
     function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
     origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
     realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,