aws-cdk-lib 2.201.0__py3-none-any.whl → 2.203.0__py3-none-any.whl

aws_cdk/aws_cloudfront/__init__.py

@@ -1295,7 +1295,25 @@ When using a CloudFront PublicKey, only the `comment` field can be updated after
 Resource handler returned message: "Invalid request provided: AWS::CloudFront::PublicKey"
 ```
 
-To update the `encodedKey`, you must change the logical ID of the public key resource in your template. This causes CloudFormation to create a new `cloudfront.PublicKey` resource and delete the old one during the next deployment.
+To update the `encodedKey`, you must change the ID of the public key resource in your template. This causes CloudFormation to create a new `cloudfront.PublicKey` resource and delete the old one during the next deployment.
+
+Example:
+
+```python
+# Step 1: Original deployment
+original_key = cloudfront.PublicKey(self, "MyPublicKeyV1",
+    encoded_key="..."
+)
+```
+
+Regenerate a new key and change the construct id in the code:
+
+```python
+# Step 2: In a subsequent deployment, create a new key with a different ID
+updated_key = cloudfront.PublicKey(self, "MyPublicKeyV2",
+    encoded_key="..."
+)
+```
 
 See:
 
@@ -6591,9 +6609,9 @@ class CfnDistribution(
             :param origin_protocol_policy: Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin. Valid values are:. - ``http-only`` – CloudFront always uses HTTP to connect to the origin. - ``match-viewer`` – CloudFront connects to the origin using the same protocol that the viewer used to connect to CloudFront. - ``https-only`` – CloudFront always uses HTTPS to connect to the origin.
             :param http_port: The HTTP port that CloudFront uses to connect to the origin. Specify the HTTP port that the origin listens on. Default: - 80
             :param https_port: The HTTPS port that CloudFront uses to connect to the origin. Specify the HTTPS port that the origin listens on. Default: - 443
-            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
-            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
-            :param origin_ssl_protocols: Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` . For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
+            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
+            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
+            :param origin_ssl_protocols: Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` . For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html
             :exampleMetadata: fixture=_generated
@@ -6683,7 +6701,7 @@ class CfnDistribution(
 
             The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.
 
-            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
 
             :default: - 5
 
@@ -6698,7 +6716,7 @@ class CfnDistribution(
 
             This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.
 
-            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
 
             :default: - 30
 
@@ -6713,7 +6731,7 @@ class CfnDistribution(
 
             Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` .
 
-            For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-originsslprotocols
             '''
@@ -7555,8 +7573,10 @@ class CfnDistribution(
                             enabled=False,
                             origin_shield_region="originShieldRegion"
                         ),
+                        response_completion_timeout=123,
                         s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
-                            origin_access_identity="originAccessIdentity"
+                            origin_access_identity="originAccessIdentity",
+                            origin_read_timeout=123
                         ),
                         vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
                             vpc_origin_id="vpcOriginId",
@@ -9325,6 +9345,7 @@ class CfnDistribution(
             "origin_custom_headers": "originCustomHeaders",
             "origin_path": "originPath",
             "origin_shield": "originShield",
+            "response_completion_timeout": "responseCompletionTimeout",
             "s3_origin_config": "s3OriginConfig",
             "vpc_origin_config": "vpcOriginConfig",
         },
@@ -9342,6 +9363,7 @@ class CfnDistribution(
             origin_custom_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginCustomHeaderProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
             origin_path: typing.Optional[builtins.str] = None,
             origin_shield: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginShieldProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+            response_completion_timeout: typing.Optional[jsii.Number] = None,
             s3_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.S3OriginConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             vpc_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.VpcOriginConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
@@ -9369,6 +9391,7 @@ class CfnDistribution(
             :param origin_custom_headers: A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin. For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .
             :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
             :param origin_shield: CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
+            :param response_completion_timeout: 
             :param s3_origin_config: Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting. To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.
             :param vpc_origin_config: The VPC origin configuration.
 
@@ -9408,8 +9431,10 @@ class CfnDistribution(
                         enabled=False,
                         origin_shield_region="originShieldRegion"
                     ),
+                    response_completion_timeout=123,
                     s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
-                        origin_access_identity="originAccessIdentity"
+                        origin_access_identity="originAccessIdentity",
+                        origin_read_timeout=123
                     ),
                     vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
                         vpc_origin_id="vpcOriginId",
@@ -9431,6 +9456,7 @@ class CfnDistribution(
                 check_type(argname="argument origin_custom_headers", value=origin_custom_headers, expected_type=type_hints["origin_custom_headers"])
                 check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
                 check_type(argname="argument origin_shield", value=origin_shield, expected_type=type_hints["origin_shield"])
+                check_type(argname="argument response_completion_timeout", value=response_completion_timeout, expected_type=type_hints["response_completion_timeout"])
                 check_type(argname="argument s3_origin_config", value=s3_origin_config, expected_type=type_hints["s3_origin_config"])
                 check_type(argname="argument vpc_origin_config", value=vpc_origin_config, expected_type=type_hints["vpc_origin_config"])
             self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -9451,6 +9477,8 @@ class CfnDistribution(
                 self._values["origin_path"] = origin_path
             if origin_shield is not None:
                 self._values["origin_shield"] = origin_shield
+            if response_completion_timeout is not None:
+                self._values["response_completion_timeout"] = response_completion_timeout
             if s3_origin_config is not None:
                 self._values["s3_origin_config"] = s3_origin_config
             if vpc_origin_config is not None:
@@ -9571,6 +9599,14 @@ class CfnDistribution(
             result = self._values.get("origin_shield")
             return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]], result)
 
+        @builtins.property
+        def response_completion_timeout(self) -> typing.Optional[jsii.Number]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-responsecompletiontimeout
+            '''
+            result = self._values.get("response_completion_timeout")
+            return typing.cast(typing.Optional[jsii.Number], result)
+
         @builtins.property
         def s3_origin_config(
             self,
@@ -9840,19 +9876,24 @@ class CfnDistribution(
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.S3OriginConfigProperty",
         jsii_struct_bases=[],
-        name_mapping={"origin_access_identity": "originAccessIdentity"},
+        name_mapping={
+            "origin_access_identity": "originAccessIdentity",
+            "origin_read_timeout": "originReadTimeout",
+        },
     )
     class S3OriginConfigProperty:
         def __init__(
             self,
             *,
             origin_access_identity: typing.Optional[builtins.str] = None,
+            origin_read_timeout: typing.Optional[jsii.Number] = None,
         ) -> None:
             '''A complex type that contains information about the Amazon S3 origin.
 
             If the origin is a custom origin or an S3 bucket that is configured as a website endpoint, use the ``CustomOriginConfig`` element instead.
 
             :param origin_access_identity: .. epigraph:: If you're using origin access control (OAC) instead of origin access identity, specify an empty ``OriginAccessIdentity`` element. For more information, see `Restricting access to an AWS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* . The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is: ``origin-access-identity/cloudfront/ID-of-origin-access-identity`` The ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity. If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element. To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element. To replace the origin access identity, update the distribution configuration and specify the new origin access identity. For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
+            :param origin_read_timeout: Default: - 30
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html
             :exampleMetadata: fixture=_generated
@@ -9864,15 +9905,19 @@ class CfnDistribution(
                 from aws_cdk import aws_cloudfront as cloudfront
                 
                 s3_origin_config_property = cloudfront.CfnDistribution.S3OriginConfigProperty(
-                    origin_access_identity="originAccessIdentity"
+                    origin_access_identity="originAccessIdentity",
+                    origin_read_timeout=123
                 )
             '''
             if __debug__:
                 type_hints = typing.get_type_hints(_typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7)
                 check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
+                check_type(argname="argument origin_read_timeout", value=origin_read_timeout, expected_type=type_hints["origin_read_timeout"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
             if origin_access_identity is not None:
                 self._values["origin_access_identity"] = origin_access_identity
+            if origin_read_timeout is not None:
+                self._values["origin_read_timeout"] = origin_read_timeout
 
         @builtins.property
         def origin_access_identity(self) -> typing.Optional[builtins.str]:
@@ -9903,6 +9948,16 @@ class CfnDistribution(
             result = self._values.get("origin_access_identity")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def origin_read_timeout(self) -> typing.Optional[jsii.Number]:
+            '''
+            :default: - 30
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html#cfn-cloudfront-distribution-s3originconfig-originreadtimeout
+            '''
+            result = self._values.get("origin_read_timeout")
+            return typing.cast(typing.Optional[jsii.Number], result)
+
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -10344,8 +10399,8 @@ class CfnDistribution(
             '''An Amazon CloudFront VPC origin configuration.
 
             :param vpc_origin_id: The VPC origin ID.
-            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
-            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
+            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
+            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-vpcoriginconfig.html
             :exampleMetadata: fixture=_generated
@@ -10393,7 +10448,7 @@ class CfnDistribution(
 
             The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.
 
-            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Keep-alive timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .
 
             :default: - 5
 
@@ -10408,7 +10463,7 @@ class CfnDistribution(
 
             This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.
 
-            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Response timeout (custom origins only) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .
 
             :default: - 30
 
@@ -10632,8 +10687,10 @@ class CfnDistributionProps:
                             enabled=False,
                             origin_shield_region="originShieldRegion"
                         ),
+                        response_completion_timeout=123,
                         s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
-                            origin_access_identity="originAccessIdentity"
+                            origin_access_identity="originAccessIdentity",
+                            origin_read_timeout=123
                         ),
                         vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
                             vpc_origin_id="vpcOriginId",
@@ -18018,7 +18075,7 @@ class CfnVpcOrigin(
             :param http_port: The HTTP port for the CloudFront VPC origin endpoint configuration. The default value is ``80`` . Default: - 80
             :param https_port: The HTTPS port of the CloudFront VPC origin endpoint configuration. The default value is ``443`` . Default: - 443
             :param origin_protocol_policy: The origin protocol policy for the CloudFront VPC origin endpoint configuration. Default: - "match-viewer"
-            :param origin_ssl_protocols: Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` . For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
+            :param origin_ssl_protocols: Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` . For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-vpcorigin-vpcoriginendpointconfig.html
             :exampleMetadata: fixture=_generated
@@ -18124,7 +18181,7 @@ class CfnVpcOrigin(
 
             Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` .
 
-            For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
+            For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesOrigin.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-vpcorigin-vpcoriginendpointconfig.html#cfn-cloudfront-vpcorigin-vpcoriginendpointconfig-originsslprotocols
             '''
@@ -22238,8 +22295,10 @@ class OriginBindConfig:
                         enabled=False,
                         origin_shield_region="originShieldRegion"
                     ),
+                    response_completion_timeout=123,
                     s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
-                        origin_access_identity="originAccessIdentity"
+                        origin_access_identity="originAccessIdentity",
+                        origin_read_timeout=123
                     ),
                     vpc_origin_config=cloudfront.CfnDistribution.VpcOriginConfigProperty(
                         vpc_origin_id="vpcOriginId",
@@ -23425,27 +23484,14 @@ class PublicKey(
 
     Example::
 
-        # Validating signed URLs or signed cookies with Trusted Key Groups
-        
-        # public key in PEM format
-        # public_key: str
-        
-        pub_key = cloudfront.PublicKey(self, "MyPubKey",
-            encoded_key=public_key
-        )
-        
-        key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
-            items=[pub_key
+        # Create a key group to use with CloudFront signed URLs and signed cookies.
+        cloudfront.KeyGroup(self, "MyKeyGroup",
+            items=[
+                cloudfront.PublicKey(self, "MyPublicKey",
+                    encoded_key="..."
+                )
             ]
         )
-        
-        cloudfront.Distribution(self, "Dist",
-            default_behavior=cloudfront.BehaviorOptions(
-                origin=origins.HttpOrigin("www.example.com"),
-                trusted_key_groups=[key_group
-                ]
-            )
-        )
     '''
 
     def __init__(
@@ -23535,27 +23581,14 @@ class PublicKeyProps:
 
         Example::
 
-            # Validating signed URLs or signed cookies with Trusted Key Groups
-            
-            # public key in PEM format
-            # public_key: str
-            
-            pub_key = cloudfront.PublicKey(self, "MyPubKey",
-                encoded_key=public_key
-            )
-            
-            key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
-                items=[pub_key
+            # Create a key group to use with CloudFront signed URLs and signed cookies.
+            cloudfront.KeyGroup(self, "MyKeyGroup",
+                items=[
+                    cloudfront.PublicKey(self, "MyPublicKey",
+                        encoded_key="..."
+                    )
                 ]
             )
-            
-            cloudfront.Distribution(self, "Dist",
-                default_behavior=cloudfront.BehaviorOptions(
-                    origin=origins.HttpOrigin("www.example.com"),
-                    trusted_key_groups=[key_group
-                    ]
-                )
-            )
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__ab6d6a7ffe806c347a4fbac3b890074d407fcf2dd19c1ca56da8ddc83cb3ad61)
@@ -29820,6 +29853,7 @@ def _typecheckingstub__cb4237408749840dbecf9d9aed57975910052da22b994c7e13cc97c98
     origin_custom_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginCustomHeaderProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
     origin_path: typing.Optional[builtins.str] = None,
     origin_shield: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginShieldProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    response_completion_timeout: typing.Optional[jsii.Number] = None,
     s3_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.S3OriginConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     vpc_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.VpcOriginConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
 ) -> None:
@@ -29852,6 +29886,7 @@ def _typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa963
 def _typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7(
     *,
     origin_access_identity: typing.Optional[builtins.str] = None,
+    origin_read_timeout: typing.Optional[jsii.Number] = None,
 ) -> None:
     """Type checking stubs"""
     pass

aws_cdk/aws_cloudfront/experimental/__init__.py

@@ -33,6 +33,7 @@ from ..._jsii import *
 import constructs as _constructs_77d1e7e8
 from ... import (
     Duration as _Duration_4839e8c3,
+    RemovalPolicy as _RemovalPolicy_9f93c814,
     Resource as _Resource_45bc6135,
     Size as _Size_7b441c34,
 )
@@ -79,6 +80,7 @@ from ...aws_lambda import (
     IEventSourceDlq as _IEventSourceDlq_5e2c6ad9,
     IFunction as _IFunction_6adb0ab8,
     ILayerVersion as _ILayerVersion_5ac127c8,
+    ISchemaRegistry as _ISchemaRegistry_7e66a87f,
     IVersion as _IVersion_faf7234e,
     InvokeMode as _InvokeMode_e7b50559,
     LambdaInsightsVersion as _LambdaInsightsVersion_9dfbfef9,
@@ -180,6 +182,7 @@ class EdgeFunction(
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[_LoggingFormat_30be8e01] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[_LogRetentionRetryOptions_ad797a7a, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -237,7 +240,8 @@ class EdgeFunction(
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -296,6 +300,7 @@ class EdgeFunction(
             log_format=log_format,
             logging_format=logging_format,
             log_group=log_group,
+            log_removal_policy=log_removal_policy,
             log_retention=log_retention,
             log_retention_retry_options=log_retention_retry_options,
             log_retention_role=log_retention_role,
@@ -396,6 +401,7 @@ class EdgeFunction(
         provisioned_poller_config: typing.Optional[typing.Union[_ProvisionedPollerConfig_1025e063, typing.Dict[builtins.str, typing.Any]]] = None,
         report_batch_item_failures: typing.Optional[builtins.bool] = None,
         retry_attempts: typing.Optional[jsii.Number] = None,
+        schema_registry_config: typing.Optional[_ISchemaRegistry_7e66a87f] = None,
         source_access_configurations: typing.Optional[typing.Sequence[typing.Union[_SourceAccessConfiguration_1926ff89, typing.Dict[builtins.str, typing.Any]]]] = None,
         starting_position: typing.Optional[_StartingPosition_c0a4852c] = None,
         starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -423,6 +429,7 @@ class EdgeFunction(
         :param provisioned_poller_config: Configuration for provisioned pollers that read from the event source. When specified, allows control over the minimum and maximum number of pollers that can be provisioned to process events from the source. Default: - no provisioned pollers
         :param report_batch_item_failures: Allow functions to return partially successful responses for a batch of records. Default: false
         :param retry_attempts: The maximum number of times to retry when the function returns an error. Set to ``undefined`` if you want lambda to keep retrying infinitely or until the record expires. Valid Range: - Minimum value of 0 - Maximum value of 10000 Default: - infinite or until the record expires.
+        :param schema_registry_config: Specific configuration settings for a Kafka schema registry. Default: - none
         :param source_access_configurations: Specific settings like the authentication protocol or the VPC components to secure access to your event source. Default: - none
         :param starting_position: The position in the DynamoDB, Kinesis or MSK stream where AWS Lambda should start reading. Default: - no starting position
         :param starting_position_timestamp: The time from which to start reading, in Unix time seconds. Default: - no timestamp
@@ -451,6 +458,7 @@ class EdgeFunction(
             provisioned_poller_config=provisioned_poller_config,
             report_batch_item_failures=report_batch_item_failures,
             retry_attempts=retry_attempts,
+            schema_registry_config=schema_registry_config,
             source_access_configurations=source_access_configurations,
             starting_position=starting_position,
             starting_position_timestamp=starting_position_timestamp,
@@ -996,6 +1004,7 @@ class EdgeFunction(
         "log_format": "logFormat",
         "logging_format": "loggingFormat",
         "log_group": "logGroup",
+        "log_removal_policy": "logRemovalPolicy",
         "log_retention": "logRetention",
         "log_retention_retry_options": "logRetentionRetryOptions",
         "log_retention_role": "logRetentionRole",
@@ -1055,6 +1064,7 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
         log_format: typing.Optional[builtins.str] = None,
         logging_format: typing.Optional[_LoggingFormat_30be8e01] = None,
         log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+        log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
         log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
         log_retention_retry_options: typing.Optional[typing.Union[_LogRetentionRetryOptions_ad797a7a, typing.Dict[builtins.str, typing.Any]]] = None,
         log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -1111,7 +1121,8 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
         :param log_format: (deprecated) Sets the logFormat for the function. Default: "Text"
         :param logging_format: Sets the loggingFormat for the function. Default: LoggingFormat.TEXT
         :param log_group: The log group the function sends logs to. By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/<function name>. However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention. Use the ``logGroup`` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it. Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first. Default: ``/aws/lambda/${this.functionName}`` - default log group created by Lambda
-        :param log_retention: The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
+        :param log_removal_policy: (deprecated) Determine the removal policy of the log group that is auto-created by this construct. Normally you want to retain the log group so you can diagnose issues from logs even after a deployment that no longer includes the log group. In that case, use the normal date-based retention policy to age out your logs. Default: RemovalPolicy.Retain
+        :param log_retention: (deprecated) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. This is a legacy API and we strongly recommend you move away from it if you can. Instead create a fully customizable log group with ``logs.LogGroup`` and use the ``logGroup`` property to instruct the Lambda function to send logs to it. Migrating from ``logRetention`` to ``logGroup`` will cause the name of the log group to change. Users and code and referencing the name verbatim will have to adjust. In AWS CDK code, you can access the log group name directly from the LogGroup construct:: import * as logs from 'aws-cdk-lib/aws-logs'; declare const myLogGroup: logs.LogGroup; myLogGroup.logGroupName; Default: logs.RetentionDays.INFINITE
         :param log_retention_retry_options: When log retention is specified, a custom resource attempts to create the CloudWatch log group. These options control the retry policy when interacting with CloudWatch APIs. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - Default AWS SDK retry options.
         :param log_retention_role: The IAM role for the Lambda function associated with the custom resource that sets the retention policy. This is a legacy API and we strongly recommend you migrate to ``logGroup`` if you can. ``logGroup`` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it. Default: - A new role is created.
         :param memory_size: The amount of memory, in MB, that is allocated to your Lambda function. Lambda uses this value to proportionally allocate the amount of CPU power. For more information, see Resource Model in the AWS Lambda Developer Guide. Default: 128
@@ -1198,6 +1209,7 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
             check_type(argname="argument log_format", value=log_format, expected_type=type_hints["log_format"])
             check_type(argname="argument logging_format", value=logging_format, expected_type=type_hints["logging_format"])
             check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
             check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
             check_type(argname="argument log_retention_retry_options", value=log_retention_retry_options, expected_type=type_hints["log_retention_retry_options"])
             check_type(argname="argument log_retention_role", value=log_retention_role, expected_type=type_hints["log_retention_role"])
@@ -1286,6 +1298,8 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
             self._values["logging_format"] = logging_format
         if log_group is not None:
             self._values["log_group"] = log_group
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
         if log_retention is not None:
             self._values["log_retention"] = log_retention
         if log_retention_retry_options is not None:
@@ -1671,9 +1685,27 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
         result = self._values.get("log_group")
         return typing.cast(typing.Optional[_ILogGroup_3c4fa718], result)
 
+    @builtins.property
+    def log_removal_policy(self) -> typing.Optional[_RemovalPolicy_9f93c814]:
+        '''(deprecated) Determine the removal policy of the log group that is auto-created by this construct.
+
+        Normally you want to retain the log group so you can diagnose issues
+        from logs even after a deployment that no longer includes the log group.
+        In that case, use the normal date-based retention policy to age out your
+        logs.
+
+        :default: RemovalPolicy.Retain
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
+        '''
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_RemovalPolicy_9f93c814], result)
+
     @builtins.property
     def log_retention(self) -> typing.Optional[_RetentionDays_070f99f0]:
-        '''The number of days log events are kept in CloudWatch Logs.
+        '''(deprecated) The number of days log events are kept in CloudWatch Logs.
 
         When updating
         this property, unsetting it doesn't remove the log retention policy. To
@@ -1694,6 +1726,10 @@ class EdgeFunctionProps(_FunctionProps_a308e854):
            my_log_group.log_group_name
 
         :default: logs.RetentionDays.INFINITE
+
+        :deprecated: use ``logGroup`` instead
+
+        :stability: deprecated
         '''
         result = self._values.get("log_retention")
         return typing.cast(typing.Optional[_RetentionDays_070f99f0], result)
@@ -2030,6 +2066,7 @@ def _typecheckingstub__b2f96e5632f259adb036f7aba2bbc7c19fd9840c647d67a10a8135cb3
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[_LoggingFormat_30be8e01] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[_LogRetentionRetryOptions_ad797a7a, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,
@@ -2098,6 +2135,7 @@ def _typecheckingstub__e3a2f6769309cd3c52da869813738e2d4a94d233e574ada7ebba1654d
     provisioned_poller_config: typing.Optional[typing.Union[_ProvisionedPollerConfig_1025e063, typing.Dict[builtins.str, typing.Any]]] = None,
     report_batch_item_failures: typing.Optional[builtins.bool] = None,
     retry_attempts: typing.Optional[jsii.Number] = None,
+    schema_registry_config: typing.Optional[_ISchemaRegistry_7e66a87f] = None,
     source_access_configurations: typing.Optional[typing.Sequence[typing.Union[_SourceAccessConfiguration_1926ff89, typing.Dict[builtins.str, typing.Any]]]] = None,
     starting_position: typing.Optional[_StartingPosition_c0a4852c] = None,
     starting_position_timestamp: typing.Optional[jsii.Number] = None,
@@ -2208,6 +2246,7 @@ def _typecheckingstub__709cdcb05c7a5fc7f7bcd1d72557097c39c5c534076a00b6b8db807bd
     log_format: typing.Optional[builtins.str] = None,
     logging_format: typing.Optional[_LoggingFormat_30be8e01] = None,
     log_group: typing.Optional[_ILogGroup_3c4fa718] = None,
+    log_removal_policy: typing.Optional[_RemovalPolicy_9f93c814] = None,
     log_retention: typing.Optional[_RetentionDays_070f99f0] = None,
     log_retention_retry_options: typing.Optional[typing.Union[_LogRetentionRetryOptions_ad797a7a, typing.Dict[builtins.str, typing.Any]]] = None,
     log_retention_role: typing.Optional[_IRole_235f5d8e] = None,