PyPI - pulumi-aws - Versions diffs - 7.15.0__py3-none-any.whl → 7.16.0__py3-none-any.whl - Mend

pulumi-aws 7.15.0py3-none-any.whl → 7.16.0py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (105) hide show

pulumi_aws/__init__.py +80 -0
pulumi_aws/alb/listener.py +7 -7
pulumi_aws/alb/target_group.py +7 -7
pulumi_aws/alb/target_group_attachment.py +83 -0
pulumi_aws/apigateway/domain_name.py +86 -7
pulumi_aws/apigateway/get_domain_name.py +15 -1
pulumi_aws/apigateway/integration.py +48 -8
pulumi_aws/athena/_inputs.py +412 -5
pulumi_aws/athena/outputs.py +342 -2
pulumi_aws/backup/global_settings.py +15 -7
pulumi_aws/bedrock/agentcore_memory_strategy.py +8 -0
pulumi_aws/cleanrooms/collaboration.py +26 -6
pulumi_aws/cloudfront/__init__.py +6 -0
pulumi_aws/cloudfront/_inputs.py +3601 -478
pulumi_aws/cloudfront/connection_function.py +658 -0
pulumi_aws/cloudfront/connection_group.py +649 -0
pulumi_aws/cloudfront/distribution.py +142 -0
pulumi_aws/cloudfront/distribution_tenant.py +857 -0
pulumi_aws/cloudfront/get_connection_group.py +249 -0
pulumi_aws/cloudfront/get_distribution_tenant.py +279 -0
pulumi_aws/cloudfront/multitenant_distribution.py +1181 -0
pulumi_aws/cloudfront/outputs.py +3034 -376
pulumi_aws/cloudwatch/log_subscription_filter.py +136 -42
pulumi_aws/directconnect/gateway.py +78 -3
pulumi_aws/directconnect/get_gateway.py +24 -4
pulumi_aws/dlm/_inputs.py +3 -3
pulumi_aws/dlm/outputs.py +2 -2
pulumi_aws/dynamodb/__init__.py +1 -0
pulumi_aws/dynamodb/_inputs.py +370 -0
pulumi_aws/dynamodb/global_secondary_index.py +666 -0
pulumi_aws/dynamodb/outputs.py +315 -0
pulumi_aws/dynamodb/table.py +9 -1
pulumi_aws/ec2/_inputs.py +44 -4
pulumi_aws/ec2/get_vpc_endpoint.py +24 -4
pulumi_aws/ec2/outputs.py +54 -4
pulumi_aws/ecr/__init__.py +1 -0
pulumi_aws/ecr/_inputs.py +58 -22
pulumi_aws/ecr/get_repository_creation_template.py +1 -1
pulumi_aws/ecr/lifecycle_policy.py +152 -64
pulumi_aws/ecr/outputs.py +37 -15
pulumi_aws/ecr/pull_time_update_exclusion.py +363 -0
pulumi_aws/ecr/repository_creation_template.py +7 -7
pulumi_aws/ecs/_inputs.py +20 -0
pulumi_aws/ecs/outputs.py +14 -0
pulumi_aws/ecs/task_definition.py +28 -28
pulumi_aws/elasticache/replication_group.py +7 -7
pulumi_aws/fsx/ontap_file_system.py +14 -0
pulumi_aws/glue/resource_policy.py +4 -4
pulumi_aws/guardduty/_inputs.py +41 -1
pulumi_aws/guardduty/outputs.py +27 -1
pulumi_aws/iam/get_saml_provider.py +15 -1
pulumi_aws/iam/outbound_web_identity_federation.py +0 -4
pulumi_aws/iam/policy.py +47 -0
pulumi_aws/iam/saml_provider.py +28 -0
pulumi_aws/iam/virtual_mfa_device.py +66 -38
pulumi_aws/imagebuilder/_inputs.py +87 -0
pulumi_aws/imagebuilder/image.py +47 -0
pulumi_aws/imagebuilder/image_pipeline.py +47 -0
pulumi_aws/imagebuilder/outputs.py +87 -0
pulumi_aws/kms/grant.py +18 -18
pulumi_aws/lambda_/_inputs.py +24 -4
pulumi_aws/lambda_/event_source_mapping.py +2 -0
pulumi_aws/lambda_/function.py +28 -0
pulumi_aws/lambda_/function_url.py +4 -0
pulumi_aws/lambda_/get_function.py +15 -1
pulumi_aws/lambda_/outputs.py +17 -3
pulumi_aws/lambda_/permission.py +47 -0
pulumi_aws/lb/listener.py +7 -7
pulumi_aws/lb/target_group.py +7 -7
pulumi_aws/lb/target_group_attachment.py +83 -0
pulumi_aws/networkfirewall/_inputs.py +3 -3
pulumi_aws/networkfirewall/outputs.py +2 -2
pulumi_aws/networkfirewall/vpc_endpoint_association.py +2 -2
pulumi_aws/networkmanager/vpc_attachment.py +7 -7
pulumi_aws/opensearchingest/pipeline.py +47 -0
pulumi_aws/organizations/__init__.py +1 -0
pulumi_aws/organizations/tag.py +292 -0
pulumi_aws/pulumi-plugin.json +1 -1
pulumi_aws/rds/cluster.py +21 -21
pulumi_aws/rds/get_proxy.py +29 -1
pulumi_aws/rds/proxy.py +94 -0
pulumi_aws/rds/proxy_default_target_group.py +0 -76
pulumi_aws/rds/proxy_target.py +0 -80
pulumi_aws/redshift/__init__.py +1 -0
pulumi_aws/redshift/_inputs.py +329 -0
pulumi_aws/redshift/idc_application.py +687 -0
pulumi_aws/redshift/outputs.py +265 -0
pulumi_aws/route53/get_resolver_firewall_rules.py +9 -0
pulumi_aws/route53/get_resolver_rule.py +19 -4
pulumi_aws/route53/outputs.py +108 -1
pulumi_aws/route53/resolver_firewall_rule.py +199 -32
pulumi_aws/secretsmanager/__init__.py +1 -0
pulumi_aws/secretsmanager/tag.py +333 -0
pulumi_aws/sesv2/__init__.py +1 -0
pulumi_aws/sesv2/tenant.py +418 -0
pulumi_aws/sfn/activity.py +0 -4
pulumi_aws/sfn/alias.py +0 -4
pulumi_aws/transfer/_inputs.py +126 -0
pulumi_aws/transfer/outputs.py +97 -0
pulumi_aws/transfer/web_app.py +54 -7
pulumi_aws/vpclattice/service_network_resource_association.py +47 -0
{pulumi_aws-7.15.0.dist-info → pulumi_aws-7.16.0.dist-info}/METADATA +1 -1
{pulumi_aws-7.15.0.dist-info → pulumi_aws-7.16.0.dist-info}/RECORD +105 -93
{pulumi_aws-7.15.0.dist-info → pulumi_aws-7.16.0.dist-info}/WHEEL +0 -0
{pulumi_aws-7.15.0.dist-info → pulumi_aws-7.16.0.dist-info}/top_level.txt +0 -0

pulumi_aws/cloudfront/_inputs.py CHANGED Viewed

@@ -29,6 +29,12 @@ __all__ = [
     'CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgsDict',
     'CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs',
     'CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgsDict',
+    'ConnectionFunctionConnectionFunctionConfigArgs',
+    'ConnectionFunctionConnectionFunctionConfigArgsDict',
+    'ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs',
+    'ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgsDict',
+    'ConnectionGroupTimeoutsArgs',
+    'ConnectionGroupTimeoutsArgsDict',
     'ContinuousDeploymentPolicyStagingDistributionDnsNamesArgs',
     'ContinuousDeploymentPolicyStagingDistributionDnsNamesArgsDict',
     'ContinuousDeploymentPolicyTrafficConfigArgs',
@@ -39,6 +45,8 @@ __all__ = [
     'ContinuousDeploymentPolicyTrafficConfigSingleWeightConfigArgsDict',
     'ContinuousDeploymentPolicyTrafficConfigSingleWeightConfigSessionStickinessConfigArgs',
     'ContinuousDeploymentPolicyTrafficConfigSingleWeightConfigSessionStickinessConfigArgsDict',
+    'DistributionConnectionFunctionAssociationArgs',
+    'DistributionConnectionFunctionAssociationArgsDict',
     'DistributionCustomErrorResponseArgs',
     'DistributionCustomErrorResponseArgsDict',
     'DistributionDefaultCacheBehaviorArgs',
@@ -89,6 +97,22 @@ __all__ = [
     'DistributionRestrictionsArgsDict',
     'DistributionRestrictionsGeoRestrictionArgs',
     'DistributionRestrictionsGeoRestrictionArgsDict',
+    'DistributionTenantCustomizationsArgs',
+    'DistributionTenantCustomizationsArgsDict',
+    'DistributionTenantCustomizationsCertificateArgs',
+    'DistributionTenantCustomizationsCertificateArgsDict',
+    'DistributionTenantCustomizationsGeoRestrictionArgs',
+    'DistributionTenantCustomizationsGeoRestrictionArgsDict',
+    'DistributionTenantCustomizationsWebAclArgs',
+    'DistributionTenantCustomizationsWebAclArgsDict',
+    'DistributionTenantDomainArgs',
+    'DistributionTenantDomainArgsDict',
+    'DistributionTenantManagedCertificateRequestArgs',
+    'DistributionTenantManagedCertificateRequestArgsDict',
+    'DistributionTenantParameterArgs',
+    'DistributionTenantParameterArgsDict',
+    'DistributionTenantTimeoutsArgs',
+    'DistributionTenantTimeoutsArgsDict',
     'DistributionTrustedKeyGroupArgs',
     'DistributionTrustedKeyGroupArgsDict',
     'DistributionTrustedKeyGroupItemArgs',
@@ -99,6 +123,10 @@ __all__ = [
     'DistributionTrustedSignerItemArgsDict',
     'DistributionViewerCertificateArgs',
     'DistributionViewerCertificateArgsDict',
+    'DistributionViewerMtlsConfigArgs',
+    'DistributionViewerMtlsConfigArgsDict',
+    'DistributionViewerMtlsConfigTrustStoreConfigArgs',
+    'DistributionViewerMtlsConfigTrustStoreConfigArgsDict',
     'FieldLevelEncryptionConfigContentTypeProfileConfigArgs',
     'FieldLevelEncryptionConfigContentTypeProfileConfigArgsDict',
     'FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs',
@@ -125,6 +153,64 @@ __all__ = [
     'MonitoringSubscriptionMonitoringSubscriptionArgsDict',
     'MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs',
     'MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict',
+    'MultitenantDistributionActiveTrustedKeyGroupArgs',
+    'MultitenantDistributionActiveTrustedKeyGroupArgsDict',
+    'MultitenantDistributionActiveTrustedKeyGroupItemArgs',
+    'MultitenantDistributionActiveTrustedKeyGroupItemArgsDict',
+    'MultitenantDistributionCacheBehaviorArgs',
+    'MultitenantDistributionCacheBehaviorArgsDict',
+    'MultitenantDistributionCacheBehaviorAllowedMethodsArgs',
+    'MultitenantDistributionCacheBehaviorAllowedMethodsArgsDict',
+    'MultitenantDistributionCacheBehaviorFunctionAssociationArgs',
+    'MultitenantDistributionCacheBehaviorFunctionAssociationArgsDict',
+    'MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs',
+    'MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgsDict',
+    'MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs',
+    'MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgsDict',
+    'MultitenantDistributionCustomErrorResponseArgs',
+    'MultitenantDistributionCustomErrorResponseArgsDict',
+    'MultitenantDistributionDefaultCacheBehaviorArgs',
+    'MultitenantDistributionDefaultCacheBehaviorArgsDict',
+    'MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs',
+    'MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgsDict',
+    'MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs',
+    'MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgsDict',
+    'MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs',
+    'MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgsDict',
+    'MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs',
+    'MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgsDict',
+    'MultitenantDistributionOriginArgs',
+    'MultitenantDistributionOriginArgsDict',
+    'MultitenantDistributionOriginCustomHeaderArgs',
+    'MultitenantDistributionOriginCustomHeaderArgsDict',
+    'MultitenantDistributionOriginCustomOriginConfigArgs',
+    'MultitenantDistributionOriginCustomOriginConfigArgsDict',
+    'MultitenantDistributionOriginGroupArgs',
+    'MultitenantDistributionOriginGroupArgsDict',
+    'MultitenantDistributionOriginGroupFailoverCriteriaArgs',
+    'MultitenantDistributionOriginGroupFailoverCriteriaArgsDict',
+    'MultitenantDistributionOriginGroupMemberArgs',
+    'MultitenantDistributionOriginGroupMemberArgsDict',
+    'MultitenantDistributionOriginOriginShieldArgs',
+    'MultitenantDistributionOriginOriginShieldArgsDict',
+    'MultitenantDistributionOriginVpcOriginConfigArgs',
+    'MultitenantDistributionOriginVpcOriginConfigArgsDict',
+    'MultitenantDistributionRestrictionsArgs',
+    'MultitenantDistributionRestrictionsArgsDict',
+    'MultitenantDistributionRestrictionsGeoRestrictionArgs',
+    'MultitenantDistributionRestrictionsGeoRestrictionArgsDict',
+    'MultitenantDistributionTenantConfigArgs',
+    'MultitenantDistributionTenantConfigArgsDict',
+    'MultitenantDistributionTenantConfigParameterDefinitionArgs',
+    'MultitenantDistributionTenantConfigParameterDefinitionArgsDict',
+    'MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs',
+    'MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgsDict',
+    'MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs',
+    'MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgsDict',
+    'MultitenantDistributionTimeoutsArgs',
+    'MultitenantDistributionTimeoutsArgsDict',
+    'MultitenantDistributionViewerCertificateArgs',
+    'MultitenantDistributionViewerCertificateArgsDict',
     'OriginRequestPolicyCookiesConfigArgs',
     'OriginRequestPolicyCookiesConfigArgsDict',
     'OriginRequestPolicyCookiesConfigCookiesArgs',
@@ -550,6 +636,179 @@ class CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQuery
         pulumi.set(self, "items", value)
+if not MYPY:
+    class ConnectionFunctionConnectionFunctionConfigArgsDict(TypedDict):
+        comment: pulumi.Input[_builtins.str]
+        """
+        Comment to describe the function.
+        """
+        runtime: pulumi.Input[_builtins.str]
+        """
+        Runtime environment for the function. Valid values are `cloudfront-js-1.0` and `cloudfront-js-2.0`.
+        """
+        key_value_store_association: NotRequired[pulumi.Input['ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgsDict']]
+        """
+        Key value store associations. See `key_value_store_association` below.
+        """
+elif False:
+    ConnectionFunctionConnectionFunctionConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class ConnectionFunctionConnectionFunctionConfigArgs:
+    def __init__(__self__, *,
+                 comment: pulumi.Input[_builtins.str],
+                 runtime: pulumi.Input[_builtins.str],
+                 key_value_store_association: Optional[pulumi.Input['ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs']] = None):
+        """
+        :param pulumi.Input[_builtins.str] comment: Comment to describe the function.
+        :param pulumi.Input[_builtins.str] runtime: Runtime environment for the function. Valid values are `cloudfront-js-1.0` and `cloudfront-js-2.0`.
+        :param pulumi.Input['ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs'] key_value_store_association: Key value store associations. See `key_value_store_association` below.
+        """
+        pulumi.set(__self__, "comment", comment)
+        pulumi.set(__self__, "runtime", runtime)
+        if key_value_store_association is not None:
+            pulumi.set(__self__, "key_value_store_association", key_value_store_association)
+    @_builtins.property
+    @pulumi.getter
+    def comment(self) -> pulumi.Input[_builtins.str]:
+        """
+        Comment to describe the function.
+        """
+        return pulumi.get(self, "comment")
+    @comment.setter
+    def comment(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "comment", value)
+    @_builtins.property
+    @pulumi.getter
+    def runtime(self) -> pulumi.Input[_builtins.str]:
+        """
+        Runtime environment for the function. Valid values are `cloudfront-js-1.0` and `cloudfront-js-2.0`.
+        """
+        return pulumi.get(self, "runtime")
+    @runtime.setter
+    def runtime(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "runtime", value)
+    @_builtins.property
+    @pulumi.getter(name="keyValueStoreAssociation")
+    def key_value_store_association(self) -> Optional[pulumi.Input['ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs']]:
+        """
+        Key value store associations. See `key_value_store_association` below.
+        """
+        return pulumi.get(self, "key_value_store_association")
+    @key_value_store_association.setter
+    def key_value_store_association(self, value: Optional[pulumi.Input['ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs']]):
+        pulumi.set(self, "key_value_store_association", value)
+if not MYPY:
+    class ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgsDict(TypedDict):
+        key_value_store_arn: pulumi.Input[_builtins.str]
+        """
+        ARN of the key value store.
+        """
+elif False:
+    ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class ConnectionFunctionConnectionFunctionConfigKeyValueStoreAssociationArgs:
+    def __init__(__self__, *,
+                 key_value_store_arn: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] key_value_store_arn: ARN of the key value store.
+        """
+        pulumi.set(__self__, "key_value_store_arn", key_value_store_arn)
+    @_builtins.property
+    @pulumi.getter(name="keyValueStoreArn")
+    def key_value_store_arn(self) -> pulumi.Input[_builtins.str]:
+        """
+        ARN of the key value store.
+        """
+        return pulumi.get(self, "key_value_store_arn")
+    @key_value_store_arn.setter
+    def key_value_store_arn(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "key_value_store_arn", value)
+if not MYPY:
+    class ConnectionGroupTimeoutsArgsDict(TypedDict):
+        create: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        delete: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        update: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+elif False:
+    ConnectionGroupTimeoutsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class ConnectionGroupTimeoutsArgs:
+    def __init__(__self__, *,
+                 create: Optional[pulumi.Input[_builtins.str]] = None,
+                 delete: Optional[pulumi.Input[_builtins.str]] = None,
+                 update: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.str] create: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        :param pulumi.Input[_builtins.str] delete: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        :param pulumi.Input[_builtins.str] update: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        if create is not None:
+            pulumi.set(__self__, "create", create)
+        if delete is not None:
+            pulumi.set(__self__, "delete", delete)
+        if update is not None:
+            pulumi.set(__self__, "update", update)
+    @_builtins.property
+    @pulumi.getter
+    def create(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        return pulumi.get(self, "create")
+    @create.setter
+    def create(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "create", value)
+    @_builtins.property
+    @pulumi.getter
+    def delete(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        return pulumi.get(self, "delete")
+    @delete.setter
+    def delete(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "delete", value)
+    @_builtins.property
+    @pulumi.getter
+    def update(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Default is 90 minutes.
+        """
+        return pulumi.get(self, "update")
+    @update.setter
+    def update(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "update", value)
 if not MYPY:
     class ContinuousDeploymentPolicyStagingDistributionDnsNamesArgsDict(TypedDict):
         quantity: pulumi.Input[_builtins.int]
@@ -823,6 +1082,37 @@ class ContinuousDeploymentPolicyTrafficConfigSingleWeightConfigSessionStickiness
         pulumi.set(self, "maximum_ttl", value)
+if not MYPY:
+    class DistributionConnectionFunctionAssociationArgsDict(TypedDict):
+        id: pulumi.Input[_builtins.str]
+        """
+        Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+        """
+elif False:
+    DistributionConnectionFunctionAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionConnectionFunctionAssociationArgs:
+    def __init__(__self__, *,
+                 id: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] id: Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+        """
+        pulumi.set(__self__, "id", id)
+    @_builtins.property
+    @pulumi.getter
+    def id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Identifier for the distribution. For example: `EDFDVBD632BHDS5`.
+        """
+        return pulumi.get(self, "id")
+    @id.setter
+    def id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "id", value)
 if not MYPY:
     class DistributionCustomErrorResponseArgsDict(TypedDict):
         error_code: pulumi.Input[_builtins.int]
@@ -3023,6 +3313,10 @@ if not MYPY:
         """
         origin_keepalive_timeout: NotRequired[pulumi.Input[_builtins.int]]
         origin_read_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        owner_account_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        The AWS account ID that owns the VPC origin. Required when referencing a VPC origin from a different AWS account for cross-account VPC origin access.
+        """
 elif False:
     DistributionOriginVpcOriginConfigArgsDict: TypeAlias = Mapping[str, Any]
@@ -3031,15 +3325,19 @@ class DistributionOriginVpcOriginConfigArgs:
     def __init__(__self__, *,
                  vpc_origin_id: pulumi.Input[_builtins.str],
                  origin_keepalive_timeout: Optional[pulumi.Input[_builtins.int]] = None,
-                 origin_read_timeout: Optional[pulumi.Input[_builtins.int]] = None):
+                 origin_read_timeout: Optional[pulumi.Input[_builtins.int]] = None,
+                 owner_account_id: Optional[pulumi.Input[_builtins.str]] = None):
         """
         :param pulumi.Input[_builtins.str] vpc_origin_id: The VPC origin ID.
+        :param pulumi.Input[_builtins.str] owner_account_id: The AWS account ID that owns the VPC origin. Required when referencing a VPC origin from a different AWS account for cross-account VPC origin access.
         """
         pulumi.set(__self__, "vpc_origin_id", vpc_origin_id)
         if origin_keepalive_timeout is not None:
             pulumi.set(__self__, "origin_keepalive_timeout", origin_keepalive_timeout)
         if origin_read_timeout is not None:
             pulumi.set(__self__, "origin_read_timeout", origin_read_timeout)
+        if owner_account_id is not None:
+            pulumi.set(__self__, "owner_account_id", owner_account_id)
     @_builtins.property
     @pulumi.getter(name="vpcOriginId")
@@ -3071,6 +3369,18 @@ class DistributionOriginVpcOriginConfigArgs:
     def origin_read_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
         pulumi.set(self, "origin_read_timeout", value)
+    @_builtins.property
+    @pulumi.getter(name="ownerAccountId")
+    def owner_account_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        The AWS account ID that owns the VPC origin. Required when referencing a VPC origin from a different AWS account for cross-account VPC origin access.
+        """
+        return pulumi.get(self, "owner_account_id")
+    @owner_account_id.setter
+    def owner_account_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "owner_account_id", value)
 if not MYPY:
     class DistributionRestrictionsArgsDict(TypedDict):
@@ -3146,710 +3456,3519 @@ class DistributionRestrictionsGeoRestrictionArgs:
 if not MYPY:
-    class DistributionTrustedKeyGroupArgsDict(TypedDict):
-        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+    class DistributionTenantCustomizationsArgsDict(TypedDict):
+        certificate: NotRequired[pulumi.Input['DistributionTenantCustomizationsCertificateArgsDict']]
         """
-        Whether the distribution is enabled to accept end user requests for content.
+        Certificate configuration for the tenant (maximum one).
         """
-        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgsDict']]]]
+        geo_restriction: NotRequired[pulumi.Input['DistributionTenantCustomizationsGeoRestrictionArgsDict']]
         """
-        List of nested attributes for each trusted signer
+        Geographic restrictions configuration for the tenant (maximum one).
+        """
+        web_acl: NotRequired[pulumi.Input['DistributionTenantCustomizationsWebAclArgsDict']]
+        """
+        Web ACL configuration for the tenant (maximum one).
         """
 elif False:
-    DistributionTrustedKeyGroupArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantCustomizationsArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class DistributionTrustedKeyGroupArgs:
+class DistributionTenantCustomizationsArgs:
     def __init__(__self__, *,
-                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
-                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]] = None):
+                 certificate: Optional[pulumi.Input['DistributionTenantCustomizationsCertificateArgs']] = None,
+                 geo_restriction: Optional[pulumi.Input['DistributionTenantCustomizationsGeoRestrictionArgs']] = None,
+                 web_acl: Optional[pulumi.Input['DistributionTenantCustomizationsWebAclArgs']] = None):
         """
-        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
-        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]] items: List of nested attributes for each trusted signer
+        :param pulumi.Input['DistributionTenantCustomizationsCertificateArgs'] certificate: Certificate configuration for the tenant (maximum one).
+        :param pulumi.Input['DistributionTenantCustomizationsGeoRestrictionArgs'] geo_restriction: Geographic restrictions configuration for the tenant (maximum one).
+        :param pulumi.Input['DistributionTenantCustomizationsWebAclArgs'] web_acl: Web ACL configuration for the tenant (maximum one).
         """
-        if enabled is not None:
-            pulumi.set(__self__, "enabled", enabled)
-        if items is not None:
-            pulumi.set(__self__, "items", items)
+        if certificate is not None:
+            pulumi.set(__self__, "certificate", certificate)
+        if geo_restriction is not None:
+            pulumi.set(__self__, "geo_restriction", geo_restriction)
+        if web_acl is not None:
+            pulumi.set(__self__, "web_acl", web_acl)
     @_builtins.property
     @pulumi.getter
-    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+    def certificate(self) -> Optional[pulumi.Input['DistributionTenantCustomizationsCertificateArgs']]:
         """
-        Whether the distribution is enabled to accept end user requests for content.
+        Certificate configuration for the tenant (maximum one).
         """
-        return pulumi.get(self, "enabled")
+        return pulumi.get(self, "certificate")
-    @enabled.setter
-    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
-        pulumi.set(self, "enabled", value)
+    @certificate.setter
+    def certificate(self, value: Optional[pulumi.Input['DistributionTenantCustomizationsCertificateArgs']]):
+        pulumi.set(self, "certificate", value)
+    @_builtins.property
+    @pulumi.getter(name="geoRestriction")
+    def geo_restriction(self) -> Optional[pulumi.Input['DistributionTenantCustomizationsGeoRestrictionArgs']]:
+        """
+        Geographic restrictions configuration for the tenant (maximum one).
+        """
+        return pulumi.get(self, "geo_restriction")
+    @geo_restriction.setter
+    def geo_restriction(self, value: Optional[pulumi.Input['DistributionTenantCustomizationsGeoRestrictionArgs']]):
+        pulumi.set(self, "geo_restriction", value)
+    @_builtins.property
+    @pulumi.getter(name="webAcl")
+    def web_acl(self) -> Optional[pulumi.Input['DistributionTenantCustomizationsWebAclArgs']]:
+        """
+        Web ACL configuration for the tenant (maximum one).
+        """
+        return pulumi.get(self, "web_acl")
+    @web_acl.setter
+    def web_acl(self, value: Optional[pulumi.Input['DistributionTenantCustomizationsWebAclArgs']]):
+        pulumi.set(self, "web_acl", value)
+if not MYPY:
+    class DistributionTenantCustomizationsCertificateArgsDict(TypedDict):
+        arn: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ARN of the distribution tenant.
+        """
+elif False:
+    DistributionTenantCustomizationsCertificateArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionTenantCustomizationsCertificateArgs:
+    def __init__(__self__, *,
+                 arn: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.str] arn: ARN of the distribution tenant.
+        """
+        if arn is not None:
+            pulumi.set(__self__, "arn", arn)
     @_builtins.property
     @pulumi.getter
-    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]:
+    def arn(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        List of nested attributes for each trusted signer
+        ARN of the distribution tenant.
         """
-        return pulumi.get(self, "items")
+        return pulumi.get(self, "arn")
-    @items.setter
-    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]):
-        pulumi.set(self, "items", value)
+    @arn.setter
+    def arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "arn", value)
 if not MYPY:
-    class DistributionTrustedKeyGroupItemArgsDict(TypedDict):
-        key_group_id: NotRequired[pulumi.Input[_builtins.str]]
+    class DistributionTenantCustomizationsGeoRestrictionArgsDict(TypedDict):
+        locations: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
         """
-        ID of the key group that contains the public keys.
+        Set of ISO 3166-1-alpha-2 country codes for the restriction. Required if `restriction_type` is `whitelist` or `blacklist`.
         """
-        key_pair_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        restriction_type: NotRequired[pulumi.Input[_builtins.str]]
         """
-        Set of active CloudFront key pairs associated with the signer account
+        Method to restrict distribution by country: `none`, `whitelist`, or `blacklist`.
         """
 elif False:
-    DistributionTrustedKeyGroupItemArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantCustomizationsGeoRestrictionArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class DistributionTrustedKeyGroupItemArgs:
+class DistributionTenantCustomizationsGeoRestrictionArgs:
     def __init__(__self__, *,
-                 key_group_id: Optional[pulumi.Input[_builtins.str]] = None,
-                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+                 locations: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 restriction_type: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input[_builtins.str] key_group_id: ID of the key group that contains the public keys.
-        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] locations: Set of ISO 3166-1-alpha-2 country codes for the restriction. Required if `restriction_type` is `whitelist` or `blacklist`.
+        :param pulumi.Input[_builtins.str] restriction_type: Method to restrict distribution by country: `none`, `whitelist`, or `blacklist`.
         """
-        if key_group_id is not None:
-            pulumi.set(__self__, "key_group_id", key_group_id)
-        if key_pair_ids is not None:
-            pulumi.set(__self__, "key_pair_ids", key_pair_ids)
+        if locations is not None:
+            pulumi.set(__self__, "locations", locations)
+        if restriction_type is not None:
+            pulumi.set(__self__, "restriction_type", restriction_type)
     @_builtins.property
-    @pulumi.getter(name="keyGroupId")
-    def key_group_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter
+    def locations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
         """
-        ID of the key group that contains the public keys.
+        Set of ISO 3166-1-alpha-2 country codes for the restriction. Required if `restriction_type` is `whitelist` or `blacklist`.
         """
-        return pulumi.get(self, "key_group_id")
+        return pulumi.get(self, "locations")
-    @key_group_id.setter
-    def key_group_id(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "key_group_id", value)
+    @locations.setter
+    def locations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "locations", value)
     @_builtins.property
-    @pulumi.getter(name="keyPairIds")
-    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+    @pulumi.getter(name="restrictionType")
+    def restriction_type(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Set of active CloudFront key pairs associated with the signer account
+        Method to restrict distribution by country: `none`, `whitelist`, or `blacklist`.
         """
-        return pulumi.get(self, "key_pair_ids")
+        return pulumi.get(self, "restriction_type")
-    @key_pair_ids.setter
-    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
-        pulumi.set(self, "key_pair_ids", value)
+    @restriction_type.setter
+    def restriction_type(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "restriction_type", value)
 if not MYPY:
-    class DistributionTrustedSignerArgsDict(TypedDict):
-        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+    class DistributionTenantCustomizationsWebAclArgsDict(TypedDict):
+        action: NotRequired[pulumi.Input[_builtins.str]]
         """
-        Whether the distribution is enabled to accept end user requests for content.
+        Action to take for the web ACL. Valid values: `allow`, `block`.
         """
-        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgsDict']]]]
+        arn: NotRequired[pulumi.Input[_builtins.str]]
         """
-        List of nested attributes for each trusted signer
+        ARN of the distribution tenant.
         """
 elif False:
-    DistributionTrustedSignerArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantCustomizationsWebAclArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class DistributionTrustedSignerArgs:
+class DistributionTenantCustomizationsWebAclArgs:
     def __init__(__self__, *,
-                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
-                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]] = None):
+                 action: Optional[pulumi.Input[_builtins.str]] = None,
+                 arn: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
-        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]] items: List of nested attributes for each trusted signer
+        :param pulumi.Input[_builtins.str] action: Action to take for the web ACL. Valid values: `allow`, `block`.
+        :param pulumi.Input[_builtins.str] arn: ARN of the distribution tenant.
         """
-        if enabled is not None:
-            pulumi.set(__self__, "enabled", enabled)
-        if items is not None:
-            pulumi.set(__self__, "items", items)
+        if action is not None:
+            pulumi.set(__self__, "action", action)
+        if arn is not None:
+            pulumi.set(__self__, "arn", arn)
     @_builtins.property
     @pulumi.getter
-    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+    def action(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Whether the distribution is enabled to accept end user requests for content.
+        Action to take for the web ACL. Valid values: `allow`, `block`.
         """
-        return pulumi.get(self, "enabled")
+        return pulumi.get(self, "action")
-    @enabled.setter
-    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
-        pulumi.set(self, "enabled", value)
+    @action.setter
+    def action(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "action", value)
     @_builtins.property
     @pulumi.getter
-    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]:
+    def arn(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        List of nested attributes for each trusted signer
+        ARN of the distribution tenant.
         """
-        return pulumi.get(self, "items")
+        return pulumi.get(self, "arn")
-    @items.setter
-    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]):
-        pulumi.set(self, "items", value)
+    @arn.setter
+    def arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "arn", value)
 if not MYPY:
-    class DistributionTrustedSignerItemArgsDict(TypedDict):
-        aws_account_number: NotRequired[pulumi.Input[_builtins.str]]
+    class DistributionTenantDomainArgsDict(TypedDict):
+        domain: pulumi.Input[_builtins.str]
         """
-        AWS account ID or `self`
+        Set of domains associated with the distribution tenant.
         """
-        key_pair_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        status: NotRequired[pulumi.Input[_builtins.str]]
         """
-        Set of active CloudFront key pairs associated with the signer account
+        Current status of the distribution tenant.
         """
 elif False:
-    DistributionTrustedSignerItemArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantDomainArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class DistributionTrustedSignerItemArgs:
+class DistributionTenantDomainArgs:
     def __init__(__self__, *,
-                 aws_account_number: Optional[pulumi.Input[_builtins.str]] = None,
-                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+                 domain: pulumi.Input[_builtins.str],
+                 status: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input[_builtins.str] aws_account_number: AWS account ID or `self`
-        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
+        :param pulumi.Input[_builtins.str] domain: Set of domains associated with the distribution tenant.
+        :param pulumi.Input[_builtins.str] status: Current status of the distribution tenant.
         """
-        if aws_account_number is not None:
-            pulumi.set(__self__, "aws_account_number", aws_account_number)
-        if key_pair_ids is not None:
-            pulumi.set(__self__, "key_pair_ids", key_pair_ids)
+        pulumi.set(__self__, "domain", domain)
+        if status is not None:
+            pulumi.set(__self__, "status", status)
     @_builtins.property
-    @pulumi.getter(name="awsAccountNumber")
-    def aws_account_number(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter
+    def domain(self) -> pulumi.Input[_builtins.str]:
         """
-        AWS account ID or `self`
+        Set of domains associated with the distribution tenant.
         """
-        return pulumi.get(self, "aws_account_number")
+        return pulumi.get(self, "domain")
-    @aws_account_number.setter
-    def aws_account_number(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "aws_account_number", value)
+    @domain.setter
+    def domain(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "domain", value)
     @_builtins.property
-    @pulumi.getter(name="keyPairIds")
-    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+    @pulumi.getter
+    def status(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Set of active CloudFront key pairs associated with the signer account
+        Current status of the distribution tenant.
         """
-        return pulumi.get(self, "key_pair_ids")
+        return pulumi.get(self, "status")
-    @key_pair_ids.setter
-    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
-        pulumi.set(self, "key_pair_ids", value)
+    @status.setter
+    def status(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "status", value)
 if not MYPY:
-    class DistributionViewerCertificateArgsDict(TypedDict):
-        acm_certificate_arn: NotRequired[pulumi.Input[_builtins.str]]
-        """
-        ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
-        """
-        cloudfront_default_certificate: NotRequired[pulumi.Input[_builtins.bool]]
-        """
-        `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
-        """
-        iam_certificate_id: NotRequired[pulumi.Input[_builtins.str]]
+    class DistributionTenantManagedCertificateRequestArgsDict(TypedDict):
+        certificate_transparency_logging_preference: NotRequired[pulumi.Input[_builtins.str]]
         """
-        IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+        Certificate transparency logging preference. Valid values: `enabled`, `disabled`.
         """
-        minimum_protocol_version: NotRequired[pulumi.Input[_builtins.str]]
+        primary_domain_name: NotRequired[pulumi.Input[_builtins.str]]
         """
-        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+        Primary domain name for the certificate.
         """
-        ssl_support_method: NotRequired[pulumi.Input[_builtins.str]]
+        validation_token_host: NotRequired[pulumi.Input[_builtins.str]]
         """
-        How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        Host for validation token. Valid values: `cloudfront`, `domain`.
         """
 elif False:
-    DistributionViewerCertificateArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantManagedCertificateRequestArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class DistributionViewerCertificateArgs:
+class DistributionTenantManagedCertificateRequestArgs:
     def __init__(__self__, *,
-                 acm_certificate_arn: Optional[pulumi.Input[_builtins.str]] = None,
-                 cloudfront_default_certificate: Optional[pulumi.Input[_builtins.bool]] = None,
-                 iam_certificate_id: Optional[pulumi.Input[_builtins.str]] = None,
-                 minimum_protocol_version: Optional[pulumi.Input[_builtins.str]] = None,
-                 ssl_support_method: Optional[pulumi.Input[_builtins.str]] = None):
+                 certificate_transparency_logging_preference: Optional[pulumi.Input[_builtins.str]] = None,
+                 primary_domain_name: Optional[pulumi.Input[_builtins.str]] = None,
+                 validation_token_host: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input[_builtins.str] acm_certificate_arn: ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
-        :param pulumi.Input[_builtins.bool] cloudfront_default_certificate: `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
-        :param pulumi.Input[_builtins.str] iam_certificate_id: IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
-        :param pulumi.Input[_builtins.str] minimum_protocol_version: Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
-        :param pulumi.Input[_builtins.str] ssl_support_method: How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        :param pulumi.Input[_builtins.str] certificate_transparency_logging_preference: Certificate transparency logging preference. Valid values: `enabled`, `disabled`.
+        :param pulumi.Input[_builtins.str] primary_domain_name: Primary domain name for the certificate.
+        :param pulumi.Input[_builtins.str] validation_token_host: Host for validation token. Valid values: `cloudfront`, `domain`.
         """
-        if acm_certificate_arn is not None:
-            pulumi.set(__self__, "acm_certificate_arn", acm_certificate_arn)
-        if cloudfront_default_certificate is not None:
-            pulumi.set(__self__, "cloudfront_default_certificate", cloudfront_default_certificate)
-        if iam_certificate_id is not None:
-            pulumi.set(__self__, "iam_certificate_id", iam_certificate_id)
-        if minimum_protocol_version is not None:
-            pulumi.set(__self__, "minimum_protocol_version", minimum_protocol_version)
-        if ssl_support_method is not None:
-            pulumi.set(__self__, "ssl_support_method", ssl_support_method)
+        if certificate_transparency_logging_preference is not None:
+            pulumi.set(__self__, "certificate_transparency_logging_preference", certificate_transparency_logging_preference)
+        if primary_domain_name is not None:
+            pulumi.set(__self__, "primary_domain_name", primary_domain_name)
+        if validation_token_host is not None:
+            pulumi.set(__self__, "validation_token_host", validation_token_host)
     @_builtins.property
-    @pulumi.getter(name="acmCertificateArn")
-    def acm_certificate_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter(name="certificateTransparencyLoggingPreference")
+    def certificate_transparency_logging_preference(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
+        Certificate transparency logging preference. Valid values: `enabled`, `disabled`.
         """
-        return pulumi.get(self, "acm_certificate_arn")
+        return pulumi.get(self, "certificate_transparency_logging_preference")
-    @acm_certificate_arn.setter
-    def acm_certificate_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "acm_certificate_arn", value)
+    @certificate_transparency_logging_preference.setter
+    def certificate_transparency_logging_preference(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "certificate_transparency_logging_preference", value)
     @_builtins.property
-    @pulumi.getter(name="cloudfrontDefaultCertificate")
-    def cloudfront_default_certificate(self) -> Optional[pulumi.Input[_builtins.bool]]:
+    @pulumi.getter(name="primaryDomainName")
+    def primary_domain_name(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
+        Primary domain name for the certificate.
         """
-        return pulumi.get(self, "cloudfront_default_certificate")
+        return pulumi.get(self, "primary_domain_name")
-    @cloudfront_default_certificate.setter
-    def cloudfront_default_certificate(self, value: Optional[pulumi.Input[_builtins.bool]]):
-        pulumi.set(self, "cloudfront_default_certificate", value)
+    @primary_domain_name.setter
+    def primary_domain_name(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "primary_domain_name", value)
     @_builtins.property
-    @pulumi.getter(name="iamCertificateId")
-    def iam_certificate_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter(name="validationTokenHost")
+    def validation_token_host(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+        Host for validation token. Valid values: `cloudfront`, `domain`.
         """
-        return pulumi.get(self, "iam_certificate_id")
+        return pulumi.get(self, "validation_token_host")
+    @validation_token_host.setter
+    def validation_token_host(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "validation_token_host", value)
-    @iam_certificate_id.setter
-    def iam_certificate_id(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "iam_certificate_id", value)
+if not MYPY:
+    class DistributionTenantParameterArgsDict(TypedDict):
+        name: pulumi.Input[_builtins.str]
+        """
+        Name of the distribution tenant.
+        """
+        value: pulumi.Input[_builtins.str]
+        """
+        Value of the parameter.
+        """
+elif False:
+    DistributionTenantParameterArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionTenantParameterArgs:
+    def __init__(__self__, *,
+                 name: pulumi.Input[_builtins.str],
+                 value: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] name: Name of the distribution tenant.
+        :param pulumi.Input[_builtins.str] value: Value of the parameter.
+        """
+        pulumi.set(__self__, "name", name)
+        pulumi.set(__self__, "value", value)
     @_builtins.property
-    @pulumi.getter(name="minimumProtocolVersion")
-    def minimum_protocol_version(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter
+    def name(self) -> pulumi.Input[_builtins.str]:
         """
-        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+        Name of the distribution tenant.
         """
-        return pulumi.get(self, "minimum_protocol_version")
+        return pulumi.get(self, "name")
-    @minimum_protocol_version.setter
-    def minimum_protocol_version(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "minimum_protocol_version", value)
+    @name.setter
+    def name(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "name", value)
     @_builtins.property
-    @pulumi.getter(name="sslSupportMethod")
-    def ssl_support_method(self) -> Optional[pulumi.Input[_builtins.str]]:
+    @pulumi.getter
+    def value(self) -> pulumi.Input[_builtins.str]:
         """
-        How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        Value of the parameter.
         """
-        return pulumi.get(self, "ssl_support_method")
+        return pulumi.get(self, "value")
-    @ssl_support_method.setter
-    def ssl_support_method(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "ssl_support_method", value)
+    @value.setter
+    def value(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "value", value)
 if not MYPY:
-    class FieldLevelEncryptionConfigContentTypeProfileConfigArgsDict(TypedDict):
-        content_type_profiles: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict']
+    class DistributionTenantTimeoutsArgsDict(TypedDict):
+        create: NotRequired[pulumi.Input[_builtins.str]]
         """
-        Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
-        forward_when_content_type_is_unknown: pulumi.Input[_builtins.bool]
+        delete: NotRequired[pulumi.Input[_builtins.str]]
         """
-        specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+        """
+        update: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
 elif False:
-    FieldLevelEncryptionConfigContentTypeProfileConfigArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTenantTimeoutsArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionConfigContentTypeProfileConfigArgs:
+class DistributionTenantTimeoutsArgs:
     def __init__(__self__, *,
-                 content_type_profiles: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'],
-                 forward_when_content_type_is_unknown: pulumi.Input[_builtins.bool]):
+                 create: Optional[pulumi.Input[_builtins.str]] = None,
+                 delete: Optional[pulumi.Input[_builtins.str]] = None,
+                 update: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'] content_type_profiles: Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
-        :param pulumi.Input[_builtins.bool] forward_when_content_type_is_unknown: specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        :param pulumi.Input[_builtins.str] create: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        :param pulumi.Input[_builtins.str] delete: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+        :param pulumi.Input[_builtins.str] update: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
-        pulumi.set(__self__, "content_type_profiles", content_type_profiles)
-        pulumi.set(__self__, "forward_when_content_type_is_unknown", forward_when_content_type_is_unknown)
+        if create is not None:
+            pulumi.set(__self__, "create", create)
+        if delete is not None:
+            pulumi.set(__self__, "delete", delete)
+        if update is not None:
+            pulumi.set(__self__, "update", update)
     @_builtins.property
-    @pulumi.getter(name="contentTypeProfiles")
-    def content_type_profiles(self) -> pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']:
+    @pulumi.getter
+    def create(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
-        return pulumi.get(self, "content_type_profiles")
+        return pulumi.get(self, "create")
-    @content_type_profiles.setter
-    def content_type_profiles(self, value: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']):
-        pulumi.set(self, "content_type_profiles", value)
+    @create.setter
+    def create(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "create", value)
     @_builtins.property
-    @pulumi.getter(name="forwardWhenContentTypeIsUnknown")
-    def forward_when_content_type_is_unknown(self) -> pulumi.Input[_builtins.bool]:
+    @pulumi.getter
+    def delete(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
         """
-        return pulumi.get(self, "forward_when_content_type_is_unknown")
-    @forward_when_content_type_is_unknown.setter
-    def forward_when_content_type_is_unknown(self, value: pulumi.Input[_builtins.bool]):
-        pulumi.set(self, "forward_when_content_type_is_unknown", value)
-if not MYPY:
-    class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict(TypedDict):
-        items: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict']]]
-elif False:
-    FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict: TypeAlias = Mapping[str, Any]
+        return pulumi.get(self, "delete")
-@pulumi.input_type
-class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs:
-    def __init__(__self__, *,
-                 items: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
-        pulumi.set(__self__, "items", items)
+    @delete.setter
+    def delete(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "delete", value)
     @_builtins.property
     @pulumi.getter
-    def items(self) -> pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]:
-        return pulumi.get(self, "items")
+    def update(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        """
+        return pulumi.get(self, "update")
-    @items.setter
-    def items(self, value: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
-        pulumi.set(self, "items", value)
+    @update.setter
+    def update(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "update", value)
 if not MYPY:
-    class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict(TypedDict):
-        content_type: pulumi.Input[_builtins.str]
+    class DistributionTrustedKeyGroupArgsDict(TypedDict):
+        enabled: NotRequired[pulumi.Input[_builtins.bool]]
         """
-        he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+        Whether the distribution is enabled to accept end user requests for content.
         """
-        format: pulumi.Input[_builtins.str]
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgsDict']]]]
         """
-        The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        List of nested attributes for each trusted signer
         """
-        profile_id: NotRequired[pulumi.Input[_builtins.str]]
 elif False:
-    FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict: TypeAlias = Mapping[str, Any]
+    DistributionTrustedKeyGroupArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs:
+class DistributionTrustedKeyGroupArgs:
     def __init__(__self__, *,
-                 content_type: pulumi.Input[_builtins.str],
-                 format: pulumi.Input[_builtins.str],
-                 profile_id: Optional[pulumi.Input[_builtins.str]] = None):
+                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]] = None):
         """
-        :param pulumi.Input[_builtins.str] content_type: he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
-        :param pulumi.Input[_builtins.str] format: The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
+        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]] items: List of nested attributes for each trusted signer
         """
-        pulumi.set(__self__, "content_type", content_type)
-        pulumi.set(__self__, "format", format)
-        if profile_id is not None:
-            pulumi.set(__self__, "profile_id", profile_id)
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        return pulumi.get(self, "enabled")
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "enabled", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]:
+        """
+        List of nested attributes for each trusted signer
+        """
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class DistributionTrustedKeyGroupItemArgsDict(TypedDict):
+        key_group_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ID of the key group that contains the public keys.
+        """
+        key_pair_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        """
+        Set of active CloudFront key pairs associated with the signer account
+        """
+elif False:
+    DistributionTrustedKeyGroupItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionTrustedKeyGroupItemArgs:
+    def __init__(__self__, *,
+                 key_group_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] key_group_id: ID of the key group that contains the public keys.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
+        """
+        if key_group_id is not None:
+            pulumi.set(__self__, "key_group_id", key_group_id)
+        if key_pair_ids is not None:
+            pulumi.set(__self__, "key_pair_ids", key_pair_ids)
+    @_builtins.property
+    @pulumi.getter(name="keyGroupId")
+    def key_group_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        ID of the key group that contains the public keys.
+        """
+        return pulumi.get(self, "key_group_id")
+    @key_group_id.setter
+    def key_group_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "key_group_id", value)
+    @_builtins.property
+    @pulumi.getter(name="keyPairIds")
+    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        Set of active CloudFront key pairs associated with the signer account
+        """
+        return pulumi.get(self, "key_pair_ids")
+    @key_pair_ids.setter
+    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "key_pair_ids", value)
+if not MYPY:
+    class DistributionTrustedSignerArgsDict(TypedDict):
+        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgsDict']]]]
+        """
+        List of nested attributes for each trusted signer
+        """
+elif False:
+    DistributionTrustedSignerArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionTrustedSignerArgs:
+    def __init__(__self__, *,
+                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]] = None):
+        """
+        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
+        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]] items: List of nested attributes for each trusted signer
+        """
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        return pulumi.get(self, "enabled")
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "enabled", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]:
+        """
+        List of nested attributes for each trusted signer
+        """
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class DistributionTrustedSignerItemArgsDict(TypedDict):
+        aws_account_number: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        AWS account ID or `self`
+        """
+        key_pair_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        """
+        Set of active CloudFront key pairs associated with the signer account
+        """
+elif False:
+    DistributionTrustedSignerItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionTrustedSignerItemArgs:
+    def __init__(__self__, *,
+                 aws_account_number: Optional[pulumi.Input[_builtins.str]] = None,
+                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] aws_account_number: AWS account ID or `self`
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
+        """
+        if aws_account_number is not None:
+            pulumi.set(__self__, "aws_account_number", aws_account_number)
+        if key_pair_ids is not None:
+            pulumi.set(__self__, "key_pair_ids", key_pair_ids)
+    @_builtins.property
+    @pulumi.getter(name="awsAccountNumber")
+    def aws_account_number(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        AWS account ID or `self`
+        """
+        return pulumi.get(self, "aws_account_number")
+    @aws_account_number.setter
+    def aws_account_number(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "aws_account_number", value)
+    @_builtins.property
+    @pulumi.getter(name="keyPairIds")
+    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        Set of active CloudFront key pairs associated with the signer account
+        """
+        return pulumi.get(self, "key_pair_ids")
+    @key_pair_ids.setter
+    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "key_pair_ids", value)
+if not MYPY:
+    class DistributionViewerCertificateArgsDict(TypedDict):
+        acm_certificate_arn: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
+        """
+        cloudfront_default_certificate: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
+        """
+        iam_certificate_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+        """
+        minimum_protocol_version: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+        """
+        ssl_support_method: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        """
+elif False:
+    DistributionViewerCertificateArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionViewerCertificateArgs:
+    def __init__(__self__, *,
+                 acm_certificate_arn: Optional[pulumi.Input[_builtins.str]] = None,
+                 cloudfront_default_certificate: Optional[pulumi.Input[_builtins.bool]] = None,
+                 iam_certificate_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 minimum_protocol_version: Optional[pulumi.Input[_builtins.str]] = None,
+                 ssl_support_method: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.str] acm_certificate_arn: ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
+        :param pulumi.Input[_builtins.bool] cloudfront_default_certificate: `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
+        :param pulumi.Input[_builtins.str] iam_certificate_id: IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+        :param pulumi.Input[_builtins.str] minimum_protocol_version: Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+        :param pulumi.Input[_builtins.str] ssl_support_method: How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        """
+        if acm_certificate_arn is not None:
+            pulumi.set(__self__, "acm_certificate_arn", acm_certificate_arn)
+        if cloudfront_default_certificate is not None:
+            pulumi.set(__self__, "cloudfront_default_certificate", cloudfront_default_certificate)
+        if iam_certificate_id is not None:
+            pulumi.set(__self__, "iam_certificate_id", iam_certificate_id)
+        if minimum_protocol_version is not None:
+            pulumi.set(__self__, "minimum_protocol_version", minimum_protocol_version)
+        if ssl_support_method is not None:
+            pulumi.set(__self__, "ssl_support_method", ssl_support_method)
+    @_builtins.property
+    @pulumi.getter(name="acmCertificateArn")
+    def acm_certificate_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
+        """
+        return pulumi.get(self, "acm_certificate_arn")
+    @acm_certificate_arn.setter
+    def acm_certificate_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "acm_certificate_arn", value)
+    @_builtins.property
+    @pulumi.getter(name="cloudfrontDefaultCertificate")
+    def cloudfront_default_certificate(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
+        """
+        return pulumi.get(self, "cloudfront_default_certificate")
+    @cloudfront_default_certificate.setter
+    def cloudfront_default_certificate(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "cloudfront_default_certificate", value)
+    @_builtins.property
+    @pulumi.getter(name="iamCertificateId")
+    def iam_certificate_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
+        """
+        return pulumi.get(self, "iam_certificate_id")
+    @iam_certificate_id.setter
+    def iam_certificate_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "iam_certificate_id", value)
+    @_builtins.property
+    @pulumi.getter(name="minimumProtocolVersion")
+    def minimum_protocol_version(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
+        """
+        return pulumi.get(self, "minimum_protocol_version")
+    @minimum_protocol_version.setter
+    def minimum_protocol_version(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "minimum_protocol_version", value)
+    @_builtins.property
+    @pulumi.getter(name="sslSupportMethod")
+    def ssl_support_method(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        How you want CloudFront to serve HTTPS requests. One of `vip`, `sni-only`, or `static-ip`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
+        """
+        return pulumi.get(self, "ssl_support_method")
+    @ssl_support_method.setter
+    def ssl_support_method(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "ssl_support_method", value)
+if not MYPY:
+    class DistributionViewerMtlsConfigArgsDict(TypedDict):
+        mode: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        The mode for viewer mTLS. Valid values: `required`, `optional`.
+        """
+        trust_store_config: NotRequired[pulumi.Input['DistributionViewerMtlsConfigTrustStoreConfigArgsDict']]
+        """
+        The trust store configuration for viewer mTLS (maximum one).
+        """
+elif False:
+    DistributionViewerMtlsConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionViewerMtlsConfigArgs:
+    def __init__(__self__, *,
+                 mode: Optional[pulumi.Input[_builtins.str]] = None,
+                 trust_store_config: Optional[pulumi.Input['DistributionViewerMtlsConfigTrustStoreConfigArgs']] = None):
+        """
+        :param pulumi.Input[_builtins.str] mode: The mode for viewer mTLS. Valid values: `required`, `optional`.
+        :param pulumi.Input['DistributionViewerMtlsConfigTrustStoreConfigArgs'] trust_store_config: The trust store configuration for viewer mTLS (maximum one).
+        """
+        if mode is not None:
+            pulumi.set(__self__, "mode", mode)
+        if trust_store_config is not None:
+            pulumi.set(__self__, "trust_store_config", trust_store_config)
+    @_builtins.property
+    @pulumi.getter
+    def mode(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        The mode for viewer mTLS. Valid values: `required`, `optional`.
+        """
+        return pulumi.get(self, "mode")
+    @mode.setter
+    def mode(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "mode", value)
+    @_builtins.property
+    @pulumi.getter(name="trustStoreConfig")
+    def trust_store_config(self) -> Optional[pulumi.Input['DistributionViewerMtlsConfigTrustStoreConfigArgs']]:
+        """
+        The trust store configuration for viewer mTLS (maximum one).
+        """
+        return pulumi.get(self, "trust_store_config")
+    @trust_store_config.setter
+    def trust_store_config(self, value: Optional[pulumi.Input['DistributionViewerMtlsConfigTrustStoreConfigArgs']]):
+        pulumi.set(self, "trust_store_config", value)
+if not MYPY:
+    class DistributionViewerMtlsConfigTrustStoreConfigArgsDict(TypedDict):
+        trust_store_id: pulumi.Input[_builtins.str]
+        """
+        Identifier of the trust store to use for viewer mTLS.
+        """
+        advertise_trust_store_ca_names: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether to advertise the trust store CA names to clients. Defaults to `false`.
+        """
+        ignore_certificate_expiry: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether to ignore certificate expiry for viewer mTLS. Defaults to `false`.
+        """
+elif False:
+    DistributionViewerMtlsConfigTrustStoreConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class DistributionViewerMtlsConfigTrustStoreConfigArgs:
+    def __init__(__self__, *,
+                 trust_store_id: pulumi.Input[_builtins.str],
+                 advertise_trust_store_ca_names: Optional[pulumi.Input[_builtins.bool]] = None,
+                 ignore_certificate_expiry: Optional[pulumi.Input[_builtins.bool]] = None):
+        """
+        :param pulumi.Input[_builtins.str] trust_store_id: Identifier of the trust store to use for viewer mTLS.
+        :param pulumi.Input[_builtins.bool] advertise_trust_store_ca_names: Whether to advertise the trust store CA names to clients. Defaults to `false`.
+        :param pulumi.Input[_builtins.bool] ignore_certificate_expiry: Whether to ignore certificate expiry for viewer mTLS. Defaults to `false`.
+        """
+        pulumi.set(__self__, "trust_store_id", trust_store_id)
+        if advertise_trust_store_ca_names is not None:
+            pulumi.set(__self__, "advertise_trust_store_ca_names", advertise_trust_store_ca_names)
+        if ignore_certificate_expiry is not None:
+            pulumi.set(__self__, "ignore_certificate_expiry", ignore_certificate_expiry)
+    @_builtins.property
+    @pulumi.getter(name="trustStoreId")
+    def trust_store_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Identifier of the trust store to use for viewer mTLS.
+        """
+        return pulumi.get(self, "trust_store_id")
+    @trust_store_id.setter
+    def trust_store_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "trust_store_id", value)
+    @_builtins.property
+    @pulumi.getter(name="advertiseTrustStoreCaNames")
+    def advertise_trust_store_ca_names(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether to advertise the trust store CA names to clients. Defaults to `false`.
+        """
+        return pulumi.get(self, "advertise_trust_store_ca_names")
+    @advertise_trust_store_ca_names.setter
+    def advertise_trust_store_ca_names(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "advertise_trust_store_ca_names", value)
+    @_builtins.property
+    @pulumi.getter(name="ignoreCertificateExpiry")
+    def ignore_certificate_expiry(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether to ignore certificate expiry for viewer mTLS. Defaults to `false`.
+        """
+        return pulumi.get(self, "ignore_certificate_expiry")
+    @ignore_certificate_expiry.setter
+    def ignore_certificate_expiry(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "ignore_certificate_expiry", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigContentTypeProfileConfigArgsDict(TypedDict):
+        content_type_profiles: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict']
+        """
+        Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
+        """
+        forward_when_content_type_is_unknown: pulumi.Input[_builtins.bool]
+        """
+        specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        """
+elif False:
+    FieldLevelEncryptionConfigContentTypeProfileConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigContentTypeProfileConfigArgs:
+    def __init__(__self__, *,
+                 content_type_profiles: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'],
+                 forward_when_content_type_is_unknown: pulumi.Input[_builtins.bool]):
+        """
+        :param pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'] content_type_profiles: Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
+        :param pulumi.Input[_builtins.bool] forward_when_content_type_is_unknown: specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        """
+        pulumi.set(__self__, "content_type_profiles", content_type_profiles)
+        pulumi.set(__self__, "forward_when_content_type_is_unknown", forward_when_content_type_is_unknown)
+    @_builtins.property
+    @pulumi.getter(name="contentTypeProfiles")
+    def content_type_profiles(self) -> pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']:
+        """
+        Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
+        """
+        return pulumi.get(self, "content_type_profiles")
+    @content_type_profiles.setter
+    def content_type_profiles(self, value: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']):
+        pulumi.set(self, "content_type_profiles", value)
+    @_builtins.property
+    @pulumi.getter(name="forwardWhenContentTypeIsUnknown")
+    def forward_when_content_type_is_unknown(self) -> pulumi.Input[_builtins.bool]:
+        """
+        specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
+        """
+        return pulumi.get(self, "forward_when_content_type_is_unknown")
+    @forward_when_content_type_is_unknown.setter
+    def forward_when_content_type_is_unknown(self, value: pulumi.Input[_builtins.bool]):
+        pulumi.set(self, "forward_when_content_type_is_unknown", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict(TypedDict):
+        items: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict']]]
+elif False:
+    FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs:
+    def __init__(__self__, *,
+                 items: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
+        pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict(TypedDict):
+        content_type: pulumi.Input[_builtins.str]
+        """
+        he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+        """
+        format: pulumi.Input[_builtins.str]
+        """
+        The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        """
+        profile_id: NotRequired[pulumi.Input[_builtins.str]]
+elif False:
+    FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs:
+    def __init__(__self__, *,
+                 content_type: pulumi.Input[_builtins.str],
+                 format: pulumi.Input[_builtins.str],
+                 profile_id: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.str] content_type: he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+        :param pulumi.Input[_builtins.str] format: The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        """
+        pulumi.set(__self__, "content_type", content_type)
+        pulumi.set(__self__, "format", format)
+        if profile_id is not None:
+            pulumi.set(__self__, "profile_id", profile_id)
+    @_builtins.property
+    @pulumi.getter(name="contentType")
+    def content_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+        """
+        return pulumi.get(self, "content_type")
+    @content_type.setter
+    def content_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "content_type", value)
+    @_builtins.property
+    @pulumi.getter
+    def format(self) -> pulumi.Input[_builtins.str]:
+        """
+        The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        """
+        return pulumi.get(self, "format")
+    @format.setter
+    def format(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "format", value)
+    @_builtins.property
+    @pulumi.getter(name="profileId")
+    def profile_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        return pulumi.get(self, "profile_id")
+    @profile_id.setter
+    def profile_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "profile_id", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigQueryArgProfileConfigArgsDict(TypedDict):
+        forward_when_query_arg_profile_is_unknown: pulumi.Input[_builtins.bool]
+        """
+        Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+        """
+        query_arg_profiles: NotRequired[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict']]
+        """
+        Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        """
+elif False:
+    FieldLevelEncryptionConfigQueryArgProfileConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigQueryArgProfileConfigArgs:
+    def __init__(__self__, *,
+                 forward_when_query_arg_profile_is_unknown: pulumi.Input[_builtins.bool],
+                 query_arg_profiles: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']] = None):
+        """
+        :param pulumi.Input[_builtins.bool] forward_when_query_arg_profile_is_unknown: Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+        :param pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs'] query_arg_profiles: Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        """
+        pulumi.set(__self__, "forward_when_query_arg_profile_is_unknown", forward_when_query_arg_profile_is_unknown)
+        if query_arg_profiles is not None:
+            pulumi.set(__self__, "query_arg_profiles", query_arg_profiles)
+    @_builtins.property
+    @pulumi.getter(name="forwardWhenQueryArgProfileIsUnknown")
+    def forward_when_query_arg_profile_is_unknown(self) -> pulumi.Input[_builtins.bool]:
+        """
+        Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+        """
+        return pulumi.get(self, "forward_when_query_arg_profile_is_unknown")
+    @forward_when_query_arg_profile_is_unknown.setter
+    def forward_when_query_arg_profile_is_unknown(self, value: pulumi.Input[_builtins.bool]):
+        pulumi.set(self, "forward_when_query_arg_profile_is_unknown", value)
+    @_builtins.property
+    @pulumi.getter(name="queryArgProfiles")
+    def query_arg_profiles(self) -> Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]:
+        """
+        Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        """
+        return pulumi.get(self, "query_arg_profiles")
+    @query_arg_profiles.setter
+    def query_arg_profiles(self, value: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]):
+        pulumi.set(self, "query_arg_profiles", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict(TypedDict):
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict']]]]
+elif False:
+    FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs:
+    def __init__(__self__, *,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]] = None):
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict(TypedDict):
+        profile_id: pulumi.Input[_builtins.str]
+        query_arg: pulumi.Input[_builtins.str]
+        """
+        Query argument for field-level encryption query argument-profile mapping.
+        """
+elif False:
+    FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs:
+    def __init__(__self__, *,
+                 profile_id: pulumi.Input[_builtins.str],
+                 query_arg: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] query_arg: Query argument for field-level encryption query argument-profile mapping.
+        """
+        pulumi.set(__self__, "profile_id", profile_id)
+        pulumi.set(__self__, "query_arg", query_arg)
+    @_builtins.property
+    @pulumi.getter(name="profileId")
+    def profile_id(self) -> pulumi.Input[_builtins.str]:
+        return pulumi.get(self, "profile_id")
+    @profile_id.setter
+    def profile_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "profile_id", value)
+    @_builtins.property
+    @pulumi.getter(name="queryArg")
+    def query_arg(self) -> pulumi.Input[_builtins.str]:
+        """
+        Query argument for field-level encryption query argument-profile mapping.
+        """
+        return pulumi.get(self, "query_arg")
+    @query_arg.setter
+    def query_arg(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "query_arg", value)
+if not MYPY:
+    class FieldLevelEncryptionProfileEncryptionEntitiesArgsDict(TypedDict):
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict']]]]
+elif False:
+    FieldLevelEncryptionProfileEncryptionEntitiesArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionProfileEncryptionEntitiesArgs:
+    def __init__(__self__, *,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]] = None):
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict(TypedDict):
+        field_patterns: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict']
+        """
+        Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+        """
+        provider_id: pulumi.Input[_builtins.str]
+        """
+        The provider associated with the public key being used for encryption.
+        """
+        public_key_id: pulumi.Input[_builtins.str]
+        """
+        The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        """
+elif False:
+    FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionProfileEncryptionEntitiesItemArgs:
+    def __init__(__self__, *,
+                 field_patterns: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'],
+                 provider_id: pulumi.Input[_builtins.str],
+                 public_key_id: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'] field_patterns: Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+        :param pulumi.Input[_builtins.str] provider_id: The provider associated with the public key being used for encryption.
+        :param pulumi.Input[_builtins.str] public_key_id: The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        """
+        pulumi.set(__self__, "field_patterns", field_patterns)
+        pulumi.set(__self__, "provider_id", provider_id)
+        pulumi.set(__self__, "public_key_id", public_key_id)
+    @_builtins.property
+    @pulumi.getter(name="fieldPatterns")
+    def field_patterns(self) -> pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']:
+        """
+        Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+        """
+        return pulumi.get(self, "field_patterns")
+    @field_patterns.setter
+    def field_patterns(self, value: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']):
+        pulumi.set(self, "field_patterns", value)
+    @_builtins.property
+    @pulumi.getter(name="providerId")
+    def provider_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        The provider associated with the public key being used for encryption.
+        """
+        return pulumi.get(self, "provider_id")
+    @provider_id.setter
+    def provider_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "provider_id", value)
+    @_builtins.property
+    @pulumi.getter(name="publicKeyId")
+    def public_key_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        """
+        return pulumi.get(self, "public_key_id")
+    @public_key_id.setter
+    def public_key_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "public_key_id", value)
+if not MYPY:
+    class FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict(TypedDict):
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+elif False:
+    FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs:
+    def __init__(__self__, *,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class KeyValueStoreTimeoutsArgsDict(TypedDict):
+        create: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        """
+elif False:
+    KeyValueStoreTimeoutsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class KeyValueStoreTimeoutsArgs:
+    def __init__(__self__, *,
+                 create: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.str] create: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        """
+        if create is not None:
+            pulumi.set(__self__, "create", create)
+    @_builtins.property
+    @pulumi.getter
+    def create(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        """
+        return pulumi.get(self, "create")
+    @create.setter
+    def create(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "create", value)
+if not MYPY:
+    class KeyvaluestoreKeysExclusiveResourceKeyValuePairArgsDict(TypedDict):
+        key: pulumi.Input[_builtins.str]
+        """
+        Key to put.
+        """
+        value: pulumi.Input[_builtins.str]
+        """
+        Value to put.
+        """
+elif False:
+    KeyvaluestoreKeysExclusiveResourceKeyValuePairArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class KeyvaluestoreKeysExclusiveResourceKeyValuePairArgs:
+    def __init__(__self__, *,
+                 key: pulumi.Input[_builtins.str],
+                 value: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] key: Key to put.
+        :param pulumi.Input[_builtins.str] value: Value to put.
+        """
+        pulumi.set(__self__, "key", key)
+        pulumi.set(__self__, "value", value)
+    @_builtins.property
+    @pulumi.getter
+    def key(self) -> pulumi.Input[_builtins.str]:
+        """
+        Key to put.
+        """
+        return pulumi.get(self, "key")
+    @key.setter
+    def key(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "key", value)
+    @_builtins.property
+    @pulumi.getter
+    def value(self) -> pulumi.Input[_builtins.str]:
+        """
+        Value to put.
+        """
+        return pulumi.get(self, "value")
+    @value.setter
+    def value(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "value", value)
+if not MYPY:
+    class MonitoringSubscriptionMonitoringSubscriptionArgsDict(TypedDict):
+        realtime_metrics_subscription_config: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict']
+        """
+        A subscription configuration for additional CloudWatch metrics. See below.
+        """
+elif False:
+    MonitoringSubscriptionMonitoringSubscriptionArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MonitoringSubscriptionMonitoringSubscriptionArgs:
+    def __init__(__self__, *,
+                 realtime_metrics_subscription_config: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
+        """
+        :param pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs'] realtime_metrics_subscription_config: A subscription configuration for additional CloudWatch metrics. See below.
+        """
+        pulumi.set(__self__, "realtime_metrics_subscription_config", realtime_metrics_subscription_config)
+    @_builtins.property
+    @pulumi.getter(name="realtimeMetricsSubscriptionConfig")
+    def realtime_metrics_subscription_config(self) -> pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']:
+        """
+        A subscription configuration for additional CloudWatch metrics. See below.
+        """
+        return pulumi.get(self, "realtime_metrics_subscription_config")
+    @realtime_metrics_subscription_config.setter
+    def realtime_metrics_subscription_config(self, value: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
+        pulumi.set(self, "realtime_metrics_subscription_config", value)
+if not MYPY:
+    class MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict(TypedDict):
+        realtime_metrics_subscription_status: pulumi.Input[_builtins.str]
+        """
+        A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        """
+elif False:
+    MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs:
+    def __init__(__self__, *,
+                 realtime_metrics_subscription_status: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] realtime_metrics_subscription_status: A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        """
+        pulumi.set(__self__, "realtime_metrics_subscription_status", realtime_metrics_subscription_status)
+    @_builtins.property
+    @pulumi.getter(name="realtimeMetricsSubscriptionStatus")
+    def realtime_metrics_subscription_status(self) -> pulumi.Input[_builtins.str]:
+        """
+        A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        """
+        return pulumi.get(self, "realtime_metrics_subscription_status")
+    @realtime_metrics_subscription_status.setter
+    def realtime_metrics_subscription_status(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "realtime_metrics_subscription_status", value)
+if not MYPY:
+    class MultitenantDistributionActiveTrustedKeyGroupArgsDict(TypedDict):
+        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether any of the key groups have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
+        """
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionActiveTrustedKeyGroupItemArgsDict']]]]
+        """
+        List of key groups. See Key Group Items below.
+        """
+elif False:
+    MultitenantDistributionActiveTrustedKeyGroupArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionActiveTrustedKeyGroupArgs:
+    def __init__(__self__, *,
+                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionActiveTrustedKeyGroupItemArgs']]]] = None):
+        """
+        :param pulumi.Input[_builtins.bool] enabled: Whether any of the key groups have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionActiveTrustedKeyGroupItemArgs']]] items: List of key groups. See Key Group Items below.
+        """
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether any of the key groups have public keys that CloudFront can use to verify the signatures of signed URLs and signed cookies.
+        """
+        return pulumi.get(self, "enabled")
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "enabled", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionActiveTrustedKeyGroupItemArgs']]]]:
+        """
+        List of key groups. See Key Group Items below.
+        """
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionActiveTrustedKeyGroupItemArgs']]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class MultitenantDistributionActiveTrustedKeyGroupItemArgsDict(TypedDict):
+        key_group_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ID of the key group that contains the public keys.
+        """
+        key_pair_ids: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        """
+        Set of active CloudFront key pairs associated with the signer that can be used to verify the signatures of signed URLs and signed cookies.
+        """
+elif False:
+    MultitenantDistributionActiveTrustedKeyGroupItemArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionActiveTrustedKeyGroupItemArgs:
+    def __init__(__self__, *,
+                 key_group_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] key_group_id: ID of the key group that contains the public keys.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer that can be used to verify the signatures of signed URLs and signed cookies.
+        """
+        if key_group_id is not None:
+            pulumi.set(__self__, "key_group_id", key_group_id)
+        if key_pair_ids is not None:
+            pulumi.set(__self__, "key_pair_ids", key_pair_ids)
+    @_builtins.property
+    @pulumi.getter(name="keyGroupId")
+    def key_group_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        ID of the key group that contains the public keys.
+        """
+        return pulumi.get(self, "key_group_id")
+    @key_group_id.setter
+    def key_group_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "key_group_id", value)
+    @_builtins.property
+    @pulumi.getter(name="keyPairIds")
+    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        Set of active CloudFront key pairs associated with the signer that can be used to verify the signatures of signed URLs and signed cookies.
+        """
+        return pulumi.get(self, "key_pair_ids")
+    @key_pair_ids.setter
+    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "key_pair_ids", value)
+if not MYPY:
+    class MultitenantDistributionCacheBehaviorArgsDict(TypedDict):
+        path_pattern: pulumi.Input[_builtins.str]
+        """
+        Pattern that specifies which requests you want this cache behavior to apply to.
+        """
+        target_origin_id: pulumi.Input[_builtins.str]
+        """
+        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        """
+        viewer_protocol_policy: pulumi.Input[_builtins.str]
+        """
+        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        """
+        allowed_methods: NotRequired[pulumi.Input['MultitenantDistributionCacheBehaviorAllowedMethodsArgsDict']]
+        """
+        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        """
+        cache_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Unique identifier of the cache policy that is attached to the cache behavior.
+        """
+        compress: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        """
+        field_level_encryption_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Field level encryption configuration ID.
+        """
+        function_associations: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorFunctionAssociationArgsDict']]]]
+        """
+        Configuration block for CloudFront Functions associations. See Function Association below.
+        """
+        lambda_function_associations: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgsDict']]]]
+        """
+        Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        """
+        origin_request_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Unique identifier of the origin request policy that is attached to the behavior.
+        """
+        realtime_log_config_arn: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ARN of the real-time log configuration that is attached to this cache behavior.
+        """
+        response_headers_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Identifier for a response headers policy.
+        """
+        trusted_key_groups: NotRequired[pulumi.Input['MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgsDict']]
+        """
+        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+elif False:
+    MultitenantDistributionCacheBehaviorArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCacheBehaviorArgs:
+    def __init__(__self__, *,
+                 path_pattern: pulumi.Input[_builtins.str],
+                 target_origin_id: pulumi.Input[_builtins.str],
+                 viewer_protocol_policy: pulumi.Input[_builtins.str],
+                 allowed_methods: Optional[pulumi.Input['MultitenantDistributionCacheBehaviorAllowedMethodsArgs']] = None,
+                 cache_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 compress: Optional[pulumi.Input[_builtins.bool]] = None,
+                 field_level_encryption_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorFunctionAssociationArgs']]]] = None,
+                 lambda_function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs']]]] = None,
+                 origin_request_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 realtime_log_config_arn: Optional[pulumi.Input[_builtins.str]] = None,
+                 response_headers_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 trusted_key_groups: Optional[pulumi.Input['MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs']] = None):
+        """
+        :param pulumi.Input[_builtins.str] path_pattern: Pattern that specifies which requests you want this cache behavior to apply to.
+        :param pulumi.Input[_builtins.str] target_origin_id: Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        :param pulumi.Input[_builtins.str] viewer_protocol_policy: Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        :param pulumi.Input['MultitenantDistributionCacheBehaviorAllowedMethodsArgs'] allowed_methods: Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        :param pulumi.Input[_builtins.str] cache_policy_id: Unique identifier of the cache policy that is attached to the cache behavior.
+        :param pulumi.Input[_builtins.bool] compress: Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        :param pulumi.Input[_builtins.str] field_level_encryption_id: Field level encryption configuration ID.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorFunctionAssociationArgs']]] function_associations: Configuration block for CloudFront Functions associations. See Function Association below.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs']]] lambda_function_associations: Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        :param pulumi.Input[_builtins.str] origin_request_policy_id: Unique identifier of the origin request policy that is attached to the behavior.
+        :param pulumi.Input[_builtins.str] realtime_log_config_arn: ARN of the real-time log configuration that is attached to this cache behavior.
+        :param pulumi.Input[_builtins.str] response_headers_policy_id: Identifier for a response headers policy.
+        :param pulumi.Input['MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs'] trusted_key_groups: List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+        pulumi.set(__self__, "path_pattern", path_pattern)
+        pulumi.set(__self__, "target_origin_id", target_origin_id)
+        pulumi.set(__self__, "viewer_protocol_policy", viewer_protocol_policy)
+        if allowed_methods is not None:
+            pulumi.set(__self__, "allowed_methods", allowed_methods)
+        if cache_policy_id is not None:
+            pulumi.set(__self__, "cache_policy_id", cache_policy_id)
+        if compress is not None:
+            pulumi.set(__self__, "compress", compress)
+        if field_level_encryption_id is not None:
+            pulumi.set(__self__, "field_level_encryption_id", field_level_encryption_id)
+        if function_associations is not None:
+            pulumi.set(__self__, "function_associations", function_associations)
+        if lambda_function_associations is not None:
+            pulumi.set(__self__, "lambda_function_associations", lambda_function_associations)
+        if origin_request_policy_id is not None:
+            pulumi.set(__self__, "origin_request_policy_id", origin_request_policy_id)
+        if realtime_log_config_arn is not None:
+            pulumi.set(__self__, "realtime_log_config_arn", realtime_log_config_arn)
+        if response_headers_policy_id is not None:
+            pulumi.set(__self__, "response_headers_policy_id", response_headers_policy_id)
+        if trusted_key_groups is not None:
+            pulumi.set(__self__, "trusted_key_groups", trusted_key_groups)
+    @_builtins.property
+    @pulumi.getter(name="pathPattern")
+    def path_pattern(self) -> pulumi.Input[_builtins.str]:
+        """
+        Pattern that specifies which requests you want this cache behavior to apply to.
+        """
+        return pulumi.get(self, "path_pattern")
+    @path_pattern.setter
+    def path_pattern(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "path_pattern", value)
+    @_builtins.property
+    @pulumi.getter(name="targetOriginId")
+    def target_origin_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        """
+        return pulumi.get(self, "target_origin_id")
+    @target_origin_id.setter
+    def target_origin_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "target_origin_id", value)
+    @_builtins.property
+    @pulumi.getter(name="viewerProtocolPolicy")
+    def viewer_protocol_policy(self) -> pulumi.Input[_builtins.str]:
+        """
+        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        """
+        return pulumi.get(self, "viewer_protocol_policy")
+    @viewer_protocol_policy.setter
+    def viewer_protocol_policy(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "viewer_protocol_policy", value)
+    @_builtins.property
+    @pulumi.getter(name="allowedMethods")
+    def allowed_methods(self) -> Optional[pulumi.Input['MultitenantDistributionCacheBehaviorAllowedMethodsArgs']]:
+        """
+        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        """
+        return pulumi.get(self, "allowed_methods")
+    @allowed_methods.setter
+    def allowed_methods(self, value: Optional[pulumi.Input['MultitenantDistributionCacheBehaviorAllowedMethodsArgs']]):
+        pulumi.set(self, "allowed_methods", value)
+    @_builtins.property
+    @pulumi.getter(name="cachePolicyId")
+    def cache_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Unique identifier of the cache policy that is attached to the cache behavior.
+        """
+        return pulumi.get(self, "cache_policy_id")
+    @cache_policy_id.setter
+    def cache_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "cache_policy_id", value)
+    @_builtins.property
+    @pulumi.getter
+    def compress(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        """
+        return pulumi.get(self, "compress")
+    @compress.setter
+    def compress(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "compress", value)
+    @_builtins.property
+    @pulumi.getter(name="fieldLevelEncryptionId")
+    def field_level_encryption_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Field level encryption configuration ID.
+        """
+        return pulumi.get(self, "field_level_encryption_id")
+    @field_level_encryption_id.setter
+    def field_level_encryption_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "field_level_encryption_id", value)
+    @_builtins.property
+    @pulumi.getter(name="functionAssociations")
+    def function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorFunctionAssociationArgs']]]]:
+        """
+        Configuration block for CloudFront Functions associations. See Function Association below.
+        """
+        return pulumi.get(self, "function_associations")
+    @function_associations.setter
+    def function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorFunctionAssociationArgs']]]]):
+        pulumi.set(self, "function_associations", value)
+    @_builtins.property
+    @pulumi.getter(name="lambdaFunctionAssociations")
+    def lambda_function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs']]]]:
+        """
+        Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        """
+        return pulumi.get(self, "lambda_function_associations")
+    @lambda_function_associations.setter
+    def lambda_function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs']]]]):
+        pulumi.set(self, "lambda_function_associations", value)
+    @_builtins.property
+    @pulumi.getter(name="originRequestPolicyId")
+    def origin_request_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Unique identifier of the origin request policy that is attached to the behavior.
+        """
+        return pulumi.get(self, "origin_request_policy_id")
+    @origin_request_policy_id.setter
+    def origin_request_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "origin_request_policy_id", value)
+    @_builtins.property
+    @pulumi.getter(name="realtimeLogConfigArn")
+    def realtime_log_config_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        ARN of the real-time log configuration that is attached to this cache behavior.
+        """
+        return pulumi.get(self, "realtime_log_config_arn")
+    @realtime_log_config_arn.setter
+    def realtime_log_config_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "realtime_log_config_arn", value)
+    @_builtins.property
+    @pulumi.getter(name="responseHeadersPolicyId")
+    def response_headers_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Identifier for a response headers policy.
+        """
+        return pulumi.get(self, "response_headers_policy_id")
+    @response_headers_policy_id.setter
+    def response_headers_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "response_headers_policy_id", value)
+    @_builtins.property
+    @pulumi.getter(name="trustedKeyGroups")
+    def trusted_key_groups(self) -> Optional[pulumi.Input['MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs']]:
+        """
+        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+        return pulumi.get(self, "trusted_key_groups")
+    @trusted_key_groups.setter
+    def trusted_key_groups(self, value: Optional[pulumi.Input['MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs']]):
+        pulumi.set(self, "trusted_key_groups", value)
+if not MYPY:
+    class MultitenantDistributionCacheBehaviorAllowedMethodsArgsDict(TypedDict):
+        cached_methods: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]
+        """
+        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        items: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]
+elif False:
+    MultitenantDistributionCacheBehaviorAllowedMethodsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCacheBehaviorAllowedMethodsArgs:
+    def __init__(__self__, *,
+                 cached_methods: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
+                 items: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] cached_methods: Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        pulumi.set(__self__, "cached_methods", cached_methods)
+        pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter(name="cachedMethods")
+    def cached_methods(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
+        """
+        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        return pulumi.get(self, "cached_methods")
+    @cached_methods.setter
+    def cached_methods(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        pulumi.set(self, "cached_methods", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class MultitenantDistributionCacheBehaviorFunctionAssociationArgsDict(TypedDict):
+        event_type: pulumi.Input[_builtins.str]
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        function_arn: pulumi.Input[_builtins.str]
+        """
+        ARN of the CloudFront function.
+        """
+elif False:
+    MultitenantDistributionCacheBehaviorFunctionAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCacheBehaviorFunctionAssociationArgs:
+    def __init__(__self__, *,
+                 event_type: pulumi.Input[_builtins.str],
+                 function_arn: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        :param pulumi.Input[_builtins.str] function_arn: ARN of the CloudFront function.
+        """
+        pulumi.set(__self__, "event_type", event_type)
+        pulumi.set(__self__, "function_arn", function_arn)
+    @_builtins.property
+    @pulumi.getter(name="eventType")
+    def event_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        return pulumi.get(self, "event_type")
+    @event_type.setter
+    def event_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "event_type", value)
+    @_builtins.property
+    @pulumi.getter(name="functionArn")
+    def function_arn(self) -> pulumi.Input[_builtins.str]:
+        """
+        ARN of the CloudFront function.
+        """
+        return pulumi.get(self, "function_arn")
+    @function_arn.setter
+    def function_arn(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "function_arn", value)
+if not MYPY:
+    class MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgsDict(TypedDict):
+        event_type: pulumi.Input[_builtins.str]
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        lambda_function_arn: pulumi.Input[_builtins.str]
+        """
+        ARN of the Lambda function.
+        """
+        include_body: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+elif False:
+    MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCacheBehaviorLambdaFunctionAssociationArgs:
+    def __init__(__self__, *,
+                 event_type: pulumi.Input[_builtins.str],
+                 lambda_function_arn: pulumi.Input[_builtins.str],
+                 include_body: Optional[pulumi.Input[_builtins.bool]] = None):
+        """
+        :param pulumi.Input[_builtins.str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        :param pulumi.Input[_builtins.str] lambda_function_arn: ARN of the Lambda function.
+        :param pulumi.Input[_builtins.bool] include_body: When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+        pulumi.set(__self__, "event_type", event_type)
+        pulumi.set(__self__, "lambda_function_arn", lambda_function_arn)
+        if include_body is not None:
+            pulumi.set(__self__, "include_body", include_body)
+    @_builtins.property
+    @pulumi.getter(name="eventType")
+    def event_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        return pulumi.get(self, "event_type")
+    @event_type.setter
+    def event_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "event_type", value)
+    @_builtins.property
+    @pulumi.getter(name="lambdaFunctionArn")
+    def lambda_function_arn(self) -> pulumi.Input[_builtins.str]:
+        """
+        ARN of the Lambda function.
+        """
+        return pulumi.get(self, "lambda_function_arn")
+    @lambda_function_arn.setter
+    def lambda_function_arn(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "lambda_function_arn", value)
+    @_builtins.property
+    @pulumi.getter(name="includeBody")
+    def include_body(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+        return pulumi.get(self, "include_body")
+    @include_body.setter
+    def include_body(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "include_body", value)
+if not MYPY:
+    class MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgsDict(TypedDict):
+        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+elif False:
+    MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCacheBehaviorTrustedKeyGroupsArgs:
+    def __init__(__self__, *,
+                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
+        """
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        return pulumi.get(self, "enabled")
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "enabled", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class MultitenantDistributionCustomErrorResponseArgsDict(TypedDict):
+        error_code: pulumi.Input[_builtins.int]
+        """
+        HTTP status code for which you want to specify a custom error page and/or a caching duration.
+        """
+        error_caching_min_ttl: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Minimum amount of time that you want CloudFront to cache the HTTP status code specified in ErrorCode.
+        """
+        response_code: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        HTTP status code that you want CloudFront to return to the viewer along with the custom error page.
+        """
+        response_page_path: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by ErrorCode.
+        """
+elif False:
+    MultitenantDistributionCustomErrorResponseArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionCustomErrorResponseArgs:
+    def __init__(__self__, *,
+                 error_code: pulumi.Input[_builtins.int],
+                 error_caching_min_ttl: Optional[pulumi.Input[_builtins.int]] = None,
+                 response_code: Optional[pulumi.Input[_builtins.str]] = None,
+                 response_page_path: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.int] error_code: HTTP status code for which you want to specify a custom error page and/or a caching duration.
+        :param pulumi.Input[_builtins.int] error_caching_min_ttl: Minimum amount of time that you want CloudFront to cache the HTTP status code specified in ErrorCode.
+        :param pulumi.Input[_builtins.str] response_code: HTTP status code that you want CloudFront to return to the viewer along with the custom error page.
+        :param pulumi.Input[_builtins.str] response_page_path: Path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by ErrorCode.
+        """
+        pulumi.set(__self__, "error_code", error_code)
+        if error_caching_min_ttl is not None:
+            pulumi.set(__self__, "error_caching_min_ttl", error_caching_min_ttl)
+        if response_code is not None:
+            pulumi.set(__self__, "response_code", response_code)
+        if response_page_path is not None:
+            pulumi.set(__self__, "response_page_path", response_page_path)
+    @_builtins.property
+    @pulumi.getter(name="errorCode")
+    def error_code(self) -> pulumi.Input[_builtins.int]:
+        """
+        HTTP status code for which you want to specify a custom error page and/or a caching duration.
+        """
+        return pulumi.get(self, "error_code")
+    @error_code.setter
+    def error_code(self, value: pulumi.Input[_builtins.int]):
+        pulumi.set(self, "error_code", value)
+    @_builtins.property
+    @pulumi.getter(name="errorCachingMinTtl")
+    def error_caching_min_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Minimum amount of time that you want CloudFront to cache the HTTP status code specified in ErrorCode.
+        """
+        return pulumi.get(self, "error_caching_min_ttl")
+    @error_caching_min_ttl.setter
+    def error_caching_min_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "error_caching_min_ttl", value)
+    @_builtins.property
+    @pulumi.getter(name="responseCode")
+    def response_code(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        HTTP status code that you want CloudFront to return to the viewer along with the custom error page.
+        """
+        return pulumi.get(self, "response_code")
+    @response_code.setter
+    def response_code(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "response_code", value)
+    @_builtins.property
+    @pulumi.getter(name="responsePagePath")
+    def response_page_path(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by ErrorCode.
+        """
+        return pulumi.get(self, "response_page_path")
+    @response_page_path.setter
+    def response_page_path(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "response_page_path", value)
+if not MYPY:
+    class MultitenantDistributionDefaultCacheBehaviorArgsDict(TypedDict):
+        target_origin_id: pulumi.Input[_builtins.str]
+        """
+        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        """
+        viewer_protocol_policy: pulumi.Input[_builtins.str]
+        """
+        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        """
+        allowed_methods: NotRequired[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgsDict']]
+        """
+        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        """
+        cache_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Unique identifier of the cache policy that is attached to the cache behavior.
+        """
+        compress: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        """
+        field_level_encryption_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Field level encryption configuration ID.
+        """
+        function_associations: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgsDict']]]]
+        """
+        Configuration block for CloudFront Functions associations. See Function Association below.
+        """
+        lambda_function_associations: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgsDict']]]]
+        """
+        Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        """
+        origin_request_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Unique identifier of the origin request policy that is attached to the behavior.
+        """
+        realtime_log_config_arn: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        ARN of the real-time log configuration that is attached to this cache behavior.
+        """
+        response_headers_policy_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Identifier for a response headers policy.
+        """
+        trusted_key_groups: NotRequired[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgsDict']]
+        """
+        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+elif False:
+    MultitenantDistributionDefaultCacheBehaviorArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionDefaultCacheBehaviorArgs:
+    def __init__(__self__, *,
+                 target_origin_id: pulumi.Input[_builtins.str],
+                 viewer_protocol_policy: pulumi.Input[_builtins.str],
+                 allowed_methods: Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs']] = None,
+                 cache_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 compress: Optional[pulumi.Input[_builtins.bool]] = None,
+                 field_level_encryption_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs']]]] = None,
+                 lambda_function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]] = None,
+                 origin_request_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 realtime_log_config_arn: Optional[pulumi.Input[_builtins.str]] = None,
+                 response_headers_policy_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 trusted_key_groups: Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs']] = None):
+        """
+        :param pulumi.Input[_builtins.str] target_origin_id: Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        :param pulumi.Input[_builtins.str] viewer_protocol_policy: Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        :param pulumi.Input['MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs'] allowed_methods: Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        :param pulumi.Input[_builtins.str] cache_policy_id: Unique identifier of the cache policy that is attached to the cache behavior.
+        :param pulumi.Input[_builtins.bool] compress: Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        :param pulumi.Input[_builtins.str] field_level_encryption_id: Field level encryption configuration ID.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs']]] function_associations: Configuration block for CloudFront Functions associations. See Function Association below.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]] lambda_function_associations: Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        :param pulumi.Input[_builtins.str] origin_request_policy_id: Unique identifier of the origin request policy that is attached to the behavior.
+        :param pulumi.Input[_builtins.str] realtime_log_config_arn: ARN of the real-time log configuration that is attached to this cache behavior.
+        :param pulumi.Input[_builtins.str] response_headers_policy_id: Identifier for a response headers policy.
+        :param pulumi.Input['MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs'] trusted_key_groups: List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+        pulumi.set(__self__, "target_origin_id", target_origin_id)
+        pulumi.set(__self__, "viewer_protocol_policy", viewer_protocol_policy)
+        if allowed_methods is not None:
+            pulumi.set(__self__, "allowed_methods", allowed_methods)
+        if cache_policy_id is not None:
+            pulumi.set(__self__, "cache_policy_id", cache_policy_id)
+        if compress is not None:
+            pulumi.set(__self__, "compress", compress)
+        if field_level_encryption_id is not None:
+            pulumi.set(__self__, "field_level_encryption_id", field_level_encryption_id)
+        if function_associations is not None:
+            pulumi.set(__self__, "function_associations", function_associations)
+        if lambda_function_associations is not None:
+            pulumi.set(__self__, "lambda_function_associations", lambda_function_associations)
+        if origin_request_policy_id is not None:
+            pulumi.set(__self__, "origin_request_policy_id", origin_request_policy_id)
+        if realtime_log_config_arn is not None:
+            pulumi.set(__self__, "realtime_log_config_arn", realtime_log_config_arn)
+        if response_headers_policy_id is not None:
+            pulumi.set(__self__, "response_headers_policy_id", response_headers_policy_id)
+        if trusted_key_groups is not None:
+            pulumi.set(__self__, "trusted_key_groups", trusted_key_groups)
+    @_builtins.property
+    @pulumi.getter(name="targetOriginId")
+    def target_origin_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
+        """
+        return pulumi.get(self, "target_origin_id")
+    @target_origin_id.setter
+    def target_origin_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "target_origin_id", value)
+    @_builtins.property
+    @pulumi.getter(name="viewerProtocolPolicy")
+    def viewer_protocol_policy(self) -> pulumi.Input[_builtins.str]:
+        """
+        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
+        """
+        return pulumi.get(self, "viewer_protocol_policy")
+    @viewer_protocol_policy.setter
+    def viewer_protocol_policy(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "viewer_protocol_policy", value)
+    @_builtins.property
+    @pulumi.getter(name="allowedMethods")
+    def allowed_methods(self) -> Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs']]:
+        """
+        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
+        """
+        return pulumi.get(self, "allowed_methods")
+    @allowed_methods.setter
+    def allowed_methods(self, value: Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs']]):
+        pulumi.set(self, "allowed_methods", value)
+    @_builtins.property
+    @pulumi.getter(name="cachePolicyId")
+    def cache_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Unique identifier of the cache policy that is attached to the cache behavior.
+        """
+        return pulumi.get(self, "cache_policy_id")
+    @cache_policy_id.setter
+    def cache_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "cache_policy_id", value)
+    @_builtins.property
+    @pulumi.getter
+    def compress(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header. Default: `false`.
+        """
+        return pulumi.get(self, "compress")
+    @compress.setter
+    def compress(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "compress", value)
+    @_builtins.property
+    @pulumi.getter(name="fieldLevelEncryptionId")
+    def field_level_encryption_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Field level encryption configuration ID.
+        """
+        return pulumi.get(self, "field_level_encryption_id")
+    @field_level_encryption_id.setter
+    def field_level_encryption_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "field_level_encryption_id", value)
+    @_builtins.property
+    @pulumi.getter(name="functionAssociations")
+    def function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs']]]]:
+        """
+        Configuration block for CloudFront Functions associations. See Function Association below.
+        """
+        return pulumi.get(self, "function_associations")
+    @function_associations.setter
+    def function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs']]]]):
+        pulumi.set(self, "function_associations", value)
+    @_builtins.property
+    @pulumi.getter(name="lambdaFunctionAssociations")
+    def lambda_function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]]:
+        """
+        Configuration block for Lambda@Edge associations. See Lambda Function Association below.
+        """
+        return pulumi.get(self, "lambda_function_associations")
+    @lambda_function_associations.setter
+    def lambda_function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]]):
+        pulumi.set(self, "lambda_function_associations", value)
+    @_builtins.property
+    @pulumi.getter(name="originRequestPolicyId")
+    def origin_request_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Unique identifier of the origin request policy that is attached to the behavior.
+        """
+        return pulumi.get(self, "origin_request_policy_id")
+    @origin_request_policy_id.setter
+    def origin_request_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "origin_request_policy_id", value)
+    @_builtins.property
+    @pulumi.getter(name="realtimeLogConfigArn")
+    def realtime_log_config_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        ARN of the real-time log configuration that is attached to this cache behavior.
+        """
+        return pulumi.get(self, "realtime_log_config_arn")
+    @realtime_log_config_arn.setter
+    def realtime_log_config_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "realtime_log_config_arn", value)
+    @_builtins.property
+    @pulumi.getter(name="responseHeadersPolicyId")
+    def response_headers_policy_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Identifier for a response headers policy.
+        """
+        return pulumi.get(self, "response_headers_policy_id")
+    @response_headers_policy_id.setter
+    def response_headers_policy_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "response_headers_policy_id", value)
+    @_builtins.property
+    @pulumi.getter(name="trustedKeyGroups")
+    def trusted_key_groups(self) -> Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs']]:
+        """
+        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies.
+        """
+        return pulumi.get(self, "trusted_key_groups")
+    @trusted_key_groups.setter
+    def trusted_key_groups(self, value: Optional[pulumi.Input['MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs']]):
+        pulumi.set(self, "trusted_key_groups", value)
+if not MYPY:
+    class MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgsDict(TypedDict):
+        cached_methods: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]
+        """
+        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        items: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]
+elif False:
+    MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs:
+    def __init__(__self__, *,
+                 cached_methods: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
+                 items: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] cached_methods: Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        pulumi.set(__self__, "cached_methods", cached_methods)
+        pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter(name="cachedMethods")
+    def cached_methods(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
+        """
+        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
+        """
+        return pulumi.get(self, "cached_methods")
+    @cached_methods.setter
+    def cached_methods(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        pulumi.set(self, "cached_methods", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgsDict(TypedDict):
+        event_type: pulumi.Input[_builtins.str]
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        function_arn: pulumi.Input[_builtins.str]
+        """
+        ARN of the CloudFront function.
+        """
+elif False:
+    MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionDefaultCacheBehaviorFunctionAssociationArgs:
+    def __init__(__self__, *,
+                 event_type: pulumi.Input[_builtins.str],
+                 function_arn: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        :param pulumi.Input[_builtins.str] function_arn: ARN of the CloudFront function.
+        """
+        pulumi.set(__self__, "event_type", event_type)
+        pulumi.set(__self__, "function_arn", function_arn)
+    @_builtins.property
+    @pulumi.getter(name="eventType")
+    def event_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        return pulumi.get(self, "event_type")
+    @event_type.setter
+    def event_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "event_type", value)
+    @_builtins.property
+    @pulumi.getter(name="functionArn")
+    def function_arn(self) -> pulumi.Input[_builtins.str]:
+        """
+        ARN of the CloudFront function.
+        """
+        return pulumi.get(self, "function_arn")
+    @function_arn.setter
+    def function_arn(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "function_arn", value)
+if not MYPY:
+    class MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgsDict(TypedDict):
+        event_type: pulumi.Input[_builtins.str]
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        lambda_function_arn: pulumi.Input[_builtins.str]
+        """
+        ARN of the Lambda function.
+        """
+        include_body: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+elif False:
+    MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs:
+    def __init__(__self__, *,
+                 event_type: pulumi.Input[_builtins.str],
+                 lambda_function_arn: pulumi.Input[_builtins.str],
+                 include_body: Optional[pulumi.Input[_builtins.bool]] = None):
+        """
+        :param pulumi.Input[_builtins.str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        :param pulumi.Input[_builtins.str] lambda_function_arn: ARN of the Lambda function.
+        :param pulumi.Input[_builtins.bool] include_body: When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+        pulumi.set(__self__, "event_type", event_type)
+        pulumi.set(__self__, "lambda_function_arn", lambda_function_arn)
+        if include_body is not None:
+            pulumi.set(__self__, "include_body", include_body)
+    @_builtins.property
+    @pulumi.getter(name="eventType")
+    def event_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
+        """
+        return pulumi.get(self, "event_type")
+    @event_type.setter
+    def event_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "event_type", value)
+    @_builtins.property
+    @pulumi.getter(name="lambdaFunctionArn")
+    def lambda_function_arn(self) -> pulumi.Input[_builtins.str]:
+        """
+        ARN of the Lambda function.
+        """
+        return pulumi.get(self, "lambda_function_arn")
+    @lambda_function_arn.setter
+    def lambda_function_arn(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "lambda_function_arn", value)
+    @_builtins.property
+    @pulumi.getter(name="includeBody")
+    def include_body(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        When set to true, the request body is exposed to the Lambda function. Default: `false`.
+        """
+        return pulumi.get(self, "include_body")
+    @include_body.setter
+    def include_body(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "include_body", value)
+if not MYPY:
+    class MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgsDict(TypedDict):
+        enabled: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+elif False:
+    MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionDefaultCacheBehaviorTrustedKeyGroupsArgs:
+    def __init__(__self__, *,
+                 enabled: Optional[pulumi.Input[_builtins.bool]] = None,
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.bool] enabled: Whether the distribution is enabled to accept end user requests for content.
+        """
+        if enabled is not None:
+            pulumi.set(__self__, "enabled", enabled)
+        if items is not None:
+            pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter
+    def enabled(self) -> Optional[pulumi.Input[_builtins.bool]]:
+        """
+        Whether the distribution is enabled to accept end user requests for content.
+        """
+        return pulumi.get(self, "enabled")
+    @enabled.setter
+    def enabled(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "enabled", value)
+    @_builtins.property
+    @pulumi.getter
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        return pulumi.get(self, "items")
+    @items.setter
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
+        pulumi.set(self, "items", value)
+if not MYPY:
+    class MultitenantDistributionOriginArgsDict(TypedDict):
+        domain_name: pulumi.Input[_builtins.str]
+        """
+        DNS domain name of either the S3 bucket, or web site of your custom origin.
+        """
+        id: pulumi.Input[_builtins.str]
+        """
+        Identifier for the distribution.
+        """
+        connection_attempts: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Default: 3.
+        """
+        connection_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Default: 10.
+        """
+        custom_headers: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomHeaderArgsDict']]]]
+        """
+        One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin. See Custom Header below.
+        """
+        custom_origin_configs: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomOriginConfigArgsDict']]]]
+        """
+        CloudFront origin access identity to associate with the origin. See Custom Origin Config below.
+        """
+        origin_access_control_id: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        CloudFront origin access control identifier to associate with the origin.
+        """
+        origin_path: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
+        """
+        origin_shields: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginOriginShieldArgsDict']]]]
+        """
+        CloudFront Origin Shield configuration information. See Origin Shield below.
+        """
+        response_completion_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Number of seconds that CloudFront waits for a response after forwarding a request to the origin. Default: 30.
+        """
+        vpc_origin_configs: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginVpcOriginConfigArgsDict']]]]
+        """
+        CloudFront VPC origin configuration. See VPC Origin Config below.
+        """
+elif False:
+    MultitenantDistributionOriginArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginArgs:
+    def __init__(__self__, *,
+                 domain_name: pulumi.Input[_builtins.str],
+                 id: pulumi.Input[_builtins.str],
+                 connection_attempts: Optional[pulumi.Input[_builtins.int]] = None,
+                 connection_timeout: Optional[pulumi.Input[_builtins.int]] = None,
+                 custom_headers: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomHeaderArgs']]]] = None,
+                 custom_origin_configs: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomOriginConfigArgs']]]] = None,
+                 origin_access_control_id: Optional[pulumi.Input[_builtins.str]] = None,
+                 origin_path: Optional[pulumi.Input[_builtins.str]] = None,
+                 origin_shields: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginOriginShieldArgs']]]] = None,
+                 response_completion_timeout: Optional[pulumi.Input[_builtins.int]] = None,
+                 vpc_origin_configs: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginVpcOriginConfigArgs']]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] domain_name: DNS domain name of either the S3 bucket, or web site of your custom origin.
+        :param pulumi.Input[_builtins.str] id: Identifier for the distribution.
+        :param pulumi.Input[_builtins.int] connection_attempts: Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Default: 3.
+        :param pulumi.Input[_builtins.int] connection_timeout: Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Default: 10.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomHeaderArgs']]] custom_headers: One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin. See Custom Header below.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomOriginConfigArgs']]] custom_origin_configs: CloudFront origin access identity to associate with the origin. See Custom Origin Config below.
+        :param pulumi.Input[_builtins.str] origin_access_control_id: CloudFront origin access control identifier to associate with the origin.
+        :param pulumi.Input[_builtins.str] origin_path: Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginOriginShieldArgs']]] origin_shields: CloudFront Origin Shield configuration information. See Origin Shield below.
+        :param pulumi.Input[_builtins.int] response_completion_timeout: Number of seconds that CloudFront waits for a response after forwarding a request to the origin. Default: 30.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginVpcOriginConfigArgs']]] vpc_origin_configs: CloudFront VPC origin configuration. See VPC Origin Config below.
+        """
+        pulumi.set(__self__, "domain_name", domain_name)
+        pulumi.set(__self__, "id", id)
+        if connection_attempts is not None:
+            pulumi.set(__self__, "connection_attempts", connection_attempts)
+        if connection_timeout is not None:
+            pulumi.set(__self__, "connection_timeout", connection_timeout)
+        if custom_headers is not None:
+            pulumi.set(__self__, "custom_headers", custom_headers)
+        if custom_origin_configs is not None:
+            pulumi.set(__self__, "custom_origin_configs", custom_origin_configs)
+        if origin_access_control_id is not None:
+            pulumi.set(__self__, "origin_access_control_id", origin_access_control_id)
+        if origin_path is not None:
+            pulumi.set(__self__, "origin_path", origin_path)
+        if origin_shields is not None:
+            pulumi.set(__self__, "origin_shields", origin_shields)
+        if response_completion_timeout is not None:
+            pulumi.set(__self__, "response_completion_timeout", response_completion_timeout)
+        if vpc_origin_configs is not None:
+            pulumi.set(__self__, "vpc_origin_configs", vpc_origin_configs)
+    @_builtins.property
+    @pulumi.getter(name="domainName")
+    def domain_name(self) -> pulumi.Input[_builtins.str]:
+        """
+        DNS domain name of either the S3 bucket, or web site of your custom origin.
+        """
+        return pulumi.get(self, "domain_name")
+    @domain_name.setter
+    def domain_name(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "domain_name", value)
+    @_builtins.property
+    @pulumi.getter
+    def id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Identifier for the distribution.
+        """
+        return pulumi.get(self, "id")
+    @id.setter
+    def id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "id", value)
+    @_builtins.property
+    @pulumi.getter(name="connectionAttempts")
+    def connection_attempts(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Default: 3.
+        """
+        return pulumi.get(self, "connection_attempts")
+    @connection_attempts.setter
+    def connection_attempts(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "connection_attempts", value)
+    @_builtins.property
+    @pulumi.getter(name="connectionTimeout")
+    def connection_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Default: 10.
+        """
+        return pulumi.get(self, "connection_timeout")
+    @connection_timeout.setter
+    def connection_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "connection_timeout", value)
+    @_builtins.property
+    @pulumi.getter(name="customHeaders")
+    def custom_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomHeaderArgs']]]]:
+        """
+        One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin. See Custom Header below.
+        """
+        return pulumi.get(self, "custom_headers")
+    @custom_headers.setter
+    def custom_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomHeaderArgs']]]]):
+        pulumi.set(self, "custom_headers", value)
+    @_builtins.property
+    @pulumi.getter(name="customOriginConfigs")
+    def custom_origin_configs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomOriginConfigArgs']]]]:
+        """
+        CloudFront origin access identity to associate with the origin. See Custom Origin Config below.
+        """
+        return pulumi.get(self, "custom_origin_configs")
+    @custom_origin_configs.setter
+    def custom_origin_configs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginCustomOriginConfigArgs']]]]):
+        pulumi.set(self, "custom_origin_configs", value)
+    @_builtins.property
+    @pulumi.getter(name="originAccessControlId")
+    def origin_access_control_id(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        CloudFront origin access control identifier to associate with the origin.
+        """
+        return pulumi.get(self, "origin_access_control_id")
+    @origin_access_control_id.setter
+    def origin_access_control_id(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "origin_access_control_id", value)
+    @_builtins.property
+    @pulumi.getter(name="originPath")
+    def origin_path(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
+        """
+        return pulumi.get(self, "origin_path")
+    @origin_path.setter
+    def origin_path(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "origin_path", value)
+    @_builtins.property
+    @pulumi.getter(name="originShields")
+    def origin_shields(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginOriginShieldArgs']]]]:
+        """
+        CloudFront Origin Shield configuration information. See Origin Shield below.
+        """
+        return pulumi.get(self, "origin_shields")
+    @origin_shields.setter
+    def origin_shields(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginOriginShieldArgs']]]]):
+        pulumi.set(self, "origin_shields", value)
+    @_builtins.property
+    @pulumi.getter(name="responseCompletionTimeout")
+    def response_completion_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Number of seconds that CloudFront waits for a response after forwarding a request to the origin. Default: 30.
+        """
+        return pulumi.get(self, "response_completion_timeout")
+    @response_completion_timeout.setter
+    def response_completion_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "response_completion_timeout", value)
+    @_builtins.property
+    @pulumi.getter(name="vpcOriginConfigs")
+    def vpc_origin_configs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginVpcOriginConfigArgs']]]]:
+        """
+        CloudFront VPC origin configuration. See VPC Origin Config below.
+        """
+        return pulumi.get(self, "vpc_origin_configs")
+    @vpc_origin_configs.setter
+    def vpc_origin_configs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginVpcOriginConfigArgs']]]]):
+        pulumi.set(self, "vpc_origin_configs", value)
+if not MYPY:
+    class MultitenantDistributionOriginCustomHeaderArgsDict(TypedDict):
+        header_name: pulumi.Input[_builtins.str]
+        """
+        Name of the header.
+        """
+        header_value: pulumi.Input[_builtins.str]
+        """
+        Value for the header.
+        """
+elif False:
+    MultitenantDistributionOriginCustomHeaderArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginCustomHeaderArgs:
+    def __init__(__self__, *,
+                 header_name: pulumi.Input[_builtins.str],
+                 header_value: pulumi.Input[_builtins.str]):
+        """
+        :param pulumi.Input[_builtins.str] header_name: Name of the header.
+        :param pulumi.Input[_builtins.str] header_value: Value for the header.
+        """
+        pulumi.set(__self__, "header_name", header_name)
+        pulumi.set(__self__, "header_value", header_value)
+    @_builtins.property
+    @pulumi.getter(name="headerName")
+    def header_name(self) -> pulumi.Input[_builtins.str]:
+        """
+        Name of the header.
+        """
+        return pulumi.get(self, "header_name")
+    @header_name.setter
+    def header_name(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "header_name", value)
+    @_builtins.property
+    @pulumi.getter(name="headerValue")
+    def header_value(self) -> pulumi.Input[_builtins.str]:
+        """
+        Value for the header.
+        """
+        return pulumi.get(self, "header_value")
+    @header_value.setter
+    def header_value(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "header_value", value)
+if not MYPY:
+    class MultitenantDistributionOriginCustomOriginConfigArgsDict(TypedDict):
+        http_port: pulumi.Input[_builtins.int]
+        """
+        HTTP port the custom origin listens on.
+        """
+        https_port: pulumi.Input[_builtins.int]
+        """
+        HTTPS port the custom origin listens on.
+        """
+        origin_protocol_policy: pulumi.Input[_builtins.str]
+        """
+        Origin protocol policy to apply to your origin. Valid values are `http-only`, `https-only`, and `match-viewer`.
+        """
+        origin_ssl_protocols: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]
+        """
+        List of SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS.
+        """
+        ip_address_type: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Type of IP addresses used by your origins. Valid values are `ipv4` and `dualstack`.
+        """
+        origin_keepalive_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Custom keep-alive timeout, in seconds. Default: 5.
+        """
+        origin_read_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Custom read timeout, in seconds. Default: 30.
+        """
+elif False:
+    MultitenantDistributionOriginCustomOriginConfigArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginCustomOriginConfigArgs:
+    def __init__(__self__, *,
+                 http_port: pulumi.Input[_builtins.int],
+                 https_port: pulumi.Input[_builtins.int],
+                 origin_protocol_policy: pulumi.Input[_builtins.str],
+                 origin_ssl_protocols: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
+                 ip_address_type: Optional[pulumi.Input[_builtins.str]] = None,
+                 origin_keepalive_timeout: Optional[pulumi.Input[_builtins.int]] = None,
+                 origin_read_timeout: Optional[pulumi.Input[_builtins.int]] = None):
+        """
+        :param pulumi.Input[_builtins.int] http_port: HTTP port the custom origin listens on.
+        :param pulumi.Input[_builtins.int] https_port: HTTPS port the custom origin listens on.
+        :param pulumi.Input[_builtins.str] origin_protocol_policy: Origin protocol policy to apply to your origin. Valid values are `http-only`, `https-only`, and `match-viewer`.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] origin_ssl_protocols: List of SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS.
+        :param pulumi.Input[_builtins.str] ip_address_type: Type of IP addresses used by your origins. Valid values are `ipv4` and `dualstack`.
+        :param pulumi.Input[_builtins.int] origin_keepalive_timeout: Custom keep-alive timeout, in seconds. Default: 5.
+        :param pulumi.Input[_builtins.int] origin_read_timeout: Custom read timeout, in seconds. Default: 30.
+        """
+        pulumi.set(__self__, "http_port", http_port)
+        pulumi.set(__self__, "https_port", https_port)
+        pulumi.set(__self__, "origin_protocol_policy", origin_protocol_policy)
+        pulumi.set(__self__, "origin_ssl_protocols", origin_ssl_protocols)
+        if ip_address_type is not None:
+            pulumi.set(__self__, "ip_address_type", ip_address_type)
+        if origin_keepalive_timeout is not None:
+            pulumi.set(__self__, "origin_keepalive_timeout", origin_keepalive_timeout)
+        if origin_read_timeout is not None:
+            pulumi.set(__self__, "origin_read_timeout", origin_read_timeout)
+    @_builtins.property
+    @pulumi.getter(name="httpPort")
+    def http_port(self) -> pulumi.Input[_builtins.int]:
+        """
+        HTTP port the custom origin listens on.
+        """
+        return pulumi.get(self, "http_port")
+    @http_port.setter
+    def http_port(self, value: pulumi.Input[_builtins.int]):
+        pulumi.set(self, "http_port", value)
+    @_builtins.property
+    @pulumi.getter(name="httpsPort")
+    def https_port(self) -> pulumi.Input[_builtins.int]:
+        """
+        HTTPS port the custom origin listens on.
+        """
+        return pulumi.get(self, "https_port")
+    @https_port.setter
+    def https_port(self, value: pulumi.Input[_builtins.int]):
+        pulumi.set(self, "https_port", value)
+    @_builtins.property
+    @pulumi.getter(name="originProtocolPolicy")
+    def origin_protocol_policy(self) -> pulumi.Input[_builtins.str]:
+        """
+        Origin protocol policy to apply to your origin. Valid values are `http-only`, `https-only`, and `match-viewer`.
+        """
+        return pulumi.get(self, "origin_protocol_policy")
+    @origin_protocol_policy.setter
+    def origin_protocol_policy(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "origin_protocol_policy", value)
+    @_builtins.property
+    @pulumi.getter(name="originSslProtocols")
+    def origin_ssl_protocols(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
+        """
+        List of SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS.
+        """
+        return pulumi.get(self, "origin_ssl_protocols")
+    @origin_ssl_protocols.setter
+    def origin_ssl_protocols(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
+        pulumi.set(self, "origin_ssl_protocols", value)
+    @_builtins.property
+    @pulumi.getter(name="ipAddressType")
+    def ip_address_type(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        Type of IP addresses used by your origins. Valid values are `ipv4` and `dualstack`.
+        """
+        return pulumi.get(self, "ip_address_type")
+    @ip_address_type.setter
+    def ip_address_type(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "ip_address_type", value)
+    @_builtins.property
+    @pulumi.getter(name="originKeepaliveTimeout")
+    def origin_keepalive_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Custom keep-alive timeout, in seconds. Default: 5.
+        """
+        return pulumi.get(self, "origin_keepalive_timeout")
+    @origin_keepalive_timeout.setter
+    def origin_keepalive_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "origin_keepalive_timeout", value)
+    @_builtins.property
+    @pulumi.getter(name="originReadTimeout")
+    def origin_read_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Custom read timeout, in seconds. Default: 30.
+        """
+        return pulumi.get(self, "origin_read_timeout")
+    @origin_read_timeout.setter
+    def origin_read_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "origin_read_timeout", value)
+if not MYPY:
+    class MultitenantDistributionOriginGroupArgsDict(TypedDict):
+        origin_id: pulumi.Input[_builtins.str]
+        """
+        Unique identifier for the origin group.
+        """
+        failover_criteria: NotRequired[pulumi.Input['MultitenantDistributionOriginGroupFailoverCriteriaArgsDict']]
+        """
+        Failover criteria for when to failover to the secondary origin. See Failover Criteria below.
+        """
+        members: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginGroupMemberArgsDict']]]]
+        """
+        List of origins in this origin group. Must contain exactly 2 members. See Origin Group Member below.
+        """
+elif False:
+    MultitenantDistributionOriginGroupArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginGroupArgs:
+    def __init__(__self__, *,
+                 origin_id: pulumi.Input[_builtins.str],
+                 failover_criteria: Optional[pulumi.Input['MultitenantDistributionOriginGroupFailoverCriteriaArgs']] = None,
+                 members: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginGroupMemberArgs']]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] origin_id: Unique identifier for the origin group.
+        :param pulumi.Input['MultitenantDistributionOriginGroupFailoverCriteriaArgs'] failover_criteria: Failover criteria for when to failover to the secondary origin. See Failover Criteria below.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginGroupMemberArgs']]] members: List of origins in this origin group. Must contain exactly 2 members. See Origin Group Member below.
+        """
+        pulumi.set(__self__, "origin_id", origin_id)
+        if failover_criteria is not None:
+            pulumi.set(__self__, "failover_criteria", failover_criteria)
+        if members is not None:
+            pulumi.set(__self__, "members", members)
+    @_builtins.property
+    @pulumi.getter(name="originId")
+    def origin_id(self) -> pulumi.Input[_builtins.str]:
+        """
+        Unique identifier for the origin group.
+        """
+        return pulumi.get(self, "origin_id")
+    @origin_id.setter
+    def origin_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "origin_id", value)
+    @_builtins.property
+    @pulumi.getter(name="failoverCriteria")
+    def failover_criteria(self) -> Optional[pulumi.Input['MultitenantDistributionOriginGroupFailoverCriteriaArgs']]:
+        """
+        Failover criteria for when to failover to the secondary origin. See Failover Criteria below.
+        """
+        return pulumi.get(self, "failover_criteria")
+    @failover_criteria.setter
+    def failover_criteria(self, value: Optional[pulumi.Input['MultitenantDistributionOriginGroupFailoverCriteriaArgs']]):
+        pulumi.set(self, "failover_criteria", value)
     @_builtins.property
-    @pulumi.getter(name="contentType")
-    def content_type(self) -> pulumi.Input[_builtins.str]:
+    @pulumi.getter
+    def members(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginGroupMemberArgs']]]]:
         """
-        he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
+        List of origins in this origin group. Must contain exactly 2 members. See Origin Group Member below.
         """
-        return pulumi.get(self, "content_type")
+        return pulumi.get(self, "members")
-    @content_type.setter
-    def content_type(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "content_type", value)
+    @members.setter
+    def members(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionOriginGroupMemberArgs']]]]):
+        pulumi.set(self, "members", value)
+if not MYPY:
+    class MultitenantDistributionOriginGroupFailoverCriteriaArgsDict(TypedDict):
+        status_codes: pulumi.Input[Sequence[pulumi.Input[_builtins.int]]]
+        """
+        List of HTTP status codes that trigger a failover to the secondary origin.
+        """
+elif False:
+    MultitenantDistributionOriginGroupFailoverCriteriaArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginGroupFailoverCriteriaArgs:
+    def __init__(__self__, *,
+                 status_codes: pulumi.Input[Sequence[pulumi.Input[_builtins.int]]]):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.int]]] status_codes: List of HTTP status codes that trigger a failover to the secondary origin.
+        """
+        pulumi.set(__self__, "status_codes", status_codes)
+    @_builtins.property
+    @pulumi.getter(name="statusCodes")
+    def status_codes(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.int]]]:
+        """
+        List of HTTP status codes that trigger a failover to the secondary origin.
+        """
+        return pulumi.get(self, "status_codes")
+    @status_codes.setter
+    def status_codes(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.int]]]):
+        pulumi.set(self, "status_codes", value)
+if not MYPY:
+    class MultitenantDistributionOriginGroupMemberArgsDict(TypedDict):
+        origin_id: pulumi.Input[_builtins.str]
+elif False:
+    MultitenantDistributionOriginGroupMemberArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginGroupMemberArgs:
+    def __init__(__self__, *,
+                 origin_id: pulumi.Input[_builtins.str]):
+        pulumi.set(__self__, "origin_id", origin_id)
+    @_builtins.property
+    @pulumi.getter(name="originId")
+    def origin_id(self) -> pulumi.Input[_builtins.str]:
+        return pulumi.get(self, "origin_id")
+    @origin_id.setter
+    def origin_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "origin_id", value)
+if not MYPY:
+    class MultitenantDistributionOriginOriginShieldArgsDict(TypedDict):
+        enabled: pulumi.Input[_builtins.bool]
+        """
+        Whether Origin Shield is enabled.
+        """
+        origin_shield_region: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        AWS Region for Origin Shield. Required when `enabled` is `true`.
+        """
+elif False:
+    MultitenantDistributionOriginOriginShieldArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionOriginOriginShieldArgs:
+    def __init__(__self__, *,
+                 enabled: pulumi.Input[_builtins.bool],
+                 origin_shield_region: Optional[pulumi.Input[_builtins.str]] = None):
+        """
+        :param pulumi.Input[_builtins.bool] enabled: Whether Origin Shield is enabled.
+        :param pulumi.Input[_builtins.str] origin_shield_region: AWS Region for Origin Shield. Required when `enabled` is `true`.
+        """
+        pulumi.set(__self__, "enabled", enabled)
+        if origin_shield_region is not None:
+            pulumi.set(__self__, "origin_shield_region", origin_shield_region)
     @_builtins.property
     @pulumi.getter
-    def format(self) -> pulumi.Input[_builtins.str]:
+    def enabled(self) -> pulumi.Input[_builtins.bool]:
         """
-        The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
+        Whether Origin Shield is enabled.
         """
-        return pulumi.get(self, "format")
+        return pulumi.get(self, "enabled")
-    @format.setter
-    def format(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "format", value)
+    @enabled.setter
+    def enabled(self, value: pulumi.Input[_builtins.bool]):
+        pulumi.set(self, "enabled", value)
     @_builtins.property
-    @pulumi.getter(name="profileId")
-    def profile_id(self) -> Optional[pulumi.Input[_builtins.str]]:
-        return pulumi.get(self, "profile_id")
+    @pulumi.getter(name="originShieldRegion")
+    def origin_shield_region(self) -> Optional[pulumi.Input[_builtins.str]]:
+        """
+        AWS Region for Origin Shield. Required when `enabled` is `true`.
+        """
+        return pulumi.get(self, "origin_shield_region")
-    @profile_id.setter
-    def profile_id(self, value: Optional[pulumi.Input[_builtins.str]]):
-        pulumi.set(self, "profile_id", value)
+    @origin_shield_region.setter
+    def origin_shield_region(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "origin_shield_region", value)
 if not MYPY:
-    class FieldLevelEncryptionConfigQueryArgProfileConfigArgsDict(TypedDict):
-        forward_when_query_arg_profile_is_unknown: pulumi.Input[_builtins.bool]
+    class MultitenantDistributionOriginVpcOriginConfigArgsDict(TypedDict):
+        vpc_origin_id: pulumi.Input[_builtins.str]
         """
-        Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+        ID of the VPC origin that you want CloudFront to route requests to.
         """
-        query_arg_profiles: NotRequired[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict']]
+        origin_keepalive_timeout: NotRequired[pulumi.Input[_builtins.int]]
         """
-        Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        Custom keep-alive timeout, in seconds. By default, CloudFront uses a default timeout. Default: 5.
+        """
+        origin_read_timeout: NotRequired[pulumi.Input[_builtins.int]]
+        """
+        Custom read timeout, in seconds. By default, CloudFront uses a default timeout. Default: 30.
         """
 elif False:
-    FieldLevelEncryptionConfigQueryArgProfileConfigArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionOriginVpcOriginConfigArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionConfigQueryArgProfileConfigArgs:
+class MultitenantDistributionOriginVpcOriginConfigArgs:
     def __init__(__self__, *,
-                 forward_when_query_arg_profile_is_unknown: pulumi.Input[_builtins.bool],
-                 query_arg_profiles: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']] = None):
+                 vpc_origin_id: pulumi.Input[_builtins.str],
+                 origin_keepalive_timeout: Optional[pulumi.Input[_builtins.int]] = None,
+                 origin_read_timeout: Optional[pulumi.Input[_builtins.int]] = None):
         """
-        :param pulumi.Input[_builtins.bool] forward_when_query_arg_profile_is_unknown: Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
-        :param pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs'] query_arg_profiles: Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        :param pulumi.Input[_builtins.str] vpc_origin_id: ID of the VPC origin that you want CloudFront to route requests to.
+        :param pulumi.Input[_builtins.int] origin_keepalive_timeout: Custom keep-alive timeout, in seconds. By default, CloudFront uses a default timeout. Default: 5.
+        :param pulumi.Input[_builtins.int] origin_read_timeout: Custom read timeout, in seconds. By default, CloudFront uses a default timeout. Default: 30.
         """
-        pulumi.set(__self__, "forward_when_query_arg_profile_is_unknown", forward_when_query_arg_profile_is_unknown)
-        if query_arg_profiles is not None:
-            pulumi.set(__self__, "query_arg_profiles", query_arg_profiles)
+        pulumi.set(__self__, "vpc_origin_id", vpc_origin_id)
+        if origin_keepalive_timeout is not None:
+            pulumi.set(__self__, "origin_keepalive_timeout", origin_keepalive_timeout)
+        if origin_read_timeout is not None:
+            pulumi.set(__self__, "origin_read_timeout", origin_read_timeout)
     @_builtins.property
-    @pulumi.getter(name="forwardWhenQueryArgProfileIsUnknown")
-    def forward_when_query_arg_profile_is_unknown(self) -> pulumi.Input[_builtins.bool]:
+    @pulumi.getter(name="vpcOriginId")
+    def vpc_origin_id(self) -> pulumi.Input[_builtins.str]:
         """
-        Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
+        ID of the VPC origin that you want CloudFront to route requests to.
         """
-        return pulumi.get(self, "forward_when_query_arg_profile_is_unknown")
+        return pulumi.get(self, "vpc_origin_id")
-    @forward_when_query_arg_profile_is_unknown.setter
-    def forward_when_query_arg_profile_is_unknown(self, value: pulumi.Input[_builtins.bool]):
-        pulumi.set(self, "forward_when_query_arg_profile_is_unknown", value)
+    @vpc_origin_id.setter
+    def vpc_origin_id(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "vpc_origin_id", value)
     @_builtins.property
-    @pulumi.getter(name="queryArgProfiles")
-    def query_arg_profiles(self) -> Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]:
+    @pulumi.getter(name="originKeepaliveTimeout")
+    def origin_keepalive_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
         """
-        Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
+        Custom keep-alive timeout, in seconds. By default, CloudFront uses a default timeout. Default: 5.
         """
-        return pulumi.get(self, "query_arg_profiles")
+        return pulumi.get(self, "origin_keepalive_timeout")
-    @query_arg_profiles.setter
-    def query_arg_profiles(self, value: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]):
-        pulumi.set(self, "query_arg_profiles", value)
+    @origin_keepalive_timeout.setter
+    def origin_keepalive_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "origin_keepalive_timeout", value)
+    @_builtins.property
+    @pulumi.getter(name="originReadTimeout")
+    def origin_read_timeout(self) -> Optional[pulumi.Input[_builtins.int]]:
+        """
+        Custom read timeout, in seconds. By default, CloudFront uses a default timeout. Default: 30.
+        """
+        return pulumi.get(self, "origin_read_timeout")
+    @origin_read_timeout.setter
+    def origin_read_timeout(self, value: Optional[pulumi.Input[_builtins.int]]):
+        pulumi.set(self, "origin_read_timeout", value)
 if not MYPY:
-    class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict(TypedDict):
-        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict']]]]
+    class MultitenantDistributionRestrictionsArgsDict(TypedDict):
+        geo_restriction: NotRequired[pulumi.Input['MultitenantDistributionRestrictionsGeoRestrictionArgsDict']]
+        """
+        Geographic restriction configuration. See Geo Restriction below.
+        """
 elif False:
-    FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionRestrictionsArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs:
+class MultitenantDistributionRestrictionsArgs:
     def __init__(__self__, *,
-                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]] = None):
+                 geo_restriction: Optional[pulumi.Input['MultitenantDistributionRestrictionsGeoRestrictionArgs']] = None):
+        """
+        :param pulumi.Input['MultitenantDistributionRestrictionsGeoRestrictionArgs'] geo_restriction: Geographic restriction configuration. See Geo Restriction below.
+        """
+        if geo_restriction is not None:
+            pulumi.set(__self__, "geo_restriction", geo_restriction)
+    @_builtins.property
+    @pulumi.getter(name="geoRestriction")
+    def geo_restriction(self) -> Optional[pulumi.Input['MultitenantDistributionRestrictionsGeoRestrictionArgs']]:
+        """
+        Geographic restriction configuration. See Geo Restriction below.
+        """
+        return pulumi.get(self, "geo_restriction")
+    @geo_restriction.setter
+    def geo_restriction(self, value: Optional[pulumi.Input['MultitenantDistributionRestrictionsGeoRestrictionArgs']]):
+        pulumi.set(self, "geo_restriction", value)
+if not MYPY:
+    class MultitenantDistributionRestrictionsGeoRestrictionArgsDict(TypedDict):
+        restriction_type: pulumi.Input[_builtins.str]
+        """
+        Method to restrict distribution of your content by country. Valid values are `none`, `whitelist`, and `blacklist`.
+        """
+        items: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
+        """
+        List of ISO 3166-1-alpha-2 country codes for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). Required when `restriction_type` is `whitelist` or `blacklist`.
+        """
+elif False:
+    MultitenantDistributionRestrictionsGeoRestrictionArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionRestrictionsGeoRestrictionArgs:
+    def __init__(__self__, *,
+                 restriction_type: pulumi.Input[_builtins.str],
+                 items: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] restriction_type: Method to restrict distribution of your content by country. Valid values are `none`, `whitelist`, and `blacklist`.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] items: List of ISO 3166-1-alpha-2 country codes for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). Required when `restriction_type` is `whitelist` or `blacklist`.
+        """
+        pulumi.set(__self__, "restriction_type", restriction_type)
         if items is not None:
             pulumi.set(__self__, "items", items)
+    @_builtins.property
+    @pulumi.getter(name="restrictionType")
+    def restriction_type(self) -> pulumi.Input[_builtins.str]:
+        """
+        Method to restrict distribution of your content by country. Valid values are `none`, `whitelist`, and `blacklist`.
+        """
+        return pulumi.get(self, "restriction_type")
+    @restriction_type.setter
+    def restriction_type(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "restriction_type", value)
     @_builtins.property
     @pulumi.getter
-    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]:
+    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
+        """
+        List of ISO 3166-1-alpha-2 country codes for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). Required when `restriction_type` is `whitelist` or `blacklist`.
+        """
         return pulumi.get(self, "items")
     @items.setter
-    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]):
+    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
         pulumi.set(self, "items", value)
 if not MYPY:
-    class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict(TypedDict):
-        profile_id: pulumi.Input[_builtins.str]
-        query_arg: pulumi.Input[_builtins.str]
+    class MultitenantDistributionTenantConfigArgsDict(TypedDict):
+        parameter_definitions: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionArgsDict']]]]
         """
-        Query argument for field-level encryption query argument-profile mapping.
+        One or more parameter definitions for the tenant configuration. See Parameter Definition below.
         """
 elif False:
-    FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionTenantConfigArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs:
+class MultitenantDistributionTenantConfigArgs:
     def __init__(__self__, *,
-                 profile_id: pulumi.Input[_builtins.str],
-                 query_arg: pulumi.Input[_builtins.str]):
+                 parameter_definitions: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionArgs']]]] = None):
         """
-        :param pulumi.Input[_builtins.str] query_arg: Query argument for field-level encryption query argument-profile mapping.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionArgs']]] parameter_definitions: One or more parameter definitions for the tenant configuration. See Parameter Definition below.
         """
-        pulumi.set(__self__, "profile_id", profile_id)
-        pulumi.set(__self__, "query_arg", query_arg)
+        if parameter_definitions is not None:
+            pulumi.set(__self__, "parameter_definitions", parameter_definitions)
     @_builtins.property
-    @pulumi.getter(name="profileId")
-    def profile_id(self) -> pulumi.Input[_builtins.str]:
-        return pulumi.get(self, "profile_id")
+    @pulumi.getter(name="parameterDefinitions")
+    def parameter_definitions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionArgs']]]]:
+        """
+        One or more parameter definitions for the tenant configuration. See Parameter Definition below.
+        """
+        return pulumi.get(self, "parameter_definitions")
+    @parameter_definitions.setter
+    def parameter_definitions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionArgs']]]]):
+        pulumi.set(self, "parameter_definitions", value)
+if not MYPY:
+    class MultitenantDistributionTenantConfigParameterDefinitionArgsDict(TypedDict):
+        name: pulumi.Input[_builtins.str]
+        """
+        Name of the parameter.
+        """
+        definitions: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgsDict']]]]
+        """
+        Definition of the parameter schema. See Parameter Definition Schema below.
+        """
+elif False:
+    MultitenantDistributionTenantConfigParameterDefinitionArgsDict: TypeAlias = Mapping[str, Any]
+@pulumi.input_type
+class MultitenantDistributionTenantConfigParameterDefinitionArgs:
+    def __init__(__self__, *,
+                 name: pulumi.Input[_builtins.str],
+                 definitions: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs']]]] = None):
+        """
+        :param pulumi.Input[_builtins.str] name: Name of the parameter.
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs']]] definitions: Definition of the parameter schema. See Parameter Definition Schema below.
+        """
+        pulumi.set(__self__, "name", name)
+        if definitions is not None:
+            pulumi.set(__self__, "definitions", definitions)
+    @_builtins.property
+    @pulumi.getter
+    def name(self) -> pulumi.Input[_builtins.str]:
+        """
+        Name of the parameter.
+        """
+        return pulumi.get(self, "name")
-    @profile_id.setter
-    def profile_id(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "profile_id", value)
+    @name.setter
+    def name(self, value: pulumi.Input[_builtins.str]):
+        pulumi.set(self, "name", value)
     @_builtins.property
-    @pulumi.getter(name="queryArg")
-    def query_arg(self) -> pulumi.Input[_builtins.str]:
+    @pulumi.getter
+    def definitions(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs']]]]:
         """
-        Query argument for field-level encryption query argument-profile mapping.
+        Definition of the parameter schema. See Parameter Definition Schema below.
         """
-        return pulumi.get(self, "query_arg")
+        return pulumi.get(self, "definitions")
-    @query_arg.setter
-    def query_arg(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "query_arg", value)
+    @definitions.setter
+    def definitions(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs']]]]):
+        pulumi.set(self, "definitions", value)
 if not MYPY:
-    class FieldLevelEncryptionProfileEncryptionEntitiesArgsDict(TypedDict):
-        items: NotRequired[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict']]]]
+    class MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgsDict(TypedDict):
+        string_schemas: NotRequired[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgsDict']]]]
+        """
+        String schema configuration. See String Schema below.
+        """
 elif False:
-    FieldLevelEncryptionProfileEncryptionEntitiesArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionProfileEncryptionEntitiesArgs:
+class MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs:
     def __init__(__self__, *,
-                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]] = None):
-        if items is not None:
-            pulumi.set(__self__, "items", items)
+                 string_schemas: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs']]]] = None):
+        """
+        :param pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs']]] string_schemas: String schema configuration. See String Schema below.
+        """
+        if string_schemas is not None:
+            pulumi.set(__self__, "string_schemas", string_schemas)
     @_builtins.property
-    @pulumi.getter
-    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]:
-        return pulumi.get(self, "items")
+    @pulumi.getter(name="stringSchemas")
+    def string_schemas(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs']]]]:
+        """
+        String schema configuration. See String Schema below.
+        """
+        return pulumi.get(self, "string_schemas")
-    @items.setter
-    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]):
-        pulumi.set(self, "items", value)
+    @string_schemas.setter
+    def string_schemas(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs']]]]):
+        pulumi.set(self, "string_schemas", value)
 if not MYPY:
-    class FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict(TypedDict):
-        field_patterns: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict']
+    class MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgsDict(TypedDict):
+        required: pulumi.Input[_builtins.bool]
         """
-        Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+        Whether the parameter is required.
         """
-        provider_id: pulumi.Input[_builtins.str]
+        comment: NotRequired[pulumi.Input[_builtins.str]]
         """
-        The provider associated with the public key being used for encryption.
+        Comment describing the parameter.
         """
-        public_key_id: pulumi.Input[_builtins.str]
+        default_value: NotRequired[pulumi.Input[_builtins.str]]
         """
-        The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        Default value for the parameter.
         """
 elif False:
-    FieldLevelEncryptionProfileEncryptionEntitiesItemArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class FieldLevelEncryptionProfileEncryptionEntitiesItemArgs:
+class MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs:
     def __init__(__self__, *,
-                 field_patterns: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'],
-                 provider_id: pulumi.Input[_builtins.str],
-                 public_key_id: pulumi.Input[_builtins.str]):
+                 required: pulumi.Input[_builtins.bool],
+                 comment: Optional[pulumi.Input[_builtins.str]] = None,
+                 default_value: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'] field_patterns: Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
-        :param pulumi.Input[_builtins.str] provider_id: The provider associated with the public key being used for encryption.
-        :param pulumi.Input[_builtins.str] public_key_id: The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        :param pulumi.Input[_builtins.bool] required: Whether the parameter is required.
+        :param pulumi.Input[_builtins.str] comment: Comment describing the parameter.
+        :param pulumi.Input[_builtins.str] default_value: Default value for the parameter.
         """
-        pulumi.set(__self__, "field_patterns", field_patterns)
-        pulumi.set(__self__, "provider_id", provider_id)
-        pulumi.set(__self__, "public_key_id", public_key_id)
+        pulumi.set(__self__, "required", required)
+        if comment is not None:
+            pulumi.set(__self__, "comment", comment)
+        if default_value is not None:
+            pulumi.set(__self__, "default_value", default_value)
     @_builtins.property
-    @pulumi.getter(name="fieldPatterns")
-    def field_patterns(self) -> pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']:
+    @pulumi.getter
+    def required(self) -> pulumi.Input[_builtins.bool]:
         """
-        Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
+        Whether the parameter is required.
         """
-        return pulumi.get(self, "field_patterns")
+        return pulumi.get(self, "required")
-    @field_patterns.setter
-    def field_patterns(self, value: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']):
-        pulumi.set(self, "field_patterns", value)
+    @required.setter
+    def required(self, value: pulumi.Input[_builtins.bool]):
+        pulumi.set(self, "required", value)
     @_builtins.property
-    @pulumi.getter(name="providerId")
-    def provider_id(self) -> pulumi.Input[_builtins.str]:
+    @pulumi.getter
+    def comment(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        The provider associated with the public key being used for encryption.
+        Comment describing the parameter.
         """
-        return pulumi.get(self, "provider_id")
+        return pulumi.get(self, "comment")
-    @provider_id.setter
-    def provider_id(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "provider_id", value)
+    @comment.setter
+    def comment(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "comment", value)
     @_builtins.property
-    @pulumi.getter(name="publicKeyId")
-    def public_key_id(self) -> pulumi.Input[_builtins.str]:
+    @pulumi.getter(name="defaultValue")
+    def default_value(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
+        Default value for the parameter.
         """
-        return pulumi.get(self, "public_key_id")
-    @public_key_id.setter
-    def public_key_id(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "public_key_id", value)
-if not MYPY:
-    class FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict(TypedDict):
-        items: NotRequired[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]
-elif False:
-    FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgsDict: TypeAlias = Mapping[str, Any]
-@pulumi.input_type
-class FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs:
-    def __init__(__self__, *,
-                 items: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None):
-        if items is not None:
-            pulumi.set(__self__, "items", items)
-    @_builtins.property
-    @pulumi.getter
-    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
-        return pulumi.get(self, "items")
+        return pulumi.get(self, "default_value")
-    @items.setter
-    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
-        pulumi.set(self, "items", value)
+    @default_value.setter
+    def default_value(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "default_value", value)
 if not MYPY:
-    class KeyValueStoreTimeoutsArgsDict(TypedDict):
+    class MultitenantDistributionTimeoutsArgsDict(TypedDict):
         create: NotRequired[pulumi.Input[_builtins.str]]
         """
         A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
+        delete: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+        """
+        update: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        """
 elif False:
-    KeyValueStoreTimeoutsArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionTimeoutsArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class KeyValueStoreTimeoutsArgs:
+class MultitenantDistributionTimeoutsArgs:
     def __init__(__self__, *,
-                 create: Optional[pulumi.Input[_builtins.str]] = None):
+                 create: Optional[pulumi.Input[_builtins.str]] = None,
+                 delete: Optional[pulumi.Input[_builtins.str]] = None,
+                 update: Optional[pulumi.Input[_builtins.str]] = None):
         """
         :param pulumi.Input[_builtins.str] create: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+        :param pulumi.Input[_builtins.str] delete: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
+        :param pulumi.Input[_builtins.str] update: A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
         if create is not None:
             pulumi.set(__self__, "create", create)
+        if delete is not None:
+            pulumi.set(__self__, "delete", delete)
+        if update is not None:
+            pulumi.set(__self__, "update", update)
     @_builtins.property
     @pulumi.getter
@@ -3863,117 +6982,121 @@ class KeyValueStoreTimeoutsArgs:
     def create(self, value: Optional[pulumi.Input[_builtins.str]]):
         pulumi.set(self, "create", value)
-if not MYPY:
-    class KeyvaluestoreKeysExclusiveResourceKeyValuePairArgsDict(TypedDict):
-        key: pulumi.Input[_builtins.str]
-        """
-        Key to put.
-        """
-        value: pulumi.Input[_builtins.str]
-        """
-        Value to put.
-        """
-elif False:
-    KeyvaluestoreKeysExclusiveResourceKeyValuePairArgsDict: TypeAlias = Mapping[str, Any]
-@pulumi.input_type
-class KeyvaluestoreKeysExclusiveResourceKeyValuePairArgs:
-    def __init__(__self__, *,
-                 key: pulumi.Input[_builtins.str],
-                 value: pulumi.Input[_builtins.str]):
-        """
-        :param pulumi.Input[_builtins.str] key: Key to put.
-        :param pulumi.Input[_builtins.str] value: Value to put.
-        """
-        pulumi.set(__self__, "key", key)
-        pulumi.set(__self__, "value", value)
     @_builtins.property
     @pulumi.getter
-    def key(self) -> pulumi.Input[_builtins.str]:
+    def delete(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Key to put.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
         """
-        return pulumi.get(self, "key")
+        return pulumi.get(self, "delete")
-    @key.setter
-    def key(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "key", value)
+    @delete.setter
+    def delete(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "delete", value)
     @_builtins.property
     @pulumi.getter
-    def value(self) -> pulumi.Input[_builtins.str]:
+    def update(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        Value to put.
+        A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
         """
-        return pulumi.get(self, "value")
+        return pulumi.get(self, "update")
-    @value.setter
-    def value(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "value", value)
+    @update.setter
+    def update(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "update", value)
 if not MYPY:
-    class MonitoringSubscriptionMonitoringSubscriptionArgsDict(TypedDict):
-        realtime_metrics_subscription_config: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict']
+    class MultitenantDistributionViewerCertificateArgsDict(TypedDict):
+        acm_certificate_arn: NotRequired[pulumi.Input[_builtins.str]]
         """
-        A subscription configuration for additional CloudWatch metrics. See below.
+        ARN of the AWS Certificate Manager certificate that you wish to use with this distribution. Required when using a custom SSL certificate.
+        """
+        cloudfront_default_certificate: NotRequired[pulumi.Input[_builtins.bool]]
+        """
+        Whether to use the CloudFront default certificate. Cannot be used with `acm_certificate_arn`.
+        """
+        minimum_protocol_version: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Default: `TLSv1`.
+        """
+        ssl_support_method: NotRequired[pulumi.Input[_builtins.str]]
+        """
+        How you want CloudFront to serve HTTPS requests. Valid values are `sni-only` and `vip`. Required when `acm_certificate_arn` is specified.
         """
 elif False:
-    MonitoringSubscriptionMonitoringSubscriptionArgsDict: TypeAlias = Mapping[str, Any]
+    MultitenantDistributionViewerCertificateArgsDict: TypeAlias = Mapping[str, Any]
 @pulumi.input_type
-class MonitoringSubscriptionMonitoringSubscriptionArgs:
+class MultitenantDistributionViewerCertificateArgs:
     def __init__(__self__, *,
-                 realtime_metrics_subscription_config: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
+                 acm_certificate_arn: Optional[pulumi.Input[_builtins.str]] = None,
+                 cloudfront_default_certificate: Optional[pulumi.Input[_builtins.bool]] = None,
+                 minimum_protocol_version: Optional[pulumi.Input[_builtins.str]] = None,
+                 ssl_support_method: Optional[pulumi.Input[_builtins.str]] = None):
         """
-        :param pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs'] realtime_metrics_subscription_config: A subscription configuration for additional CloudWatch metrics. See below.
+        :param pulumi.Input[_builtins.str] acm_certificate_arn: ARN of the AWS Certificate Manager certificate that you wish to use with this distribution. Required when using a custom SSL certificate.
+        :param pulumi.Input[_builtins.bool] cloudfront_default_certificate: Whether to use the CloudFront default certificate. Cannot be used with `acm_certificate_arn`.
+        :param pulumi.Input[_builtins.str] minimum_protocol_version: Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Default: `TLSv1`.
+        :param pulumi.Input[_builtins.str] ssl_support_method: How you want CloudFront to serve HTTPS requests. Valid values are `sni-only` and `vip`. Required when `acm_certificate_arn` is specified.
         """
-        pulumi.set(__self__, "realtime_metrics_subscription_config", realtime_metrics_subscription_config)
+        if acm_certificate_arn is not None:
+            pulumi.set(__self__, "acm_certificate_arn", acm_certificate_arn)
+        if cloudfront_default_certificate is not None:
+            pulumi.set(__self__, "cloudfront_default_certificate", cloudfront_default_certificate)
+        if minimum_protocol_version is not None:
+            pulumi.set(__self__, "minimum_protocol_version", minimum_protocol_version)
+        if ssl_support_method is not None:
+            pulumi.set(__self__, "ssl_support_method", ssl_support_method)
     @_builtins.property
-    @pulumi.getter(name="realtimeMetricsSubscriptionConfig")
-    def realtime_metrics_subscription_config(self) -> pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']:
+    @pulumi.getter(name="acmCertificateArn")
+    def acm_certificate_arn(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        A subscription configuration for additional CloudWatch metrics. See below.
+        ARN of the AWS Certificate Manager certificate that you wish to use with this distribution. Required when using a custom SSL certificate.
         """
-        return pulumi.get(self, "realtime_metrics_subscription_config")
-    @realtime_metrics_subscription_config.setter
-    def realtime_metrics_subscription_config(self, value: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
-        pulumi.set(self, "realtime_metrics_subscription_config", value)
+        return pulumi.get(self, "acm_certificate_arn")
+    @acm_certificate_arn.setter
+    def acm_certificate_arn(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "acm_certificate_arn", value)
-if not MYPY:
-    class MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict(TypedDict):
-        realtime_metrics_subscription_status: pulumi.Input[_builtins.str]
+    @_builtins.property
+    @pulumi.getter(name="cloudfrontDefaultCertificate")
+    def cloudfront_default_certificate(self) -> Optional[pulumi.Input[_builtins.bool]]:
         """
-        A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        Whether to use the CloudFront default certificate. Cannot be used with `acm_certificate_arn`.
         """
-elif False:
-    MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgsDict: TypeAlias = Mapping[str, Any]
+        return pulumi.get(self, "cloudfront_default_certificate")
-@pulumi.input_type
-class MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs:
-    def __init__(__self__, *,
-                 realtime_metrics_subscription_status: pulumi.Input[_builtins.str]):
+    @cloudfront_default_certificate.setter
+    def cloudfront_default_certificate(self, value: Optional[pulumi.Input[_builtins.bool]]):
+        pulumi.set(self, "cloudfront_default_certificate", value)
+    @_builtins.property
+    @pulumi.getter(name="minimumProtocolVersion")
+    def minimum_protocol_version(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        :param pulumi.Input[_builtins.str] realtime_metrics_subscription_status: A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Default: `TLSv1`.
         """
-        pulumi.set(__self__, "realtime_metrics_subscription_status", realtime_metrics_subscription_status)
+        return pulumi.get(self, "minimum_protocol_version")
+    @minimum_protocol_version.setter
+    def minimum_protocol_version(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "minimum_protocol_version", value)
     @_builtins.property
-    @pulumi.getter(name="realtimeMetricsSubscriptionStatus")
-    def realtime_metrics_subscription_status(self) -> pulumi.Input[_builtins.str]:
+    @pulumi.getter(name="sslSupportMethod")
+    def ssl_support_method(self) -> Optional[pulumi.Input[_builtins.str]]:
         """
-        A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
+        How you want CloudFront to serve HTTPS requests. Valid values are `sni-only` and `vip`. Required when `acm_certificate_arn` is specified.
         """
-        return pulumi.get(self, "realtime_metrics_subscription_status")
+        return pulumi.get(self, "ssl_support_method")
-    @realtime_metrics_subscription_status.setter
-    def realtime_metrics_subscription_status(self, value: pulumi.Input[_builtins.str]):
-        pulumi.set(self, "realtime_metrics_subscription_status", value)
+    @ssl_support_method.setter
+    def ssl_support_method(self, value: Optional[pulumi.Input[_builtins.str]]):
+        pulumi.set(self, "ssl_support_method", value)
 if not MYPY:

pulumi-aws 7.15.0__py3-none-any.whl → 7.16.0__py3-none-any.whl

pulumi-aws 7.15.0py3-none-any.whl → 7.16.0py3-none-any.whl