aws-cdk-lib 2.192.0__py3-none-any.whl → 2.194.0__py3-none-any.whl

aws_cdk/aws_cloudfront/__init__.py

@@ -4347,20 +4347,16 @@ class CfnCloudFrontOriginAccessIdentityProps:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
-class CfnContinuousDeploymentPolicy(
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+class CfnConnectionGroup(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
-    jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy",
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnConnectionGroup",
 ):
-    '''Creates a continuous deployment policy that routes a subset of production traffic from a primary distribution to a staging distribution.
-
-    After you create and update a staging distribution, you can use a continuous deployment policy to incrementally move traffic to the staging distribution. This enables you to test changes to a distribution's configuration before moving all of your production traffic to the new configuration.
-
-    For more information, see `Using CloudFront continuous deployment to safely test CDN configuration changes <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/continuous-deployment.html>`_ in the *Amazon CloudFront Developer Guide* .
+    '''Resource Type definition for AWS::CloudFront::ConnectionGroup.
 
-    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-continuousdeploymentpolicy.html
-    :cloudformationResource: AWS::CloudFront::ContinuousDeploymentPolicy
+    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html
+    :cloudformationResource: AWS::CloudFront::ConnectionGroup
     :exampleMetadata: fixture=_generated
 
     Example::
@@ -4369,45 +4365,17 @@ class CfnContinuousDeploymentPolicy(
         # The values are placeholders you should change.
         from aws_cdk import aws_cloudfront as cloudfront
         
-        cfn_continuous_deployment_policy = cloudfront.CfnContinuousDeploymentPolicy(self, "MyCfnContinuousDeploymentPolicy",
-            continuous_deployment_policy_config=cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
-                enabled=False,
-                staging_distribution_dns_names=["stagingDistributionDnsNames"],
-        
-                # the properties below are optional
-                single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
-                    header="header",
-                    value="value"
-                ),
-                single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
-                    weight=123,
-        
-                    # the properties below are optional
-                    session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
-                        idle_ttl=123,
-                        maximum_ttl=123
-                    )
-                ),
-                traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
-                    type="type",
-        
-                    # the properties below are optional
-                    single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
-                        header="header",
-                        value="value"
-                    ),
-                    single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
-                        weight=123,
+        cfn_connection_group = cloudfront.CfnConnectionGroup(self, "MyCfnConnectionGroup",
+            name="name",
         
-                        # the properties below are optional
-                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
-                            idle_ttl=123,
-                            maximum_ttl=123
-                        )
-                    )
-                ),
-                type="type"
-            )
+            # the properties below are optional
+            anycast_ip_list_id="anycastIpListId",
+            enabled=False,
+            ipv6_enabled=False,
+            tags=[CfnTag(
+                key="key",
+                value="value"
+            )]
         )
     '''
 
@@ -4416,19 +4384,31 @@ class CfnContinuousDeploymentPolicy(
         scope: _constructs_77d1e7e8.Construct,
         id: builtins.str,
         *,
-        continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
+        name: builtins.str,
+        anycast_ip_list_id: typing.Optional[builtins.str] = None,
+        enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param continuous_deployment_policy_config: Contains the configuration for a continuous deployment policy.
+        :param name: 
+        :param anycast_ip_list_id: The ID of the Anycast static IP list.
+        :param enabled: 
+        :param ipv6_enabled: 
+        :param tags: A complex type that contains zero or more ``Tag`` elements.
         '''
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__b57269fe6faf53d2e30ff31a58c5711db8b8cc3b38dc9ac79efdb585dc8f324b)
+            type_hints = typing.get_type_hints(_typecheckingstub__a7fbc949dbac76664bfea111378c9ea57cd63caa1212fdbe30d64584bd8f53de)
             check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
             check_type(argname="argument id", value=id, expected_type=type_hints["id"])
-        props = CfnContinuousDeploymentPolicyProps(
-            continuous_deployment_policy_config=continuous_deployment_policy_config
+        props = CfnConnectionGroupProps(
+            name=name,
+            anycast_ip_list_id=anycast_ip_list_id,
+            enabled=enabled,
+            ipv6_enabled=ipv6_enabled,
+            tags=tags,
         )
 
         jsii.create(self.__class__, self, [scope, id, props])
@@ -4440,7 +4420,7 @@ class CfnContinuousDeploymentPolicy(
         :param inspector: tree inspector to collect and process attributes.
         '''
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__95d0eeca39c0c26751595d2bbe6c1247ac12b7acdb2d7c9d28f5fb0eeacb7187)
+            type_hints = typing.get_type_hints(_typecheckingstub__dad045911121964ba7e6a7c8d166ac2aaace23640d9bee11f9fbbbb1b78e3236)
             check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
         return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))
 
@@ -4453,7 +4433,7 @@ class CfnContinuousDeploymentPolicy(
         :param props: -
         '''
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__779f5842b62fc4504802401955475d45973a372c1d8293180cd8ce460b4e4823)
+            type_hints = typing.get_type_hints(_typecheckingstub__d4834ec5a54af69a2e3413ff8a46f3539a6607f6b49adaabe420e5490ae353ea)
             check_type(argname="argument props", value=props, expected_type=type_hints["props"])
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))
 
@@ -4463,312 +4443,475 @@ class CfnContinuousDeploymentPolicy(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
+    @builtins.property
+    @jsii.member(jsii_name="attrArn")
+    def attr_arn(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: Arn
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrCreatedTime")
+    def attr_created_time(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: CreatedTime
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrCreatedTime"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrETag")
+    def attr_e_tag(self) -> builtins.str:
+        '''A complex type that contains ``Tag`` key and ``Tag`` value.
+
+        :cloudformationAttribute: ETag
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrETag"))
+
     @builtins.property
     @jsii.member(jsii_name="attrId")
     def attr_id(self) -> builtins.str:
-        '''The identifier of the cotinuous deployment policy.
-
+        '''
         :cloudformationAttribute: Id
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrId"))
 
+    @builtins.property
+    @jsii.member(jsii_name="attrIsDefault")
+    def attr_is_default(self) -> _IResolvable_da3f097b:
+        '''
+        :cloudformationAttribute: IsDefault
+        '''
+        return typing.cast(_IResolvable_da3f097b, jsii.get(self, "attrIsDefault"))
+
     @builtins.property
     @jsii.member(jsii_name="attrLastModifiedTime")
     def attr_last_modified_time(self) -> builtins.str:
-        '''The date and time when the continuous deployment policy was last modified.
-
+        '''
         :cloudformationAttribute: LastModifiedTime
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))
 
+    @builtins.property
+    @jsii.member(jsii_name="attrRoutingEndpoint")
+    def attr_routing_endpoint(self) -> builtins.str:
+        '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data in a real-time log configuration.
+
+        :cloudformationAttribute: RoutingEndpoint
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrRoutingEndpoint"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrStatus")
+    def attr_status(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: Status
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrStatus"))
+
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
         return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
 
     @builtins.property
-    @jsii.member(jsii_name="continuousDeploymentPolicyConfig")
-    def continuous_deployment_policy_config(
+    @jsii.member(jsii_name="name")
+    def name(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "name"))
+
+    @name.setter
+    def name(self, value: builtins.str) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__46cb5b39bb34a52a464d8364089e47d3ba47e4a293aaa3f92857d624e7902898)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "name", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="anycastIpListId")
+    def anycast_ip_list_id(self) -> typing.Optional[builtins.str]:
+        '''The ID of the Anycast static IP list.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "anycastIpListId"))
+
+    @anycast_ip_list_id.setter
+    def anycast_ip_list_id(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2633385b8f4da7c2341c3b54e4d30ea9345b38862ced8c6f1d893c36ec7c669d)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "anycastIpListId", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="enabled")
+    def enabled(
         self,
-    ) -> typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"]:
-        '''Contains the configuration for a continuous deployment policy.'''
-        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"], jsii.get(self, "continuousDeploymentPolicyConfig"))
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "enabled"))
 
-    @continuous_deployment_policy_config.setter
-    def continuous_deployment_policy_config(
+    @enabled.setter
+    def enabled(
         self,
-        value: typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"],
+        value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
     ) -> None:
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__f4581f42e1117e6de93836f594986c28a2378e8200e2f4a535cce028879382c9)
+            type_hints = typing.get_type_hints(_typecheckingstub__41addbff9b29ce6c4465d1d973785d727f6742a1723e79dcdce59a1087df694f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "continuousDeploymentPolicyConfig", value) # pyright: ignore[reportArgumentType]
+        jsii.set(self, "enabled", value) # pyright: ignore[reportArgumentType]
 
-    @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty",
-        jsii_struct_bases=[],
-        name_mapping={
-            "enabled": "enabled",
-            "staging_distribution_dns_names": "stagingDistributionDnsNames",
-            "single_header_policy_config": "singleHeaderPolicyConfig",
-            "single_weight_policy_config": "singleWeightPolicyConfig",
-            "traffic_config": "trafficConfig",
-            "type": "type",
-        },
-    )
-    class ContinuousDeploymentPolicyConfigProperty:
-        def __init__(
-            self,
-            *,
-            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
-            staging_distribution_dns_names: typing.Sequence[builtins.str],
-            single_header_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
-            single_weight_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
-            traffic_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.TrafficConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
-            type: typing.Optional[builtins.str] = None,
-        ) -> None:
-            '''Contains the configuration for a continuous deployment policy.
+    @builtins.property
+    @jsii.member(jsii_name="ipv6Enabled")
+    def ipv6_enabled(
+        self,
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "ipv6Enabled"))
 
-            :param enabled: A Boolean that indicates whether this continuous deployment policy is enabled (in effect). When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.
-            :param staging_distribution_dns_names: The CloudFront domain name of the staging distribution. For example: ``d111111abcdef8.cloudfront.net`` .
-            :param single_header_policy_config: This configuration determines which HTTP requests are sent to the staging distribution. If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.
-            :param single_weight_policy_config: This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
-            :param traffic_config: Contains the parameters for routing production traffic from your primary to staging distributions.
-            :param type: The type of traffic configuration.
+    @ipv6_enabled.setter
+    def ipv6_enabled(
+        self,
+        value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2678e60f75fc9c3a75819708e1b8cda159dd49a5c52a78d805d37bb94bd0efa5)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "ipv6Enabled", value) # pyright: ignore[reportArgumentType]
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html
-            :exampleMetadata: fixture=_generated
+    @builtins.property
+    @jsii.member(jsii_name="tags")
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''A complex type that contains zero or more ``Tag`` elements.'''
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "tags"))
 
-            Example::
+    @tags.setter
+    def tags(self, value: typing.Optional[typing.List[_CfnTag_f6864754]]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f9f02fbda8fa97b38f114c9910b9d9cef69228aa69dfe80217e98e1707226ce0)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "tags", value) # pyright: ignore[reportArgumentType]
 
-                # The code below shows an example of how to instantiate this type.
-                # The values are placeholders you should change.
-                from aws_cdk import aws_cloudfront as cloudfront
-                
-                continuous_deployment_policy_config_property = cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
-                    enabled=False,
-                    staging_distribution_dns_names=["stagingDistributionDnsNames"],
-                
-                    # the properties below are optional
-                    single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
-                        header="header",
-                        value="value"
-                    ),
-                    single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
-                        weight=123,
-                
-                        # the properties below are optional
-                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
-                            idle_ttl=123,
-                            maximum_ttl=123
-                        )
-                    ),
-                    traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
-                        type="type",
-                
-                        # the properties below are optional
-                        single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
-                            header="header",
-                            value="value"
-                        ),
-                        single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
-                            weight=123,
-                
-                            # the properties below are optional
-                            session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
-                                idle_ttl=123,
-                                maximum_ttl=123
-                            )
-                        )
-                    ),
-                    type="type"
-                )
-            '''
-            if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__5bd1a74dffe3773a269b4a42a8f5fc37c7934b0931fd845b2923603086ea48cc)
-                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
-                check_type(argname="argument staging_distribution_dns_names", value=staging_distribution_dns_names, expected_type=type_hints["staging_distribution_dns_names"])
-                check_type(argname="argument single_header_policy_config", value=single_header_policy_config, expected_type=type_hints["single_header_policy_config"])
-                check_type(argname="argument single_weight_policy_config", value=single_weight_policy_config, expected_type=type_hints["single_weight_policy_config"])
-                check_type(argname="argument traffic_config", value=traffic_config, expected_type=type_hints["traffic_config"])
-                check_type(argname="argument type", value=type, expected_type=type_hints["type"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "enabled": enabled,
-                "staging_distribution_dns_names": staging_distribution_dns_names,
-            }
-            if single_header_policy_config is not None:
-                self._values["single_header_policy_config"] = single_header_policy_config
-            if single_weight_policy_config is not None:
-                self._values["single_weight_policy_config"] = single_weight_policy_config
-            if traffic_config is not None:
-                self._values["traffic_config"] = traffic_config
-            if type is not None:
-                self._values["type"] = type
 
-        @builtins.property
-        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
-            '''A Boolean that indicates whether this continuous deployment policy is enabled (in effect).
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnConnectionGroupProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "name": "name",
+        "anycast_ip_list_id": "anycastIpListId",
+        "enabled": "enabled",
+        "ipv6_enabled": "ipv6Enabled",
+        "tags": "tags",
+    },
+)
+class CfnConnectionGroupProps:
+    def __init__(
+        self,
+        *,
+        name: builtins.str,
+        anycast_ip_list_id: typing.Optional[builtins.str] = None,
+        enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ) -> None:
+        '''Properties for defining a ``CfnConnectionGroup``.
 
-            When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.
+        :param name: 
+        :param anycast_ip_list_id: The ID of the Anycast static IP list.
+        :param enabled: 
+        :param ipv6_enabled: 
+        :param tags: A complex type that contains zero or more ``Tag`` elements.
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-enabled
-            '''
-            result = self._values.get("enabled")
-            assert result is not None, "Required property 'enabled' is missing"
-            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html
+        :exampleMetadata: fixture=_generated
 
-        @builtins.property
-        def staging_distribution_dns_names(self) -> typing.List[builtins.str]:
-            '''The CloudFront domain name of the staging distribution.
+        Example::
 
-            For example: ``d111111abcdef8.cloudfront.net`` .
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cloudfront as cloudfront
+            
+            cfn_connection_group_props = cloudfront.CfnConnectionGroupProps(
+                name="name",
+            
+                # the properties below are optional
+                anycast_ip_list_id="anycastIpListId",
+                enabled=False,
+                ipv6_enabled=False,
+                tags=[CfnTag(
+                    key="key",
+                    value="value"
+                )]
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__d9f88b4b65d8b9e48fd57e5bde8f7d6681cdcbb9e46fe34c223e63914ee033f4)
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+            check_type(argname="argument anycast_ip_list_id", value=anycast_ip_list_id, expected_type=type_hints["anycast_ip_list_id"])
+            check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
+            check_type(argname="argument ipv6_enabled", value=ipv6_enabled, expected_type=type_hints["ipv6_enabled"])
+            check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "name": name,
+        }
+        if anycast_ip_list_id is not None:
+            self._values["anycast_ip_list_id"] = anycast_ip_list_id
+        if enabled is not None:
+            self._values["enabled"] = enabled
+        if ipv6_enabled is not None:
+            self._values["ipv6_enabled"] = ipv6_enabled
+        if tags is not None:
+            self._values["tags"] = tags
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-stagingdistributiondnsnames
-            '''
-            result = self._values.get("staging_distribution_dns_names")
-            assert result is not None, "Required property 'staging_distribution_dns_names' is missing"
-            return typing.cast(typing.List[builtins.str], result)
+    @builtins.property
+    def name(self) -> builtins.str:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html#cfn-cloudfront-connectiongroup-name
+        '''
+        result = self._values.get("name")
+        assert result is not None, "Required property 'name' is missing"
+        return typing.cast(builtins.str, result)
 
-        @builtins.property
-        def single_header_policy_config(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]]:
-            '''This configuration determines which HTTP requests are sent to the staging distribution.
+    @builtins.property
+    def anycast_ip_list_id(self) -> typing.Optional[builtins.str]:
+        '''The ID of the Anycast static IP list.
 
-            If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html#cfn-cloudfront-connectiongroup-anycastiplistid
+        '''
+        result = self._values.get("anycast_ip_list_id")
+        return typing.cast(typing.Optional[builtins.str], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleheaderpolicyconfig
-            '''
-            result = self._values.get("single_header_policy_config")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]], result)
+    @builtins.property
+    def enabled(
+        self,
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html#cfn-cloudfront-connectiongroup-enabled
+        '''
+        result = self._values.get("enabled")
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
-        @builtins.property
-        def single_weight_policy_config(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]]:
-            '''This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
+    @builtins.property
+    def ipv6_enabled(
+        self,
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html#cfn-cloudfront-connectiongroup-ipv6enabled
+        '''
+        result = self._values.get("ipv6_enabled")
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleweightpolicyconfig
-            '''
-            result = self._values.get("single_weight_policy_config")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]], result)
+    @builtins.property
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''A complex type that contains zero or more ``Tag`` elements.
 
-        @builtins.property
-        def traffic_config(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]]:
-            '''Contains the parameters for routing production traffic from your primary to staging distributions.
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-connectiongroup.html#cfn-cloudfront-connectiongroup-tags
+        '''
+        result = self._values.get("tags")
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-trafficconfig
-            '''
-            result = self._values.get("traffic_config")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]], result)
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
 
-        @builtins.property
-        def type(self) -> typing.Optional[builtins.str]:
-            '''The type of traffic configuration.
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-type
-            '''
-            result = self._values.get("type")
-            return typing.cast(typing.Optional[builtins.str], result)
+    def __repr__(self) -> str:
+        return "CfnConnectionGroupProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
 
-        def __eq__(self, rhs: typing.Any) -> builtins.bool:
-            return isinstance(rhs, self.__class__) and rhs._values == self._values
 
-        def __ne__(self, rhs: typing.Any) -> builtins.bool:
-            return not (rhs == self)
+@jsii.implements(_IInspectable_c2943556)
+class CfnContinuousDeploymentPolicy(
+    _CfnResource_9df397a6,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy",
+):
+    '''Creates a continuous deployment policy that routes a subset of production traffic from a primary distribution to a staging distribution.
 
-        def __repr__(self) -> str:
-            return "ContinuousDeploymentPolicyConfigProperty(%s)" % ", ".join(
-                k + "=" + repr(v) for k, v in self._values.items()
-            )
+    After you create and update a staging distribution, you can use a continuous deployment policy to incrementally move traffic to the staging distribution. This enables you to test changes to a distribution's configuration before moving all of your production traffic to the new configuration.
 
-    @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty",
-        jsii_struct_bases=[],
-        name_mapping={"idle_ttl": "idleTtl", "maximum_ttl": "maximumTtl"},
-    )
-    class SessionStickinessConfigProperty:
-        def __init__(self, *, idle_ttl: jsii.Number, maximum_ttl: jsii.Number) -> None:
-            '''Session stickiness provides the ability to define multiple requests from a single viewer as a single session.
+    For more information, see `Using CloudFront continuous deployment to safely test CDN configuration changes <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/continuous-deployment.html>`_ in the *Amazon CloudFront Developer Guide* .
 
-            This prevents the potentially inconsistent experience of sending some of a given user's requests to your staging distribution, while others are sent to your primary distribution. Define the session duration using TTL values.
+    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-continuousdeploymentpolicy.html
+    :cloudformationResource: AWS::CloudFront::ContinuousDeploymentPolicy
+    :exampleMetadata: fixture=_generated
 
-            :param idle_ttl: The amount of time after which you want sessions to cease if no requests are received. Allowed values are 300–3600 seconds (5–60 minutes).
-            :param maximum_ttl: The maximum amount of time to consider requests from the viewer as being part of the same session. Allowed values are 300–3600 seconds (5–60 minutes).
+    Example::
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html
-            :exampleMetadata: fixture=_generated
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        from aws_cdk import aws_cloudfront as cloudfront
+        
+        cfn_continuous_deployment_policy = cloudfront.CfnContinuousDeploymentPolicy(self, "MyCfnContinuousDeploymentPolicy",
+            continuous_deployment_policy_config=cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
+                enabled=False,
+                staging_distribution_dns_names=["stagingDistributionDnsNames"],
+        
+                # the properties below are optional
+                single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
+                    header="header",
+                    value="value"
+                ),
+                single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
+                    weight=123,
+        
+                    # the properties below are optional
+                    session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
+                        idle_ttl=123,
+                        maximum_ttl=123
+                    )
+                ),
+                traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
+                    type="type",
+        
+                    # the properties below are optional
+                    single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
+                        header="header",
+                        value="value"
+                    ),
+                    single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
+                        weight=123,
+        
+                        # the properties below are optional
+                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
+                            idle_ttl=123,
+                            maximum_ttl=123
+                        )
+                    )
+                ),
+                type="type"
+            )
+        )
+    '''
 
-            Example::
+    def __init__(
+        self,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
+    ) -> None:
+        '''
+        :param scope: Scope in which this resource is defined.
+        :param id: Construct identifier for this resource (unique in its scope).
+        :param continuous_deployment_policy_config: Contains the configuration for a continuous deployment policy.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b57269fe6faf53d2e30ff31a58c5711db8b8cc3b38dc9ac79efdb585dc8f324b)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = CfnContinuousDeploymentPolicyProps(
+            continuous_deployment_policy_config=continuous_deployment_policy_config
+        )
 
-                # The code below shows an example of how to instantiate this type.
-                # The values are placeholders you should change.
-                from aws_cdk import aws_cloudfront as cloudfront
-                
-                session_stickiness_config_property = cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
-                    idle_ttl=123,
-                    maximum_ttl=123
-                )
-            '''
-            if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__28b75d48272033dc185ab5e21f79a97315becd9c7999a921e0b955c636dc0311)
-                check_type(argname="argument idle_ttl", value=idle_ttl, expected_type=type_hints["idle_ttl"])
-                check_type(argname="argument maximum_ttl", value=maximum_ttl, expected_type=type_hints["maximum_ttl"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "idle_ttl": idle_ttl,
-                "maximum_ttl": maximum_ttl,
-            }
+        jsii.create(self.__class__, self, [scope, id, props])
 
-        @builtins.property
-        def idle_ttl(self) -> jsii.Number:
-            '''The amount of time after which you want sessions to cease if no requests are received.
+    @jsii.member(jsii_name="inspect")
+    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
+        '''Examines the CloudFormation resource and discloses attributes.
 
-            Allowed values are 300–3600 seconds (5–60 minutes).
+        :param inspector: tree inspector to collect and process attributes.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__95d0eeca39c0c26751595d2bbe6c1247ac12b7acdb2d7c9d28f5fb0eeacb7187)
+            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
+        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-idlettl
-            '''
-            result = self._values.get("idle_ttl")
-            assert result is not None, "Required property 'idle_ttl' is missing"
-            return typing.cast(jsii.Number, result)
+    @jsii.member(jsii_name="renderProperties")
+    def _render_properties(
+        self,
+        props: typing.Mapping[builtins.str, typing.Any],
+    ) -> typing.Mapping[builtins.str, typing.Any]:
+        '''
+        :param props: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__779f5842b62fc4504802401955475d45973a372c1d8293180cd8ce460b4e4823)
+            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
+        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))
 
-        @builtins.property
-        def maximum_ttl(self) -> jsii.Number:
-            '''The maximum amount of time to consider requests from the viewer as being part of the same session.
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
+    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
+        '''The CloudFormation resource type name for this resource class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
-            Allowed values are 300–3600 seconds (5–60 minutes).
+    @builtins.property
+    @jsii.member(jsii_name="attrId")
+    def attr_id(self) -> builtins.str:
+        '''The identifier of the cotinuous deployment policy.
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-maximumttl
-            '''
-            result = self._values.get("maximum_ttl")
-            assert result is not None, "Required property 'maximum_ttl' is missing"
-            return typing.cast(jsii.Number, result)
+        :cloudformationAttribute: Id
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrId"))
 
-        def __eq__(self, rhs: typing.Any) -> builtins.bool:
-            return isinstance(rhs, self.__class__) and rhs._values == self._values
+    @builtins.property
+    @jsii.member(jsii_name="attrLastModifiedTime")
+    def attr_last_modified_time(self) -> builtins.str:
+        '''The date and time when the continuous deployment policy was last modified.
 
-        def __ne__(self, rhs: typing.Any) -> builtins.bool:
-            return not (rhs == self)
+        :cloudformationAttribute: LastModifiedTime
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))
 
-        def __repr__(self) -> str:
-            return "SessionStickinessConfigProperty(%s)" % ", ".join(
-                k + "=" + repr(v) for k, v in self._values.items()
-            )
+    @builtins.property
+    @jsii.member(jsii_name="cfnProperties")
+    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
+        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
+
+    @builtins.property
+    @jsii.member(jsii_name="continuousDeploymentPolicyConfig")
+    def continuous_deployment_policy_config(
+        self,
+    ) -> typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"]:
+        '''Contains the configuration for a continuous deployment policy.'''
+        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"], jsii.get(self, "continuousDeploymentPolicyConfig"))
+
+    @continuous_deployment_policy_config.setter
+    def continuous_deployment_policy_config(
+        self,
+        value: typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f4581f42e1117e6de93836f594986c28a2378e8200e2f4a535cce028879382c9)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "continuousDeploymentPolicyConfig", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty",
         jsii_struct_bases=[],
-        name_mapping={"header": "header", "value": "value"},
+        name_mapping={
+            "enabled": "enabled",
+            "staging_distribution_dns_names": "stagingDistributionDnsNames",
+            "single_header_policy_config": "singleHeaderPolicyConfig",
+            "single_weight_policy_config": "singleWeightPolicyConfig",
+            "traffic_config": "trafficConfig",
+            "type": "type",
+        },
     )
-    class SingleHeaderConfigProperty:
-        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
-            '''Determines which HTTP requests are sent to the staging distribution.
+    class ContinuousDeploymentPolicyConfigProperty:
+        def __init__(
+            self,
+            *,
+            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
+            staging_distribution_dns_names: typing.Sequence[builtins.str],
+            single_header_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            single_weight_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            traffic_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.TrafficConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            type: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''Contains the configuration for a continuous deployment policy.
 
-            :param header: The request header name that you want CloudFront to send to your staging distribution. The header must contain the prefix ``aws-cf-cd-`` .
-            :param value: The request header value.
+            :param enabled: A Boolean that indicates whether this continuous deployment policy is enabled (in effect). When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.
+            :param staging_distribution_dns_names: The CloudFront domain name of the staging distribution. For example: ``d111111abcdef8.cloudfront.net`` .
+            :param single_header_policy_config: This configuration determines which HTTP requests are sent to the staging distribution. If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.
+            :param single_weight_policy_config: This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
+            :param traffic_config: Contains the parameters for routing production traffic from your primary to staging distributions.
+            :param type: The type of traffic configuration.
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -4777,67 +4920,299 @@ class CfnContinuousDeploymentPolicy(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                single_header_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
-                    header="header",
-                    value="value"
+                continuous_deployment_policy_config_property = cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
+                    enabled=False,
+                    staging_distribution_dns_names=["stagingDistributionDnsNames"],
+                
+                    # the properties below are optional
+                    single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
+                        header="header",
+                        value="value"
+                    ),
+                    single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
+                        weight=123,
+                
+                        # the properties below are optional
+                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
+                            idle_ttl=123,
+                            maximum_ttl=123
+                        )
+                    ),
+                    traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
+                        type="type",
+                
+                        # the properties below are optional
+                        single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
+                            header="header",
+                            value="value"
+                        ),
+                        single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
+                            weight=123,
+                
+                            # the properties below are optional
+                            session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
+                                idle_ttl=123,
+                                maximum_ttl=123
+                            )
+                        )
+                    ),
+                    type="type"
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__ab2cd352992c9ba2b394cb9901d11c00f78ce00fd375f0cc51f4ae2401889435)
-                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
-                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+                type_hints = typing.get_type_hints(_typecheckingstub__5bd1a74dffe3773a269b4a42a8f5fc37c7934b0931fd845b2923603086ea48cc)
+                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
+                check_type(argname="argument staging_distribution_dns_names", value=staging_distribution_dns_names, expected_type=type_hints["staging_distribution_dns_names"])
+                check_type(argname="argument single_header_policy_config", value=single_header_policy_config, expected_type=type_hints["single_header_policy_config"])
+                check_type(argname="argument single_weight_policy_config", value=single_weight_policy_config, expected_type=type_hints["single_weight_policy_config"])
+                check_type(argname="argument traffic_config", value=traffic_config, expected_type=type_hints["traffic_config"])
+                check_type(argname="argument type", value=type, expected_type=type_hints["type"])
             self._values: typing.Dict[builtins.str, typing.Any] = {
-                "header": header,
-                "value": value,
+                "enabled": enabled,
+                "staging_distribution_dns_names": staging_distribution_dns_names,
             }
+            if single_header_policy_config is not None:
+                self._values["single_header_policy_config"] = single_header_policy_config
+            if single_weight_policy_config is not None:
+                self._values["single_weight_policy_config"] = single_weight_policy_config
+            if traffic_config is not None:
+                self._values["traffic_config"] = traffic_config
+            if type is not None:
+                self._values["type"] = type
 
         @builtins.property
-        def header(self) -> builtins.str:
-            '''The request header name that you want CloudFront to send to your staging distribution.
+        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
+            '''A Boolean that indicates whether this continuous deployment policy is enabled (in effect).
 
-            The header must contain the prefix ``aws-cf-cd-`` .
+            When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-header
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-enabled
             '''
-            result = self._values.get("header")
-            assert result is not None, "Required property 'header' is missing"
-            return typing.cast(builtins.str, result)
+            result = self._values.get("enabled")
+            assert result is not None, "Required property 'enabled' is missing"
+            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)
 
         @builtins.property
-        def value(self) -> builtins.str:
-            '''The request header value.
+        def staging_distribution_dns_names(self) -> typing.List[builtins.str]:
+            '''The CloudFront domain name of the staging distribution.
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-value
+            For example: ``d111111abcdef8.cloudfront.net`` .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-stagingdistributiondnsnames
             '''
-            result = self._values.get("value")
-            assert result is not None, "Required property 'value' is missing"
-            return typing.cast(builtins.str, result)
+            result = self._values.get("staging_distribution_dns_names")
+            assert result is not None, "Required property 'staging_distribution_dns_names' is missing"
+            return typing.cast(typing.List[builtins.str], result)
 
-        def __eq__(self, rhs: typing.Any) -> builtins.bool:
-            return isinstance(rhs, self.__class__) and rhs._values == self._values
+        @builtins.property
+        def single_header_policy_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]]:
+            '''This configuration determines which HTTP requests are sent to the staging distribution.
 
-        def __ne__(self, rhs: typing.Any) -> builtins.bool:
-            return not (rhs == self)
+            If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.
 
-        def __repr__(self) -> str:
-            return "SingleHeaderConfigProperty(%s)" % ", ".join(
-                k + "=" + repr(v) for k, v in self._values.items()
-            )
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleheaderpolicyconfig
+            '''
+            result = self._values.get("single_header_policy_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]], result)
 
-    @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty",
-        jsii_struct_bases=[],
-        name_mapping={"header": "header", "value": "value"},
-    )
-    class SingleHeaderPolicyConfigProperty:
-        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
-            '''Defines a single header policy for a CloudFront distribution.
+        @builtins.property
+        def single_weight_policy_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]]:
+            '''This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
 
-            .. epigraph::
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleweightpolicyconfig
+            '''
+            result = self._values.get("single_weight_policy_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]], result)
 
-               This property is legacy. We recommend that you use `TrafficConfig <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html>`_ and specify the `SingleHeaderConfig <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html#cfn-cloudfront-continuousdeploymentpolicy-trafficconfig-singleheaderconfig>`_ property instead.
+        @builtins.property
+        def traffic_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]]:
+            '''Contains the parameters for routing production traffic from your primary to staging distributions.
 
-            :param header: The name of the HTTP header that CloudFront uses to configure for the single header policy.
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-trafficconfig
+            '''
+            result = self._values.get("traffic_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]], result)
+
+        @builtins.property
+        def type(self) -> typing.Optional[builtins.str]:
+            '''The type of traffic configuration.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-type
+            '''
+            result = self._values.get("type")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ContinuousDeploymentPolicyConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"idle_ttl": "idleTtl", "maximum_ttl": "maximumTtl"},
+    )
+    class SessionStickinessConfigProperty:
+        def __init__(self, *, idle_ttl: jsii.Number, maximum_ttl: jsii.Number) -> None:
+            '''Session stickiness provides the ability to define multiple requests from a single viewer as a single session.
+
+            This prevents the potentially inconsistent experience of sending some of a given user's requests to your staging distribution, while others are sent to your primary distribution. Define the session duration using TTL values.
+
+            :param idle_ttl: The amount of time after which you want sessions to cease if no requests are received. Allowed values are 300–3600 seconds (5–60 minutes).
+            :param maximum_ttl: The maximum amount of time to consider requests from the viewer as being part of the same session. Allowed values are 300–3600 seconds (5–60 minutes).
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                session_stickiness_config_property = cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
+                    idle_ttl=123,
+                    maximum_ttl=123
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__28b75d48272033dc185ab5e21f79a97315becd9c7999a921e0b955c636dc0311)
+                check_type(argname="argument idle_ttl", value=idle_ttl, expected_type=type_hints["idle_ttl"])
+                check_type(argname="argument maximum_ttl", value=maximum_ttl, expected_type=type_hints["maximum_ttl"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "idle_ttl": idle_ttl,
+                "maximum_ttl": maximum_ttl,
+            }
+
+        @builtins.property
+        def idle_ttl(self) -> jsii.Number:
+            '''The amount of time after which you want sessions to cease if no requests are received.
+
+            Allowed values are 300–3600 seconds (5–60 minutes).
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-idlettl
+            '''
+            result = self._values.get("idle_ttl")
+            assert result is not None, "Required property 'idle_ttl' is missing"
+            return typing.cast(jsii.Number, result)
+
+        @builtins.property
+        def maximum_ttl(self) -> jsii.Number:
+            '''The maximum amount of time to consider requests from the viewer as being part of the same session.
+
+            Allowed values are 300–3600 seconds (5–60 minutes).
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-maximumttl
+            '''
+            result = self._values.get("maximum_ttl")
+            assert result is not None, "Required property 'maximum_ttl' is missing"
+            return typing.cast(jsii.Number, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "SessionStickinessConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"header": "header", "value": "value"},
+    )
+    class SingleHeaderConfigProperty:
+        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
+            '''Determines which HTTP requests are sent to the staging distribution.
+
+            :param header: The request header name that you want CloudFront to send to your staging distribution. The header must contain the prefix ``aws-cf-cd-`` .
+            :param value: The request header value.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                single_header_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
+                    header="header",
+                    value="value"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ab2cd352992c9ba2b394cb9901d11c00f78ce00fd375f0cc51f4ae2401889435)
+                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
+                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "header": header,
+                "value": value,
+            }
+
+        @builtins.property
+        def header(self) -> builtins.str:
+            '''The request header name that you want CloudFront to send to your staging distribution.
+
+            The header must contain the prefix ``aws-cf-cd-`` .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-header
+            '''
+            result = self._values.get("header")
+            assert result is not None, "Required property 'header' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def value(self) -> builtins.str:
+            '''The request header value.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-value
+            '''
+            result = self._values.get("value")
+            assert result is not None, "Required property 'value' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "SingleHeaderConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"header": "header", "value": "value"},
+    )
+    class SingleHeaderPolicyConfigProperty:
+        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
+            '''Defines a single header policy for a CloudFront distribution.
+
+            .. epigraph::
+
+               This property is legacy. We recommend that you use `TrafficConfig <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html>`_ and specify the `SingleHeaderConfig <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html#cfn-cloudfront-continuousdeploymentpolicy-trafficconfig-singleheaderconfig>`_ property instead.
+
+            :param header: The name of the HTTP header that CloudFront uses to configure for the single header policy.
             :param value: Specifies the value to assign to the header for a single header policy.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig.html
@@ -6825,6 +7200,67 @@ class CfnDistribution(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.DefinitionProperty",
+        jsii_struct_bases=[],
+        name_mapping={"string_schema": "stringSchema"},
+    )
+    class DefinitionProperty:
+        def __init__(
+            self,
+            *,
+            string_schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.StringSchemaProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        ) -> None:
+            '''
+            :param string_schema: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-definition.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                definition_property = cloudfront.CfnDistribution.DefinitionProperty(
+                    string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
+                        required=False,
+                
+                        # the properties below are optional
+                        comment="comment",
+                        default_value="defaultValue"
+                    )
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__6373c35cb5b68c4917ddc72054f5c42da1b689748928adaa28575e2f9058bcf1)
+                check_type(argname="argument string_schema", value=string_schema, expected_type=type_hints["string_schema"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if string_schema is not None:
+                self._values["string_schema"] = string_schema
+
+        @builtins.property
+        def string_schema(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.StringSchemaProperty"]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-definition.html#cfn-cloudfront-distribution-definition-stringschema
+            '''
+            result = self._values.get("string_schema")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.StringSchemaProperty"]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "DefinitionProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.DistributionConfigProperty",
         jsii_struct_bases=[],
@@ -6836,6 +7272,7 @@ class CfnDistribution(
             "cache_behaviors": "cacheBehaviors",
             "cnam_es": "cnamEs",
             "comment": "comment",
+            "connection_mode": "connectionMode",
             "continuous_deployment_policy_id": "continuousDeploymentPolicyId",
             "custom_error_responses": "customErrorResponses",
             "custom_origin": "customOrigin",
@@ -6849,6 +7286,7 @@ class CfnDistribution(
             "restrictions": "restrictions",
             "s3_origin": "s3Origin",
             "staging": "staging",
+            "tenant_config": "tenantConfig",
             "viewer_certificate": "viewerCertificate",
             "web_acl_id": "webAclId",
         },
@@ -6864,6 +7302,7 @@ class CfnDistribution(
             cache_behaviors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CacheBehaviorProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
             cnam_es: typing.Optional[typing.Sequence[builtins.str]] = None,
             comment: typing.Optional[builtins.str] = None,
+            connection_mode: typing.Optional[builtins.str] = None,
             continuous_deployment_policy_id: typing.Optional[builtins.str] = None,
             custom_error_responses: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CustomErrorResponseProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
             custom_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LegacyCustomOriginProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -6877,6 +7316,7 @@ class CfnDistribution(
             restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.RestrictionsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             s3_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LegacyS3OriginProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             staging: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+            tenant_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.TenantConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             viewer_certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.ViewerCertificateProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             web_acl_id: typing.Optional[builtins.str] = None,
         ) -> None:
@@ -6889,6 +7329,7 @@ class CfnDistribution(
             :param cache_behaviors: A complex type that contains zero or more ``CacheBehavior`` elements.
             :param cnam_es: An alias for the CloudFront distribution's domain name. .. epigraph:: This property is legacy. We recommend that you use `Aliases <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-aliases>`_ instead.
             :param comment: A comment to describe the distribution. The comment cannot be longer than 128 characters. Default: - ""
+            :param connection_mode: 
             :param continuous_deployment_policy_id: The identifier of a continuous deployment policy. For more information, see ``CreateContinuousDeploymentPolicy`` .
             :param custom_error_responses: A complex type that controls the following:. - Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer. - How long CloudFront caches HTTP status codes in the 4xx and 5xx range. For more information about custom error pages, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* .
             :param custom_origin: The user-defined HTTP server that serves as the origin for content that CloudFront distributes. .. epigraph:: This property is legacy. We recommend that you use `Origin <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html>`_ instead.
@@ -6902,6 +7343,7 @@ class CfnDistribution(
             :param restrictions: A complex type that identifies ways in which you want to restrict distribution of your content.
             :param s3_origin: The origin as an Amazon S3 bucket. .. epigraph:: This property is legacy. We recommend that you use `Origin <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html>`_ instead.
             :param staging: A Boolean that indicates whether this is a staging distribution. When this value is ``true`` , this is a staging distribution. When this value is ``false`` , this is not a staging distribution.
+            :param tenant_config: 
             :param viewer_certificate: A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.
             :param web_acl_id: A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF , use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111`` . To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``a1b2c3d4-5678-90ab-cdef-EXAMPLE11111`` . AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to CloudFront, and lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront responds to requests either with the requested content or with an HTTP 403 status code (Forbidden). You can also configure CloudFront to return a custom error page when a request is blocked. For more information about AWS WAF , see the `AWS WAF Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html>`_ . Default: - ""
 
@@ -7013,6 +7455,7 @@ class CfnDistribution(
                     )],
                     cnam_es=["cnamEs"],
                     comment="comment",
+                    connection_mode="connectionMode",
                     continuous_deployment_policy_id="continuousDeploymentPolicyId",
                     custom_error_responses=[cloudfront.CfnDistribution.CustomErrorResponseProperty(
                         error_code=123,
@@ -7116,6 +7559,20 @@ class CfnDistribution(
                         origin_access_identity="originAccessIdentity"
                     ),
                     staging=False,
+                    tenant_config=cloudfront.CfnDistribution.TenantConfigProperty(
+                        parameter_definitions=[cloudfront.CfnDistribution.ParameterDefinitionProperty(
+                            definition=cloudfront.CfnDistribution.DefinitionProperty(
+                                string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
+                                    required=False,
+                
+                                    # the properties below are optional
+                                    comment="comment",
+                                    default_value="defaultValue"
+                                )
+                            ),
+                            name="name"
+                        )]
+                    ),
                     viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty(
                         acm_certificate_arn="acmCertificateArn",
                         cloud_front_default_certificate=False,
@@ -7135,6 +7592,7 @@ class CfnDistribution(
                 check_type(argname="argument cache_behaviors", value=cache_behaviors, expected_type=type_hints["cache_behaviors"])
                 check_type(argname="argument cnam_es", value=cnam_es, expected_type=type_hints["cnam_es"])
                 check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
+                check_type(argname="argument connection_mode", value=connection_mode, expected_type=type_hints["connection_mode"])
                 check_type(argname="argument continuous_deployment_policy_id", value=continuous_deployment_policy_id, expected_type=type_hints["continuous_deployment_policy_id"])
                 check_type(argname="argument custom_error_responses", value=custom_error_responses, expected_type=type_hints["custom_error_responses"])
                 check_type(argname="argument custom_origin", value=custom_origin, expected_type=type_hints["custom_origin"])
@@ -7148,6 +7606,7 @@ class CfnDistribution(
                 check_type(argname="argument restrictions", value=restrictions, expected_type=type_hints["restrictions"])
                 check_type(argname="argument s3_origin", value=s3_origin, expected_type=type_hints["s3_origin"])
                 check_type(argname="argument staging", value=staging, expected_type=type_hints["staging"])
+                check_type(argname="argument tenant_config", value=tenant_config, expected_type=type_hints["tenant_config"])
                 check_type(argname="argument viewer_certificate", value=viewer_certificate, expected_type=type_hints["viewer_certificate"])
                 check_type(argname="argument web_acl_id", value=web_acl_id, expected_type=type_hints["web_acl_id"])
             self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -7164,6 +7623,8 @@ class CfnDistribution(
                 self._values["cnam_es"] = cnam_es
             if comment is not None:
                 self._values["comment"] = comment
+            if connection_mode is not None:
+                self._values["connection_mode"] = connection_mode
             if continuous_deployment_policy_id is not None:
                 self._values["continuous_deployment_policy_id"] = continuous_deployment_policy_id
             if custom_error_responses is not None:
@@ -7190,6 +7651,8 @@ class CfnDistribution(
                 self._values["s3_origin"] = s3_origin
             if staging is not None:
                 self._values["staging"] = staging
+            if tenant_config is not None:
+                self._values["tenant_config"] = tenant_config
             if viewer_certificate is not None:
                 self._values["viewer_certificate"] = viewer_certificate
             if web_acl_id is not None:
@@ -7274,6 +7737,14 @@ class CfnDistribution(
             result = self._values.get("comment")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def connection_mode(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-connectionmode
+            '''
+            result = self._values.get("connection_mode")
+            return typing.cast(typing.Optional[builtins.str], result)
+
         @builtins.property
         def continuous_deployment_policy_id(self) -> typing.Optional[builtins.str]:
             '''The identifier of a continuous deployment policy.
@@ -7475,6 +7946,16 @@ class CfnDistribution(
             result = self._values.get("staging")
             return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
+        @builtins.property
+        def tenant_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.TenantConfigProperty"]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-tenantconfig
+            '''
+            result = self._values.get("tenant_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.TenantConfigProperty"]], result)
+
         @builtins.property
         def viewer_certificate(
             self,
@@ -9019,75 +9500,1573 @@ class CfnDistribution(
         def origin_access_control_id(self) -> typing.Optional[builtins.str]:
             '''The unique identifier of an origin access control for this origin.
 
-            For more information, see `Restricting access to an Amazon S3 origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Restricting access to an Amazon S3 origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originaccesscontrolid
+            '''
+            result = self._values.get("origin_access_control_id")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def origin_custom_headers(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]]:
+            '''A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin.
+
+            For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-origincustomheaders
+            '''
+            result = self._values.get("origin_custom_headers")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]], result)
+
+        @builtins.property
+        def origin_path(self) -> typing.Optional[builtins.str]:
+            '''An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
+
+            For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :default: - ""
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originpath
+            '''
+            result = self._values.get("origin_path")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def origin_shield(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]]:
+            '''CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin.
+
+            For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originshield
+            '''
+            result = self._values.get("origin_shield")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]], result)
+
+        @builtins.property
+        def s3_origin_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]]:
+            '''Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting.
+
+            To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-s3originconfig
+            '''
+            result = self._values.get("s3_origin_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]], result)
+
+        @builtins.property
+        def vpc_origin_config(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.VpcOriginConfigProperty"]]:
+            '''The VPC origin configuration.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-vpcoriginconfig
+            '''
+            result = self._values.get("vpc_origin_config")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.VpcOriginConfigProperty"]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "OriginProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginShieldProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "enabled": "enabled",
+            "origin_shield_region": "originShieldRegion",
+        },
+    )
+    class OriginShieldProperty:
+        def __init__(
+            self,
+            *,
+            enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+            origin_shield_region: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''CloudFront Origin Shield.
+
+            Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :param enabled: A flag that specifies whether Origin Shield is enabled. When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
+            :param origin_shield_region: The AWS Region for Origin Shield. Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` . When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                origin_shield_property = cloudfront.CfnDistribution.OriginShieldProperty(
+                    enabled=False,
+                    origin_shield_region="originShieldRegion"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__d2a25e92d5905a4c19d3636ff8b631afa34a538497a13fa9d29e56ca404539e4)
+                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
+                check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if enabled is not None:
+                self._values["enabled"] = enabled
+            if origin_shield_region is not None:
+                self._values["origin_shield_region"] = origin_shield_region
+
+        @builtins.property
+        def enabled(
+            self,
+        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+            '''A flag that specifies whether Origin Shield is enabled.
+
+            When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-enabled
+            '''
+            result = self._values.get("enabled")
+            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
+
+        @builtins.property
+        def origin_shield_region(self) -> typing.Optional[builtins.str]:
+            '''The AWS Region for Origin Shield.
+
+            Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` .
+
+            When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-originshieldregion
+            '''
+            result = self._values.get("origin_shield_region")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "OriginShieldProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.ParameterDefinitionProperty",
+        jsii_struct_bases=[],
+        name_mapping={"definition": "definition", "name": "name"},
+    )
+    class ParameterDefinitionProperty:
+        def __init__(
+            self,
+            *,
+            definition: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.DefinitionProperty", typing.Dict[builtins.str, typing.Any]]],
+            name: builtins.str,
+        ) -> None:
+            '''
+            :param definition: 
+            :param name: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-parameterdefinition.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                parameter_definition_property = cloudfront.CfnDistribution.ParameterDefinitionProperty(
+                    definition=cloudfront.CfnDistribution.DefinitionProperty(
+                        string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
+                            required=False,
+                
+                            # the properties below are optional
+                            comment="comment",
+                            default_value="defaultValue"
+                        )
+                    ),
+                    name="name"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__d3077fc2475a570e548a4c766c77d7d863c9b4298e77dbf52c861eb303170cbd)
+                check_type(argname="argument definition", value=definition, expected_type=type_hints["definition"])
+                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "definition": definition,
+                "name": name,
+            }
+
+        @builtins.property
+        def definition(
+            self,
+        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.DefinitionProperty"]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-parameterdefinition.html#cfn-cloudfront-distribution-parameterdefinition-definition
+            '''
+            result = self._values.get("definition")
+            assert result is not None, "Required property 'definition' is missing"
+            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.DefinitionProperty"], result)
+
+        @builtins.property
+        def name(self) -> builtins.str:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-parameterdefinition.html#cfn-cloudfront-distribution-parameterdefinition-name
+            '''
+            result = self._values.get("name")
+            assert result is not None, "Required property 'name' is missing"
+            return typing.cast(builtins.str, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ParameterDefinitionProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.RestrictionsProperty",
+        jsii_struct_bases=[],
+        name_mapping={"geo_restriction": "geoRestriction"},
+    )
+    class RestrictionsProperty:
+        def __init__(
+            self,
+            *,
+            geo_restriction: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.GeoRestrictionProperty", typing.Dict[builtins.str, typing.Any]]],
+        ) -> None:
+            '''A complex type that identifies ways in which you want to restrict distribution of your content.
+
+            :param geo_restriction: A complex type that controls the countries in which your content is distributed. CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                restrictions_property = cloudfront.CfnDistribution.RestrictionsProperty(
+                    geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
+                        restriction_type="restrictionType",
+                
+                        # the properties below are optional
+                        locations=["locations"]
+                    )
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa9638220c0d)
+                check_type(argname="argument geo_restriction", value=geo_restriction, expected_type=type_hints["geo_restriction"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "geo_restriction": geo_restriction,
+            }
+
+        @builtins.property
+        def geo_restriction(
+            self,
+        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"]:
+            '''A complex type that controls the countries in which your content is distributed.
+
+            CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html#cfn-cloudfront-distribution-restrictions-georestriction
+            '''
+            result = self._values.get("geo_restriction")
+            assert result is not None, "Required property 'geo_restriction' is missing"
+            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "RestrictionsProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.S3OriginConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"origin_access_identity": "originAccessIdentity"},
+    )
+    class S3OriginConfigProperty:
+        def __init__(
+            self,
+            *,
+            origin_access_identity: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''A complex type that contains information about the Amazon S3 origin.
+
+            If the origin is a custom origin or an S3 bucket that is configured as a website endpoint, use the ``CustomOriginConfig`` element instead.
+
+            :param origin_access_identity: .. epigraph:: If you're using origin access control (OAC) instead of origin access identity, specify an empty ``OriginAccessIdentity`` element. For more information, see `Restricting access to an AWS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* . The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is: ``origin-access-identity/cloudfront/ID-of-origin-access-identity`` The ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity. If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element. To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element. To replace the origin access identity, update the distribution configuration and specify the new origin access identity. For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                s3_origin_config_property = cloudfront.CfnDistribution.S3OriginConfigProperty(
+                    origin_access_identity="originAccessIdentity"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7)
+                check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if origin_access_identity is not None:
+                self._values["origin_access_identity"] = origin_access_identity
+
+        @builtins.property
+        def origin_access_identity(self) -> typing.Optional[builtins.str]:
+            '''.. epigraph::
+
+   If you're using origin access control (OAC) instead of origin access identity, specify an empty ``OriginAccessIdentity`` element.
+
+            For more information, see `Restricting access to an AWS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is:
+
+            ``origin-access-identity/cloudfront/ID-of-origin-access-identity``
+
+            The ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity.
+
+            If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element.
+
+            To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element.
+
+            To replace the origin access identity, update the distribution configuration and specify the new origin access identity.
+
+            For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :default: - ""
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html#cfn-cloudfront-distribution-s3originconfig-originaccessidentity
+            '''
+            result = self._values.get("origin_access_identity")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "S3OriginConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.StatusCodesProperty",
+        jsii_struct_bases=[],
+        name_mapping={"items": "items", "quantity": "quantity"},
+    )
+    class StatusCodesProperty:
+        def __init__(
+            self,
+            *,
+            items: typing.Union[typing.Sequence[jsii.Number], _IResolvable_da3f097b],
+            quantity: jsii.Number,
+        ) -> None:
+            '''A complex data type for the status codes that you specify that, when returned by a primary origin, trigger CloudFront to failover to a second origin.
+
+            :param items: The items (status codes) for an origin group.
+            :param quantity: The number of status codes.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                status_codes_property = cloudfront.CfnDistribution.StatusCodesProperty(
+                    items=[123],
+                    quantity=123
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__7b8b62ce6bf1ec6151566719caf2d665f3f7fea596e402fba7354f19f781f23c)
+                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
+                check_type(argname="argument quantity", value=quantity, expected_type=type_hints["quantity"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "items": items,
+                "quantity": quantity,
+            }
+
+        @builtins.property
+        def items(
+            self,
+        ) -> typing.Union[typing.List[jsii.Number], _IResolvable_da3f097b]:
+            '''The items (status codes) for an origin group.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-items
+            '''
+            result = self._values.get("items")
+            assert result is not None, "Required property 'items' is missing"
+            return typing.cast(typing.Union[typing.List[jsii.Number], _IResolvable_da3f097b], result)
+
+        @builtins.property
+        def quantity(self) -> jsii.Number:
+            '''The number of status codes.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-quantity
+            '''
+            result = self._values.get("quantity")
+            assert result is not None, "Required property 'quantity' is missing"
+            return typing.cast(jsii.Number, result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "StatusCodesProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.StringSchemaProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "required": "required",
+            "comment": "comment",
+            "default_value": "defaultValue",
+        },
+    )
+    class StringSchemaProperty:
+        def __init__(
+            self,
+            *,
+            required: typing.Union[builtins.bool, _IResolvable_da3f097b],
+            comment: typing.Optional[builtins.str] = None,
+            default_value: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''
+            :param required: 
+            :param comment: 
+            :param default_value: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-stringschema.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                string_schema_property = cloudfront.CfnDistribution.StringSchemaProperty(
+                    required=False,
+                
+                    # the properties below are optional
+                    comment="comment",
+                    default_value="defaultValue"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__063da7cd247f9f65fbf71edf06b732e35e339a5952e2f2bf8ccd5eee1c5611d8)
+                check_type(argname="argument required", value=required, expected_type=type_hints["required"])
+                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
+                check_type(argname="argument default_value", value=default_value, expected_type=type_hints["default_value"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "required": required,
+            }
+            if comment is not None:
+                self._values["comment"] = comment
+            if default_value is not None:
+                self._values["default_value"] = default_value
+
+        @builtins.property
+        def required(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-stringschema.html#cfn-cloudfront-distribution-stringschema-required
+            '''
+            result = self._values.get("required")
+            assert result is not None, "Required property 'required' is missing"
+            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)
+
+        @builtins.property
+        def comment(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-stringschema.html#cfn-cloudfront-distribution-stringschema-comment
+            '''
+            result = self._values.get("comment")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def default_value(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-stringschema.html#cfn-cloudfront-distribution-stringschema-defaultvalue
+            '''
+            result = self._values.get("default_value")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "StringSchemaProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.TenantConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={"parameter_definitions": "parameterDefinitions"},
+    )
+    class TenantConfigProperty:
+        def __init__(
+            self,
+            *,
+            parameter_definitions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.ParameterDefinitionProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        ) -> None:
+            '''
+            :param parameter_definitions: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-tenantconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                tenant_config_property = cloudfront.CfnDistribution.TenantConfigProperty(
+                    parameter_definitions=[cloudfront.CfnDistribution.ParameterDefinitionProperty(
+                        definition=cloudfront.CfnDistribution.DefinitionProperty(
+                            string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
+                                required=False,
+                
+                                # the properties below are optional
+                                comment="comment",
+                                default_value="defaultValue"
+                            )
+                        ),
+                        name="name"
+                    )]
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__d2edbb1e96d7cdd1ba9da9c2eb778117b7b4726ec0bcf6cf55c64bbbdba19541)
+                check_type(argname="argument parameter_definitions", value=parameter_definitions, expected_type=type_hints["parameter_definitions"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if parameter_definitions is not None:
+                self._values["parameter_definitions"] = parameter_definitions
+
+        @builtins.property
+        def parameter_definitions(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ParameterDefinitionProperty"]]]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-tenantconfig.html#cfn-cloudfront-distribution-tenantconfig-parameterdefinitions
+            '''
+            result = self._values.get("parameter_definitions")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ParameterDefinitionProperty"]]]], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "TenantConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.ViewerCertificateProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "acm_certificate_arn": "acmCertificateArn",
+            "cloud_front_default_certificate": "cloudFrontDefaultCertificate",
+            "iam_certificate_id": "iamCertificateId",
+            "minimum_protocol_version": "minimumProtocolVersion",
+            "ssl_support_method": "sslSupportMethod",
+        },
+    )
+    class ViewerCertificateProperty:
+        def __init__(
+            self,
+            *,
+            acm_certificate_arn: typing.Optional[builtins.str] = None,
+            cloud_front_default_certificate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+            iam_certificate_id: typing.Optional[builtins.str] = None,
+            minimum_protocol_version: typing.Optional[builtins.str] = None,
+            ssl_support_method: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.
+
+            If the distribution doesn't use ``Aliases`` (also known as alternate domain names or CNAMEs)—that is, if the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` —set ``CloudFrontDefaultCertificate`` to ``true`` and leave all other fields empty.
+
+            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), use the fields in this type to specify the following settings:
+
+            - Which viewers the distribution accepts HTTPS connections from: only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ (recommended), or all viewers including those that don't support SNI.
+            - To accept HTTPS connections from only viewers that support SNI, set ``SSLSupportMethod`` to ``sni-only`` . This is recommended. Most browsers and clients support SNI. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+            - To accept HTTPS connections from all viewers, including those that don't support SNI, set ``SSLSupportMethod`` to ``vip`` . This is not recommended, and results in additional monthly charges from CloudFront. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+            - The minimum SSL/TLS protocol version that the distribution can use to communicate with viewers. To specify a minimum version, choose a value for ``MinimumProtocolVersion`` . For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ in the *Amazon CloudFront Developer Guide* .
+            - The location of the SSL/TLS certificate, `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ (recommended) or `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ . You specify the location by setting a value in one of the following fields (not both):
+            - ``ACMCertificateArn`` (In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.)
+            - ``IAMCertificateId`` (In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.)
+
+            All distributions support HTTPS connections from viewers. To require viewers to use HTTPS only, or to redirect them from HTTP to HTTPS, use ``ViewerProtocolPolicy`` in the ``CacheBehavior`` or ``DefaultCacheBehavior`` . To specify how CloudFront should use SSL/TLS to communicate with your custom origin, use ``CustomOriginConfig`` .
+
+            For more information, see `Using HTTPS with CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html>`_ and `Using Alternate Domain Names and HTTPS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :param acm_certificate_arn: .. epigraph:: In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ). If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+            :param cloud_front_default_certificate: If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` . If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields: - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both) - ``MinimumProtocolVersion`` - ``SslSupportMethod``
+            :param iam_certificate_id: .. epigraph:: In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate. If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+            :param minimum_protocol_version: If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers. The security policy determines two settings: - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers. - The ciphers that CloudFront can use to encrypt the content that it returns to viewers. For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* . .. epigraph:: On the CloudFront console, this setting is called *Security Policy* . When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.) If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.
+            :param ssl_support_method: .. epigraph:: In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from. - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI. - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront. - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `Support Center <https://docs.aws.amazon.com/support/home>`_ . If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                viewer_certificate_property = cloudfront.CfnDistribution.ViewerCertificateProperty(
+                    acm_certificate_arn="acmCertificateArn",
+                    cloud_front_default_certificate=False,
+                    iam_certificate_id="iamCertificateId",
+                    minimum_protocol_version="minimumProtocolVersion",
+                    ssl_support_method="sslSupportMethod"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__511560286b35778c69f3d2a23120607f1ab2e58901f0c1ba7acd75a338eb699e)
+                check_type(argname="argument acm_certificate_arn", value=acm_certificate_arn, expected_type=type_hints["acm_certificate_arn"])
+                check_type(argname="argument cloud_front_default_certificate", value=cloud_front_default_certificate, expected_type=type_hints["cloud_front_default_certificate"])
+                check_type(argname="argument iam_certificate_id", value=iam_certificate_id, expected_type=type_hints["iam_certificate_id"])
+                check_type(argname="argument minimum_protocol_version", value=minimum_protocol_version, expected_type=type_hints["minimum_protocol_version"])
+                check_type(argname="argument ssl_support_method", value=ssl_support_method, expected_type=type_hints["ssl_support_method"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if acm_certificate_arn is not None:
+                self._values["acm_certificate_arn"] = acm_certificate_arn
+            if cloud_front_default_certificate is not None:
+                self._values["cloud_front_default_certificate"] = cloud_front_default_certificate
+            if iam_certificate_id is not None:
+                self._values["iam_certificate_id"] = iam_certificate_id
+            if minimum_protocol_version is not None:
+                self._values["minimum_protocol_version"] = minimum_protocol_version
+            if ssl_support_method is not None:
+                self._values["ssl_support_method"] = ssl_support_method
+
+        @builtins.property
+        def acm_certificate_arn(self) -> typing.Optional[builtins.str]:
+            '''.. epigraph::
+
+   In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.
+
+            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ).
+
+            If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-acmcertificatearn
+            '''
+            result = self._values.get("acm_certificate_arn")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def cloud_front_default_certificate(
+            self,
+        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+            '''If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` .
+
+            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields:
+
+            - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both)
+            - ``MinimumProtocolVersion``
+            - ``SslSupportMethod``
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-cloudfrontdefaultcertificate
+            '''
+            result = self._values.get("cloud_front_default_certificate")
+            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
+
+        @builtins.property
+        def iam_certificate_id(self) -> typing.Optional[builtins.str]:
+            '''.. epigraph::
+
+   In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.
+
+            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate.
+
+            If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-iamcertificateid
+            '''
+            result = self._values.get("iam_certificate_id")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def minimum_protocol_version(self) -> typing.Optional[builtins.str]:
+            '''If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers.
+
+            The security policy determines two settings:
+
+            - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers.
+            - The ciphers that CloudFront can use to encrypt the content that it returns to viewers.
+
+            For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* .
+            .. epigraph::
+
+               On the CloudFront console, this setting is called *Security Policy* .
+
+            When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
+
+            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-minimumprotocolversion
+            '''
+            result = self._values.get("minimum_protocol_version")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        @builtins.property
+        def ssl_support_method(self) -> typing.Optional[builtins.str]:
+            '''.. epigraph::
+
+   In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization.
+
+            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from.
+
+            - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI.
+            - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront.
+            - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `Support Center <https://docs.aws.amazon.com/support/home>`_ .
+
+            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-sslsupportmethod
+            '''
+            result = self._values.get("ssl_support_method")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "ViewerCertificateProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.VpcOriginConfigProperty",
+        jsii_struct_bases=[],
+        name_mapping={
+            "vpc_origin_id": "vpcOriginId",
+            "origin_keepalive_timeout": "originKeepaliveTimeout",
+            "origin_read_timeout": "originReadTimeout",
+        },
+    )
+    class VpcOriginConfigProperty:
+        def __init__(
+            self,
+            *,
+            vpc_origin_id: builtins.str,
+            origin_keepalive_timeout: typing.Optional[jsii.Number] = None,
+            origin_read_timeout: typing.Optional[jsii.Number] = None,
+        ) -> None:
+            '''An Amazon CloudFront VPC origin configuration.
+
+            :param vpc_origin_id: The VPC origin ID.
+            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
+            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                vpc_origin_config_property = cloudfront.CfnDistribution.VpcOriginConfigProperty(
+                    vpc_origin_id="vpcOriginId",
+                
+                    # the properties below are optional
+                    origin_keepalive_timeout=123,
+                    origin_read_timeout=123
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__f7a2beaed61436754427d5794c11e2b8b3ecac452591d86453fc6b4321c161b0)
+                check_type(argname="argument vpc_origin_id", value=vpc_origin_id, expected_type=type_hints["vpc_origin_id"])
+                check_type(argname="argument origin_keepalive_timeout", value=origin_keepalive_timeout, expected_type=type_hints["origin_keepalive_timeout"])
+                check_type(argname="argument origin_read_timeout", value=origin_read_timeout, expected_type=type_hints["origin_read_timeout"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {
+                "vpc_origin_id": vpc_origin_id,
+            }
+            if origin_keepalive_timeout is not None:
+                self._values["origin_keepalive_timeout"] = origin_keepalive_timeout
+            if origin_read_timeout is not None:
+                self._values["origin_read_timeout"] = origin_read_timeout
+
+        @builtins.property
+        def vpc_origin_id(self) -> builtins.str:
+            '''The VPC origin ID.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-vpcoriginid
+            '''
+            result = self._values.get("vpc_origin_id")
+            assert result is not None, "Required property 'vpc_origin_id' is missing"
+            return typing.cast(builtins.str, result)
+
+        @builtins.property
+        def origin_keepalive_timeout(self) -> typing.Optional[jsii.Number]:
+            '''Specifies how long, in seconds, CloudFront persists its connection to the origin.
+
+            The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.
+
+            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :default: - 5
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originkeepalivetimeout
+            '''
+            result = self._values.get("origin_keepalive_timeout")
+            return typing.cast(typing.Optional[jsii.Number], result)
+
+        @builtins.property
+        def origin_read_timeout(self) -> typing.Optional[jsii.Number]:
+            '''Specifies how long, in seconds, CloudFront waits for a response from the origin.
+
+            This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.
+
+            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+
+            :default: - 30
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originreadtimeout
+            '''
+            result = self._values.get("origin_read_timeout")
+            return typing.cast(typing.Optional[jsii.Number], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "VpcOriginConfigProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
+
+@jsii.data_type(
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionProps",
+    jsii_struct_bases=[],
+    name_mapping={"distribution_config": "distributionConfig", "tags": "tags"},
+)
+class CfnDistributionProps:
+    def __init__(
+        self,
+        *,
+        distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ) -> None:
+        '''Properties for defining a ``CfnDistribution``.
+
+        :param distribution_config: The distribution's configuration.
+        :param tags: A complex type that contains zero or more ``Tag`` elements.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html
+        :exampleMetadata: fixture=_generated
+
+        Example::
+
+            # The code below shows an example of how to instantiate this type.
+            # The values are placeholders you should change.
+            from aws_cdk import aws_cloudfront as cloudfront
+            
+            cfn_distribution_props = cloudfront.CfnDistributionProps(
+                distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty(
+                    default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
+                        target_origin_id="targetOriginId",
+                        viewer_protocol_policy="viewerProtocolPolicy",
+            
+                        # the properties below are optional
+                        allowed_methods=["allowedMethods"],
+                        cached_methods=["cachedMethods"],
+                        cache_policy_id="cachePolicyId",
+                        compress=False,
+                        default_ttl=123,
+                        field_level_encryption_id="fieldLevelEncryptionId",
+                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
+                            query_string=False,
+            
+                            # the properties below are optional
+                            cookies=cloudfront.CfnDistribution.CookiesProperty(
+                                forward="forward",
+            
+                                # the properties below are optional
+                                whitelisted_names=["whitelistedNames"]
+                            ),
+                            headers=["headers"],
+                            query_string_cache_keys=["queryStringCacheKeys"]
+                        ),
+                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
+                            event_type="eventType",
+                            function_arn="functionArn"
+                        )],
+                        grpc_config=cloudfront.CfnDistribution.GrpcConfigProperty(
+                            enabled=False
+                        ),
+                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
+                            event_type="eventType",
+                            include_body=False,
+                            lambda_function_arn="lambdaFunctionArn"
+                        )],
+                        max_ttl=123,
+                        min_ttl=123,
+                        origin_request_policy_id="originRequestPolicyId",
+                        realtime_log_config_arn="realtimeLogConfigArn",
+                        response_headers_policy_id="responseHeadersPolicyId",
+                        smooth_streaming=False,
+                        trusted_key_groups=["trustedKeyGroups"],
+                        trusted_signers=["trustedSigners"]
+                    ),
+                    enabled=False,
+            
+                    # the properties below are optional
+                    aliases=["aliases"],
+                    anycast_ip_list_id="anycastIpListId",
+                    cache_behaviors=[cloudfront.CfnDistribution.CacheBehaviorProperty(
+                        path_pattern="pathPattern",
+                        target_origin_id="targetOriginId",
+                        viewer_protocol_policy="viewerProtocolPolicy",
+            
+                        # the properties below are optional
+                        allowed_methods=["allowedMethods"],
+                        cached_methods=["cachedMethods"],
+                        cache_policy_id="cachePolicyId",
+                        compress=False,
+                        default_ttl=123,
+                        field_level_encryption_id="fieldLevelEncryptionId",
+                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
+                            query_string=False,
+            
+                            # the properties below are optional
+                            cookies=cloudfront.CfnDistribution.CookiesProperty(
+                                forward="forward",
+            
+                                # the properties below are optional
+                                whitelisted_names=["whitelistedNames"]
+                            ),
+                            headers=["headers"],
+                            query_string_cache_keys=["queryStringCacheKeys"]
+                        ),
+                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
+                            event_type="eventType",
+                            function_arn="functionArn"
+                        )],
+                        grpc_config=cloudfront.CfnDistribution.GrpcConfigProperty(
+                            enabled=False
+                        ),
+                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
+                            event_type="eventType",
+                            include_body=False,
+                            lambda_function_arn="lambdaFunctionArn"
+                        )],
+                        max_ttl=123,
+                        min_ttl=123,
+                        origin_request_policy_id="originRequestPolicyId",
+                        realtime_log_config_arn="realtimeLogConfigArn",
+                        response_headers_policy_id="responseHeadersPolicyId",
+                        smooth_streaming=False,
+                        trusted_key_groups=["trustedKeyGroups"],
+                        trusted_signers=["trustedSigners"]
+                    )],
+                    cnam_es=["cnamEs"],
+                    comment="comment",
+                    connection_mode="connectionMode",
+                    continuous_deployment_policy_id="continuousDeploymentPolicyId",
+                    custom_error_responses=[cloudfront.CfnDistribution.CustomErrorResponseProperty(
+                        error_code=123,
+            
+                        # the properties below are optional
+                        error_caching_min_ttl=123,
+                        response_code=123,
+                        response_page_path="responsePagePath"
+                    )],
+                    custom_origin=cloudfront.CfnDistribution.LegacyCustomOriginProperty(
+                        dns_name="dnsName",
+                        origin_protocol_policy="originProtocolPolicy",
+                        origin_ssl_protocols=["originSslProtocols"],
+            
+                        # the properties below are optional
+                        http_port=123,
+                        https_port=123
+                    ),
+                    default_root_object="defaultRootObject",
+                    http_version="httpVersion",
+                    ipv6_enabled=False,
+                    logging=cloudfront.CfnDistribution.LoggingProperty(
+                        bucket="bucket",
+                        include_cookies=False,
+                        prefix="prefix"
+                    ),
+                    origin_groups=cloudfront.CfnDistribution.OriginGroupsProperty(
+                        quantity=123,
+            
+                        # the properties below are optional
+                        items=[cloudfront.CfnDistribution.OriginGroupProperty(
+                            failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
+                                status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
+                                    items=[123],
+                                    quantity=123
+                                )
+                            ),
+                            id="id",
+                            members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
+                                items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
+                                    origin_id="originId"
+                                )],
+                                quantity=123
+                            ),
+            
+                            # the properties below are optional
+                            selection_criteria="selectionCriteria"
+                        )]
+                    ),
+                    origins=[cloudfront.CfnDistribution.OriginProperty(
+                        domain_name="domainName",
+                        id="id",
+            
+                        # the properties below are optional
+                        connection_attempts=123,
+                        connection_timeout=123,
+                        custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
+                            origin_protocol_policy="originProtocolPolicy",
+            
+                            # the properties below are optional
+                            http_port=123,
+                            https_port=123,
+                            origin_keepalive_timeout=123,
+                            origin_read_timeout=123,
+                            origin_ssl_protocols=["originSslProtocols"]
+                        ),
+                        origin_access_control_id="originAccessControlId",
+                        origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
+                            header_name="headerName",
+                            header_value="headerValue"
+                        )],
+                        origin_path="originPath",
+                        origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
+                            enabled=False,
+                            origin_shield_region="originShieldRegion"
+                        ),
+                        s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
+                            origin_access_identity="originAccessIdentity"
+                        ),
+                        vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
+                            vpc_origin_id="vpcOriginId",
+            
+                            # the properties below are optional
+                            origin_keepalive_timeout=123,
+                            origin_read_timeout=123
+                        )
+                    )],
+                    price_class="priceClass",
+                    restrictions=cloudfront.CfnDistribution.RestrictionsProperty(
+                        geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
+                            restriction_type="restrictionType",
+            
+                            # the properties below are optional
+                            locations=["locations"]
+                        )
+                    ),
+                    s3_origin=cloudfront.CfnDistribution.LegacyS3OriginProperty(
+                        dns_name="dnsName",
+            
+                        # the properties below are optional
+                        origin_access_identity="originAccessIdentity"
+                    ),
+                    staging=False,
+                    tenant_config=cloudfront.CfnDistribution.TenantConfigProperty(
+                        parameter_definitions=[cloudfront.CfnDistribution.ParameterDefinitionProperty(
+                            definition=cloudfront.CfnDistribution.DefinitionProperty(
+                                string_schema=cloudfront.CfnDistribution.StringSchemaProperty(
+                                    required=False,
+            
+                                    # the properties below are optional
+                                    comment="comment",
+                                    default_value="defaultValue"
+                                )
+                            ),
+                            name="name"
+                        )]
+                    ),
+                    viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty(
+                        acm_certificate_arn="acmCertificateArn",
+                        cloud_front_default_certificate=False,
+                        iam_certificate_id="iamCertificateId",
+                        minimum_protocol_version="minimumProtocolVersion",
+                        ssl_support_method="sslSupportMethod"
+                    ),
+                    web_acl_id="webAclId"
+                ),
+            
+                # the properties below are optional
+                tags=[CfnTag(
+                    key="key",
+                    value="value"
+                )]
+            )
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__f7553d47847912fd83a61da98a84c9c8cb5fdb95cf08048d70723db17c73053a)
+            check_type(argname="argument distribution_config", value=distribution_config, expected_type=type_hints["distribution_config"])
+            check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "distribution_config": distribution_config,
+        }
+        if tags is not None:
+            self._values["tags"] = tags
+
+    @builtins.property
+    def distribution_config(
+        self,
+    ) -> typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty]:
+        '''The distribution's configuration.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-distributionconfig
+        '''
+        result = self._values.get("distribution_config")
+        assert result is not None, "Required property 'distribution_config' is missing"
+        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty], result)
+
+    @builtins.property
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''A complex type that contains zero or more ``Tag`` elements.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-tags
+        '''
+        result = self._values.get("tags")
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "CfnDistributionProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
+class CfnDistributionTenant(
+    _CfnResource_9df397a6,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant",
+):
+    '''Resource Type definition for AWS::CloudFront::DistributionTenant.
+
+    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html
+    :cloudformationResource: AWS::CloudFront::DistributionTenant
+    :exampleMetadata: fixture=_generated
+
+    Example::
+
+        # The code below shows an example of how to instantiate this type.
+        # The values are placeholders you should change.
+        from aws_cdk import aws_cloudfront as cloudfront
+        
+        cfn_distribution_tenant = cloudfront.CfnDistributionTenant(self, "MyCfnDistributionTenant",
+            distribution_id="distributionId",
+            domains=["domains"],
+            name="name",
+        
+            # the properties below are optional
+            connection_group_id="connectionGroupId",
+            customizations=cloudfront.CfnDistributionTenant.CustomizationsProperty(
+                certificate=cloudfront.CfnDistributionTenant.CertificateProperty(
+                    arn="arn"
+                ),
+                geo_restrictions=cloudfront.CfnDistributionTenant.GeoRestrictionCustomizationProperty(
+                    locations=["locations"],
+                    restriction_type="restrictionType"
+                ),
+                web_acl=cloudfront.CfnDistributionTenant.WebAclCustomizationProperty(
+                    action="action",
+                    arn="arn"
+                )
+            ),
+            enabled=False,
+            managed_certificate_request=cloudfront.CfnDistributionTenant.ManagedCertificateRequestProperty(
+                certificate_transparency_logging_preference="certificateTransparencyLoggingPreference",
+                primary_domain_name="primaryDomainName",
+                validation_token_host="validationTokenHost"
+            ),
+            parameters=[cloudfront.CfnDistributionTenant.ParameterProperty(
+                name="name",
+                value="value"
+            )],
+            tags=[CfnTag(
+                key="key",
+                value="value"
+            )]
+        )
+    '''
+
+    def __init__(
+        self,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        distribution_id: builtins.str,
+        domains: typing.Sequence[builtins.str],
+        name: builtins.str,
+        connection_group_id: typing.Optional[builtins.str] = None,
+        customizations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.CustomizationsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        managed_certificate_request: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.ManagedCertificateRequestProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.ParameterProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
+        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+    ) -> None:
+        '''
+        :param scope: Scope in which this resource is defined.
+        :param id: Construct identifier for this resource (unique in its scope).
+        :param distribution_id: The distribution's identifier. For example: ``E1U5RQF7T870K0`` .
+        :param domains: 
+        :param name: 
+        :param connection_group_id: 
+        :param customizations: 
+        :param enabled: 
+        :param managed_certificate_request: 
+        :param parameters: 
+        :param tags: A complex type that contains zero or more ``Tag`` elements.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__b31d7c64540327014853973d80c83a2f4a5686901e7f7ac7b0ace4f059413572)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = CfnDistributionTenantProps(
+            distribution_id=distribution_id,
+            domains=domains,
+            name=name,
+            connection_group_id=connection_group_id,
+            customizations=customizations,
+            enabled=enabled,
+            managed_certificate_request=managed_certificate_request,
+            parameters=parameters,
+            tags=tags,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @jsii.member(jsii_name="inspect")
+    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
+        '''Examines the CloudFormation resource and discloses attributes.
+
+        :param inspector: tree inspector to collect and process attributes.
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__57520040a3293830d92c5db58279dc6ba57c2835396f254ab1cf1fc8a732ea40)
+            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
+        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))
+
+    @jsii.member(jsii_name="renderProperties")
+    def _render_properties(
+        self,
+        props: typing.Mapping[builtins.str, typing.Any],
+    ) -> typing.Mapping[builtins.str, typing.Any]:
+        '''
+        :param props: -
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9e01bfefdb980893d11ecf908e131b3da5b94143ee485dce5ed8d1d657843e21)
+            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
+        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
+    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
+        '''The CloudFormation resource type name for this resource class.'''
+        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrArn")
+    def attr_arn(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: Arn
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrCreatedTime")
+    def attr_created_time(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: CreatedTime
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrCreatedTime"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrDomainResults")
+    def attr_domain_results(self) -> _IResolvable_da3f097b:
+        '''
+        :cloudformationAttribute: DomainResults
+        '''
+        return typing.cast(_IResolvable_da3f097b, jsii.get(self, "attrDomainResults"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrETag")
+    def attr_e_tag(self) -> builtins.str:
+        '''A complex type that contains ``Tag`` key and ``Tag`` value.
+
+        :cloudformationAttribute: ETag
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrETag"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrId")
+    def attr_id(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: Id
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrId"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrLastModifiedTime")
+    def attr_last_modified_time(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: LastModifiedTime
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))
+
+    @builtins.property
+    @jsii.member(jsii_name="attrStatus")
+    def attr_status(self) -> builtins.str:
+        '''
+        :cloudformationAttribute: Status
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "attrStatus"))
+
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
+    @builtins.property
+    @jsii.member(jsii_name="cfnProperties")
+    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
+        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))
+
+    @builtins.property
+    @jsii.member(jsii_name="distributionId")
+    def distribution_id(self) -> builtins.str:
+        '''The distribution's identifier.'''
+        return typing.cast(builtins.str, jsii.get(self, "distributionId"))
+
+    @distribution_id.setter
+    def distribution_id(self, value: builtins.str) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__01b4d19a34e50ac410f9509edd30a04265cf1cbbd17b788ad5aa7507c63f00f8)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "distributionId", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="domains")
+    def domains(self) -> typing.List[builtins.str]:
+        return typing.cast(typing.List[builtins.str], jsii.get(self, "domains"))
+
+    @domains.setter
+    def domains(self, value: typing.List[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__7e4ea73186e7ded8d4be1abca7ad4ad20e62ac773ff4030551f69552bebf4111)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "domains", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="name")
+    def name(self) -> builtins.str:
+        return typing.cast(builtins.str, jsii.get(self, "name"))
+
+    @name.setter
+    def name(self, value: builtins.str) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__21d549f43b17cc6909f030b9a70862b4d3cc9f8321d3c0808f5a34ad3a82bdac)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "name", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="connectionGroupId")
+    def connection_group_id(self) -> typing.Optional[builtins.str]:
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "connectionGroupId"))
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originaccesscontrolid
-            '''
-            result = self._values.get("origin_access_control_id")
-            return typing.cast(typing.Optional[builtins.str], result)
+    @connection_group_id.setter
+    def connection_group_id(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__260bd4d44d34feabb54c786083ced4eca1f6825ffa23ac7256d4a56686f6f06e)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "connectionGroupId", value) # pyright: ignore[reportArgumentType]
 
-        @builtins.property
-        def origin_custom_headers(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]]:
-            '''A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin.
+    @builtins.property
+    @jsii.member(jsii_name="customizations")
+    def customizations(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.CustomizationsProperty"]]:
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.CustomizationsProperty"]], jsii.get(self, "customizations"))
 
-            For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .
+    @customizations.setter
+    def customizations(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.CustomizationsProperty"]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__1ecc1c2d6ca5ed07f9220424e298d73ccc2d9ff84388993cacf60c02fc6431d2)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "customizations", value) # pyright: ignore[reportArgumentType]
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-origincustomheaders
-            '''
-            result = self._values.get("origin_custom_headers")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]], result)
+    @builtins.property
+    @jsii.member(jsii_name="enabled")
+    def enabled(
+        self,
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "enabled"))
 
-        @builtins.property
-        def origin_path(self) -> typing.Optional[builtins.str]:
-            '''An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.
+    @enabled.setter
+    def enabled(
+        self,
+        value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__4faa42cfcdbcfaf7031a5ad328e3b92614cc4b898e43367bd53e66b4edb53dd8)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "enabled", value) # pyright: ignore[reportArgumentType]
 
-            For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* .
+    @builtins.property
+    @jsii.member(jsii_name="managedCertificateRequest")
+    def managed_certificate_request(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ManagedCertificateRequestProperty"]]:
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ManagedCertificateRequestProperty"]], jsii.get(self, "managedCertificateRequest"))
 
-            :default: - ""
+    @managed_certificate_request.setter
+    def managed_certificate_request(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ManagedCertificateRequestProperty"]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__5137481a2aef0ac0e79363b8e827531e762d17f59cfa3b092f770cb0813fedc0)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "managedCertificateRequest", value) # pyright: ignore[reportArgumentType]
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originpath
-            '''
-            result = self._values.get("origin_path")
-            return typing.cast(typing.Optional[builtins.str], result)
+    @builtins.property
+    @jsii.member(jsii_name="parameters")
+    def parameters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ParameterProperty"]]]]:
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ParameterProperty"]]]], jsii.get(self, "parameters"))
 
-        @builtins.property
-        def origin_shield(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]]:
-            '''CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin.
+    @parameters.setter
+    def parameters(
+        self,
+        value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.ParameterProperty"]]]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c5ac60c7274f522196384c452007fc5b615ae79ffad1520970925978b4606156)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "parameters", value) # pyright: ignore[reportArgumentType]
 
-            For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
+    @builtins.property
+    @jsii.member(jsii_name="tags")
+    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''A complex type that contains zero or more ``Tag`` elements.'''
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "tags"))
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originshield
+    @tags.setter
+    def tags(self, value: typing.Optional[typing.List[_CfnTag_f6864754]]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__2cea18d7ff4ed5a97170964e15f6e2d6e58a5f394ede6d8f1dd4c80f19f719e2)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "tags", value) # pyright: ignore[reportArgumentType]
+
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.CertificateProperty",
+        jsii_struct_bases=[],
+        name_mapping={"arn": "arn"},
+    )
+    class CertificateProperty:
+        def __init__(self, *, arn: typing.Optional[builtins.str] = None) -> None:
             '''
-            result = self._values.get("origin_shield")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]], result)
+            :param arn: 
 
-        @builtins.property
-        def s3_origin_config(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]]:
-            '''Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting.
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-certificate.html
+            :exampleMetadata: fixture=_generated
 
-            To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.
+            Example::
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-s3originconfig
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cloudfront as cloudfront
+                
+                certificate_property = cloudfront.CfnDistributionTenant.CertificateProperty(
+                    arn="arn"
+                )
             '''
-            result = self._values.get("s3_origin_config")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]], result)
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ff0d269846a4a9f6793265a71266235fd771204d2a0ad4f09ad78055533b5c48)
+                check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if arn is not None:
+                self._values["arn"] = arn
 
         @builtins.property
-        def vpc_origin_config(
-            self,
-        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.VpcOriginConfigProperty"]]:
-            '''The VPC origin configuration.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-vpcoriginconfig
+        def arn(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("vpc_origin_config")
-            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.VpcOriginConfigProperty"]], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-certificate.html#cfn-cloudfront-distributiontenant-certificate-arn
+            '''
+            result = self._values.get("arn")
+            return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -9096,33 +11075,33 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "OriginProperty(%s)" % ", ".join(
+            return "CertificateProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginShieldProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.CustomizationsProperty",
         jsii_struct_bases=[],
         name_mapping={
-            "enabled": "enabled",
-            "origin_shield_region": "originShieldRegion",
+            "certificate": "certificate",
+            "geo_restrictions": "geoRestrictions",
+            "web_acl": "webAcl",
         },
     )
-    class OriginShieldProperty:
+    class CustomizationsProperty:
         def __init__(
             self,
             *,
-            enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
-            origin_shield_region: typing.Optional[builtins.str] = None,
+            certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.CertificateProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            geo_restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.GeoRestrictionCustomizationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            web_acl: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistributionTenant.WebAclCustomizationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
-            '''CloudFront Origin Shield.
-
-            Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
-
-            :param enabled: A flag that specifies whether Origin Shield is enabled. When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
-            :param origin_shield_region: The AWS Region for Origin Shield. Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` . When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .
+            '''
+            :param certificate: 
+            :param geo_restrictions: 
+            :param web_acl: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-customizations.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9131,46 +11110,62 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                origin_shield_property = cloudfront.CfnDistribution.OriginShieldProperty(
-                    enabled=False,
-                    origin_shield_region="originShieldRegion"
+                customizations_property = cloudfront.CfnDistributionTenant.CustomizationsProperty(
+                    certificate=cloudfront.CfnDistributionTenant.CertificateProperty(
+                        arn="arn"
+                    ),
+                    geo_restrictions=cloudfront.CfnDistributionTenant.GeoRestrictionCustomizationProperty(
+                        locations=["locations"],
+                        restriction_type="restrictionType"
+                    ),
+                    web_acl=cloudfront.CfnDistributionTenant.WebAclCustomizationProperty(
+                        action="action",
+                        arn="arn"
+                    )
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__d2a25e92d5905a4c19d3636ff8b631afa34a538497a13fa9d29e56ca404539e4)
-                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
-                check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
+                type_hints = typing.get_type_hints(_typecheckingstub__0491da142c813dc4673791039712e33ce224f81450f91a62e3bae808ffa535c1)
+                check_type(argname="argument certificate", value=certificate, expected_type=type_hints["certificate"])
+                check_type(argname="argument geo_restrictions", value=geo_restrictions, expected_type=type_hints["geo_restrictions"])
+                check_type(argname="argument web_acl", value=web_acl, expected_type=type_hints["web_acl"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
-            if enabled is not None:
-                self._values["enabled"] = enabled
-            if origin_shield_region is not None:
-                self._values["origin_shield_region"] = origin_shield_region
+            if certificate is not None:
+                self._values["certificate"] = certificate
+            if geo_restrictions is not None:
+                self._values["geo_restrictions"] = geo_restrictions
+            if web_acl is not None:
+                self._values["web_acl"] = web_acl
 
         @builtins.property
-        def enabled(
+        def certificate(
             self,
-        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''A flag that specifies whether Origin Shield is enabled.
-
-            When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-enabled
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.CertificateProperty"]]:
             '''
-            result = self._values.get("enabled")
-            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-customizations.html#cfn-cloudfront-distributiontenant-customizations-certificate
+            '''
+            result = self._values.get("certificate")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.CertificateProperty"]], result)
 
         @builtins.property
-        def origin_shield_region(self) -> typing.Optional[builtins.str]:
-            '''The AWS Region for Origin Shield.
-
-            Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` .
-
-            When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .
+        def geo_restrictions(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.GeoRestrictionCustomizationProperty"]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-customizations.html#cfn-cloudfront-distributiontenant-customizations-georestrictions
+            '''
+            result = self._values.get("geo_restrictions")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.GeoRestrictionCustomizationProperty"]], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-originshieldregion
+        @builtins.property
+        def web_acl(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.WebAclCustomizationProperty"]]:
             '''
-            result = self._values.get("origin_shield_region")
-            return typing.cast(typing.Optional[builtins.str], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-customizations.html#cfn-cloudfront-distributiontenant-customizations-webacl
+            '''
+            result = self._values.get("web_acl")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistributionTenant.WebAclCustomizationProperty"]], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -9179,26 +11174,29 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "OriginShieldProperty(%s)" % ", ".join(
+            return "CustomizationsProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.RestrictionsProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.DomainResultProperty",
         jsii_struct_bases=[],
-        name_mapping={"geo_restriction": "geoRestriction"},
+        name_mapping={"domain": "domain", "reason": "reason", "status": "status"},
     )
-    class RestrictionsProperty:
+    class DomainResultProperty:
         def __init__(
             self,
             *,
-            geo_restriction: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.GeoRestrictionProperty", typing.Dict[builtins.str, typing.Any]]],
+            domain: typing.Optional[builtins.str] = None,
+            reason: typing.Optional[builtins.str] = None,
+            status: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A complex type that identifies ways in which you want to restrict distribution of your content.
-
-            :param geo_restriction: A complex type that controls the countries in which your content is distributed. CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.
+            '''
+            :param domain: 
+            :param reason: 
+            :param status: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-domainresult.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9207,35 +11205,48 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                restrictions_property = cloudfront.CfnDistribution.RestrictionsProperty(
-                    geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
-                        restriction_type="restrictionType",
-                
-                        # the properties below are optional
-                        locations=["locations"]
-                    )
+                domain_result_property = cloudfront.CfnDistributionTenant.DomainResultProperty(
+                    domain="domain",
+                    reason="reason",
+                    status="status"
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa9638220c0d)
-                check_type(argname="argument geo_restriction", value=geo_restriction, expected_type=type_hints["geo_restriction"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "geo_restriction": geo_restriction,
-            }
+                type_hints = typing.get_type_hints(_typecheckingstub__d24d49d6e44d4deb653a24465ec61e7862ea07d5a5cdc7f3cfa829da2181be64)
+                check_type(argname="argument domain", value=domain, expected_type=type_hints["domain"])
+                check_type(argname="argument reason", value=reason, expected_type=type_hints["reason"])
+                check_type(argname="argument status", value=status, expected_type=type_hints["status"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if domain is not None:
+                self._values["domain"] = domain
+            if reason is not None:
+                self._values["reason"] = reason
+            if status is not None:
+                self._values["status"] = status
 
         @builtins.property
-        def geo_restriction(
-            self,
-        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"]:
-            '''A complex type that controls the countries in which your content is distributed.
+        def domain(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-domainresult.html#cfn-cloudfront-distributiontenant-domainresult-domain
+            '''
+            result = self._values.get("domain")
+            return typing.cast(typing.Optional[builtins.str], result)
 
-            CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.
+        @builtins.property
+        def reason(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-domainresult.html#cfn-cloudfront-distributiontenant-domainresult-reason
+            '''
+            result = self._values.get("reason")
+            return typing.cast(typing.Optional[builtins.str], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html#cfn-cloudfront-distribution-restrictions-georestriction
+        @builtins.property
+        def status(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("geo_restriction")
-            assert result is not None, "Required property 'geo_restriction' is missing"
-            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-domainresult.html#cfn-cloudfront-distributiontenant-domainresult-status
+            '''
+            result = self._values.get("status")
+            return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -9244,28 +11255,27 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "RestrictionsProperty(%s)" % ", ".join(
+            return "DomainResultProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.S3OriginConfigProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.GeoRestrictionCustomizationProperty",
         jsii_struct_bases=[],
-        name_mapping={"origin_access_identity": "originAccessIdentity"},
+        name_mapping={"locations": "locations", "restriction_type": "restrictionType"},
     )
-    class S3OriginConfigProperty:
+    class GeoRestrictionCustomizationProperty:
         def __init__(
             self,
             *,
-            origin_access_identity: typing.Optional[builtins.str] = None,
+            locations: typing.Optional[typing.Sequence[builtins.str]] = None,
+            restriction_type: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A complex type that contains information about the Amazon S3 origin.
-
-            If the origin is a custom origin or an S3 bucket that is configured as a website endpoint, use the ``CustomOriginConfig`` element instead.
-
-            :param origin_access_identity: .. epigraph:: If you're using origin access control (OAC) instead of origin access identity, specify an empty ``OriginAccessIdentity`` element. For more information, see `Restricting access to an AWS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* . The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is: ``origin-access-identity/cloudfront/ID-of-origin-access-identity`` The ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity. If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element. To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element. To replace the origin access identity, update the distribution configuration and specify the new origin access identity. For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
+            '''
+            :param locations: 
+            :param restriction_type: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-georestrictioncustomization.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9274,44 +11284,35 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                s3_origin_config_property = cloudfront.CfnDistribution.S3OriginConfigProperty(
-                    origin_access_identity="originAccessIdentity"
+                geo_restriction_customization_property = cloudfront.CfnDistributionTenant.GeoRestrictionCustomizationProperty(
+                    locations=["locations"],
+                    restriction_type="restrictionType"
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7)
-                check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
+                type_hints = typing.get_type_hints(_typecheckingstub__b12cc1d8db14a6223b67c5f9254d5e808563dc8b6065256b09f01459db825b10)
+                check_type(argname="argument locations", value=locations, expected_type=type_hints["locations"])
+                check_type(argname="argument restriction_type", value=restriction_type, expected_type=type_hints["restriction_type"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
-            if origin_access_identity is not None:
-                self._values["origin_access_identity"] = origin_access_identity
+            if locations is not None:
+                self._values["locations"] = locations
+            if restriction_type is not None:
+                self._values["restriction_type"] = restriction_type
 
         @builtins.property
-        def origin_access_identity(self) -> typing.Optional[builtins.str]:
-            '''.. epigraph::
-
-   If you're using origin access control (OAC) instead of origin access identity, specify an empty ``OriginAccessIdentity`` element.
-
-            For more information, see `Restricting access to an AWS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* .
-
-            The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is:
-
-            ``origin-access-identity/cloudfront/ID-of-origin-access-identity``
-
-            The ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity.
-
-            If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element.
-
-            To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element.
-
-            To replace the origin access identity, update the distribution configuration and specify the new origin access identity.
-
-            For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .
-
-            :default: - ""
+        def locations(self) -> typing.Optional[typing.List[builtins.str]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-georestrictioncustomization.html#cfn-cloudfront-distributiontenant-georestrictioncustomization-locations
+            '''
+            result = self._values.get("locations")
+            return typing.cast(typing.Optional[typing.List[builtins.str]], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html#cfn-cloudfront-distribution-s3originconfig-originaccessidentity
+        @builtins.property
+        def restriction_type(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("origin_access_identity")
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-georestrictioncustomization.html#cfn-cloudfront-distributiontenant-georestrictioncustomization-restrictiontype
+            '''
+            result = self._values.get("restriction_type")
             return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
@@ -9321,28 +11322,33 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "S3OriginConfigProperty(%s)" % ", ".join(
+            return "GeoRestrictionCustomizationProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.StatusCodesProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.ManagedCertificateRequestProperty",
         jsii_struct_bases=[],
-        name_mapping={"items": "items", "quantity": "quantity"},
+        name_mapping={
+            "certificate_transparency_logging_preference": "certificateTransparencyLoggingPreference",
+            "primary_domain_name": "primaryDomainName",
+            "validation_token_host": "validationTokenHost",
+        },
     )
-    class StatusCodesProperty:
+    class ManagedCertificateRequestProperty:
         def __init__(
             self,
             *,
-            items: typing.Union[typing.Sequence[jsii.Number], _IResolvable_da3f097b],
-            quantity: jsii.Number,
+            certificate_transparency_logging_preference: typing.Optional[builtins.str] = None,
+            primary_domain_name: typing.Optional[builtins.str] = None,
+            validation_token_host: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A complex data type for the status codes that you specify that, when returned by a primary origin, trigger CloudFront to failover to a second origin.
-
-            :param items: The items (status codes) for an origin group.
-            :param quantity: The number of status codes.
+            '''
+            :param certificate_transparency_logging_preference: 
+            :param primary_domain_name: 
+            :param validation_token_host: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-managedcertificaterequest.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9351,41 +11357,50 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                status_codes_property = cloudfront.CfnDistribution.StatusCodesProperty(
-                    items=[123],
-                    quantity=123
+                managed_certificate_request_property = cloudfront.CfnDistributionTenant.ManagedCertificateRequestProperty(
+                    certificate_transparency_logging_preference="certificateTransparencyLoggingPreference",
+                    primary_domain_name="primaryDomainName",
+                    validation_token_host="validationTokenHost"
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__7b8b62ce6bf1ec6151566719caf2d665f3f7fea596e402fba7354f19f781f23c)
-                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
-                check_type(argname="argument quantity", value=quantity, expected_type=type_hints["quantity"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "items": items,
-                "quantity": quantity,
-            }
+                type_hints = typing.get_type_hints(_typecheckingstub__bd3055b78628b26ba1bcd38e78722682f53f911f50dd7e46fce1153242ca9358)
+                check_type(argname="argument certificate_transparency_logging_preference", value=certificate_transparency_logging_preference, expected_type=type_hints["certificate_transparency_logging_preference"])
+                check_type(argname="argument primary_domain_name", value=primary_domain_name, expected_type=type_hints["primary_domain_name"])
+                check_type(argname="argument validation_token_host", value=validation_token_host, expected_type=type_hints["validation_token_host"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if certificate_transparency_logging_preference is not None:
+                self._values["certificate_transparency_logging_preference"] = certificate_transparency_logging_preference
+            if primary_domain_name is not None:
+                self._values["primary_domain_name"] = primary_domain_name
+            if validation_token_host is not None:
+                self._values["validation_token_host"] = validation_token_host
 
         @builtins.property
-        def items(
+        def certificate_transparency_logging_preference(
             self,
-        ) -> typing.Union[typing.List[jsii.Number], _IResolvable_da3f097b]:
-            '''The items (status codes) for an origin group.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-items
+        ) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("items")
-            assert result is not None, "Required property 'items' is missing"
-            return typing.cast(typing.Union[typing.List[jsii.Number], _IResolvable_da3f097b], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-managedcertificaterequest.html#cfn-cloudfront-distributiontenant-managedcertificaterequest-certificatetransparencyloggingpreference
+            '''
+            result = self._values.get("certificate_transparency_logging_preference")
+            return typing.cast(typing.Optional[builtins.str], result)
 
         @builtins.property
-        def quantity(self) -> jsii.Number:
-            '''The number of status codes.
+        def primary_domain_name(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-managedcertificaterequest.html#cfn-cloudfront-distributiontenant-managedcertificaterequest-primarydomainname
+            '''
+            result = self._values.get("primary_domain_name")
+            return typing.cast(typing.Optional[builtins.str], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-quantity
+        @builtins.property
+        def validation_token_host(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("quantity")
-            assert result is not None, "Required property 'quantity' is missing"
-            return typing.cast(jsii.Number, result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-managedcertificaterequest.html#cfn-cloudfront-distributiontenant-managedcertificaterequest-validationtokenhost
+            '''
+            result = self._values.get("validation_token_host")
+            return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -9394,56 +11409,27 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "StatusCodesProperty(%s)" % ", ".join(
+            return "ManagedCertificateRequestProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.ViewerCertificateProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.ParameterProperty",
         jsii_struct_bases=[],
-        name_mapping={
-            "acm_certificate_arn": "acmCertificateArn",
-            "cloud_front_default_certificate": "cloudFrontDefaultCertificate",
-            "iam_certificate_id": "iamCertificateId",
-            "minimum_protocol_version": "minimumProtocolVersion",
-            "ssl_support_method": "sslSupportMethod",
-        },
+        name_mapping={"name": "name", "value": "value"},
     )
-    class ViewerCertificateProperty:
+    class ParameterProperty:
         def __init__(
             self,
             *,
-            acm_certificate_arn: typing.Optional[builtins.str] = None,
-            cloud_front_default_certificate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
-            iam_certificate_id: typing.Optional[builtins.str] = None,
-            minimum_protocol_version: typing.Optional[builtins.str] = None,
-            ssl_support_method: typing.Optional[builtins.str] = None,
+            name: typing.Optional[builtins.str] = None,
+            value: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.
-
-            If the distribution doesn't use ``Aliases`` (also known as alternate domain names or CNAMEs)—that is, if the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` —set ``CloudFrontDefaultCertificate`` to ``true`` and leave all other fields empty.
-
-            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), use the fields in this type to specify the following settings:
-
-            - Which viewers the distribution accepts HTTPS connections from: only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ (recommended), or all viewers including those that don't support SNI.
-            - To accept HTTPS connections from only viewers that support SNI, set ``SSLSupportMethod`` to ``sni-only`` . This is recommended. Most browsers and clients support SNI. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-            - To accept HTTPS connections from all viewers, including those that don't support SNI, set ``SSLSupportMethod`` to ``vip`` . This is not recommended, and results in additional monthly charges from CloudFront. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-            - The minimum SSL/TLS protocol version that the distribution can use to communicate with viewers. To specify a minimum version, choose a value for ``MinimumProtocolVersion`` . For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ in the *Amazon CloudFront Developer Guide* .
-            - The location of the SSL/TLS certificate, `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ (recommended) or `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ . You specify the location by setting a value in one of the following fields (not both):
-            - ``ACMCertificateArn`` (In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.)
-            - ``IAMCertificateId`` (In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.)
-
-            All distributions support HTTPS connections from viewers. To require viewers to use HTTPS only, or to redirect them from HTTP to HTTPS, use ``ViewerProtocolPolicy`` in the ``CacheBehavior`` or ``DefaultCacheBehavior`` . To specify how CloudFront should use SSL/TLS to communicate with your custom origin, use ``CustomOriginConfig`` .
-
-            For more information, see `Using HTTPS with CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html>`_ and `Using Alternate Domain Names and HTTPS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html>`_ in the *Amazon CloudFront Developer Guide* .
-
-            :param acm_certificate_arn: .. epigraph:: In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ). If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-            :param cloud_front_default_certificate: If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` . If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields: - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both) - ``MinimumProtocolVersion`` - ``SslSupportMethod``
-            :param iam_certificate_id: .. epigraph:: In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate. If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-            :param minimum_protocol_version: If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers. The security policy determines two settings: - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers. - The ciphers that CloudFront can use to encrypt the content that it returns to viewers. For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* . .. epigraph:: On the CloudFront console, this setting is called *Security Policy* . When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.) If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.
-            :param ssl_support_method: .. epigraph:: In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from. - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI. - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront. - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `Support Center <https://docs.aws.amazon.com/support/home>`_ . If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.
+            '''
+            :param name: 
+            :param value: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-parameter.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9452,120 +11438,35 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                viewer_certificate_property = cloudfront.CfnDistribution.ViewerCertificateProperty(
-                    acm_certificate_arn="acmCertificateArn",
-                    cloud_front_default_certificate=False,
-                    iam_certificate_id="iamCertificateId",
-                    minimum_protocol_version="minimumProtocolVersion",
-                    ssl_support_method="sslSupportMethod"
+                parameter_property = cloudfront.CfnDistributionTenant.ParameterProperty(
+                    name="name",
+                    value="value"
                 )
             '''
             if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__511560286b35778c69f3d2a23120607f1ab2e58901f0c1ba7acd75a338eb699e)
-                check_type(argname="argument acm_certificate_arn", value=acm_certificate_arn, expected_type=type_hints["acm_certificate_arn"])
-                check_type(argname="argument cloud_front_default_certificate", value=cloud_front_default_certificate, expected_type=type_hints["cloud_front_default_certificate"])
-                check_type(argname="argument iam_certificate_id", value=iam_certificate_id, expected_type=type_hints["iam_certificate_id"])
-                check_type(argname="argument minimum_protocol_version", value=minimum_protocol_version, expected_type=type_hints["minimum_protocol_version"])
-                check_type(argname="argument ssl_support_method", value=ssl_support_method, expected_type=type_hints["ssl_support_method"])
+                type_hints = typing.get_type_hints(_typecheckingstub__153cd98fd3544f143cb0059bfc0c01069aa936e548aae6596f575cebfb894add)
+                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
-            if acm_certificate_arn is not None:
-                self._values["acm_certificate_arn"] = acm_certificate_arn
-            if cloud_front_default_certificate is not None:
-                self._values["cloud_front_default_certificate"] = cloud_front_default_certificate
-            if iam_certificate_id is not None:
-                self._values["iam_certificate_id"] = iam_certificate_id
-            if minimum_protocol_version is not None:
-                self._values["minimum_protocol_version"] = minimum_protocol_version
-            if ssl_support_method is not None:
-                self._values["ssl_support_method"] = ssl_support_method
-
-        @builtins.property
-        def acm_certificate_arn(self) -> typing.Optional[builtins.str]:
-            '''.. epigraph::
-
-   In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.
-
-            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ).
-
-            If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-acmcertificatearn
-            '''
-            result = self._values.get("acm_certificate_arn")
-            return typing.cast(typing.Optional[builtins.str], result)
+            if name is not None:
+                self._values["name"] = name
+            if value is not None:
+                self._values["value"] = value
 
         @builtins.property
-        def cloud_front_default_certificate(
-            self,
-        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
-            '''If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` .
-
-            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields:
-
-            - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both)
-            - ``MinimumProtocolVersion``
-            - ``SslSupportMethod``
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-cloudfrontdefaultcertificate
+        def name(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("cloud_front_default_certificate")
-            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
-
-        @builtins.property
-        def iam_certificate_id(self) -> typing.Optional[builtins.str]:
-            '''.. epigraph::
-
-   In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.
-
-            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate.
-
-            If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-iamcertificateid
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-parameter.html#cfn-cloudfront-distributiontenant-parameter-name
             '''
-            result = self._values.get("iam_certificate_id")
+            result = self._values.get("name")
             return typing.cast(typing.Optional[builtins.str], result)
 
         @builtins.property
-        def minimum_protocol_version(self) -> typing.Optional[builtins.str]:
-            '''If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers.
-
-            The security policy determines two settings:
-
-            - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers.
-            - The ciphers that CloudFront can use to encrypt the content that it returns to viewers.
-
-            For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* .
-            .. epigraph::
-
-               On the CloudFront console, this setting is called *Security Policy* .
-
-            When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
-
-            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-minimumprotocolversion
+        def value(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("minimum_protocol_version")
-            return typing.cast(typing.Optional[builtins.str], result)
-
-        @builtins.property
-        def ssl_support_method(self) -> typing.Optional[builtins.str]:
-            '''.. epigraph::
-
-   In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization.
-
-            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from.
-
-            - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI.
-            - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront.
-            - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `Support Center <https://docs.aws.amazon.com/support/home>`_ .
-
-            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-sslsupportmethod
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-parameter.html#cfn-cloudfront-distributiontenant-parameter-value
             '''
-            result = self._values.get("ssl_support_method")
+            result = self._values.get("value")
             return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
@@ -9575,34 +11476,27 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "ViewerCertificateProperty(%s)" % ", ".join(
+            return "ParameterProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
     @jsii.data_type(
-        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.VpcOriginConfigProperty",
+        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenant.WebAclCustomizationProperty",
         jsii_struct_bases=[],
-        name_mapping={
-            "vpc_origin_id": "vpcOriginId",
-            "origin_keepalive_timeout": "originKeepaliveTimeout",
-            "origin_read_timeout": "originReadTimeout",
-        },
+        name_mapping={"action": "action", "arn": "arn"},
     )
-    class VpcOriginConfigProperty:
+    class WebAclCustomizationProperty:
         def __init__(
             self,
             *,
-            vpc_origin_id: builtins.str,
-            origin_keepalive_timeout: typing.Optional[jsii.Number] = None,
-            origin_read_timeout: typing.Optional[jsii.Number] = None,
+            action: typing.Optional[builtins.str] = None,
+            arn: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''An Amazon CloudFront VPC origin configuration.
-
-            :param vpc_origin_id: The VPC origin ID.
-            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
-            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
+            '''
+            :param action: 
+            :param arn: 
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-webaclcustomization.html
             :exampleMetadata: fixture=_generated
 
             Example::
@@ -9611,66 +11505,36 @@ class CfnDistribution(
                 # The values are placeholders you should change.
                 from aws_cdk import aws_cloudfront as cloudfront
                 
-                vpc_origin_config_property = cloudfront.CfnDistribution.VpcOriginConfigProperty(
-                    vpc_origin_id="vpcOriginId",
-                
-                    # the properties below are optional
-                    origin_keepalive_timeout=123,
-                    origin_read_timeout=123
+                web_acl_customization_property = cloudfront.CfnDistributionTenant.WebAclCustomizationProperty(
+                    action="action",
+                    arn="arn"
                 )
             '''
-            if __debug__:
-                type_hints = typing.get_type_hints(_typecheckingstub__f7a2beaed61436754427d5794c11e2b8b3ecac452591d86453fc6b4321c161b0)
-                check_type(argname="argument vpc_origin_id", value=vpc_origin_id, expected_type=type_hints["vpc_origin_id"])
-                check_type(argname="argument origin_keepalive_timeout", value=origin_keepalive_timeout, expected_type=type_hints["origin_keepalive_timeout"])
-                check_type(argname="argument origin_read_timeout", value=origin_read_timeout, expected_type=type_hints["origin_read_timeout"])
-            self._values: typing.Dict[builtins.str, typing.Any] = {
-                "vpc_origin_id": vpc_origin_id,
-            }
-            if origin_keepalive_timeout is not None:
-                self._values["origin_keepalive_timeout"] = origin_keepalive_timeout
-            if origin_read_timeout is not None:
-                self._values["origin_read_timeout"] = origin_read_timeout
-
-        @builtins.property
-        def vpc_origin_id(self) -> builtins.str:
-            '''The VPC origin ID.
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-vpcoriginid
-            '''
-            result = self._values.get("vpc_origin_id")
-            assert result is not None, "Required property 'vpc_origin_id' is missing"
-            return typing.cast(builtins.str, result)
-
-        @builtins.property
-        def origin_keepalive_timeout(self) -> typing.Optional[jsii.Number]:
-            '''Specifies how long, in seconds, CloudFront persists its connection to the origin.
-
-            The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.
-
-            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
-
-            :default: - 5
-
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originkeepalivetimeout
-            '''
-            result = self._values.get("origin_keepalive_timeout")
-            return typing.cast(typing.Optional[jsii.Number], result)
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__1146c72709bb4672e62f556fac241f6dc79c09223c1e3a1863d70512f623c799)
+                check_type(argname="argument action", value=action, expected_type=type_hints["action"])
+                check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if action is not None:
+                self._values["action"] = action
+            if arn is not None:
+                self._values["arn"] = arn
 
         @builtins.property
-        def origin_read_timeout(self) -> typing.Optional[jsii.Number]:
-            '''Specifies how long, in seconds, CloudFront waits for a response from the origin.
-
-            This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.
-
-            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
-
-            :default: - 30
+        def action(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-webaclcustomization.html#cfn-cloudfront-distributiontenant-webaclcustomization-action
+            '''
+            result = self._values.get("action")
+            return typing.cast(typing.Optional[builtins.str], result)
 
-            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html#cfn-cloudfront-distribution-vpcoriginconfig-originreadtimeout
+        @builtins.property
+        def arn(self) -> typing.Optional[builtins.str]:
             '''
-            result = self._values.get("origin_read_timeout")
-            return typing.cast(typing.Optional[jsii.Number], result)
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distributiontenant-webaclcustomization.html#cfn-cloudfront-distributiontenant-webaclcustomization-arn
+            '''
+            result = self._values.get("arn")
+            return typing.cast(typing.Optional[builtins.str], result)
 
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
@@ -9679,29 +11543,53 @@ class CfnDistribution(
             return not (rhs == self)
 
         def __repr__(self) -> str:
-            return "VpcOriginConfigProperty(%s)" % ", ".join(
+            return "WebAclCustomizationProperty(%s)" % ", ".join(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
 
 @jsii.data_type(
-    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionProps",
+    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionTenantProps",
     jsii_struct_bases=[],
-    name_mapping={"distribution_config": "distributionConfig", "tags": "tags"},
+    name_mapping={
+        "distribution_id": "distributionId",
+        "domains": "domains",
+        "name": "name",
+        "connection_group_id": "connectionGroupId",
+        "customizations": "customizations",
+        "enabled": "enabled",
+        "managed_certificate_request": "managedCertificateRequest",
+        "parameters": "parameters",
+        "tags": "tags",
+    },
 )
-class CfnDistributionProps:
+class CfnDistributionTenantProps:
     def __init__(
         self,
         *,
-        distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
+        distribution_id: builtins.str,
+        domains: typing.Sequence[builtins.str],
+        name: builtins.str,
+        connection_group_id: typing.Optional[builtins.str] = None,
+        customizations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.CustomizationsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+        enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        managed_certificate_request: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ManagedCertificateRequestProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+        parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ParameterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     ) -> None:
-        '''Properties for defining a ``CfnDistribution``.
-
-        :param distribution_config: The distribution's configuration.
+        '''Properties for defining a ``CfnDistributionTenant``.
+
+        :param distribution_id: The distribution's identifier. For example: ``E1U5RQF7T870K0`` .
+        :param domains: 
+        :param name: 
+        :param connection_group_id: 
+        :param customizations: 
+        :param enabled: 
+        :param managed_certificate_request: 
+        :param parameters: 
         :param tags: A complex type that contains zero or more ``Tag`` elements.
 
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html
         :exampleMetadata: fixture=_generated
 
         Example::
@@ -9710,220 +11598,36 @@ class CfnDistributionProps:
             # The values are placeholders you should change.
             from aws_cdk import aws_cloudfront as cloudfront
             
-            cfn_distribution_props = cloudfront.CfnDistributionProps(
-                distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty(
-                    default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
-                        target_origin_id="targetOriginId",
-                        viewer_protocol_policy="viewerProtocolPolicy",
-            
-                        # the properties below are optional
-                        allowed_methods=["allowedMethods"],
-                        cached_methods=["cachedMethods"],
-                        cache_policy_id="cachePolicyId",
-                        compress=False,
-                        default_ttl=123,
-                        field_level_encryption_id="fieldLevelEncryptionId",
-                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
-                            query_string=False,
-            
-                            # the properties below are optional
-                            cookies=cloudfront.CfnDistribution.CookiesProperty(
-                                forward="forward",
-            
-                                # the properties below are optional
-                                whitelisted_names=["whitelistedNames"]
-                            ),
-                            headers=["headers"],
-                            query_string_cache_keys=["queryStringCacheKeys"]
-                        ),
-                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
-                            event_type="eventType",
-                            function_arn="functionArn"
-                        )],
-                        grpc_config=cloudfront.CfnDistribution.GrpcConfigProperty(
-                            enabled=False
-                        ),
-                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
-                            event_type="eventType",
-                            include_body=False,
-                            lambda_function_arn="lambdaFunctionArn"
-                        )],
-                        max_ttl=123,
-                        min_ttl=123,
-                        origin_request_policy_id="originRequestPolicyId",
-                        realtime_log_config_arn="realtimeLogConfigArn",
-                        response_headers_policy_id="responseHeadersPolicyId",
-                        smooth_streaming=False,
-                        trusted_key_groups=["trustedKeyGroups"],
-                        trusted_signers=["trustedSigners"]
-                    ),
-                    enabled=False,
-            
-                    # the properties below are optional
-                    aliases=["aliases"],
-                    anycast_ip_list_id="anycastIpListId",
-                    cache_behaviors=[cloudfront.CfnDistribution.CacheBehaviorProperty(
-                        path_pattern="pathPattern",
-                        target_origin_id="targetOriginId",
-                        viewer_protocol_policy="viewerProtocolPolicy",
-            
-                        # the properties below are optional
-                        allowed_methods=["allowedMethods"],
-                        cached_methods=["cachedMethods"],
-                        cache_policy_id="cachePolicyId",
-                        compress=False,
-                        default_ttl=123,
-                        field_level_encryption_id="fieldLevelEncryptionId",
-                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
-                            query_string=False,
-            
-                            # the properties below are optional
-                            cookies=cloudfront.CfnDistribution.CookiesProperty(
-                                forward="forward",
-            
-                                # the properties below are optional
-                                whitelisted_names=["whitelistedNames"]
-                            ),
-                            headers=["headers"],
-                            query_string_cache_keys=["queryStringCacheKeys"]
-                        ),
-                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
-                            event_type="eventType",
-                            function_arn="functionArn"
-                        )],
-                        grpc_config=cloudfront.CfnDistribution.GrpcConfigProperty(
-                            enabled=False
-                        ),
-                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
-                            event_type="eventType",
-                            include_body=False,
-                            lambda_function_arn="lambdaFunctionArn"
-                        )],
-                        max_ttl=123,
-                        min_ttl=123,
-                        origin_request_policy_id="originRequestPolicyId",
-                        realtime_log_config_arn="realtimeLogConfigArn",
-                        response_headers_policy_id="responseHeadersPolicyId",
-                        smooth_streaming=False,
-                        trusted_key_groups=["trustedKeyGroups"],
-                        trusted_signers=["trustedSigners"]
-                    )],
-                    cnam_es=["cnamEs"],
-                    comment="comment",
-                    continuous_deployment_policy_id="continuousDeploymentPolicyId",
-                    custom_error_responses=[cloudfront.CfnDistribution.CustomErrorResponseProperty(
-                        error_code=123,
-            
-                        # the properties below are optional
-                        error_caching_min_ttl=123,
-                        response_code=123,
-                        response_page_path="responsePagePath"
-                    )],
-                    custom_origin=cloudfront.CfnDistribution.LegacyCustomOriginProperty(
-                        dns_name="dnsName",
-                        origin_protocol_policy="originProtocolPolicy",
-                        origin_ssl_protocols=["originSslProtocols"],
-            
-                        # the properties below are optional
-                        http_port=123,
-                        https_port=123
-                    ),
-                    default_root_object="defaultRootObject",
-                    http_version="httpVersion",
-                    ipv6_enabled=False,
-                    logging=cloudfront.CfnDistribution.LoggingProperty(
-                        bucket="bucket",
-                        include_cookies=False,
-                        prefix="prefix"
-                    ),
-                    origin_groups=cloudfront.CfnDistribution.OriginGroupsProperty(
-                        quantity=123,
-            
-                        # the properties below are optional
-                        items=[cloudfront.CfnDistribution.OriginGroupProperty(
-                            failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
-                                status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
-                                    items=[123],
-                                    quantity=123
-                                )
-                            ),
-                            id="id",
-                            members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
-                                items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
-                                    origin_id="originId"
-                                )],
-                                quantity=123
-                            ),
-            
-                            # the properties below are optional
-                            selection_criteria="selectionCriteria"
-                        )]
-                    ),
-                    origins=[cloudfront.CfnDistribution.OriginProperty(
-                        domain_name="domainName",
-                        id="id",
-            
-                        # the properties below are optional
-                        connection_attempts=123,
-                        connection_timeout=123,
-                        custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
-                            origin_protocol_policy="originProtocolPolicy",
-            
-                            # the properties below are optional
-                            http_port=123,
-                            https_port=123,
-                            origin_keepalive_timeout=123,
-                            origin_read_timeout=123,
-                            origin_ssl_protocols=["originSslProtocols"]
-                        ),
-                        origin_access_control_id="originAccessControlId",
-                        origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
-                            header_name="headerName",
-                            header_value="headerValue"
-                        )],
-                        origin_path="originPath",
-                        origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
-                            enabled=False,
-                            origin_shield_region="originShieldRegion"
-                        ),
-                        s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
-                            origin_access_identity="originAccessIdentity"
-                        ),
-                        vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
-                            vpc_origin_id="vpcOriginId",
-            
-                            # the properties below are optional
-                            origin_keepalive_timeout=123,
-                            origin_read_timeout=123
-                        )
-                    )],
-                    price_class="priceClass",
-                    restrictions=cloudfront.CfnDistribution.RestrictionsProperty(
-                        geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
-                            restriction_type="restrictionType",
-            
-                            # the properties below are optional
-                            locations=["locations"]
-                        )
-                    ),
-                    s3_origin=cloudfront.CfnDistribution.LegacyS3OriginProperty(
-                        dns_name="dnsName",
+            cfn_distribution_tenant_props = cloudfront.CfnDistributionTenantProps(
+                distribution_id="distributionId",
+                domains=["domains"],
+                name="name",
             
-                        # the properties below are optional
-                        origin_access_identity="originAccessIdentity"
+                # the properties below are optional
+                connection_group_id="connectionGroupId",
+                customizations=cloudfront.CfnDistributionTenant.CustomizationsProperty(
+                    certificate=cloudfront.CfnDistributionTenant.CertificateProperty(
+                        arn="arn"
                     ),
-                    staging=False,
-                    viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty(
-                        acm_certificate_arn="acmCertificateArn",
-                        cloud_front_default_certificate=False,
-                        iam_certificate_id="iamCertificateId",
-                        minimum_protocol_version="minimumProtocolVersion",
-                        ssl_support_method="sslSupportMethod"
+                    geo_restrictions=cloudfront.CfnDistributionTenant.GeoRestrictionCustomizationProperty(
+                        locations=["locations"],
+                        restriction_type="restrictionType"
                     ),
-                    web_acl_id="webAclId"
+                    web_acl=cloudfront.CfnDistributionTenant.WebAclCustomizationProperty(
+                        action="action",
+                        arn="arn"
+                    )
                 ),
-            
-                # the properties below are optional
+                enabled=False,
+                managed_certificate_request=cloudfront.CfnDistributionTenant.ManagedCertificateRequestProperty(
+                    certificate_transparency_logging_preference="certificateTransparencyLoggingPreference",
+                    primary_domain_name="primaryDomainName",
+                    validation_token_host="validationTokenHost"
+                ),
+                parameters=[cloudfront.CfnDistributionTenant.ParameterProperty(
+                    name="name",
+                    value="value"
+                )],
                 tags=[CfnTag(
                     key="key",
                     value="value"
@@ -9931,32 +11635,117 @@ class CfnDistributionProps:
             )
         '''
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__f7553d47847912fd83a61da98a84c9c8cb5fdb95cf08048d70723db17c73053a)
-            check_type(argname="argument distribution_config", value=distribution_config, expected_type=type_hints["distribution_config"])
+            type_hints = typing.get_type_hints(_typecheckingstub__a7e7108347c4dbf8d509df9b928e7c2257744baad28d87264b196951988c668c)
+            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
+            check_type(argname="argument domains", value=domains, expected_type=type_hints["domains"])
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+            check_type(argname="argument connection_group_id", value=connection_group_id, expected_type=type_hints["connection_group_id"])
+            check_type(argname="argument customizations", value=customizations, expected_type=type_hints["customizations"])
+            check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
+            check_type(argname="argument managed_certificate_request", value=managed_certificate_request, expected_type=type_hints["managed_certificate_request"])
+            check_type(argname="argument parameters", value=parameters, expected_type=type_hints["parameters"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
-            "distribution_config": distribution_config,
+            "distribution_id": distribution_id,
+            "domains": domains,
+            "name": name,
         }
+        if connection_group_id is not None:
+            self._values["connection_group_id"] = connection_group_id
+        if customizations is not None:
+            self._values["customizations"] = customizations
+        if enabled is not None:
+            self._values["enabled"] = enabled
+        if managed_certificate_request is not None:
+            self._values["managed_certificate_request"] = managed_certificate_request
+        if parameters is not None:
+            self._values["parameters"] = parameters
         if tags is not None:
             self._values["tags"] = tags
 
     @builtins.property
-    def distribution_config(
+    def distribution_id(self) -> builtins.str:
+        '''The distribution's identifier.
+
+        For example: ``E1U5RQF7T870K0`` .
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-distributionid
+        '''
+        result = self._values.get("distribution_id")
+        assert result is not None, "Required property 'distribution_id' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def domains(self) -> typing.List[builtins.str]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-domains
+        '''
+        result = self._values.get("domains")
+        assert result is not None, "Required property 'domains' is missing"
+        return typing.cast(typing.List[builtins.str], result)
+
+    @builtins.property
+    def name(self) -> builtins.str:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-name
+        '''
+        result = self._values.get("name")
+        assert result is not None, "Required property 'name' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def connection_group_id(self) -> typing.Optional[builtins.str]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-connectiongroupid
+        '''
+        result = self._values.get("connection_group_id")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def customizations(
         self,
-    ) -> typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty]:
-        '''The distribution's configuration.
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.CustomizationsProperty]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-customizations
+        '''
+        result = self._values.get("customizations")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.CustomizationsProperty]], result)
 
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-distributionconfig
+    @builtins.property
+    def enabled(
+        self,
+    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
         '''
-        result = self._values.get("distribution_config")
-        assert result is not None, "Required property 'distribution_config' is missing"
-        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty], result)
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-enabled
+        '''
+        result = self._values.get("enabled")
+        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
+
+    @builtins.property
+    def managed_certificate_request(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ManagedCertificateRequestProperty]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-managedcertificaterequest
+        '''
+        result = self._values.get("managed_certificate_request")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ManagedCertificateRequestProperty]], result)
+
+    @builtins.property
+    def parameters(
+        self,
+    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ParameterProperty]]]]:
+        '''
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-parameters
+        '''
+        result = self._values.get("parameters")
+        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ParameterProperty]]]], result)
 
     @builtins.property
     def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
         '''A complex type that contains zero or more ``Tag`` elements.
 
-        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-tags
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distributiontenant.html#cfn-cloudfront-distributiontenant-tags
         '''
         result = self._values.get("tags")
         return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
@@ -9968,7 +11757,7 @@ class CfnDistributionProps:
         return not (rhs == self)
 
     def __repr__(self) -> str:
-        return "CfnDistributionProps(%s)" % ", ".join(
+        return "CfnDistributionTenantProps(%s)" % ", ".join(
             k + "=" + repr(v) for k, v in self._values.items()
         )
 
@@ -26978,10 +28767,14 @@ __all__ = [
     "CfnCachePolicyProps",
     "CfnCloudFrontOriginAccessIdentity",
     "CfnCloudFrontOriginAccessIdentityProps",
+    "CfnConnectionGroup",
+    "CfnConnectionGroupProps",
     "CfnContinuousDeploymentPolicy",
     "CfnContinuousDeploymentPolicyProps",
     "CfnDistribution",
     "CfnDistributionProps",
+    "CfnDistributionTenant",
+    "CfnDistributionTenantProps",
     "CfnFunction",
     "CfnFunctionProps",
     "CfnKeyGroup",
@@ -27411,6 +29204,72 @@ def _typecheckingstub__ac17d18e4ddb1cb8a79015a96667059270fe5083273f938cf851deeb4
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__a7fbc949dbac76664bfea111378c9ea57cd63caa1212fdbe30d64584bd8f53de(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    name: builtins.str,
+    anycast_ip_list_id: typing.Optional[builtins.str] = None,
+    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__dad045911121964ba7e6a7c8d166ac2aaace23640d9bee11f9fbbbb1b78e3236(
+    inspector: _TreeInspector_488e0dd5,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d4834ec5a54af69a2e3413ff8a46f3539a6607f6b49adaabe420e5490ae353ea(
+    props: typing.Mapping[builtins.str, typing.Any],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__46cb5b39bb34a52a464d8364089e47d3ba47e4a293aaa3f92857d624e7902898(
+    value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__2633385b8f4da7c2341c3b54e4d30ea9345b38862ced8c6f1d893c36ec7c669d(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__41addbff9b29ce6c4465d1d973785d727f6742a1723e79dcdce59a1087df694f(
+    value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__2678e60f75fc9c3a75819708e1b8cda159dd49a5c52a78d805d37bb94bd0efa5(
+    value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__f9f02fbda8fa97b38f114c9910b9d9cef69228aa69dfe80217e98e1707226ce0(
+    value: typing.Optional[typing.List[_CfnTag_f6864754]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d9f88b4b65d8b9e48fd57e5bde8f7d6681cdcbb9e46fe34c223e63914ee033f4(
+    *,
+    name: builtins.str,
+    anycast_ip_list_id: typing.Optional[builtins.str] = None,
+    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__b57269fe6faf53d2e30ff31a58c5711db8b8cc3b38dc9ac79efdb585dc8f324b(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,
@@ -27623,6 +29482,13 @@ def _typecheckingstub__acf9839d8791146628088e2f7ab6072f3232af301427572733ecdb1c5
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__6373c35cb5b68c4917ddc72054f5c42da1b689748928adaa28575e2f9058bcf1(
+    *,
+    string_schema: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.StringSchemaProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__924aa31797d5562075c15043a82632c8afbc217d476fdf805d7efea103da3360(
     *,
     default_cache_behavior: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DefaultCacheBehaviorProperty, typing.Dict[builtins.str, typing.Any]]],
@@ -27632,6 +29498,7 @@ def _typecheckingstub__924aa31797d5562075c15043a82632c8afbc217d476fdf805d7efea10
     cache_behaviors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CacheBehaviorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     cnam_es: typing.Optional[typing.Sequence[builtins.str]] = None,
     comment: typing.Optional[builtins.str] = None,
+    connection_mode: typing.Optional[builtins.str] = None,
     continuous_deployment_policy_id: typing.Optional[builtins.str] = None,
     custom_error_responses: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     custom_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LegacyCustomOriginProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -27645,6 +29512,7 @@ def _typecheckingstub__924aa31797d5562075c15043a82632c8afbc217d476fdf805d7efea10
     restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.RestrictionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     s3_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LegacyS3OriginProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     staging: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    tenant_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.TenantConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     viewer_certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.ViewerCertificateProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     web_acl_id: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -27794,6 +29662,14 @@ def _typecheckingstub__d2a25e92d5905a4c19d3636ff8b631afa34a538497a13fa9d29e56ca4
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__d3077fc2475a570e548a4c766c77d7d863c9b4298e77dbf52c861eb303170cbd(
+    *,
+    definition: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DefinitionProperty, typing.Dict[builtins.str, typing.Any]]],
+    name: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa9638220c0d(
     *,
     geo_restriction: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.GeoRestrictionProperty, typing.Dict[builtins.str, typing.Any]]],
@@ -27816,6 +29692,22 @@ def _typecheckingstub__7b8b62ce6bf1ec6151566719caf2d665f3f7fea596e402fba7354f19f
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__063da7cd247f9f65fbf71edf06b732e35e339a5952e2f2bf8ccd5eee1c5611d8(
+    *,
+    required: typing.Union[builtins.bool, _IResolvable_da3f097b],
+    comment: typing.Optional[builtins.str] = None,
+    default_value: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d2edbb1e96d7cdd1ba9da9c2eb778117b7b4726ec0bcf6cf55c64bbbdba19541(
+    *,
+    parameter_definitions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.ParameterDefinitionProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__511560286b35778c69f3d2a23120607f1ab2e58901f0c1ba7acd75a338eb699e(
     *,
     acm_certificate_arn: typing.Optional[builtins.str] = None,
@@ -27844,6 +29736,162 @@ def _typecheckingstub__f7553d47847912fd83a61da98a84c9c8cb5fdb95cf08048d70723db17
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__b31d7c64540327014853973d80c83a2f4a5686901e7f7ac7b0ace4f059413572(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    distribution_id: builtins.str,
+    domains: typing.Sequence[builtins.str],
+    name: builtins.str,
+    connection_group_id: typing.Optional[builtins.str] = None,
+    customizations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.CustomizationsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    managed_certificate_request: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ManagedCertificateRequestProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ParameterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__57520040a3293830d92c5db58279dc6ba57c2835396f254ab1cf1fc8a732ea40(
+    inspector: _TreeInspector_488e0dd5,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__9e01bfefdb980893d11ecf908e131b3da5b94143ee485dce5ed8d1d657843e21(
+    props: typing.Mapping[builtins.str, typing.Any],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__01b4d19a34e50ac410f9509edd30a04265cf1cbbd17b788ad5aa7507c63f00f8(
+    value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__7e4ea73186e7ded8d4be1abca7ad4ad20e62ac773ff4030551f69552bebf4111(
+    value: typing.List[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__21d549f43b17cc6909f030b9a70862b4d3cc9f8321d3c0808f5a34ad3a82bdac(
+    value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__260bd4d44d34feabb54c786083ced4eca1f6825ffa23ac7256d4a56686f6f06e(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1ecc1c2d6ca5ed07f9220424e298d73ccc2d9ff84388993cacf60c02fc6431d2(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.CustomizationsProperty]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4faa42cfcdbcfaf7031a5ad328e3b92614cc4b898e43367bd53e66b4edb53dd8(
+    value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__5137481a2aef0ac0e79363b8e827531e762d17f59cfa3b092f770cb0813fedc0(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ManagedCertificateRequestProperty]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c5ac60c7274f522196384c452007fc5b615ae79ffad1520970925978b4606156(
+    value: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnDistributionTenant.ParameterProperty]]]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__2cea18d7ff4ed5a97170964e15f6e2d6e58a5f394ede6d8f1dd4c80f19f719e2(
+    value: typing.Optional[typing.List[_CfnTag_f6864754]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__ff0d269846a4a9f6793265a71266235fd771204d2a0ad4f09ad78055533b5c48(
+    *,
+    arn: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__0491da142c813dc4673791039712e33ce224f81450f91a62e3bae808ffa535c1(
+    *,
+    certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.CertificateProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    geo_restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.GeoRestrictionCustomizationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    web_acl: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.WebAclCustomizationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d24d49d6e44d4deb653a24465ec61e7862ea07d5a5cdc7f3cfa829da2181be64(
+    *,
+    domain: typing.Optional[builtins.str] = None,
+    reason: typing.Optional[builtins.str] = None,
+    status: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__b12cc1d8db14a6223b67c5f9254d5e808563dc8b6065256b09f01459db825b10(
+    *,
+    locations: typing.Optional[typing.Sequence[builtins.str]] = None,
+    restriction_type: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__bd3055b78628b26ba1bcd38e78722682f53f911f50dd7e46fce1153242ca9358(
+    *,
+    certificate_transparency_logging_preference: typing.Optional[builtins.str] = None,
+    primary_domain_name: typing.Optional[builtins.str] = None,
+    validation_token_host: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__153cd98fd3544f143cb0059bfc0c01069aa936e548aae6596f575cebfb894add(
+    *,
+    name: typing.Optional[builtins.str] = None,
+    value: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1146c72709bb4672e62f556fac241f6dc79c09223c1e3a1863d70512f623c799(
+    *,
+    action: typing.Optional[builtins.str] = None,
+    arn: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a7e7108347c4dbf8d509df9b928e7c2257744baad28d87264b196951988c668c(
+    *,
+    distribution_id: builtins.str,
+    domains: typing.Sequence[builtins.str],
+    name: builtins.str,
+    connection_group_id: typing.Optional[builtins.str] = None,
+    customizations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.CustomizationsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    managed_certificate_request: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ManagedCertificateRequestProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    parameters: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistributionTenant.ParameterProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
+    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__7fd6686720dc42916d1486e9d86a083535cb418c14fb4746839d47b9f77562f0(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,