/**
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
* SPDX-License-Identifier: Apache-2.0.
*/
#pragma once
#include A complex type that determines the distribution’s SSL/TLS configuration for
* communicating with viewers. If the distribution doesn’t use
* If the distribution uses Which viewers the distribution accepts
* HTTPS connections from: only viewers that support server name
* indication (SNI) (recommended), or all viewers including those that don’t
* support SNI. To accept HTTPS connections from only viewers that
* support SNI, set To accept
* HTTPS connections from all viewers, including those that don’t support SNI, set
* The minimum SSL/TLS protocol version that the distribution can use to
* communicate with viewers. To specify a minimum version, choose a value for
* The location of the SSL/TLS certificate, AWS
* Certificate Manager (ACM) (recommended) or AWS
* Identity and Access Management (AWS IAM). You specify the location by
* setting a value in one of the following fields (not both):
* All distributions support HTTPS connections from
* viewers. To require viewers to use HTTPS only, or to redirect them from HTTP to
* HTTPS, use For more information, see Using
* HTTPS with CloudFront and
* Using Alternate Domain Names and HTTPS in the Amazon CloudFront Developer
* Guide.Aliases (also known as alternate domain names or CNAMEs)—that is,
* if the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net—set
* CloudFrontDefaultCertificate to true and leave all
* other fields empty.Aliases
* (alternate domain names or CNAMEs), use the fields in this type to specify the
* following settings:
SSLSupportMethod to sni-only. This is
* recommended. Most browsers and clients support SNI. SSLSupportMethod to vip. This is not recommended, and
* results in additional monthly charges from CloudFront. MinimumProtocolVersion. For more information, see Security
* Policy in the Amazon CloudFront Developer Guide.
ACMCertificateArn IAMCertificateId
* ViewerProtocolPolicy in the CacheBehavior
* or DefaultCacheBehavior. To specify how CloudFront should use
* SSL/TLS to communicate with your custom origin, use
* CustomOriginConfig.See Also:
AWS
* API Reference
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, set this field to
* true.
If the distribution uses Aliases
* (alternate domain names or CNAMEs), set this field to false and
* specify values for the following fields:
* ACMCertificateArn or IAMCertificateId (specify a value
* for one, not both)
MinimumProtocolVersion
SSLSupportMethod
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, set this field to
* true.
If the distribution uses Aliases
* (alternate domain names or CNAMEs), set this field to false and
* specify values for the following fields:
* ACMCertificateArn or IAMCertificateId (specify a value
* for one, not both)
MinimumProtocolVersion
SSLSupportMethod
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, set this field to
* true.
If the distribution uses Aliases
* (alternate domain names or CNAMEs), set this field to false and
* specify values for the following fields:
* ACMCertificateArn or IAMCertificateId (specify a value
* for one, not both)
MinimumProtocolVersion
SSLSupportMethod
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, set this field to
* true.
If the distribution uses Aliases
* (alternate domain names or CNAMEs), set this field to false and
* specify values for the following fields:
* ACMCertificateArn or IAMCertificateId (specify a value
* for one, not both)
MinimumProtocolVersion
SSLSupportMethod
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Identity and Access Management (AWS IAM), provide the ID of the IAM
* certificate.
If you specify an IAM certificate ID, you must also specify
* values for MinimumProtocolVerison and
* SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs) and the SSL/TLS certificate is stored in AWS
* Certificate Manager (ACM), provide the Amazon Resource Name (ARN) of the ACM
* certificate. CloudFront only supports ACM certificates in the US East (N.
* Virginia) Region (us-east-1).
If you specify an ACM
* certificate ARN, you must also specify values for
* MinimumProtocolVerison and SSLSupportMethod.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify which viewers the distribution accepts HTTPS connections
* from.
sni-only – The distribution accepts HTTPS
* connections from only viewers that support server name
* indication (SNI). This is recommended. Most browsers and clients support
* SNI.
vip – The distribution accepts HTTPS
* connections from all viewers including those that don’t support SNI. This is not
* recommended, and results in additional monthly charges from CloudFront.
If the distribution uses the CloudFront domain name such as
* d111111abcdef8.cloudfront.net, don’t set a value for this
* field.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.
If the distribution uses Aliases (alternate domain names or
* CNAMEs), specify the security policy that you want CloudFront to use for HTTPS
* connections with viewers. The security policy determines two settings:
The minimum SSL/TLS protocol that CloudFront can use to communicate with * viewers.
The ciphers that CloudFront can use to encrypt the * content that it returns to viewers.
For more information, see * Security * Policy and Supported * Protocols and Ciphers Between Viewers and CloudFront in the Amazon * CloudFront Developer Guide.
On the CloudFront console, this * setting is called Security Policy.
When you’re using SNI
* only (you set SSLSupportMethod to sni-only), you must
* specify TLSv1 or higher.
If the distribution uses the
* CloudFront domain name such as d111111abcdef8.cloudfront.net (you
* set CloudFrontDefaultCertificate to true), CloudFront
* automatically sets the security policy to TLSv1 regardless of the
* value that you set here.