'''
# Amazon CloudFront Construct Library

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to
your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that
you're serving with CloudFront, the user is routed to the edge location that provides the lowest latency, so that content is delivered with the best
possible performance.

## Distribution API

The `Distribution` API is currently being built to replace the existing `CloudFrontWebDistribution` API. The `Distribution` API is optimized for the
most common use cases of CloudFront distributions (e.g., single origin and behavior, few customizations) while still providing the ability for more
advanced use cases. The API focuses on simplicity for the common use cases, and convenience methods for creating the behaviors and origins necessary
for more complex use cases.

### Creating a distribution

CloudFront distributions deliver your content from one or more origins; an origin is the location where you store the original version of your
content. Origins can be created from S3 buckets or a custom origin (HTTP server). Constructs to define origins are in the `aws-cdk-lib/aws-cloudfront-origins` module.

Each distribution has a default behavior which applies to all requests to that distribution, and routes requests to a primary origin.
Additional behaviors may be specified for an origin with a given URL path pattern. Behaviors allow routing with multiple origins,
controlling which HTTP methods to support, whether to require users to use HTTPS, and what query strings or cookies to forward to your origin,
among other settings.

#### From an S3 Bucket

An S3 bucket can be added as an origin. If the bucket is configured as a website endpoint, the distribution can use S3 redirects and S3 custom error
documents.

```python
# Creates a distribution from an S3 bucket.
my_bucket = s3.Bucket(self, "myBucket")
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.S3Origin(my_bucket))
)
```

The above will treat the bucket differently based on if `IBucket.isWebsite` is set or not. If the bucket is configured as a website, the bucket is
treated as an HTTP origin, and the built-in S3 redirects and error pages can be used. Otherwise, the bucket is handled as a bucket origin and
CloudFront's redirect and error handling will be used. In the latter case, the Origin will create an origin access identity and grant it access to the
underlying bucket. This can be used in conjunction with a bucket that is not public to require that your users access your content using CloudFront
URLs and not S3 URLs directly.

#### ELBv2 Load Balancer

An Elastic Load Balancing (ELB) v2 load balancer may be used as an origin. In order for a load balancer to serve as an origin, it must be publicly
accessible (`internetFacing` is true). Both Application and Network load balancers are supported.

```python
# Creates a distribution from an ELBv2 load balancer
# vpc: ec2.Vpc

# Create an application load balancer in a VPC. 'internetFacing' must be 'true'
# for CloudFront to access the load balancer and use it as an origin.
lb = elbv2.ApplicationLoadBalancer(self, "LB",
    vpc=vpc,
    internet_facing=True
)
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.LoadBalancerV2Origin(lb))
)
```

#### From an HTTP endpoint

Origins can also be created from any other HTTP endpoint, given the domain name, and optionally, other origin properties.

```python
# Creates a distribution from an HTTP endpoint
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com"))
)
```

### Domain Names and Certificates

When you create a distribution, CloudFront assigns a domain name for the distribution, for example: `d111111abcdef8.cloudfront.net`; this value can
be retrieved from `distribution.distributionDomainName`. CloudFront distributions use a default certificate (`*.cloudfront.net`) to support HTTPS by
default. If you want to use your own domain name, such as `www.example.com`, you must associate a certificate with your distribution that contains
your domain name, and provide one (or more) domain names from the certificate for the distribution.

The certificate must be present in the AWS Certificate Manager (ACM) service in the US East (N. Virginia) region; the certificate
may either be created by ACM, or created elsewhere and imported into ACM. When a certificate is used, the distribution will support HTTPS connections
from SNI only and a minimum protocol version of TLSv1.2_2021 if the `@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021` feature flag is set, and TLSv1.2_2019 otherwise.

```python
# To use your own domain name in a Distribution, you must associate a certificate
import aws_cdk.aws_certificatemanager as acm
import aws_cdk.aws_route53 as route53

# hosted_zone: route53.HostedZone

# my_bucket: s3.Bucket

my_certificate = acm.Certificate(self, "mySiteCert",
    domain_name="www.example.com",
    validation=acm.CertificateValidation.from_dns(hosted_zone)
)
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.S3Origin(my_bucket)),
    domain_names=["www.example.com"],
    certificate=my_certificate
)
```

However, you can customize the minimum protocol version for the certificate while creating the distribution using `minimumProtocolVersion` property.

```python
# Create a Distribution with a custom domain name and a minimum protocol version.
# my_bucket: s3.Bucket

cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.S3Origin(my_bucket)),
    domain_names=["www.example.com"],
    minimum_protocol_version=cloudfront.SecurityPolicyProtocol.TLS_V1_2016,
    ssl_support_method=cloudfront.SSLMethod.SNI
)
```

#### Cross Region Certificates

> **This feature is currently experimental**

You can enable the Stack property `crossRegionReferences`
in order to access resources in a different stack *and* region. With this feature flag
enabled it is possible to do something like creating a CloudFront distribution in `us-east-2` and
an ACM certificate in `us-east-1`.

```python
import aws_cdk.aws_certificatemanager as acm
import aws_cdk.aws_route53 as route53

# app: App


stack1 = Stack(app, "Stack1",
    env=Environment(
        region="us-east-1"
    ),
    cross_region_references=True
)
cert = acm.Certificate(stack1, "Cert",
    domain_name="*.example.com",
    validation=acm.CertificateValidation.from_dns(route53.PublicHostedZone.from_hosted_zone_id(stack1, "Zone", "Z0329774B51CGXTDQV3X"))
)

stack2 = Stack(app, "Stack2",
    env=Environment(
        region="us-east-2"
    ),
    cross_region_references=True
)
cloudfront.Distribution(stack2, "Distribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.HttpOrigin("example.com")
    ),
    domain_names=["dev.example.com"],
    certificate=cert
)
```

### Multiple Behaviors & Origins

Each distribution has a default behavior which applies to all requests to that distribution; additional behaviors may be specified for a
given URL path pattern. Behaviors allow routing with multiple origins, controlling which HTTP methods to support, whether to require users to
use HTTPS, and what query strings or cookies to forward to your origin, among others.

The properties of the default behavior can be adjusted as part of the distribution creation. The following example shows configuring the HTTP
methods and viewer protocol policy of the cache.

```python
# Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
# my_bucket: s3.Bucket

my_web_distribution = cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(my_bucket),
        allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,
        viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
    )
)
```

Additional behaviors can be specified at creation, or added after the initial creation. Each additional behavior is associated with an origin,
and enable customization for a specific set of resources based on a URL path pattern. For example, we can add a behavior to `myWebDistribution` to
override the default viewer protocol policy for all of the images.

```python
# Add a behavior to a Distribution after initial creation.
# my_bucket: s3.Bucket
# my_web_distribution: cloudfront.Distribution

my_web_distribution.add_behavior("/images/*.jpg", origins.S3Origin(my_bucket),
    viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
)
```

These behaviors can also be specified at distribution creation time.

```python
# Create a Distribution with additional behaviors at creation time.
# my_bucket: s3.Bucket

bucket_origin = origins.S3Origin(my_bucket)
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,
        viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
    ),
    additional_behaviors={
        "/images/*.jpg": cloudfront.BehaviorOptions(
            origin=bucket_origin,
            viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
        )
    }
)
```

### Customizing Cache Keys and TTLs with Cache Policies

You can use a cache policy to improve your cache hit ratio by controlling the values (URL query strings, HTTP headers, and cookies)
that are included in the cache key, and/or adjusting how long items remain in the cache via the time-to-live (TTL) settings.
CloudFront provides some predefined cache policies, known as managed policies, for common use cases. You can use these managed policies,
or you can create your own cache policy that’s specific to your needs.
See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html for more details.

```python
# Using an existing cache policy for a Distribution
# bucket_origin: origins.S3Origin

cloudfront.Distribution(self, "myDistManagedPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED
    )
)
```

```python
# Creating a custom cache policy for a Distribution -- all parameters optional
# bucket_origin: origins.S3Origin

my_cache_policy = cloudfront.CachePolicy(self, "myCachePolicy",
    cache_policy_name="MyPolicy",
    comment="A default policy",
    default_ttl=Duration.days(2),
    min_ttl=Duration.minutes(1),
    max_ttl=Duration.days(10),
    cookie_behavior=cloudfront.CacheCookieBehavior.all(),
    header_behavior=cloudfront.CacheHeaderBehavior.allow_list("X-CustomHeader"),
    query_string_behavior=cloudfront.CacheQueryStringBehavior.deny_list("username"),
    enable_accept_encoding_gzip=True,
    enable_accept_encoding_brotli=True
)
cloudfront.Distribution(self, "myDistCustomPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        cache_policy=my_cache_policy
    )
)
```

### Customizing Origin Requests with Origin Request Policies

When CloudFront makes a request to an origin, the URL path, request body (if present), and a few standard headers are included.
Other information from the viewer request, such as URL query strings, HTTP headers, and cookies, is not included in the origin request by default.
You can use an origin request policy to control the information that’s included in an origin request.
CloudFront provides some predefined origin request policies, known as managed policies, for common use cases. You can use these managed policies,
or you can create your own origin request policy that’s specific to your needs.
See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html for more details.

```python
# Using an existing origin request policy for a Distribution
# bucket_origin: origins.S3Origin

cloudfront.Distribution(self, "myDistManagedPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        origin_request_policy=cloudfront.OriginRequestPolicy.CORS_S3_ORIGIN
    )
)
```

```python
# Creating a custom origin request policy for a Distribution -- all parameters optional
# bucket_origin: origins.S3Origin

my_origin_request_policy = cloudfront.OriginRequestPolicy(self, "OriginRequestPolicy",
    origin_request_policy_name="MyPolicy",
    comment="A default policy",
    cookie_behavior=cloudfront.OriginRequestCookieBehavior.none(),
    header_behavior=cloudfront.OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"),
    query_string_behavior=cloudfront.OriginRequestQueryStringBehavior.allow_list("username")
)

cloudfront.Distribution(self, "myDistCustomPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        origin_request_policy=my_origin_request_policy
    )
)
```

### Customizing Response Headers with Response Headers Policies

You can configure CloudFront to add one or more HTTP headers to the responses that it sends to viewers (web browsers or other clients), without making any changes to the origin or writing any code.
To specify the headers that CloudFront adds to HTTP responses, you use a response headers policy. CloudFront adds the headers regardless of whether it serves the object from the cache or has to retrieve the object from the origin. If the origin response includes one or more of the headers that’s in a response headers policy, the policy can specify whether CloudFront uses the header it received from the origin or overwrites it with the one in the policy.
See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/adding-response-headers.html

```python
# Using an existing managed response headers policy
# bucket_origin: origins.S3Origin

cloudfront.Distribution(self, "myDistManagedPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
    )
)

# Creating a custom response headers policy -- all parameters optional
my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
    response_headers_policy_name="MyPolicy",
    comment="A default policy",
    cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
        access_control_allow_credentials=False,
        access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
        access_control_allow_methods=["GET", "POST"],
        access_control_allow_origins=["*"],
        access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
        access_control_max_age=Duration.seconds(600),
        origin_override=True
    ),
    custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
        custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
        ]
    ),
    security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
        content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
        content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
        frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
        referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
        strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
        xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
    ),
    remove_headers=["Server"],
    server_timing_sampling_rate=50
)
cloudfront.Distribution(self, "myDistCustomPolicy",
    default_behavior=cloudfront.BehaviorOptions(
        origin=bucket_origin,
        response_headers_policy=my_response_headers_policy
    )
)
```

### Validating signed URLs or signed cookies with Trusted Key Groups

CloudFront Distribution supports validating signed URLs or signed cookies using key groups.
When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed
cookies for all requests that match the cache behavior.

```python
# Validating signed URLs or signed cookies with Trusted Key Groups

# public key in PEM format
# public_key: str

pub_key = cloudfront.PublicKey(self, "MyPubKey",
    encoded_key=public_key
)

key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
    items=[pub_key
    ]
)

cloudfront.Distribution(self, "Dist",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.HttpOrigin("www.example.com"),
        trusted_key_groups=[key_group
        ]
    )
)
```

### Lambda@Edge

Lambda@Edge is an extension of AWS Lambda, a compute service that lets you execute
functions that customize the content that CloudFront delivers. You can author Node.js
or Python functions in the US East (N. Virginia) region, and then execute them in AWS
locations globally that are closer to the viewer, without provisioning or managing servers.
Lambda@Edge functions are associated with a specific behavior and event type. Lambda@Edge
can be used to rewrite URLs, alter responses based on headers or cookies, or authorize
requests based on headers or authorization tokens.

The following shows a Lambda@Edge function added to the default behavior and triggered
on every request:

```python
# my_bucket: s3.Bucket
# A Lambda@Edge function added to default behavior of a Distribution
# and triggered on every request
my_func = cloudfront.experimental.EdgeFunction(self, "MyFunction",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    handler="index.handler",
    code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler"))
)
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(my_bucket),
        edge_lambdas=[cloudfront.EdgeLambda(
            function_version=my_func.current_version,
            event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
        )
        ]
    )
)
```

> **Note:** Lambda@Edge functions must be created in the `us-east-1` region, regardless of the region of the CloudFront distribution and stack.
> To make it easier to request functions for Lambda@Edge, the `EdgeFunction` construct can be used.
> The `EdgeFunction` construct will automatically request a function in `us-east-1`, regardless of the region of the current stack.
> `EdgeFunction` has the same interface as `Function` and can be created and used interchangeably.
> Please note that using `EdgeFunction` requires that the `us-east-1` region has been bootstrapped.
> See https://docs.aws.amazon.com/cdk/latest/guide/bootstrapping.html for more about bootstrapping regions.

If the stack is in `us-east-1`, a "normal" `lambda.Function` can be used instead of an `EdgeFunction`.

```python
# Using a lambda Function instead of an EdgeFunction for stacks in `us-east-`.
my_func = lambda_.Function(self, "MyFunction",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    handler="index.handler",
    code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler"))
)
```

If the stack is not in `us-east-1`, and you need references from different applications on the same account,
you can also set a specific stack ID for each Lambda@Edge.

```python
# Setting stackIds for EdgeFunctions that can be referenced from different applications
# on the same account.
my_func1 = cloudfront.experimental.EdgeFunction(self, "MyFunction1",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    handler="index.handler",
    code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler1")),
    stack_id="edge-lambda-stack-id-1"
)

my_func2 = cloudfront.experimental.EdgeFunction(self, "MyFunction2",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    handler="index.handler",
    code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler2")),
    stack_id="edge-lambda-stack-id-2"
)
```

Lambda@Edge functions can also be associated with additional behaviors,
either at or after Distribution creation time.

```python
# Associating a Lambda@Edge function with additional behaviors.

# my_func: cloudfront.experimental.EdgeFunction
# assigning at Distribution creation
# my_bucket: s3.Bucket

my_origin = origins.S3Origin(my_bucket)
my_distribution = cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=my_origin),
    additional_behaviors={
        "images/*": cloudfront.BehaviorOptions(
            origin=my_origin,
            edge_lambdas=[cloudfront.EdgeLambda(
                function_version=my_func.current_version,
                event_type=cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                include_body=True
            )
            ]
        )
    }
)

# assigning after creation
my_distribution.add_behavior("images/*", my_origin,
    edge_lambdas=[cloudfront.EdgeLambda(
        function_version=my_func.current_version,
        event_type=cloudfront.LambdaEdgeEventType.VIEWER_RESPONSE
    )
    ]
)
```

Adding an existing Lambda@Edge function created in a different stack to a CloudFront distribution.

```python
# Adding an existing Lambda@Edge function created in a different stack
# to a CloudFront distribution.
# s3_bucket: s3.Bucket

function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")

cloudfront.Distribution(self, "distro",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(s3_bucket),
        edge_lambdas=[cloudfront.EdgeLambda(
            function_version=function_version,
            event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
        )
        ]
    )
)
```

### CloudFront Function

You can also deploy CloudFront functions and add them to a CloudFront distribution.

```python
# s3_bucket: s3.Bucket
# Add a cloudfront Function to a Distribution
cf_function = cloudfront.Function(self, "Function",
    code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
    runtime=cloudfront.FunctionRuntime.JS_2_0
)
cloudfront.Distribution(self, "distro",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(s3_bucket),
        function_associations=[cloudfront.FunctionAssociation(
            function=cf_function,
            event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
        )]
    )
)
```

It will auto-generate the name of the function and deploy it to the `live` stage.

Additionally, you can load the function's code from a file using the `FunctionCode.fromFile()` method.

### Key Value Store

A CloudFront Key Value Store can be created and optionally have data imported from a JSON file
by default.

To create an empty Key Value Store:

```python
store = cloudfront.KeyValueStore(self, "KeyValueStore")
```

To also include an initial set of value, the `source` property can be specified. For the
structure of this file, see [Creating a file of key value pairs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/kvs-with-functions-create-s3-kvp.html).

```python
store = cloudfront.KeyValueStore(self, "KeyValueStore",
    key_value_store_name="KeyValueStore",
    source=cloudfront.ImportSource.from_asset("path-to-data.json")
)
```

The Key Value Store can then be associated to a function using the `cloudfront-js-2.0` runtime
or newer:

```python
store = cloudfront.KeyValueStore(self, "KeyValueStore")
cloudfront.Function(self, "Function",
    code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
    # Note that JS_2_0 must be used for Key Value Store support
    runtime=cloudfront.FunctionRuntime.JS_2_0,
    key_value_store=store
)
```

### Logging

You can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives.
The logs can go to either an existing bucket, or a bucket will be created for you.

```python
# Configure logging for Distributions

# Simplest form - creates a new bucket and logs to it.
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com")),
    enable_logging=True
)

# You can optionally log to a specific bucket, configure whether cookies are logged, and give the log files a prefix.
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com")),
    enable_logging=True,  # Optional, this is implied if logBucket is specified
    log_bucket=s3.Bucket(self, "LogBucket",
        object_ownership=s3.ObjectOwnership.OBJECT_WRITER
    ),
    log_file_prefix="distribution-access-logs/",
    log_includes_cookies=True
)
```

### CloudFront Distribution Metrics

You can view operational metrics about your CloudFront distributions.

#### Default CloudFront Distribution Metrics

The [following metrics are available by default](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html#monitoring-console.distributions) for all CloudFront distributions:

* Total requests: The total number of viewer requests received by CloudFront for all HTTP methods and for both HTTP and HTTPS requests.
* Total bytes uploaded: The total number of bytes that viewers uploaded to your origin with CloudFront, using POST and PUT requests.
* Total bytes downloaded: The total number of bytes downloaded by viewers for GET, HEAD, and OPTIONS requests.
* Total error rate: The percentage of all viewer requests for which the response's HTTP status code was 4xx or 5xx.
* 4xx error rate: The percentage of all viewer requests for which the response's HTTP status code was 4xx.
* 5xx error rate: The percentage of all viewer requests for which the response's HTTP status code was 5xx.

```python
dist = cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com"))
)

# Retrieving default distribution metrics
requests_metric = dist.metric_requests()
bytes_uploaded_metric = dist.metric_bytes_uploaded()
bytes_downloaded_metric = dist.metric_bytes_downloaded()
total_error_rate_metric = dist.metric_total_error_rate()
http4xx_error_rate_metric = dist.metric4xx_error_rate()
http5xx_error_rate_metric = dist.metric5xx_error_rate()
```

#### Additional CloudFront Distribution Metrics

You can enable [additional CloudFront distribution metrics](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html#monitoring-console.distributions-additional), which include the following metrics:

* 4xx and 5xx error rates: View 4xx and 5xx error rates by the specific HTTP status code, as a percentage of total requests.
* Origin latency: See the total time spent from when CloudFront receives a request to when it provides a response to the network (not the viewer), for responses that are served from the origin, not the CloudFront cache.
* Cache hit rate: View cache hits as a percentage of total cacheable requests, excluding errors.

```python
dist = cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com")),
    publish_additional_metrics=True
)

# Retrieving additional distribution metrics
latency_metric = dist.metric_origin_latency()
cache_hit_rate_metric = dist.metric_cache_hit_rate()
http401_error_rate_metric = dist.metric401_error_rate()
http403_error_rate_metric = dist.metric403_error_rate()
http404_error_rate_metric = dist.metric404_error_rate()
http502_error_rate_metric = dist.metric502_error_rate()
http503_error_rate_metric = dist.metric503_error_rate()
http504_error_rate_metric = dist.metric504_error_rate()
```

### HTTP Versions

You can configure CloudFront to use a particular version of the HTTP protocol. By default,
newly created distributions use HTTP/2 but can be configured to use both HTTP/2 and HTTP/3 or
just HTTP/3. For all supported HTTP versions, see the `HttpVerson` enum.

```python
# Configure a distribution to use HTTP/2 and HTTP/3
cloudfront.Distribution(self, "myDist",
    default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com")),
    http_version=cloudfront.HttpVersion.HTTP2_AND_3
)
```

### Importing Distributions

Existing distributions can be imported as well; note that like most imported constructs, an imported distribution cannot be modified.
However, it can be used as a reference for other higher-level constructs.

```python
# Using a reference to an imported Distribution
distribution = cloudfront.Distribution.from_distribution_attributes(self, "ImportedDist",
    domain_name="d111111abcdef8.cloudfront.net",
    distribution_id="012345ABCDEF"
)
```

### Permissions

Use the `grant()` method to allow actions on the distribution.
`grantCreateInvalidation()` is a shorthand to allow `CreateInvalidation`.

```python
# distribution: cloudfront.Distribution
# lambda_fn: lambda.Function

distribution.grant(lambda_fn, "cloudfront:ListInvalidations", "cloudfront:GetInvalidation")
distribution.grant_create_invalidation(lambda_fn)
```

### Realtime Log Config

CloudFront supports realtime log delivery from your distribution to a Kinesis stream.

See [Real-time logs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html) in the CloudFront User Guide.

Example:

```python
# Adding realtime logs config to a Cloudfront Distribution on default behavior.
import aws_cdk.aws_kinesis as kinesis

# stream: kinesis.Stream


real_time_config = cloudfront.RealtimeLogConfig(self, "realtimeLog",
    end_points=[
        cloudfront.Endpoint.from_kinesis_stream(stream)
    ],
    fields=["timestamp", "c-ip", "time-to-first-byte", "sc-status"
    ],
    realtime_log_config_name="my-delivery-stream",
    sampling_rate=100
)

cloudfront.Distribution(self, "myCdn",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.HttpOrigin("www.example.com"),
        realtime_log_config=real_time_config
    )
)
```

## Migrating from the original CloudFrontWebDistribution to the newer Distribution construct

It's possible to migrate a distribution from the original to the modern API.
The changes necessary are the following:

### The Distribution

Replace `new CloudFrontWebDistribution` with `new Distribution`. Some
configuration properties have been changed:

| Old API                | New API                                                                                        |
| ---------------------- | ---------------------------------------------------------------------------------------------- |
| `originConfigs`        | `defaultBehavior`; use `additionalBehaviors` if necessary                                      |
| `viewerCertificate`    | `certificate`; use `domainNames` for aliases                                                   |
| `errorConfigurations`  | `errorResponses`                                                                               |
| `loggingConfig`        | `enableLogging`; configure with `logBucket` `logFilePrefix` and `logIncludesCookies`           |
| `viewerProtocolPolicy` | removed; set on each behavior instead. default changed from `REDIRECT_TO_HTTPS` to `ALLOW_ALL` |

After switching constructs, you need to maintain the same logical ID for the underlying [CfnDistribution](https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_aws-cloudfront.CfnDistribution.html) if you wish to avoid the deletion and recreation of your distribution.
To do this, use [escape hatches](https://docs.aws.amazon.com/cdk/v2/guide/cfn_layer.html) to override the logical ID created by the new Distribution construct with the logical ID created by the old construct.

Example:

```python
# source_bucket: s3.Bucket


my_distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(source_bucket)
    )
)
cfn_distribution = my_distribution.node.default_child
cfn_distribution.override_logical_id("MyDistributionCFDistribution3H55TI9Q")
```

### Behaviors

The modern API makes use of the [CloudFront Origins](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront_origins-readme.html) module to easily configure your origin. Replace your origin configuration with the relevant CloudFront Origins class. For example, here's a behavior with an S3 origin:

```python
# source_bucket: s3.Bucket
# oai: cloudfront.OriginAccessIdentity


cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket,
            origin_access_identity=oai
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    )
    ]
)
```

Becomes:

```python
# source_bucket: s3.Bucket


distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(source_bucket)
    )
)
```

In the original API all behaviors are defined in the `originConfigs` property. The new API is optimized for a single origin and behavior, so the default behavior and additional behaviors will be defined separately.

```python
# source_bucket: s3.Bucket
# oai: cloudfront.OriginAccessIdentity


cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket,
            origin_access_identity=oai
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    ), cloudfront.SourceConfiguration(
        custom_origin_source=cloudfront.CustomOriginConfig(
            domain_name="MYALIAS"
        ),
        behaviors=[cloudfront.Behavior(path_pattern="/somewhere")]
    )
    ]
)
```

Becomes:

```python
# source_bucket: s3.Bucket


distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(source_bucket)
    ),
    additional_behaviors={
        "/somewhere": cloudfront.BehaviorOptions(
            origin=origins.HttpOrigin("MYALIAS")
        )
    }
)
```

### Certificates

If you are using an ACM certificate, you can pass the certificate directly to the `certificate` prop.
Any aliases used before in the `ViewerCertificate` class should be passed in to the `domainNames` prop in the modern API.

```python
import aws_cdk.aws_certificatemanager as acm
# certificate: acm.Certificate
# source_bucket: s3.Bucket


viewer_certificate = cloudfront.ViewerCertificate.from_acm_certificate(certificate,
    aliases=["MYALIAS"]
)

cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    )
    ],
    viewer_certificate=viewer_certificate
)
```

Becomes:

```python
import aws_cdk.aws_certificatemanager as acm
# certificate: acm.Certificate
# source_bucket: s3.Bucket


distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(source_bucket)
    ),
    domain_names=["MYALIAS"],
    certificate=certificate
)
```

IAM certificates aren't directly supported by the new API, but can be easily configured through [escape hatches](https://docs.aws.amazon.com/cdk/v2/guide/cfn_layer.html)

```python
# source_bucket: s3.Bucket

viewer_certificate = cloudfront.ViewerCertificate.from_iam_certificate("MYIAMROLEIDENTIFIER",
    aliases=["MYALIAS"]
)

cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    )
    ],
    viewer_certificate=viewer_certificate
)
```

Becomes:

```python
# source_bucket: s3.Bucket

distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
    default_behavior=cloudfront.BehaviorOptions(
        origin=origins.S3Origin(source_bucket)
    ),
    domain_names=["MYALIAS"]
)

cfn_distribution = distribution.node.default_child

cfn_distribution.add_property_override("ViewerCertificate.IamCertificateId", "MYIAMROLEIDENTIFIER")
cfn_distribution.add_property_override("ViewerCertificate.SslSupportMethod", "sni-only")
```

### Other changes

A number of default settings have changed on the new API when creating a new distribution, behavior, and origin.
After making the major changes needed for the migration, run `cdk diff` to see what settings have changed.
If no changes are desired during migration, you will at the least be able to use [escape hatches](https://docs.aws.amazon.com/cdk/v2/guide/cfn_layer.html) to override what the CDK synthesizes, if you can't change the properties directly.

## CloudFrontWebDistribution API

> The `CloudFrontWebDistribution` construct is the original construct written for working with CloudFront distributions.
> Users are encouraged to use the newer `Distribution` instead, as it has a simpler interface and receives new features faster.

Example usage:

```python
# Using a CloudFrontWebDistribution construct.

# source_bucket: s3.Bucket

distribution = cloudfront.CloudFrontWebDistribution(self, "MyDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    )
    ]
)
```

### Viewer certificate

By default, CloudFront Web Distributions will answer HTTPS requests with CloudFront's default certificate,
only containing the distribution `domainName` (e.g. d111111abcdef8.cloudfront.net).
You can customize the viewer certificate property to provide a custom certificate and/or list of domain name aliases to fit your needs.

See [Using Alternate Domain Names and HTTPS](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html) in the CloudFront User Guide.

#### Default certificate

You can customize the default certificate aliases. This is intended to be used in combination with CNAME records in your DNS zone.

Example:

```python
s3_bucket_source = s3.Bucket(self, "Bucket")

distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
    origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
        behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
    )],
    viewer_certificate=cloudfront.ViewerCertificate.from_cloud_front_default_certificate("www.example.com")
)
```

#### ACM certificate

You can change the default certificate by one stored AWS Certificate Manager, or ACM.
Those certificate can either be generated by AWS, or purchased by another CA imported into ACM.

For more information, see
[the aws-certificatemanager module documentation](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-certificatemanager-readme.html)
or [Importing Certificates into AWS Certificate Manager](https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.html)
in the AWS Certificate Manager User Guide.

Example:

```python
s3_bucket_source = s3.Bucket(self, "Bucket")

certificate = certificatemanager.Certificate(self, "Certificate",
    domain_name="example.com",
    subject_alternative_names=["*.example.com"]
)

distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
    origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
        behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
    )],
    viewer_certificate=cloudfront.ViewerCertificate.from_acm_certificate(certificate,
        aliases=["example.com", "www.example.com"],
        security_policy=cloudfront.SecurityPolicyProtocol.TLS_V1,  # default
        ssl_method=cloudfront.SSLMethod.SNI
    )
)
```

#### IAM certificate

You can also import a certificate into the IAM certificate store.

See [Importing an SSL/TLS Certificate](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-procedures.html#cnames-and-https-uploading-certificates) in the CloudFront User Guide.

Example:

```python
s3_bucket_source = s3.Bucket(self, "Bucket")

distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
    origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
        behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
    )],
    viewer_certificate=cloudfront.ViewerCertificate.from_iam_certificate("certificateId",
        aliases=["example.com"],
        security_policy=cloudfront.SecurityPolicyProtocol.SSL_V3,  # default
        ssl_method=cloudfront.SSLMethod.SNI
    )
)
```

### Trusted Key Groups

CloudFront Web Distributions supports validating signed URLs or signed cookies using key groups.
When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior.

Example:

```python
# Using trusted key groups for Cloudfront Web Distributions.
# source_bucket: s3.Bucket
# public_key: str

pub_key = cloudfront.PublicKey(self, "MyPubKey",
    encoded_key=public_key
)

key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
    items=[pub_key
    ]
)

cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket
        ),
        behaviors=[cloudfront.Behavior(
            is_default_behavior=True,
            trusted_key_groups=[key_group
            ]
        )
        ]
    )
    ]
)
```

### Restrictions

CloudFront supports adding restrictions to your distribution.

See [Restricting the Geographic Distribution of Your Content](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.html) in the CloudFront User Guide.

Example:

```python
# Adding restrictions to a Cloudfront Web Distribution.
# source_bucket: s3.Bucket

cloudfront.CloudFrontWebDistribution(self, "MyDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=source_bucket
        ),
        behaviors=[cloudfront.Behavior(is_default_behavior=True)]
    )
    ],
    geo_restriction=cloudfront.GeoRestriction.allowlist("US", "GB")
)
```

### Connection behaviors between CloudFront and your origin

CloudFront provides you even more control over the connection behaviors between CloudFront and your origin.
You can now configure the number of connection attempts CloudFront will make to your origin and the origin connection timeout for each attempt.

See [Origin Connection Attempts](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-attempts)

See [Origin Connection Timeout](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-timeout)

Example usage:

```python
# Configuring connection behaviors between Cloudfront and your origin
distribution = cloudfront.CloudFrontWebDistribution(self, "MyDistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        connection_attempts=3,
        connection_timeout=Duration.seconds(10),
        behaviors=[cloudfront.Behavior(
            is_default_behavior=True
        )
        ]
    )
    ]
)
```

#### Origin Fallback

In case the origin source is not available and answers with one of the
specified status codes the failover origin source will be used.

```python
# Configuring origin fallback options for the CloudFrontWebDistribution
cloudfront.CloudFrontWebDistribution(self, "ADistribution",
    origin_configs=[cloudfront.SourceConfiguration(
        s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=s3.Bucket.from_bucket_name(self, "aBucket", "myoriginbucket"),
            origin_path="/",
            origin_headers={
                "myHeader": "42"
            },
            origin_shield_region="us-west-2"
        ),
        failover_s3_origin_source=cloudfront.S3OriginConfig(
            s3_bucket_source=s3.Bucket.from_bucket_name(self, "aBucketFallback", "myoriginbucketfallback"),
            origin_path="/somewhere",
            origin_headers={
                "myHeader2": "21"
            },
            origin_shield_region="us-east-1"
        ),
        failover_criteria_status_codes=[cloudfront.FailoverStatusCode.INTERNAL_SERVER_ERROR],
        behaviors=[cloudfront.Behavior(
            is_default_behavior=True
        )
        ]
    )
    ]
)
```

## KeyGroup & PublicKey API

You can create a key group to use with CloudFront signed URLs and signed cookies
You can add public keys to use with CloudFront features such as signed URLs, signed cookies, and field-level encryption.

The following example command uses OpenSSL to generate an RSA key pair with a length of 2048 bits and save to the file named `private_key.pem`.

```bash
openssl genrsa -out private_key.pem 2048
```

The resulting file contains both the public and the private key. The following example command extracts the public key from the file named `private_key.pem` and stores it in `public_key.pem`.

```bash
openssl rsa -pubout -in private_key.pem -out public_key.pem
```

Note: Don't forget to copy/paste the contents of `public_key.pem` file including `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines into `encodedKey` parameter when creating a `PublicKey`.

Example:

```python
# Create a key group to use with CloudFront signed URLs and signed cookies.
cloudfront.KeyGroup(self, "MyKeyGroup",
    items=[
        cloudfront.PublicKey(self, "MyPublicKey",
            encoded_key="..."
        )
    ]
)
```

See:

* https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
* https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html
'''
import abc
import builtins
import datetime
import enum
import typing

import jsii
import publication
import typing_extensions

from typeguard import check_type

from .._jsii import *

import constructs as _constructs_77d1e7e8
from .. import (
    AssetHashType as _AssetHashType_05b67f2d,
    BundlingOptions as _BundlingOptions_588cc936,
    CfnResource as _CfnResource_9df397a6,
    CfnTag as _CfnTag_f6864754,
    Duration as _Duration_4839e8c3,
    IInspectable as _IInspectable_c2943556,
    IResolvable as _IResolvable_da3f097b,
    IResource as _IResource_c80c4260,
    ITaggable as _ITaggable_36806126,
    IgnoreMode as _IgnoreMode_655a98e8,
    Resource as _Resource_45bc6135,
    SymlinkFollowMode as _SymlinkFollowMode_047ec1f6,
    TagManager as _TagManager_0a598cb3,
    TreeInspector as _TreeInspector_488e0dd5,
)
from ..aws_certificatemanager import ICertificate as _ICertificate_c194c70b
from ..aws_cloudwatch import (
    Metric as _Metric_e396a4dc,
    MetricOptions as _MetricOptions_1788b62f,
    Unit as _Unit_61bc6f70,
)
from ..aws_iam import (
    Grant as _Grant_a7ae64f8,
    IGrantable as _IGrantable_71c4f5de,
    IPrincipal as _IPrincipal_539bb2fd,
    IRole as _IRole_235f5d8e,
)
from ..aws_kinesis import IStream as _IStream_4e2457d2
from ..aws_lambda import IVersion as _IVersion_faf7234e
from ..aws_s3 import IBucket as _IBucket_42e086fd
from ..aws_s3_assets import AssetOptions as _AssetOptions_2aa69621


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.AddBehaviorOptions",
    jsii_struct_bases=[],
    name_mapping={
        "allowed_methods": "allowedMethods",
        "cached_methods": "cachedMethods",
        "cache_policy": "cachePolicy",
        "compress": "compress",
        "edge_lambdas": "edgeLambdas",
        "function_associations": "functionAssociations",
        "origin_request_policy": "originRequestPolicy",
        "realtime_log_config": "realtimeLogConfig",
        "response_headers_policy": "responseHeadersPolicy",
        "smooth_streaming": "smoothStreaming",
        "trusted_key_groups": "trustedKeyGroups",
        "viewer_protocol_policy": "viewerProtocolPolicy",
    },
)
class AddBehaviorOptions:
    def __init__(
        self,
        *,
        allowed_methods: typing.Optional["AllowedMethods"] = None,
        cached_methods: typing.Optional["CachedMethods"] = None,
        cache_policy: typing.Optional["ICachePolicy"] = None,
        compress: typing.Optional[builtins.bool] = None,
        edge_lambdas: typing.Optional[typing.Sequence[typing.Union["EdgeLambda", typing.Dict[builtins.str, typing.Any]]]] = None,
        function_associations: typing.Optional[typing.Sequence[typing.Union["FunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
        origin_request_policy: typing.Optional["IOriginRequestPolicy"] = None,
        realtime_log_config: typing.Optional["IRealtimeLogConfig"] = None,
        response_headers_policy: typing.Optional["IResponseHeadersPolicy"] = None,
        smooth_streaming: typing.Optional[builtins.bool] = None,
        trusted_key_groups: typing.Optional[typing.Sequence["IKeyGroup"]] = None,
        viewer_protocol_policy: typing.Optional["ViewerProtocolPolicy"] = None,
    ) -> None:
        '''Options for adding a new behavior to a Distribution.

        :param allowed_methods: HTTP methods to allow for this behavior. Default: AllowedMethods.ALLOW_GET_HEAD
        :param cached_methods: HTTP methods to cache for this behavior. Default: CachedMethods.CACHE_GET_HEAD
        :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
        :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
        :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
        :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
        :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
        :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
        :param response_headers_policy: The response headers policy for this behavior. The response headers policy determines which headers are included in responses Default: - none
        :param smooth_streaming: Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior. Default: false
        :param trusted_key_groups: A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies. Default: - no KeyGroups are associated with cache behavior
        :param viewer_protocol_policy: The protocol that viewers can use to access the files controlled by this behavior. Default: ViewerProtocolPolicy.ALLOW_ALL

        :exampleMetadata: infused

        Example::

            # Add a behavior to a Distribution after initial creation.
            # my_bucket: s3.Bucket
            # my_web_distribution: cloudfront.Distribution
            
            my_web_distribution.add_behavior("/images/*.jpg", origins.S3Origin(my_bucket),
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__65772d6db92564a1181169ceb316d515431097e5d91750c338502393dc09f916)
            check_type(argname="argument allowed_methods", value=allowed_methods, expected_type=type_hints["allowed_methods"])
            check_type(argname="argument cached_methods", value=cached_methods, expected_type=type_hints["cached_methods"])
            check_type(argname="argument cache_policy", value=cache_policy, expected_type=type_hints["cache_policy"])
            check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
            check_type(argname="argument edge_lambdas", value=edge_lambdas, expected_type=type_hints["edge_lambdas"])
            check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
            check_type(argname="argument origin_request_policy", value=origin_request_policy, expected_type=type_hints["origin_request_policy"])
            check_type(argname="argument realtime_log_config", value=realtime_log_config, expected_type=type_hints["realtime_log_config"])
            check_type(argname="argument response_headers_policy", value=response_headers_policy, expected_type=type_hints["response_headers_policy"])
            check_type(argname="argument smooth_streaming", value=smooth_streaming, expected_type=type_hints["smooth_streaming"])
            check_type(argname="argument trusted_key_groups", value=trusted_key_groups, expected_type=type_hints["trusted_key_groups"])
            check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if allowed_methods is not None:
            self._values["allowed_methods"] = allowed_methods
        if cached_methods is not None:
            self._values["cached_methods"] = cached_methods
        if cache_policy is not None:
            self._values["cache_policy"] = cache_policy
        if compress is not None:
            self._values["compress"] = compress
        if edge_lambdas is not None:
            self._values["edge_lambdas"] = edge_lambdas
        if function_associations is not None:
            self._values["function_associations"] = function_associations
        if origin_request_policy is not None:
            self._values["origin_request_policy"] = origin_request_policy
        if realtime_log_config is not None:
            self._values["realtime_log_config"] = realtime_log_config
        if response_headers_policy is not None:
            self._values["response_headers_policy"] = response_headers_policy
        if smooth_streaming is not None:
            self._values["smooth_streaming"] = smooth_streaming
        if trusted_key_groups is not None:
            self._values["trusted_key_groups"] = trusted_key_groups
        if viewer_protocol_policy is not None:
            self._values["viewer_protocol_policy"] = viewer_protocol_policy

    @builtins.property
    def allowed_methods(self) -> typing.Optional["AllowedMethods"]:
        '''HTTP methods to allow for this behavior.

        :default: AllowedMethods.ALLOW_GET_HEAD
        '''
        result = self._values.get("allowed_methods")
        return typing.cast(typing.Optional["AllowedMethods"], result)

    @builtins.property
    def cached_methods(self) -> typing.Optional["CachedMethods"]:
        '''HTTP methods to cache for this behavior.

        :default: CachedMethods.CACHE_GET_HEAD
        '''
        result = self._values.get("cached_methods")
        return typing.cast(typing.Optional["CachedMethods"], result)

    @builtins.property
    def cache_policy(self) -> typing.Optional["ICachePolicy"]:
        '''The cache policy for this behavior.

        The cache policy determines what values are included in the cache key,
        and the time-to-live (TTL) values for the cache.

        :default: CachePolicy.CACHING_OPTIMIZED

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html.
        '''
        result = self._values.get("cache_policy")
        return typing.cast(typing.Optional["ICachePolicy"], result)

    @builtins.property
    def compress(self) -> typing.Optional[builtins.bool]:
        '''Whether you want CloudFront to automatically compress certain files for this cache behavior.

        See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types
        for file types CloudFront will compress.

        :default: true
        '''
        result = self._values.get("compress")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def edge_lambdas(self) -> typing.Optional[typing.List["EdgeLambda"]]:
        '''The Lambda@Edge functions to invoke before serving the contents.

        :default: - no Lambda functions will be invoked

        :see: https://aws.amazon.com/lambda/edge
        '''
        result = self._values.get("edge_lambdas")
        return typing.cast(typing.Optional[typing.List["EdgeLambda"]], result)

    @builtins.property
    def function_associations(
        self,
    ) -> typing.Optional[typing.List["FunctionAssociation"]]:
        '''The CloudFront functions to invoke before serving the contents.

        :default: - no functions will be invoked
        '''
        result = self._values.get("function_associations")
        return typing.cast(typing.Optional[typing.List["FunctionAssociation"]], result)

    @builtins.property
    def origin_request_policy(self) -> typing.Optional["IOriginRequestPolicy"]:
        '''The origin request policy for this behavior.

        The origin request policy determines which values (e.g., headers, cookies)
        are included in requests that CloudFront sends to the origin.

        :default: - none
        '''
        result = self._values.get("origin_request_policy")
        return typing.cast(typing.Optional["IOriginRequestPolicy"], result)

    @builtins.property
    def realtime_log_config(self) -> typing.Optional["IRealtimeLogConfig"]:
        '''The real-time log configuration to be attached to this cache behavior.

        :default: - none
        '''
        result = self._values.get("realtime_log_config")
        return typing.cast(typing.Optional["IRealtimeLogConfig"], result)

    @builtins.property
    def response_headers_policy(self) -> typing.Optional["IResponseHeadersPolicy"]:
        '''The response headers policy for this behavior.

        The response headers policy determines which headers are included in responses

        :default: - none
        '''
        result = self._values.get("response_headers_policy")
        return typing.cast(typing.Optional["IResponseHeadersPolicy"], result)

    @builtins.property
    def smooth_streaming(self) -> typing.Optional[builtins.bool]:
        '''Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior.

        :default: false
        '''
        result = self._values.get("smooth_streaming")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def trusted_key_groups(self) -> typing.Optional[typing.List["IKeyGroup"]]:
        '''A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.

        :default: - no KeyGroups are associated with cache behavior

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
        '''
        result = self._values.get("trusted_key_groups")
        return typing.cast(typing.Optional[typing.List["IKeyGroup"]], result)

    @builtins.property
    def viewer_protocol_policy(self) -> typing.Optional["ViewerProtocolPolicy"]:
        '''The protocol that viewers can use to access the files controlled by this behavior.

        :default: ViewerProtocolPolicy.ALLOW_ALL
        '''
        result = self._values.get("viewer_protocol_policy")
        return typing.cast(typing.Optional["ViewerProtocolPolicy"], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "AddBehaviorOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class AllowedMethods(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.AllowedMethods",
):
    '''The HTTP methods that the Behavior will accept requests on.

    :exampleMetadata: infused

    Example::

        # Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
        # my_bucket: s3.Bucket
        
        my_web_distribution = cloudfront.Distribution(self, "myDist",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(my_bucket),
                allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
            )
        )
    '''

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALLOW_ALL")
    def ALLOW_ALL(cls) -> "AllowedMethods":
        '''All supported HTTP methods.'''
        return typing.cast("AllowedMethods", jsii.sget(cls, "ALLOW_ALL"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALLOW_GET_HEAD")
    def ALLOW_GET_HEAD(cls) -> "AllowedMethods":
        '''HEAD and GET.'''
        return typing.cast("AllowedMethods", jsii.sget(cls, "ALLOW_GET_HEAD"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALLOW_GET_HEAD_OPTIONS")
    def ALLOW_GET_HEAD_OPTIONS(cls) -> "AllowedMethods":
        '''HEAD, GET, and OPTIONS.'''
        return typing.cast("AllowedMethods", jsii.sget(cls, "ALLOW_GET_HEAD_OPTIONS"))

    @builtins.property
    @jsii.member(jsii_name="methods")
    def methods(self) -> typing.List[builtins.str]:
        '''HTTP methods supported.'''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "methods"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.Behavior",
    jsii_struct_bases=[],
    name_mapping={
        "allowed_methods": "allowedMethods",
        "cached_methods": "cachedMethods",
        "compress": "compress",
        "default_ttl": "defaultTtl",
        "forwarded_values": "forwardedValues",
        "function_associations": "functionAssociations",
        "is_default_behavior": "isDefaultBehavior",
        "lambda_function_associations": "lambdaFunctionAssociations",
        "max_ttl": "maxTtl",
        "min_ttl": "minTtl",
        "path_pattern": "pathPattern",
        "trusted_key_groups": "trustedKeyGroups",
        "trusted_signers": "trustedSigners",
        "viewer_protocol_policy": "viewerProtocolPolicy",
    },
)
class Behavior:
    def __init__(
        self,
        *,
        allowed_methods: typing.Optional["CloudFrontAllowedMethods"] = None,
        cached_methods: typing.Optional["CloudFrontAllowedCachedMethods"] = None,
        compress: typing.Optional[builtins.bool] = None,
        default_ttl: typing.Optional[_Duration_4839e8c3] = None,
        forwarded_values: typing.Optional[typing.Union["CfnDistribution.ForwardedValuesProperty", typing.Dict[builtins.str, typing.Any]]] = None,
        function_associations: typing.Optional[typing.Sequence[typing.Union["FunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
        is_default_behavior: typing.Optional[builtins.bool] = None,
        lambda_function_associations: typing.Optional[typing.Sequence[typing.Union["LambdaFunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
        max_ttl: typing.Optional[_Duration_4839e8c3] = None,
        min_ttl: typing.Optional[_Duration_4839e8c3] = None,
        path_pattern: typing.Optional[builtins.str] = None,
        trusted_key_groups: typing.Optional[typing.Sequence["IKeyGroup"]] = None,
        trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
        viewer_protocol_policy: typing.Optional["ViewerProtocolPolicy"] = None,
    ) -> None:
        '''A CloudFront behavior wrapper.

        :param allowed_methods: The method this CloudFront distribution responds do. Default: GET_HEAD
        :param cached_methods: Which methods are cached by CloudFront by default. Default: GET_HEAD
        :param compress: If CloudFront should automatically compress some content types. Default: true
        :param default_ttl: The default amount of time CloudFront will cache an object. This value applies only when your custom origin does not add HTTP headers, such as Cache-Control max-age, Cache-Control s-maxage, and Expires to objects. Default: 86400 (1 day)
        :param forwarded_values: The values CloudFront will forward to the origin when making a request. Default: none (no cookies - no headers)
        :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
        :param is_default_behavior: If this behavior is the default behavior for the distribution. You must specify exactly one default distribution per CloudFront distribution. The default behavior is allowed to omit the "path" property.
        :param lambda_function_associations: Declares associated lambda@edge functions for this distribution behaviour. Default: No lambda function associated
        :param max_ttl: The max amount of time you want objects to stay in the cache before CloudFront queries your origin. Default: Duration.seconds(31536000) (one year)
        :param min_ttl: The minimum amount of time that you want objects to stay in the cache before CloudFront queries your origin.
        :param path_pattern: The path this behavior responds to. Required for all non-default behaviors. (The default behavior implicitly has "*" as the path pattern. )
        :param trusted_key_groups: A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies. Default: - no KeyGroups are associated with cache behavior
        :param trusted_signers: (deprecated) Trusted signers is how CloudFront allows you to serve private content. The signers are the account IDs that are allowed to sign cookies/presigned URLs for this distribution. If you pass a non empty value, all requests for this behavior must be signed (no public access will be allowed)
        :param viewer_protocol_policy: The viewer policy for this behavior. Default: - the distribution wide viewer protocol policy will be used

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            import aws_cdk as cdk
            from aws_cdk import aws_cloudfront as cloudfront
            from aws_cdk import aws_lambda as lambda_
            
            # function_: cloudfront.Function
            # key_group: cloudfront.KeyGroup
            # version: lambda.Version
            
            behavior = cloudfront.Behavior(
                allowed_methods=cloudfront.CloudFrontAllowedMethods.GET_HEAD,
                cached_methods=cloudfront.CloudFrontAllowedCachedMethods.GET_HEAD,
                compress=False,
                default_ttl=cdk.Duration.minutes(30),
                forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                    query_string=False,
            
                    # the properties below are optional
                    cookies=cloudfront.CfnDistribution.CookiesProperty(
                        forward="forward",
            
                        # the properties below are optional
                        whitelisted_names=["whitelistedNames"]
                    ),
                    headers=["headers"],
                    query_string_cache_keys=["queryStringCacheKeys"]
                ),
                function_associations=[cloudfront.FunctionAssociation(
                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST,
                    function=function_
                )],
                is_default_behavior=False,
                lambda_function_associations=[cloudfront.LambdaFunctionAssociation(
                    event_type=cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                    lambda_function=version,
            
                    # the properties below are optional
                    include_body=False
                )],
                max_ttl=cdk.Duration.minutes(30),
                min_ttl=cdk.Duration.minutes(30),
                path_pattern="pathPattern",
                trusted_key_groups=[key_group],
                trusted_signers=["trustedSigners"],
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.HTTPS_ONLY
            )
        '''
        if isinstance(forwarded_values, dict):
            forwarded_values = CfnDistribution.ForwardedValuesProperty(**forwarded_values)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9578dfe76ca23ed5579560a4735db540df319a1f3d27dbe31a05d73a3e0ede5)
            check_type(argname="argument allowed_methods", value=allowed_methods, expected_type=type_hints["allowed_methods"])
            check_type(argname="argument cached_methods", value=cached_methods, expected_type=type_hints["cached_methods"])
            check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
            check_type(argname="argument default_ttl", value=default_ttl, expected_type=type_hints["default_ttl"])
            check_type(argname="argument forwarded_values", value=forwarded_values, expected_type=type_hints["forwarded_values"])
            check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
            check_type(argname="argument is_default_behavior", value=is_default_behavior, expected_type=type_hints["is_default_behavior"])
            check_type(argname="argument lambda_function_associations", value=lambda_function_associations, expected_type=type_hints["lambda_function_associations"])
            check_type(argname="argument max_ttl", value=max_ttl, expected_type=type_hints["max_ttl"])
            check_type(argname="argument min_ttl", value=min_ttl, expected_type=type_hints["min_ttl"])
            check_type(argname="argument path_pattern", value=path_pattern, expected_type=type_hints["path_pattern"])
            check_type(argname="argument trusted_key_groups", value=trusted_key_groups, expected_type=type_hints["trusted_key_groups"])
            check_type(argname="argument trusted_signers", value=trusted_signers, expected_type=type_hints["trusted_signers"])
            check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if allowed_methods is not None:
            self._values["allowed_methods"] = allowed_methods
        if cached_methods is not None:
            self._values["cached_methods"] = cached_methods
        if compress is not None:
            self._values["compress"] = compress
        if default_ttl is not None:
            self._values["default_ttl"] = default_ttl
        if forwarded_values is not None:
            self._values["forwarded_values"] = forwarded_values
        if function_associations is not None:
            self._values["function_associations"] = function_associations
        if is_default_behavior is not None:
            self._values["is_default_behavior"] = is_default_behavior
        if lambda_function_associations is not None:
            self._values["lambda_function_associations"] = lambda_function_associations
        if max_ttl is not None:
            self._values["max_ttl"] = max_ttl
        if min_ttl is not None:
            self._values["min_ttl"] = min_ttl
        if path_pattern is not None:
            self._values["path_pattern"] = path_pattern
        if trusted_key_groups is not None:
            self._values["trusted_key_groups"] = trusted_key_groups
        if trusted_signers is not None:
            self._values["trusted_signers"] = trusted_signers
        if viewer_protocol_policy is not None:
            self._values["viewer_protocol_policy"] = viewer_protocol_policy

    @builtins.property
    def allowed_methods(self) -> typing.Optional["CloudFrontAllowedMethods"]:
        '''The method this CloudFront distribution responds do.

        :default: GET_HEAD
        '''
        result = self._values.get("allowed_methods")
        return typing.cast(typing.Optional["CloudFrontAllowedMethods"], result)

    @builtins.property
    def cached_methods(self) -> typing.Optional["CloudFrontAllowedCachedMethods"]:
        '''Which methods are cached by CloudFront by default.

        :default: GET_HEAD
        '''
        result = self._values.get("cached_methods")
        return typing.cast(typing.Optional["CloudFrontAllowedCachedMethods"], result)

    @builtins.property
    def compress(self) -> typing.Optional[builtins.bool]:
        '''If CloudFront should automatically compress some content types.

        :default: true
        '''
        result = self._values.get("compress")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def default_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The default amount of time CloudFront will cache an object.

        This value applies only when your custom origin does not add HTTP headers,
        such as Cache-Control max-age, Cache-Control s-maxage, and Expires to objects.

        :default: 86400 (1 day)
        '''
        result = self._values.get("default_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def forwarded_values(
        self,
    ) -> typing.Optional["CfnDistribution.ForwardedValuesProperty"]:
        '''The values CloudFront will forward to the origin when making a request.

        :default: none (no cookies - no headers)
        '''
        result = self._values.get("forwarded_values")
        return typing.cast(typing.Optional["CfnDistribution.ForwardedValuesProperty"], result)

    @builtins.property
    def function_associations(
        self,
    ) -> typing.Optional[typing.List["FunctionAssociation"]]:
        '''The CloudFront functions to invoke before serving the contents.

        :default: - no functions will be invoked
        '''
        result = self._values.get("function_associations")
        return typing.cast(typing.Optional[typing.List["FunctionAssociation"]], result)

    @builtins.property
    def is_default_behavior(self) -> typing.Optional[builtins.bool]:
        '''If this behavior is the default behavior for the distribution.

        You must specify exactly one default distribution per CloudFront distribution.
        The default behavior is allowed to omit the "path" property.
        '''
        result = self._values.get("is_default_behavior")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def lambda_function_associations(
        self,
    ) -> typing.Optional[typing.List["LambdaFunctionAssociation"]]:
        '''Declares associated lambda@edge functions for this distribution behaviour.

        :default: No lambda function associated
        '''
        result = self._values.get("lambda_function_associations")
        return typing.cast(typing.Optional[typing.List["LambdaFunctionAssociation"]], result)

    @builtins.property
    def max_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The max amount of time you want objects to stay in the cache before CloudFront queries your origin.

        :default: Duration.seconds(31536000) (one year)
        '''
        result = self._values.get("max_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def min_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The minimum amount of time that you want objects to stay in the cache before CloudFront queries your origin.'''
        result = self._values.get("min_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def path_pattern(self) -> typing.Optional[builtins.str]:
        '''The path this behavior responds to.

        Required for all non-default behaviors. (The default behavior implicitly has "*" as the path pattern. )
        '''
        result = self._values.get("path_pattern")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def trusted_key_groups(self) -> typing.Optional[typing.List["IKeyGroup"]]:
        '''A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.

        :default: - no KeyGroups are associated with cache behavior

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
        '''
        result = self._values.get("trusted_key_groups")
        return typing.cast(typing.Optional[typing.List["IKeyGroup"]], result)

    @builtins.property
    def trusted_signers(self) -> typing.Optional[typing.List[builtins.str]]:
        '''(deprecated) Trusted signers is how CloudFront allows you to serve private content.

        The signers are the account IDs that are allowed to sign cookies/presigned URLs for this distribution.

        If you pass a non empty value, all requests for this behavior must be signed (no public access will be allowed)

        :deprecated: - We recommend using trustedKeyGroups instead of trustedSigners.

        :stability: deprecated
        '''
        result = self._values.get("trusted_signers")
        return typing.cast(typing.Optional[typing.List[builtins.str]], result)

    @builtins.property
    def viewer_protocol_policy(self) -> typing.Optional["ViewerProtocolPolicy"]:
        '''The viewer policy for this behavior.

        :default: - the distribution wide viewer protocol policy will be used
        '''
        result = self._values.get("viewer_protocol_policy")
        return typing.cast(typing.Optional["ViewerProtocolPolicy"], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "Behavior(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.BehaviorOptions",
    jsii_struct_bases=[AddBehaviorOptions],
    name_mapping={
        "allowed_methods": "allowedMethods",
        "cached_methods": "cachedMethods",
        "cache_policy": "cachePolicy",
        "compress": "compress",
        "edge_lambdas": "edgeLambdas",
        "function_associations": "functionAssociations",
        "origin_request_policy": "originRequestPolicy",
        "realtime_log_config": "realtimeLogConfig",
        "response_headers_policy": "responseHeadersPolicy",
        "smooth_streaming": "smoothStreaming",
        "trusted_key_groups": "trustedKeyGroups",
        "viewer_protocol_policy": "viewerProtocolPolicy",
        "origin": "origin",
    },
)
class BehaviorOptions(AddBehaviorOptions):
    def __init__(
        self,
        *,
        allowed_methods: typing.Optional[AllowedMethods] = None,
        cached_methods: typing.Optional["CachedMethods"] = None,
        cache_policy: typing.Optional["ICachePolicy"] = None,
        compress: typing.Optional[builtins.bool] = None,
        edge_lambdas: typing.Optional[typing.Sequence[typing.Union["EdgeLambda", typing.Dict[builtins.str, typing.Any]]]] = None,
        function_associations: typing.Optional[typing.Sequence[typing.Union["FunctionAssociation", typing.Dict[builtins.str, typing.Any]]]] = None,
        origin_request_policy: typing.Optional["IOriginRequestPolicy"] = None,
        realtime_log_config: typing.Optional["IRealtimeLogConfig"] = None,
        response_headers_policy: typing.Optional["IResponseHeadersPolicy"] = None,
        smooth_streaming: typing.Optional[builtins.bool] = None,
        trusted_key_groups: typing.Optional[typing.Sequence["IKeyGroup"]] = None,
        viewer_protocol_policy: typing.Optional["ViewerProtocolPolicy"] = None,
        origin: "IOrigin",
    ) -> None:
        '''Options for creating a new behavior.

        :param allowed_methods: HTTP methods to allow for this behavior. Default: AllowedMethods.ALLOW_GET_HEAD
        :param cached_methods: HTTP methods to cache for this behavior. Default: CachedMethods.CACHE_GET_HEAD
        :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
        :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
        :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
        :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
        :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
        :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
        :param response_headers_policy: The response headers policy for this behavior. The response headers policy determines which headers are included in responses Default: - none
        :param smooth_streaming: Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior. Default: false
        :param trusted_key_groups: A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies. Default: - no KeyGroups are associated with cache behavior
        :param viewer_protocol_policy: The protocol that viewers can use to access the files controlled by this behavior. Default: ViewerProtocolPolicy.ALLOW_ALL
        :param origin: The origin that you want CloudFront to route requests to when they match this behavior.

        :exampleMetadata: infused

        Example::

            # Adding an existing Lambda@Edge function created in a different stack
            # to a CloudFront distribution.
            # s3_bucket: s3.Bucket
            
            function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")
            
            cloudfront.Distribution(self, "distro",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.S3Origin(s3_bucket),
                    edge_lambdas=[cloudfront.EdgeLambda(
                        function_version=function_version,
                        event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
                    )
                    ]
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4eb7e06f76f798ae0a32c303cbe5f500a4fd80b03804aa96894c0cddc6b6bdde)
            check_type(argname="argument allowed_methods", value=allowed_methods, expected_type=type_hints["allowed_methods"])
            check_type(argname="argument cached_methods", value=cached_methods, expected_type=type_hints["cached_methods"])
            check_type(argname="argument cache_policy", value=cache_policy, expected_type=type_hints["cache_policy"])
            check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
            check_type(argname="argument edge_lambdas", value=edge_lambdas, expected_type=type_hints["edge_lambdas"])
            check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
            check_type(argname="argument origin_request_policy", value=origin_request_policy, expected_type=type_hints["origin_request_policy"])
            check_type(argname="argument realtime_log_config", value=realtime_log_config, expected_type=type_hints["realtime_log_config"])
            check_type(argname="argument response_headers_policy", value=response_headers_policy, expected_type=type_hints["response_headers_policy"])
            check_type(argname="argument smooth_streaming", value=smooth_streaming, expected_type=type_hints["smooth_streaming"])
            check_type(argname="argument trusted_key_groups", value=trusted_key_groups, expected_type=type_hints["trusted_key_groups"])
            check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
            check_type(argname="argument origin", value=origin, expected_type=type_hints["origin"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "origin": origin,
        }
        if allowed_methods is not None:
            self._values["allowed_methods"] = allowed_methods
        if cached_methods is not None:
            self._values["cached_methods"] = cached_methods
        if cache_policy is not None:
            self._values["cache_policy"] = cache_policy
        if compress is not None:
            self._values["compress"] = compress
        if edge_lambdas is not None:
            self._values["edge_lambdas"] = edge_lambdas
        if function_associations is not None:
            self._values["function_associations"] = function_associations
        if origin_request_policy is not None:
            self._values["origin_request_policy"] = origin_request_policy
        if realtime_log_config is not None:
            self._values["realtime_log_config"] = realtime_log_config
        if response_headers_policy is not None:
            self._values["response_headers_policy"] = response_headers_policy
        if smooth_streaming is not None:
            self._values["smooth_streaming"] = smooth_streaming
        if trusted_key_groups is not None:
            self._values["trusted_key_groups"] = trusted_key_groups
        if viewer_protocol_policy is not None:
            self._values["viewer_protocol_policy"] = viewer_protocol_policy

    @builtins.property
    def allowed_methods(self) -> typing.Optional[AllowedMethods]:
        '''HTTP methods to allow for this behavior.

        :default: AllowedMethods.ALLOW_GET_HEAD
        '''
        result = self._values.get("allowed_methods")
        return typing.cast(typing.Optional[AllowedMethods], result)

    @builtins.property
    def cached_methods(self) -> typing.Optional["CachedMethods"]:
        '''HTTP methods to cache for this behavior.

        :default: CachedMethods.CACHE_GET_HEAD
        '''
        result = self._values.get("cached_methods")
        return typing.cast(typing.Optional["CachedMethods"], result)

    @builtins.property
    def cache_policy(self) -> typing.Optional["ICachePolicy"]:
        '''The cache policy for this behavior.

        The cache policy determines what values are included in the cache key,
        and the time-to-live (TTL) values for the cache.

        :default: CachePolicy.CACHING_OPTIMIZED

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html.
        '''
        result = self._values.get("cache_policy")
        return typing.cast(typing.Optional["ICachePolicy"], result)

    @builtins.property
    def compress(self) -> typing.Optional[builtins.bool]:
        '''Whether you want CloudFront to automatically compress certain files for this cache behavior.

        See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types
        for file types CloudFront will compress.

        :default: true
        '''
        result = self._values.get("compress")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def edge_lambdas(self) -> typing.Optional[typing.List["EdgeLambda"]]:
        '''The Lambda@Edge functions to invoke before serving the contents.

        :default: - no Lambda functions will be invoked

        :see: https://aws.amazon.com/lambda/edge
        '''
        result = self._values.get("edge_lambdas")
        return typing.cast(typing.Optional[typing.List["EdgeLambda"]], result)

    @builtins.property
    def function_associations(
        self,
    ) -> typing.Optional[typing.List["FunctionAssociation"]]:
        '''The CloudFront functions to invoke before serving the contents.

        :default: - no functions will be invoked
        '''
        result = self._values.get("function_associations")
        return typing.cast(typing.Optional[typing.List["FunctionAssociation"]], result)

    @builtins.property
    def origin_request_policy(self) -> typing.Optional["IOriginRequestPolicy"]:
        '''The origin request policy for this behavior.

        The origin request policy determines which values (e.g., headers, cookies)
        are included in requests that CloudFront sends to the origin.

        :default: - none
        '''
        result = self._values.get("origin_request_policy")
        return typing.cast(typing.Optional["IOriginRequestPolicy"], result)

    @builtins.property
    def realtime_log_config(self) -> typing.Optional["IRealtimeLogConfig"]:
        '''The real-time log configuration to be attached to this cache behavior.

        :default: - none
        '''
        result = self._values.get("realtime_log_config")
        return typing.cast(typing.Optional["IRealtimeLogConfig"], result)

    @builtins.property
    def response_headers_policy(self) -> typing.Optional["IResponseHeadersPolicy"]:
        '''The response headers policy for this behavior.

        The response headers policy determines which headers are included in responses

        :default: - none
        '''
        result = self._values.get("response_headers_policy")
        return typing.cast(typing.Optional["IResponseHeadersPolicy"], result)

    @builtins.property
    def smooth_streaming(self) -> typing.Optional[builtins.bool]:
        '''Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior.

        :default: false
        '''
        result = self._values.get("smooth_streaming")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def trusted_key_groups(self) -> typing.Optional[typing.List["IKeyGroup"]]:
        '''A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies.

        :default: - no KeyGroups are associated with cache behavior

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html
        '''
        result = self._values.get("trusted_key_groups")
        return typing.cast(typing.Optional[typing.List["IKeyGroup"]], result)

    @builtins.property
    def viewer_protocol_policy(self) -> typing.Optional["ViewerProtocolPolicy"]:
        '''The protocol that viewers can use to access the files controlled by this behavior.

        :default: ViewerProtocolPolicy.ALLOW_ALL
        '''
        result = self._values.get("viewer_protocol_policy")
        return typing.cast(typing.Optional["ViewerProtocolPolicy"], result)

    @builtins.property
    def origin(self) -> "IOrigin":
        '''The origin that you want CloudFront to route requests to when they match this behavior.'''
        result = self._values.get("origin")
        assert result is not None, "Required property 'origin' is missing"
        return typing.cast("IOrigin", result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "BehaviorOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class CacheCookieBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CacheCookieBehavior",
):
    '''Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom cache policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_cache_policy = cloudfront.CachePolicy(self, "myCachePolicy",
            cache_policy_name="MyPolicy",
            comment="A default policy",
            default_ttl=Duration.days(2),
            min_ttl=Duration.minutes(1),
            max_ttl=Duration.days(10),
            cookie_behavior=cloudfront.CacheCookieBehavior.all(),
            header_behavior=cloudfront.CacheHeaderBehavior.allow_list("X-CustomHeader"),
            query_string_behavior=cloudfront.CacheQueryStringBehavior.deny_list("username"),
            enable_accept_encoding_gzip=True,
            enable_accept_encoding_brotli=True
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                cache_policy=my_cache_policy
            )
        )
    '''

    @jsii.member(jsii_name="all")
    @builtins.classmethod
    def all(cls) -> "CacheCookieBehavior":
        '''All cookies in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.'''
        return typing.cast("CacheCookieBehavior", jsii.sinvoke(cls, "all", []))

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(cls, *cookies: builtins.str) -> "CacheCookieBehavior":
        '''Only the provided ``cookies`` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :param cookies: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8f0589a04e5898d704a7865117107d07b6fc07534515180daeb80b9ccadecd3)
            check_type(argname="argument cookies", value=cookies, expected_type=typing.Tuple[type_hints["cookies"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("CacheCookieBehavior", jsii.sinvoke(cls, "allowList", [*cookies]))

    @jsii.member(jsii_name="denyList")
    @builtins.classmethod
    def deny_list(cls, *cookies: builtins.str) -> "CacheCookieBehavior":
        '''All cookies except the provided ``cookies`` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :param cookies: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb45fad1f5139b6f0b21bc7c8049b9ba75512317a075cf007e71241e20ab594a)
            check_type(argname="argument cookies", value=cookies, expected_type=typing.Tuple[type_hints["cookies"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("CacheCookieBehavior", jsii.sinvoke(cls, "denyList", [*cookies]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "CacheCookieBehavior":
        '''Cookies in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.'''
        return typing.cast("CacheCookieBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''The behavior of cookies: allow all, none, an allow list, or a deny list.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="cookies")
    def cookies(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The cookies to allow or deny, if the behavior is an allow or deny list.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "cookies"))


class CacheHeaderBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CacheHeaderBehavior",
):
    '''Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom cache policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_cache_policy = cloudfront.CachePolicy(self, "myCachePolicy",
            cache_policy_name="MyPolicy",
            comment="A default policy",
            default_ttl=Duration.days(2),
            min_ttl=Duration.minutes(1),
            max_ttl=Duration.days(10),
            cookie_behavior=cloudfront.CacheCookieBehavior.all(),
            header_behavior=cloudfront.CacheHeaderBehavior.allow_list("X-CustomHeader"),
            query_string_behavior=cloudfront.CacheQueryStringBehavior.deny_list("username"),
            enable_accept_encoding_gzip=True,
            enable_accept_encoding_brotli=True
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                cache_policy=my_cache_policy
            )
        )
    '''

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(cls, *headers: builtins.str) -> "CacheHeaderBehavior":
        '''Listed headers are included in the cache key and are automatically included in requests that CloudFront sends to the origin.

        :param headers: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f6328e96e4626d927599ef0a823150c80dedc786fcecd52ead47872ab792f1d)
            check_type(argname="argument headers", value=headers, expected_type=typing.Tuple[type_hints["headers"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("CacheHeaderBehavior", jsii.sinvoke(cls, "allowList", [*headers]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "CacheHeaderBehavior":
        '''HTTP headers are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.'''
        return typing.cast("CacheHeaderBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''If no headers will be passed, or an allow list of headers.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="headers")
    def headers(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The headers for the allow/deny list, if applicable.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "headers"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CachePolicyProps",
    jsii_struct_bases=[],
    name_mapping={
        "cache_policy_name": "cachePolicyName",
        "comment": "comment",
        "cookie_behavior": "cookieBehavior",
        "default_ttl": "defaultTtl",
        "enable_accept_encoding_brotli": "enableAcceptEncodingBrotli",
        "enable_accept_encoding_gzip": "enableAcceptEncodingGzip",
        "header_behavior": "headerBehavior",
        "max_ttl": "maxTtl",
        "min_ttl": "minTtl",
        "query_string_behavior": "queryStringBehavior",
    },
)
class CachePolicyProps:
    def __init__(
        self,
        *,
        cache_policy_name: typing.Optional[builtins.str] = None,
        comment: typing.Optional[builtins.str] = None,
        cookie_behavior: typing.Optional[CacheCookieBehavior] = None,
        default_ttl: typing.Optional[_Duration_4839e8c3] = None,
        enable_accept_encoding_brotli: typing.Optional[builtins.bool] = None,
        enable_accept_encoding_gzip: typing.Optional[builtins.bool] = None,
        header_behavior: typing.Optional[CacheHeaderBehavior] = None,
        max_ttl: typing.Optional[_Duration_4839e8c3] = None,
        min_ttl: typing.Optional[_Duration_4839e8c3] = None,
        query_string_behavior: typing.Optional["CacheQueryStringBehavior"] = None,
    ) -> None:
        '''Properties for creating a Cache Policy.

        :param cache_policy_name: A unique name to identify the cache policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
        :param comment: A comment to describe the cache policy. Default: - no comment
        :param cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheCookieBehavior.none()
        :param default_ttl: The default amount of time for objects to stay in the CloudFront cache. Only used when the origin does not send Cache-Control or Expires headers with the object. Default: - The greater of 1 day and ``minTtl``
        :param enable_accept_encoding_brotli: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'br'. Default: false
        :param enable_accept_encoding_gzip: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'gzip'. Default: false
        :param header_behavior: Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheHeaderBehavior.none()
        :param max_ttl: The maximum amount of time for objects to stay in the CloudFront cache. CloudFront uses this value only when the origin sends Cache-Control or Expires headers with the object. Default: - The greater of 1 year and ``defaultTtl``
        :param min_ttl: The minimum amount of time for objects to stay in the CloudFront cache. Default: Duration.seconds(0)
        :param query_string_behavior: Determines whether any query strings are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheQueryStringBehavior.none()

        :exampleMetadata: infused

        Example::

            # Creating a custom cache policy for a Distribution -- all parameters optional
            # bucket_origin: origins.S3Origin
            
            my_cache_policy = cloudfront.CachePolicy(self, "myCachePolicy",
                cache_policy_name="MyPolicy",
                comment="A default policy",
                default_ttl=Duration.days(2),
                min_ttl=Duration.minutes(1),
                max_ttl=Duration.days(10),
                cookie_behavior=cloudfront.CacheCookieBehavior.all(),
                header_behavior=cloudfront.CacheHeaderBehavior.allow_list("X-CustomHeader"),
                query_string_behavior=cloudfront.CacheQueryStringBehavior.deny_list("username"),
                enable_accept_encoding_gzip=True,
                enable_accept_encoding_brotli=True
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    cache_policy=my_cache_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6711b48737c2878c00a53b355affefe0cd15881ebeb8815751d145b20c1ac29)
            check_type(argname="argument cache_policy_name", value=cache_policy_name, expected_type=type_hints["cache_policy_name"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument cookie_behavior", value=cookie_behavior, expected_type=type_hints["cookie_behavior"])
            check_type(argname="argument default_ttl", value=default_ttl, expected_type=type_hints["default_ttl"])
            check_type(argname="argument enable_accept_encoding_brotli", value=enable_accept_encoding_brotli, expected_type=type_hints["enable_accept_encoding_brotli"])
            check_type(argname="argument enable_accept_encoding_gzip", value=enable_accept_encoding_gzip, expected_type=type_hints["enable_accept_encoding_gzip"])
            check_type(argname="argument header_behavior", value=header_behavior, expected_type=type_hints["header_behavior"])
            check_type(argname="argument max_ttl", value=max_ttl, expected_type=type_hints["max_ttl"])
            check_type(argname="argument min_ttl", value=min_ttl, expected_type=type_hints["min_ttl"])
            check_type(argname="argument query_string_behavior", value=query_string_behavior, expected_type=type_hints["query_string_behavior"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if cache_policy_name is not None:
            self._values["cache_policy_name"] = cache_policy_name
        if comment is not None:
            self._values["comment"] = comment
        if cookie_behavior is not None:
            self._values["cookie_behavior"] = cookie_behavior
        if default_ttl is not None:
            self._values["default_ttl"] = default_ttl
        if enable_accept_encoding_brotli is not None:
            self._values["enable_accept_encoding_brotli"] = enable_accept_encoding_brotli
        if enable_accept_encoding_gzip is not None:
            self._values["enable_accept_encoding_gzip"] = enable_accept_encoding_gzip
        if header_behavior is not None:
            self._values["header_behavior"] = header_behavior
        if max_ttl is not None:
            self._values["max_ttl"] = max_ttl
        if min_ttl is not None:
            self._values["min_ttl"] = min_ttl
        if query_string_behavior is not None:
            self._values["query_string_behavior"] = query_string_behavior

    @builtins.property
    def cache_policy_name(self) -> typing.Optional[builtins.str]:
        '''A unique name to identify the cache policy.

        The name must only include '-', '_', or alphanumeric characters.

        :default: - generated from the ``id``
        '''
        result = self._values.get("cache_policy_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the cache policy.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def cookie_behavior(self) -> typing.Optional[CacheCookieBehavior]:
        '''Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :default: CacheCookieBehavior.none()
        '''
        result = self._values.get("cookie_behavior")
        return typing.cast(typing.Optional[CacheCookieBehavior], result)

    @builtins.property
    def default_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The default amount of time for objects to stay in the CloudFront cache.

        Only used when the origin does not send Cache-Control or Expires headers with the object.

        :default: - The greater of 1 day and ``minTtl``
        '''
        result = self._values.get("default_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def enable_accept_encoding_brotli(self) -> typing.Optional[builtins.bool]:
        '''Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'br'.

        :default: false
        '''
        result = self._values.get("enable_accept_encoding_brotli")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def enable_accept_encoding_gzip(self) -> typing.Optional[builtins.bool]:
        '''Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'gzip'.

        :default: false
        '''
        result = self._values.get("enable_accept_encoding_gzip")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def header_behavior(self) -> typing.Optional[CacheHeaderBehavior]:
        '''Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :default: CacheHeaderBehavior.none()
        '''
        result = self._values.get("header_behavior")
        return typing.cast(typing.Optional[CacheHeaderBehavior], result)

    @builtins.property
    def max_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The maximum amount of time for objects to stay in the CloudFront cache.

        CloudFront uses this value only when the origin sends Cache-Control or Expires headers with the object.

        :default: - The greater of 1 year and ``defaultTtl``
        '''
        result = self._values.get("max_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def min_ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The minimum amount of time for objects to stay in the CloudFront cache.

        :default: Duration.seconds(0)
        '''
        result = self._values.get("min_ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def query_string_behavior(self) -> typing.Optional["CacheQueryStringBehavior"]:
        '''Determines whether any query strings are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :default: CacheQueryStringBehavior.none()
        '''
        result = self._values.get("query_string_behavior")
        return typing.cast(typing.Optional["CacheQueryStringBehavior"], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CachePolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class CacheQueryStringBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CacheQueryStringBehavior",
):
    '''Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom cache policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_cache_policy = cloudfront.CachePolicy(self, "myCachePolicy",
            cache_policy_name="MyPolicy",
            comment="A default policy",
            default_ttl=Duration.days(2),
            min_ttl=Duration.minutes(1),
            max_ttl=Duration.days(10),
            cookie_behavior=cloudfront.CacheCookieBehavior.all(),
            header_behavior=cloudfront.CacheHeaderBehavior.allow_list("X-CustomHeader"),
            query_string_behavior=cloudfront.CacheQueryStringBehavior.deny_list("username"),
            enable_accept_encoding_gzip=True,
            enable_accept_encoding_brotli=True
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                cache_policy=my_cache_policy
            )
        )
    '''

    @jsii.member(jsii_name="all")
    @builtins.classmethod
    def all(cls) -> "CacheQueryStringBehavior":
        '''All query strings in viewer requests are included in the cache key and are automatically included in requests that CloudFront sends to the origin.'''
        return typing.cast("CacheQueryStringBehavior", jsii.sinvoke(cls, "all", []))

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(cls, *query_strings: builtins.str) -> "CacheQueryStringBehavior":
        '''Only the provided ``queryStrings`` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :param query_strings: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__094db6ae59f6747b36b05734a6b50105265c51b64c1ebda30cf790535b51d268)
            check_type(argname="argument query_strings", value=query_strings, expected_type=typing.Tuple[type_hints["query_strings"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("CacheQueryStringBehavior", jsii.sinvoke(cls, "allowList", [*query_strings]))

    @jsii.member(jsii_name="denyList")
    @builtins.classmethod
    def deny_list(cls, *query_strings: builtins.str) -> "CacheQueryStringBehavior":
        '''All query strings except the provided ``queryStrings`` are included in the cache key and automatically included in requests that CloudFront sends to the origin.

        :param query_strings: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a222c5119a62123645775df745b141b876338875bf9ef6e0b116ff55a45e82e3)
            check_type(argname="argument query_strings", value=query_strings, expected_type=typing.Tuple[type_hints["query_strings"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("CacheQueryStringBehavior", jsii.sinvoke(cls, "denyList", [*query_strings]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "CacheQueryStringBehavior":
        '''Query strings in viewer requests are not included in the cache key and are not automatically included in requests that CloudFront sends to the origin.'''
        return typing.cast("CacheQueryStringBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''The behavior of query strings -- allow all, none, only an allow list, or a deny list.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="queryStrings")
    def query_strings(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The query strings to allow or deny, if the behavior is an allow or deny list.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "queryStrings"))


class CachedMethods(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CachedMethods",
):
    '''The HTTP methods that the Behavior will cache requests on.

    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cached_methods = cloudfront.CachedMethods.CACHE_GET_HEAD
    '''

    @jsii.python.classproperty
    @jsii.member(jsii_name="CACHE_GET_HEAD")
    def CACHE_GET_HEAD(cls) -> "CachedMethods":
        '''HEAD and GET.'''
        return typing.cast("CachedMethods", jsii.sget(cls, "CACHE_GET_HEAD"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CACHE_GET_HEAD_OPTIONS")
    def CACHE_GET_HEAD_OPTIONS(cls) -> "CachedMethods":
        '''HEAD, GET, and OPTIONS.'''
        return typing.cast("CachedMethods", jsii.sget(cls, "CACHE_GET_HEAD_OPTIONS"))

    @builtins.property
    @jsii.member(jsii_name="methods")
    def methods(self) -> typing.List[builtins.str]:
        '''HTTP methods supported.'''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "methods"))


@jsii.implements(_IInspectable_c2943556)
class CfnCachePolicy(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy",
):
    '''A cache policy.

    When it's attached to a cache behavior, the cache policy determines the following:

    - The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.
    - The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.

    The headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find a valid object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use ``OriginRequestPolicy`` .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cachepolicy.html
    :cloudformationResource: AWS::CloudFront::CachePolicy
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_cache_policy = cloudfront.CfnCachePolicy(self, "MyCfnCachePolicy",
            cache_policy_config=cloudfront.CfnCachePolicy.CachePolicyConfigProperty(
                default_ttl=123,
                max_ttl=123,
                min_ttl=123,
                name="name",
                parameters_in_cache_key_and_forwarded_to_origin=cloudfront.CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty(
                    cookies_config=cloudfront.CfnCachePolicy.CookiesConfigProperty(
                        cookie_behavior="cookieBehavior",
        
                        # the properties below are optional
                        cookies=["cookies"]
                    ),
                    enable_accept_encoding_gzip=False,
                    headers_config=cloudfront.CfnCachePolicy.HeadersConfigProperty(
                        header_behavior="headerBehavior",
        
                        # the properties below are optional
                        headers=["headers"]
                    ),
                    query_strings_config=cloudfront.CfnCachePolicy.QueryStringsConfigProperty(
                        query_string_behavior="queryStringBehavior",
        
                        # the properties below are optional
                        query_strings=["queryStrings"]
                    ),
        
                    # the properties below are optional
                    enable_accept_encoding_brotli=False
                ),
        
                # the properties below are optional
                comment="comment"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        cache_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCachePolicy.CachePolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param cache_policy_config: The cache policy configuration.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ecaedd7f16610a74896b909af6b8327237ba10f429c68ee400588f2df9ef521)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnCachePolicyProps(cache_policy_config=cache_policy_config)

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8cc9977c97b3ea5f90c24bea4d8773b19f82c365e3c365d8958a74f5f2a1967)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f0cd76a4bde3d2792f5f48785eee4f3d7e310661d2ce134a5c0d4f2651ed7641)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The unique identifier for the cache policy.

        For example: ``2766f7b2-75c5-41c6-8f06-bf4303a2f2f5`` .

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrLastModifiedTime")
    def attr_last_modified_time(self) -> builtins.str:
        '''The date and time when the cache policy was last modified.

        :cloudformationAttribute: LastModifiedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="cachePolicyConfig")
    def cache_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.CachePolicyConfigProperty"]:
        '''The cache policy configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.CachePolicyConfigProperty"], jsii.get(self, "cachePolicyConfig"))

    @cache_policy_config.setter
    def cache_policy_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.CachePolicyConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__368f0f7bddba18df11229a8928c7cef7fa894a962c8f2f2c356a58aafc898f60)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "cachePolicyConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy.CachePolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "default_ttl": "defaultTtl",
            "max_ttl": "maxTtl",
            "min_ttl": "minTtl",
            "name": "name",
            "parameters_in_cache_key_and_forwarded_to_origin": "parametersInCacheKeyAndForwardedToOrigin",
            "comment": "comment",
        },
    )
    class CachePolicyConfigProperty:
        def __init__(
            self,
            *,
            default_ttl: jsii.Number,
            max_ttl: jsii.Number,
            min_ttl: jsii.Number,
            name: builtins.str,
            parameters_in_cache_key_and_forwarded_to_origin: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty", typing.Dict[builtins.str, typing.Any]]],
            comment: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A cache policy configuration.

            This configuration determines the following:

            - The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.
            - The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.

            The headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find a valid object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use ``OriginRequestPolicy`` .

            :param default_ttl: The default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. CloudFront uses this value as the object's time to live (TTL) only when the origin does *not* send ``Cache-Control`` or ``Expires`` headers with the object. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . The default value for this field is 86400 seconds (one day). If the value of ``MinTTL`` is more than 86400 seconds, then the default value for this field is the same as the value of ``MinTTL`` .
            :param max_ttl: The maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. CloudFront uses this value only when the origin sends ``Cache-Control`` or ``Expires`` headers with the object. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . The default value for this field is 31536000 seconds (one year). If the value of ``MinTTL`` or ``DefaultTTL`` is more than 31536000 seconds, then the default value for this field is the same as the value of ``DefaultTTL`` .
            :param min_ttl: The minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param name: A unique name to identify the cache policy.
            :param parameters_in_cache_key_and_forwarded_to_origin: The HTTP headers, cookies, and URL query strings to include in the cache key. The values included in the cache key are also included in requests that CloudFront sends to the origin.
            :param comment: A comment to describe the cache policy. The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cache_policy_config_property = cloudfront.CfnCachePolicy.CachePolicyConfigProperty(
                    default_ttl=123,
                    max_ttl=123,
                    min_ttl=123,
                    name="name",
                    parameters_in_cache_key_and_forwarded_to_origin=cloudfront.CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty(
                        cookies_config=cloudfront.CfnCachePolicy.CookiesConfigProperty(
                            cookie_behavior="cookieBehavior",
                
                            # the properties below are optional
                            cookies=["cookies"]
                        ),
                        enable_accept_encoding_gzip=False,
                        headers_config=cloudfront.CfnCachePolicy.HeadersConfigProperty(
                            header_behavior="headerBehavior",
                
                            # the properties below are optional
                            headers=["headers"]
                        ),
                        query_strings_config=cloudfront.CfnCachePolicy.QueryStringsConfigProperty(
                            query_string_behavior="queryStringBehavior",
                
                            # the properties below are optional
                            query_strings=["queryStrings"]
                        ),
                
                        # the properties below are optional
                        enable_accept_encoding_brotli=False
                    ),
                
                    # the properties below are optional
                    comment="comment"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__ec1b7b3968af5b89f6e59013aba51df728071d409ddc819a6ba52d2f73c7f35c)
                check_type(argname="argument default_ttl", value=default_ttl, expected_type=type_hints["default_ttl"])
                check_type(argname="argument max_ttl", value=max_ttl, expected_type=type_hints["max_ttl"])
                check_type(argname="argument min_ttl", value=min_ttl, expected_type=type_hints["min_ttl"])
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument parameters_in_cache_key_and_forwarded_to_origin", value=parameters_in_cache_key_and_forwarded_to_origin, expected_type=type_hints["parameters_in_cache_key_and_forwarded_to_origin"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "default_ttl": default_ttl,
                "max_ttl": max_ttl,
                "min_ttl": min_ttl,
                "name": name,
                "parameters_in_cache_key_and_forwarded_to_origin": parameters_in_cache_key_and_forwarded_to_origin,
            }
            if comment is not None:
                self._values["comment"] = comment

        @builtins.property
        def default_ttl(self) -> jsii.Number:
            '''The default amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.

            CloudFront uses this value as the object's time to live (TTL) only when the origin does *not* send ``Cache-Control`` or ``Expires`` headers with the object. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            The default value for this field is 86400 seconds (one day). If the value of ``MinTTL`` is more than 86400 seconds, then the default value for this field is the same as the value of ``MinTTL`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-defaultttl
            '''
            result = self._values.get("default_ttl")
            assert result is not None, "Required property 'default_ttl' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def max_ttl(self) -> jsii.Number:
            '''The maximum amount of time, in seconds, that objects stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.

            CloudFront uses this value only when the origin sends ``Cache-Control`` or ``Expires`` headers with the object. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            The default value for this field is 31536000 seconds (one year). If the value of ``MinTTL`` or ``DefaultTTL`` is more than 31536000 seconds, then the default value for this field is the same as the value of ``DefaultTTL`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-maxttl
            '''
            result = self._values.get("max_ttl")
            assert result is not None, "Required property 'max_ttl' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def min_ttl(self) -> jsii.Number:
            '''The minimum amount of time, in seconds, that you want objects to stay in the CloudFront cache before CloudFront sends another request to the origin to see if the object has been updated.

            For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-minttl
            '''
            result = self._values.get("min_ttl")
            assert result is not None, "Required property 'min_ttl' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def name(self) -> builtins.str:
            '''A unique name to identify the cache policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def parameters_in_cache_key_and_forwarded_to_origin(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty"]:
            '''The HTTP headers, cookies, and URL query strings to include in the cache key.

            The values included in the cache key are also included in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-parametersincachekeyandforwardedtoorigin
            '''
            result = self._values.get("parameters_in_cache_key_and_forwarded_to_origin")
            assert result is not None, "Required property 'parameters_in_cache_key_and_forwarded_to_origin' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty"], result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the cache policy.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cachepolicyconfig.html#cfn-cloudfront-cachepolicy-cachepolicyconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CachePolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy.CookiesConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"cookie_behavior": "cookieBehavior", "cookies": "cookies"},
    )
    class CookiesConfigProperty:
        def __init__(
            self,
            *,
            cookie_behavior: builtins.str,
            cookies: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and in requests that CloudFront sends to the origin.

            :param cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin. Valid values are: - ``none`` – No cookies in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any cookies that are listed in an ``OriginRequestPolicy`` *are* included in origin requests. - ``whitelist`` – Only the cookies in viewer requests that are listed in the ``CookieNames`` type are included in the cache key and in requests that CloudFront sends to the origin. - ``allExcept`` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** for those that are listed in the ``CookieNames`` type, which are not included. - ``all`` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.
            :param cookies: Contains a list of cookie names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cookiesconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cookies_config_property = cloudfront.CfnCachePolicy.CookiesConfigProperty(
                    cookie_behavior="cookieBehavior",
                
                    # the properties below are optional
                    cookies=["cookies"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__00472fa326e61dbdcc1f65b5f16211e3c809eeab0306a33f8944dbc2aa998e5f)
                check_type(argname="argument cookie_behavior", value=cookie_behavior, expected_type=type_hints["cookie_behavior"])
                check_type(argname="argument cookies", value=cookies, expected_type=type_hints["cookies"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "cookie_behavior": cookie_behavior,
            }
            if cookies is not None:
                self._values["cookies"] = cookies

        @builtins.property
        def cookie_behavior(self) -> builtins.str:
            '''Determines whether any cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.

            Valid values are:

            - ``none`` – No cookies in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any cookies that are listed in an ``OriginRequestPolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the cookies in viewer requests that are listed in the ``CookieNames`` type are included in the cache key and in requests that CloudFront sends to the origin.
            - ``allExcept`` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** for those that are listed in the ``CookieNames`` type, which are not included.
            - ``all`` – All cookies in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cookiesconfig.html#cfn-cloudfront-cachepolicy-cookiesconfig-cookiebehavior
            '''
            result = self._values.get("cookie_behavior")
            assert result is not None, "Required property 'cookie_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def cookies(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of cookie names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-cookiesconfig.html#cfn-cloudfront-cachepolicy-cookiesconfig-cookies
            '''
            result = self._values.get("cookies")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CookiesConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy.HeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"header_behavior": "headerBehavior", "headers": "headers"},
    )
    class HeadersConfigProperty:
        def __init__(
            self,
            *,
            header_behavior: builtins.str,
            headers: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and in requests that CloudFront sends to the origin.

            :param header_behavior: Determines whether any HTTP headers are included in the cache key and in requests that CloudFront sends to the origin. Valid values are: - ``none`` – No HTTP headers are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any headers that are listed in an ``OriginRequestPolicy`` *are* included in origin requests. - ``whitelist`` – Only the HTTP headers that are listed in the ``Headers`` type are included in the cache key and in requests that CloudFront sends to the origin.
            :param headers: Contains a list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-headersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                headers_config_property = cloudfront.CfnCachePolicy.HeadersConfigProperty(
                    header_behavior="headerBehavior",
                
                    # the properties below are optional
                    headers=["headers"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__b80d639143aac5598d38694f54735db2be433f16d5f6c2c18e598933c520524d)
                check_type(argname="argument header_behavior", value=header_behavior, expected_type=type_hints["header_behavior"])
                check_type(argname="argument headers", value=headers, expected_type=type_hints["headers"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header_behavior": header_behavior,
            }
            if headers is not None:
                self._values["headers"] = headers

        @builtins.property
        def header_behavior(self) -> builtins.str:
            '''Determines whether any HTTP headers are included in the cache key and in requests that CloudFront sends to the origin.

            Valid values are:

            - ``none`` – No HTTP headers are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any headers that are listed in an ``OriginRequestPolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the HTTP headers that are listed in the ``Headers`` type are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-headersconfig.html#cfn-cloudfront-cachepolicy-headersconfig-headerbehavior
            '''
            result = self._values.get("header_behavior")
            assert result is not None, "Required property 'header_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def headers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-headersconfig.html#cfn-cloudfront-cachepolicy-headersconfig-headers
            '''
            result = self._values.get("headers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "HeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty",
        jsii_struct_bases=[],
        name_mapping={
            "cookies_config": "cookiesConfig",
            "enable_accept_encoding_gzip": "enableAcceptEncodingGzip",
            "headers_config": "headersConfig",
            "query_strings_config": "queryStringsConfig",
            "enable_accept_encoding_brotli": "enableAcceptEncodingBrotli",
        },
    )
    class ParametersInCacheKeyAndForwardedToOriginProperty:
        def __init__(
            self,
            *,
            cookies_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCachePolicy.CookiesConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            enable_accept_encoding_gzip: typing.Union[builtins.bool, _IResolvable_da3f097b],
            headers_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCachePolicy.HeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            query_strings_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCachePolicy.QueryStringsConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            enable_accept_encoding_brotli: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
        ) -> None:
            '''This object determines the values that CloudFront includes in the cache key.

            These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.

            The headers, cookies, and query strings that are included in the cache key are also included in requests that CloudFront sends to the origin. CloudFront sends a request when it can't find an object in its cache that matches the request's cache key. If you want to send values to the origin but *not* include them in the cache key, use ``OriginRequestPolicy`` .

            :param cookies_config: An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and in requests that CloudFront sends to the origin.
            :param enable_accept_encoding_gzip: A flag that can affect whether the ``Accept-Encoding`` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin. This field is related to the ``EnableAcceptEncodingBrotli`` field. If one or both of these fields is ``true`` *and* the viewer request includes the ``Accept-Encoding`` header, then CloudFront does the following: - Normalizes the value of the viewer's ``Accept-Encoding`` header - Includes the normalized header in the cache key - Includes the normalized header in the request to the origin, if a request is necessary For more information, see `Compression support <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects>`_ in the *Amazon CloudFront Developer Guide* . If you set this value to ``true`` , and this cache behavior also has an origin request policy attached, do not include the ``Accept-Encoding`` header in the origin request policy. CloudFront always includes the ``Accept-Encoding`` header in origin requests when the value of this field is ``true`` , so including this header in an origin request policy has no effect. If both of these fields are ``false`` , then CloudFront treats the ``Accept-Encoding`` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add ``Accept-Encoding`` to the headers whitelist like any other HTTP header.
            :param headers_config: An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and in requests that CloudFront sends to the origin.
            :param query_strings_config: An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and in requests that CloudFront sends to the origin.
            :param enable_accept_encoding_brotli: A flag that can affect whether the ``Accept-Encoding`` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin. This field is related to the ``EnableAcceptEncodingGzip`` field. If one or both of these fields is ``true`` *and* the viewer request includes the ``Accept-Encoding`` header, then CloudFront does the following: - Normalizes the value of the viewer's ``Accept-Encoding`` header - Includes the normalized header in the cache key - Includes the normalized header in the request to the origin, if a request is necessary For more information, see `Compression support <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects>`_ in the *Amazon CloudFront Developer Guide* . If you set this value to ``true`` , and this cache behavior also has an origin request policy attached, do not include the ``Accept-Encoding`` header in the origin request policy. CloudFront always includes the ``Accept-Encoding`` header in origin requests when the value of this field is ``true`` , so including this header in an origin request policy has no effect. If both of these fields are ``false`` , then CloudFront treats the ``Accept-Encoding`` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add ``Accept-Encoding`` to the headers whitelist like any other HTTP header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                parameters_in_cache_key_and_forwarded_to_origin_property = cloudfront.CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty(
                    cookies_config=cloudfront.CfnCachePolicy.CookiesConfigProperty(
                        cookie_behavior="cookieBehavior",
                
                        # the properties below are optional
                        cookies=["cookies"]
                    ),
                    enable_accept_encoding_gzip=False,
                    headers_config=cloudfront.CfnCachePolicy.HeadersConfigProperty(
                        header_behavior="headerBehavior",
                
                        # the properties below are optional
                        headers=["headers"]
                    ),
                    query_strings_config=cloudfront.CfnCachePolicy.QueryStringsConfigProperty(
                        query_string_behavior="queryStringBehavior",
                
                        # the properties below are optional
                        query_strings=["queryStrings"]
                    ),
                
                    # the properties below are optional
                    enable_accept_encoding_brotli=False
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e4f66fadef22e9fe00758307d849db076998474f283ea1102c4ac6025e05103e)
                check_type(argname="argument cookies_config", value=cookies_config, expected_type=type_hints["cookies_config"])
                check_type(argname="argument enable_accept_encoding_gzip", value=enable_accept_encoding_gzip, expected_type=type_hints["enable_accept_encoding_gzip"])
                check_type(argname="argument headers_config", value=headers_config, expected_type=type_hints["headers_config"])
                check_type(argname="argument query_strings_config", value=query_strings_config, expected_type=type_hints["query_strings_config"])
                check_type(argname="argument enable_accept_encoding_brotli", value=enable_accept_encoding_brotli, expected_type=type_hints["enable_accept_encoding_brotli"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "cookies_config": cookies_config,
                "enable_accept_encoding_gzip": enable_accept_encoding_gzip,
                "headers_config": headers_config,
                "query_strings_config": query_strings_config,
            }
            if enable_accept_encoding_brotli is not None:
                self._values["enable_accept_encoding_brotli"] = enable_accept_encoding_brotli

        @builtins.property
        def cookies_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.CookiesConfigProperty"]:
            '''An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html#cfn-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin-cookiesconfig
            '''
            result = self._values.get("cookies_config")
            assert result is not None, "Required property 'cookies_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.CookiesConfigProperty"], result)

        @builtins.property
        def enable_accept_encoding_gzip(
            self,
        ) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A flag that can affect whether the ``Accept-Encoding`` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.

            This field is related to the ``EnableAcceptEncodingBrotli`` field. If one or both of these fields is ``true`` *and* the viewer request includes the ``Accept-Encoding`` header, then CloudFront does the following:

            - Normalizes the value of the viewer's ``Accept-Encoding`` header
            - Includes the normalized header in the cache key
            - Includes the normalized header in the request to the origin, if a request is necessary

            For more information, see `Compression support <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects>`_ in the *Amazon CloudFront Developer Guide* .

            If you set this value to ``true`` , and this cache behavior also has an origin request policy attached, do not include the ``Accept-Encoding`` header in the origin request policy. CloudFront always includes the ``Accept-Encoding`` header in origin requests when the value of this field is ``true`` , so including this header in an origin request policy has no effect.

            If both of these fields are ``false`` , then CloudFront treats the ``Accept-Encoding`` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add ``Accept-Encoding`` to the headers whitelist like any other HTTP header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html#cfn-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin-enableacceptencodinggzip
            '''
            result = self._values.get("enable_accept_encoding_gzip")
            assert result is not None, "Required property 'enable_accept_encoding_gzip' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def headers_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.HeadersConfigProperty"]:
            '''An object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html#cfn-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin-headersconfig
            '''
            result = self._values.get("headers_config")
            assert result is not None, "Required property 'headers_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.HeadersConfigProperty"], result)

        @builtins.property
        def query_strings_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.QueryStringsConfigProperty"]:
            '''An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html#cfn-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin-querystringsconfig
            '''
            result = self._values.get("query_strings_config")
            assert result is not None, "Required property 'query_strings_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCachePolicy.QueryStringsConfigProperty"], result)

        @builtins.property
        def enable_accept_encoding_brotli(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A flag that can affect whether the ``Accept-Encoding`` HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.

            This field is related to the ``EnableAcceptEncodingGzip`` field. If one or both of these fields is ``true`` *and* the viewer request includes the ``Accept-Encoding`` header, then CloudFront does the following:

            - Normalizes the value of the viewer's ``Accept-Encoding`` header
            - Includes the normalized header in the cache key
            - Includes the normalized header in the request to the origin, if a request is necessary

            For more information, see `Compression support <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-policy-compressed-objects>`_ in the *Amazon CloudFront Developer Guide* .

            If you set this value to ``true`` , and this cache behavior also has an origin request policy attached, do not include the ``Accept-Encoding`` header in the origin request policy. CloudFront always includes the ``Accept-Encoding`` header in origin requests when the value of this field is ``true`` , so including this header in an origin request policy has no effect.

            If both of these fields are ``false`` , then CloudFront treats the ``Accept-Encoding`` header the same as any other HTTP header in the viewer request. By default, it's not included in the cache key and it's not included in origin requests. In this case, you can manually add ``Accept-Encoding`` to the headers whitelist like any other HTTP header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin.html#cfn-cloudfront-cachepolicy-parametersincachekeyandforwardedtoorigin-enableacceptencodingbrotli
            '''
            result = self._values.get("enable_accept_encoding_brotli")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ParametersInCacheKeyAndForwardedToOriginProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicy.QueryStringsConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "query_string_behavior": "queryStringBehavior",
            "query_strings": "queryStrings",
        },
    )
    class QueryStringsConfigProperty:
        def __init__(
            self,
            *,
            query_string_behavior: builtins.str,
            query_strings: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and in requests that CloudFront sends to the origin.

            :param query_string_behavior: Determines whether any URL query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin. Valid values are: - ``none`` – No query strings in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any query strings that are listed in an ``OriginRequestPolicy`` *are* included in origin requests. - ``whitelist`` – Only the query strings in viewer requests that are listed in the ``QueryStringNames`` type are included in the cache key and in requests that CloudFront sends to the origin. - ``allExcept`` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** those that are listed in the ``QueryStringNames`` type, which are not included. - ``all`` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.
            :param query_strings: Contains a list of query string names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-querystringsconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                query_strings_config_property = cloudfront.CfnCachePolicy.QueryStringsConfigProperty(
                    query_string_behavior="queryStringBehavior",
                
                    # the properties below are optional
                    query_strings=["queryStrings"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e7d5343f09690980c0041ef3359edc53a470f00af784ccbaf385999eb32b95b1)
                check_type(argname="argument query_string_behavior", value=query_string_behavior, expected_type=type_hints["query_string_behavior"])
                check_type(argname="argument query_strings", value=query_strings, expected_type=type_hints["query_strings"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "query_string_behavior": query_string_behavior,
            }
            if query_strings is not None:
                self._values["query_strings"] = query_strings

        @builtins.property
        def query_string_behavior(self) -> builtins.str:
            '''Determines whether any URL query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.

            Valid values are:

            - ``none`` – No query strings in viewer requests are included in the cache key or in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any query strings that are listed in an ``OriginRequestPolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the query strings in viewer requests that are listed in the ``QueryStringNames`` type are included in the cache key and in requests that CloudFront sends to the origin.
            - ``allExcept`` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin, **except** those that are listed in the ``QueryStringNames`` type, which are not included.
            - ``all`` – All query strings in viewer requests are included in the cache key and in requests that CloudFront sends to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-querystringsconfig.html#cfn-cloudfront-cachepolicy-querystringsconfig-querystringbehavior
            '''
            result = self._values.get("query_string_behavior")
            assert result is not None, "Required property 'query_string_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def query_strings(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of query string names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cachepolicy-querystringsconfig.html#cfn-cloudfront-cachepolicy-querystringsconfig-querystrings
            '''
            result = self._values.get("query_strings")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "QueryStringsConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnCachePolicyProps",
    jsii_struct_bases=[],
    name_mapping={"cache_policy_config": "cachePolicyConfig"},
)
class CfnCachePolicyProps:
    def __init__(
        self,
        *,
        cache_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.CachePolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnCachePolicy``.

        :param cache_policy_config: The cache policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cachepolicy.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_cache_policy_props = cloudfront.CfnCachePolicyProps(
                cache_policy_config=cloudfront.CfnCachePolicy.CachePolicyConfigProperty(
                    default_ttl=123,
                    max_ttl=123,
                    min_ttl=123,
                    name="name",
                    parameters_in_cache_key_and_forwarded_to_origin=cloudfront.CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty(
                        cookies_config=cloudfront.CfnCachePolicy.CookiesConfigProperty(
                            cookie_behavior="cookieBehavior",
            
                            # the properties below are optional
                            cookies=["cookies"]
                        ),
                        enable_accept_encoding_gzip=False,
                        headers_config=cloudfront.CfnCachePolicy.HeadersConfigProperty(
                            header_behavior="headerBehavior",
            
                            # the properties below are optional
                            headers=["headers"]
                        ),
                        query_strings_config=cloudfront.CfnCachePolicy.QueryStringsConfigProperty(
                            query_string_behavior="queryStringBehavior",
            
                            # the properties below are optional
                            query_strings=["queryStrings"]
                        ),
            
                        # the properties below are optional
                        enable_accept_encoding_brotli=False
                    ),
            
                    # the properties below are optional
                    comment="comment"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c50bde17577533380a433f5d5db423b4327130bc1c895dda7a73412879fd10c3)
            check_type(argname="argument cache_policy_config", value=cache_policy_config, expected_type=type_hints["cache_policy_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "cache_policy_config": cache_policy_config,
        }

    @builtins.property
    def cache_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnCachePolicy.CachePolicyConfigProperty]:
        '''The cache policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cachepolicy.html#cfn-cloudfront-cachepolicy-cachepolicyconfig
        '''
        result = self._values.get("cache_policy_config")
        assert result is not None, "Required property 'cache_policy_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnCachePolicy.CachePolicyConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnCachePolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnCloudFrontOriginAccessIdentity(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnCloudFrontOriginAccessIdentity",
):
    '''The request to create a new origin access identity (OAI).

    An origin access identity is a special CloudFront user that you can associate with Amazon S3 origins, so that you can secure all or just some of your Amazon S3 content. For more information, see `Restricting Access to Amazon S3 Content by Using an Origin Access Identity <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cloudfrontoriginaccessidentity.html
    :cloudformationResource: AWS::CloudFront::CloudFrontOriginAccessIdentity
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_cloud_front_origin_access_identity = cloudfront.CfnCloudFrontOriginAccessIdentity(self, "MyCfnCloudFrontOriginAccessIdentity",
            cloud_front_origin_access_identity_config=cloudfront.CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty(
                comment="comment"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        cloud_front_origin_access_identity_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param cloud_front_origin_access_identity_config: The current configuration information for the identity.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7e5746b5e9605c9b6058b245e37628d4de4a28a6ec81a063f83dcea2b8fc3e3)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnCloudFrontOriginAccessIdentityProps(
            cloud_front_origin_access_identity_config=cloud_front_origin_access_identity_config,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__683eb561c6eda03fa343baf1dac94004449a9f5f958222dbcf3157aad3d2353a)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e16bd6a135e3ccb5946d8cee951e62c0ea1f7914d77fb803f6e8f45b4c813cd)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The ID for the origin access identity, for example, ``E74FTE3AJFJ256A`` .

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrS3CanonicalUserId")
    def attr_s3_canonical_user_id(self) -> builtins.str:
        '''The Amazon S3 canonical user ID for the origin access identity, used when giving the origin access identity read permission to an object in Amazon S3.

        For example: ``b970b42360b81c8ddbd79d2f5df0069ba9033c8a79655752abe380cd6d63ba8bcf23384d568fcf89fc49700b5e11a0fd`` .

        :cloudformationAttribute: S3CanonicalUserId
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrS3CanonicalUserId"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="cloudFrontOriginAccessIdentityConfig")
    def cloud_front_origin_access_identity_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty"]:
        '''The current configuration information for the identity.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty"], jsii.get(self, "cloudFrontOriginAccessIdentityConfig"))

    @cloud_front_origin_access_identity_config.setter
    def cloud_front_origin_access_identity_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dbd0afebd21ffa009f133a600072844fc5616264b7a1829c3dea492b21c75315)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "cloudFrontOriginAccessIdentityConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"comment": "comment"},
    )
    class CloudFrontOriginAccessIdentityConfigProperty:
        def __init__(self, *, comment: builtins.str) -> None:
            '''Origin access identity configuration.

            Send a ``GET`` request to the ``/ *CloudFront API version* /CloudFront/identity ID/config`` resource.

            :param comment: A comment to describe the origin access identity. The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cloudfrontoriginaccessidentity-cloudfrontoriginaccessidentityconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cloud_front_origin_access_identity_config_property = cloudfront.CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty(
                    comment="comment"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__d4999a9391c03ffa8a42c6617711deb35dfb94305e962c6704faa714a245dd9a)
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "comment": comment,
            }

        @builtins.property
        def comment(self) -> builtins.str:
            '''A comment to describe the origin access identity.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-cloudfrontoriginaccessidentity-cloudfrontoriginaccessidentityconfig.html#cfn-cloudfront-cloudfrontoriginaccessidentity-cloudfrontoriginaccessidentityconfig-comment
            '''
            result = self._values.get("comment")
            assert result is not None, "Required property 'comment' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CloudFrontOriginAccessIdentityConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnCloudFrontOriginAccessIdentityProps",
    jsii_struct_bases=[],
    name_mapping={
        "cloud_front_origin_access_identity_config": "cloudFrontOriginAccessIdentityConfig",
    },
)
class CfnCloudFrontOriginAccessIdentityProps:
    def __init__(
        self,
        *,
        cloud_front_origin_access_identity_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnCloudFrontOriginAccessIdentity``.

        :param cloud_front_origin_access_identity_config: The current configuration information for the identity.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cloudfrontoriginaccessidentity.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_cloud_front_origin_access_identity_props = cloudfront.CfnCloudFrontOriginAccessIdentityProps(
                cloud_front_origin_access_identity_config=cloudfront.CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty(
                    comment="comment"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac17d18e4ddb1cb8a79015a96667059270fe5083273f938cf851deeb4c65e450)
            check_type(argname="argument cloud_front_origin_access_identity_config", value=cloud_front_origin_access_identity_config, expected_type=type_hints["cloud_front_origin_access_identity_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "cloud_front_origin_access_identity_config": cloud_front_origin_access_identity_config,
        }

    @builtins.property
    def cloud_front_origin_access_identity_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty]:
        '''The current configuration information for the identity.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-cloudfrontoriginaccessidentity.html#cfn-cloudfront-cloudfrontoriginaccessidentity-cloudfrontoriginaccessidentityconfig
        '''
        result = self._values.get("cloud_front_origin_access_identity_config")
        assert result is not None, "Required property 'cloud_front_origin_access_identity_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnCloudFrontOriginAccessIdentityProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnContinuousDeploymentPolicy(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy",
):
    '''Creates a continuous deployment policy that routes a subset of production traffic from a primary distribution to a staging distribution.

    After you create and update a staging distribution, you can use a continuous deployment policy to incrementally move traffic to the staging distribution. This enables you to test changes to a distribution's configuration before moving all of your production traffic to the new configuration.

    For more information, see `Using CloudFront continuous deployment to safely test CDN configuration changes <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/continuous-deployment.html>`_ in the *Amazon CloudFront Developer Guide* .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-continuousdeploymentpolicy.html
    :cloudformationResource: AWS::CloudFront::ContinuousDeploymentPolicy
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_continuous_deployment_policy = cloudfront.CfnContinuousDeploymentPolicy(self, "MyCfnContinuousDeploymentPolicy",
            continuous_deployment_policy_config=cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
                enabled=False,
                staging_distribution_dns_names=["stagingDistributionDnsNames"],
        
                # the properties below are optional
                single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
                    header="header",
                    value="value"
                ),
                single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
                    weight=123,
        
                    # the properties below are optional
                    session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                        idle_ttl=123,
                        maximum_ttl=123
                    )
                ),
                traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
                    type="type",
        
                    # the properties below are optional
                    single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
                        header="header",
                        value="value"
                    ),
                    single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
                        weight=123,
        
                        # the properties below are optional
                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                            idle_ttl=123,
                            maximum_ttl=123
                        )
                    )
                ),
                type="type"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param continuous_deployment_policy_config: Contains the configuration for a continuous deployment policy.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b57269fe6faf53d2e30ff31a58c5711db8b8cc3b38dc9ac79efdb585dc8f324b)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnContinuousDeploymentPolicyProps(
            continuous_deployment_policy_config=continuous_deployment_policy_config
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__95d0eeca39c0c26751595d2bbe6c1247ac12b7acdb2d7c9d28f5fb0eeacb7187)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__779f5842b62fc4504802401955475d45973a372c1d8293180cd8ce460b4e4823)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The identifier of the cotinuous deployment policy.

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrLastModifiedTime")
    def attr_last_modified_time(self) -> builtins.str:
        '''The date and time when the continuous deployment policy was last modified.

        :cloudformationAttribute: LastModifiedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="continuousDeploymentPolicyConfig")
    def continuous_deployment_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"]:
        '''Contains the configuration for a continuous deployment policy.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"], jsii.get(self, "continuousDeploymentPolicyConfig"))

    @continuous_deployment_policy_config.setter
    def continuous_deployment_policy_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4581f42e1117e6de93836f594986c28a2378e8200e2f4a535cce028879382c9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "continuousDeploymentPolicyConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "enabled": "enabled",
            "staging_distribution_dns_names": "stagingDistributionDnsNames",
            "single_header_policy_config": "singleHeaderPolicyConfig",
            "single_weight_policy_config": "singleWeightPolicyConfig",
            "traffic_config": "trafficConfig",
            "type": "type",
        },
    )
    class ContinuousDeploymentPolicyConfigProperty:
        def __init__(
            self,
            *,
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            staging_distribution_dns_names: typing.Sequence[builtins.str],
            single_header_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            single_weight_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            traffic_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.TrafficConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            type: typing.Optional[builtins.str] = None,
        ) -> None:
            '''Contains the configuration for a continuous deployment policy.

            :param enabled: A Boolean that indicates whether this continuous deployment policy is enabled (in effect). When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.
            :param staging_distribution_dns_names: The CloudFront domain name of the staging distribution. For example: ``d111111abcdef8.cloudfront.net`` .
            :param single_header_policy_config: This configuration determines which HTTP requests are sent to the staging distribution. If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.
            :param single_weight_policy_config: This configuration determines the percentage of HTTP requests that are sent to the staging distribution.
            :param traffic_config: Contains the parameters for routing production traffic from your primary to staging distributions.
            :param type: The type of traffic configuration.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                continuous_deployment_policy_config_property = cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
                    enabled=False,
                    staging_distribution_dns_names=["stagingDistributionDnsNames"],
                
                    # the properties below are optional
                    single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
                        header="header",
                        value="value"
                    ),
                    single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
                        weight=123,
                
                        # the properties below are optional
                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                            idle_ttl=123,
                            maximum_ttl=123
                        )
                    ),
                    traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
                        type="type",
                
                        # the properties below are optional
                        single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
                            header="header",
                            value="value"
                        ),
                        single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
                            weight=123,
                
                            # the properties below are optional
                            session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                                idle_ttl=123,
                                maximum_ttl=123
                            )
                        )
                    ),
                    type="type"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__5bd1a74dffe3773a269b4a42a8f5fc37c7934b0931fd845b2923603086ea48cc)
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument staging_distribution_dns_names", value=staging_distribution_dns_names, expected_type=type_hints["staging_distribution_dns_names"])
                check_type(argname="argument single_header_policy_config", value=single_header_policy_config, expected_type=type_hints["single_header_policy_config"])
                check_type(argname="argument single_weight_policy_config", value=single_weight_policy_config, expected_type=type_hints["single_weight_policy_config"])
                check_type(argname="argument traffic_config", value=traffic_config, expected_type=type_hints["traffic_config"])
                check_type(argname="argument type", value=type, expected_type=type_hints["type"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "enabled": enabled,
                "staging_distribution_dns_names": staging_distribution_dns_names,
            }
            if single_header_policy_config is not None:
                self._values["single_header_policy_config"] = single_header_policy_config
            if single_weight_policy_config is not None:
                self._values["single_weight_policy_config"] = single_weight_policy_config
            if traffic_config is not None:
                self._values["traffic_config"] = traffic_config
            if type is not None:
                self._values["type"] = type

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that indicates whether this continuous deployment policy is enabled (in effect).

            When this value is ``true`` , this policy is enabled and in effect. When this value is ``false`` , this policy is not enabled and has no effect.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def staging_distribution_dns_names(self) -> typing.List[builtins.str]:
            '''The CloudFront domain name of the staging distribution.

            For example: ``d111111abcdef8.cloudfront.net`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-stagingdistributiondnsnames
            '''
            result = self._values.get("staging_distribution_dns_names")
            assert result is not None, "Required property 'staging_distribution_dns_names' is missing"
            return typing.cast(typing.List[builtins.str], result)

        @builtins.property
        def single_header_policy_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]]:
            '''This configuration determines which HTTP requests are sent to the staging distribution.

            If the HTTP request contains a header and value that matches what you specify here, the request is sent to the staging distribution. Otherwise the request is sent to the primary distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleheaderpolicyconfig
            '''
            result = self._values.get("single_header_policy_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty"]], result)

        @builtins.property
        def single_weight_policy_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]]:
            '''This configuration determines the percentage of HTTP requests that are sent to the staging distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-singleweightpolicyconfig
            '''
            result = self._values.get("single_weight_policy_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty"]], result)

        @builtins.property
        def traffic_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]]:
            '''Contains the parameters for routing production traffic from your primary to staging distributions.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-trafficconfig
            '''
            result = self._values.get("traffic_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.TrafficConfigProperty"]], result)

        @builtins.property
        def type(self) -> typing.Optional[builtins.str]:
            '''The type of traffic configuration.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig-type
            '''
            result = self._values.get("type")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ContinuousDeploymentPolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"idle_ttl": "idleTtl", "maximum_ttl": "maximumTtl"},
    )
    class SessionStickinessConfigProperty:
        def __init__(self, *, idle_ttl: jsii.Number, maximum_ttl: jsii.Number) -> None:
            '''Session stickiness provides the ability to define multiple requests from a single viewer as a single session.

            This prevents the potentially inconsistent experience of sending some of a given user's requests to your staging distribution, while others are sent to your primary distribution. Define the session duration using TTL values.

            :param idle_ttl: The amount of time after which you want sessions to cease if no requests are received. Allowed values are 300–3600 seconds (5–60 minutes).
            :param maximum_ttl: The maximum amount of time to consider requests from the viewer as being part of the same session. Allowed values are 300–3600 seconds (5–60 minutes).

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                session_stickiness_config_property = cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                    idle_ttl=123,
                    maximum_ttl=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__28b75d48272033dc185ab5e21f79a97315becd9c7999a921e0b955c636dc0311)
                check_type(argname="argument idle_ttl", value=idle_ttl, expected_type=type_hints["idle_ttl"])
                check_type(argname="argument maximum_ttl", value=maximum_ttl, expected_type=type_hints["maximum_ttl"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "idle_ttl": idle_ttl,
                "maximum_ttl": maximum_ttl,
            }

        @builtins.property
        def idle_ttl(self) -> jsii.Number:
            '''The amount of time after which you want sessions to cease if no requests are received.

            Allowed values are 300–3600 seconds (5–60 minutes).

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-idlettl
            '''
            result = self._values.get("idle_ttl")
            assert result is not None, "Required property 'idle_ttl' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def maximum_ttl(self) -> jsii.Number:
            '''The maximum amount of time to consider requests from the viewer as being part of the same session.

            Allowed values are 300–3600 seconds (5–60 minutes).

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig.html#cfn-cloudfront-continuousdeploymentpolicy-sessionstickinessconfig-maximumttl
            '''
            result = self._values.get("maximum_ttl")
            assert result is not None, "Required property 'maximum_ttl' is missing"
            return typing.cast(jsii.Number, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SessionStickinessConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"header": "header", "value": "value"},
    )
    class SingleHeaderConfigProperty:
        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
            '''Determines which HTTP requests are sent to the staging distribution.

            :param header: The request header name that you want CloudFront to send to your staging distribution. The header must contain the prefix ``aws-cf-cd-`` .
            :param value: The request header value.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                single_header_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
                    header="header",
                    value="value"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__ab2cd352992c9ba2b394cb9901d11c00f78ce00fd375f0cc51f4ae2401889435)
                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header": header,
                "value": value,
            }

        @builtins.property
        def header(self) -> builtins.str:
            '''The request header name that you want CloudFront to send to your staging distribution.

            The header must contain the prefix ``aws-cf-cd-`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-header
            '''
            result = self._values.get("header")
            assert result is not None, "Required property 'header' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def value(self) -> builtins.str:
            '''The request header value.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderconfig-value
            '''
            result = self._values.get("value")
            assert result is not None, "Required property 'value' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SingleHeaderConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"header": "header", "value": "value"},
    )
    class SingleHeaderPolicyConfigProperty:
        def __init__(self, *, header: builtins.str, value: builtins.str) -> None:
            '''
            :param header: 
            :param value: 

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                single_header_policy_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
                    header="header",
                    value="value"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__cdc8f6ee6354e61b27155f9e23e4aa75f2a7ba61db0aefaa8b33d79f7772fe16)
                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header": header,
                "value": value,
            }

        @builtins.property
        def header(self) -> builtins.str:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig-header
            '''
            result = self._values.get("header")
            assert result is not None, "Required property 'header' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def value(self) -> builtins.str:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleheaderpolicyconfig-value
            '''
            result = self._values.get("value")
            assert result is not None, "Required property 'value' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SingleHeaderPolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "weight": "weight",
            "session_stickiness_config": "sessionStickinessConfig",
        },
    )
    class SingleWeightConfigProperty:
        def __init__(
            self,
            *,
            weight: jsii.Number,
            session_stickiness_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''This configuration determines the percentage of HTTP requests that are sent to the staging distribution.

            :param weight: The percentage of traffic to send to a staging distribution, expressed as a decimal number between 0 and .15.
            :param session_stickiness_config: Session stickiness provides the ability to define multiple requests from a single viewer as a single session. This prevents the potentially inconsistent experience of sending some of a given user's requests to your staging distribution, while others are sent to your primary distribution. Define the session duration using TTL values.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                single_weight_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
                    weight=123,
                
                    # the properties below are optional
                    session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                        idle_ttl=123,
                        maximum_ttl=123
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__1ba7d952d1015505a10d7999960852df19dab54d6b3113134cf9174ef1030b16)
                check_type(argname="argument weight", value=weight, expected_type=type_hints["weight"])
                check_type(argname="argument session_stickiness_config", value=session_stickiness_config, expected_type=type_hints["session_stickiness_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "weight": weight,
            }
            if session_stickiness_config is not None:
                self._values["session_stickiness_config"] = session_stickiness_config

        @builtins.property
        def weight(self) -> jsii.Number:
            '''The percentage of traffic to send to a staging distribution, expressed as a decimal number between 0 and .15.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleweightconfig-weight
            '''
            result = self._values.get("weight")
            assert result is not None, "Required property 'weight' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def session_stickiness_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty"]]:
            '''Session stickiness provides the ability to define multiple requests from a single viewer as a single session.

            This prevents the potentially inconsistent experience of sending some of a given user's requests to your staging distribution, while others are sent to your primary distribution. Define the session duration using TTL values.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleweightconfig-sessionstickinessconfig
            '''
            result = self._values.get("session_stickiness_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SingleWeightConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "weight": "weight",
            "session_stickiness_config": "sessionStickinessConfig",
        },
    )
    class SingleWeightPolicyConfigProperty:
        def __init__(
            self,
            *,
            weight: jsii.Number,
            session_stickiness_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''
            :param weight: 
            :param session_stickiness_config: 

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightpolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                single_weight_policy_config_property = cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
                    weight=123,
                
                    # the properties below are optional
                    session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                        idle_ttl=123,
                        maximum_ttl=123
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__84e0588982dd4503df87db99f734b545b51a61216a04cbf8ae433c7e6041c065)
                check_type(argname="argument weight", value=weight, expected_type=type_hints["weight"])
                check_type(argname="argument session_stickiness_config", value=session_stickiness_config, expected_type=type_hints["session_stickiness_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "weight": weight,
            }
            if session_stickiness_config is not None:
                self._values["session_stickiness_config"] = session_stickiness_config

        @builtins.property
        def weight(self) -> jsii.Number:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleweightpolicyconfig-weight
            '''
            result = self._values.get("weight")
            assert result is not None, "Required property 'weight' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def session_stickiness_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty"]]:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-singleweightpolicyconfig.html#cfn-cloudfront-continuousdeploymentpolicy-singleweightpolicyconfig-sessionstickinessconfig
            '''
            result = self._values.get("session_stickiness_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SingleWeightPolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "type": "type",
            "single_header_config": "singleHeaderConfig",
            "single_weight_config": "singleWeightConfig",
        },
    )
    class TrafficConfigProperty:
        def __init__(
            self,
            *,
            type: builtins.str,
            single_header_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            single_weight_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnContinuousDeploymentPolicy.SingleWeightConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''The traffic configuration of your continuous deployment.

            :param type: The type of traffic configuration.
            :param single_header_config: Determines which HTTP requests are sent to the staging distribution.
            :param single_weight_config: Contains the percentage of traffic to send to the staging distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                traffic_config_property = cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
                    type="type",
                
                    # the properties below are optional
                    single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
                        header="header",
                        value="value"
                    ),
                    single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
                        weight=123,
                
                        # the properties below are optional
                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                            idle_ttl=123,
                            maximum_ttl=123
                        )
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__25e3b1d96d558cd97eeb1dde2cdbe1659675a2229aa5fd29c732485f764f4aa8)
                check_type(argname="argument type", value=type, expected_type=type_hints["type"])
                check_type(argname="argument single_header_config", value=single_header_config, expected_type=type_hints["single_header_config"])
                check_type(argname="argument single_weight_config", value=single_weight_config, expected_type=type_hints["single_weight_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "type": type,
            }
            if single_header_config is not None:
                self._values["single_header_config"] = single_header_config
            if single_weight_config is not None:
                self._values["single_weight_config"] = single_weight_config

        @builtins.property
        def type(self) -> builtins.str:
            '''The type of traffic configuration.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html#cfn-cloudfront-continuousdeploymentpolicy-trafficconfig-type
            '''
            result = self._values.get("type")
            assert result is not None, "Required property 'type' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def single_header_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty"]]:
            '''Determines which HTTP requests are sent to the staging distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html#cfn-cloudfront-continuousdeploymentpolicy-trafficconfig-singleheaderconfig
            '''
            result = self._values.get("single_header_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty"]], result)

        @builtins.property
        def single_weight_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightConfigProperty"]]:
            '''Contains the percentage of traffic to send to the staging distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-continuousdeploymentpolicy-trafficconfig.html#cfn-cloudfront-continuousdeploymentpolicy-trafficconfig-singleweightconfig
            '''
            result = self._values.get("single_weight_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnContinuousDeploymentPolicy.SingleWeightConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "TrafficConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnContinuousDeploymentPolicyProps",
    jsii_struct_bases=[],
    name_mapping={
        "continuous_deployment_policy_config": "continuousDeploymentPolicyConfig",
    },
)
class CfnContinuousDeploymentPolicyProps:
    def __init__(
        self,
        *,
        continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnContinuousDeploymentPolicy``.

        :param continuous_deployment_policy_config: Contains the configuration for a continuous deployment policy.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-continuousdeploymentpolicy.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_continuous_deployment_policy_props = cloudfront.CfnContinuousDeploymentPolicyProps(
                continuous_deployment_policy_config=cloudfront.CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty(
                    enabled=False,
                    staging_distribution_dns_names=["stagingDistributionDnsNames"],
            
                    # the properties below are optional
                    single_header_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty(
                        header="header",
                        value="value"
                    ),
                    single_weight_policy_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty(
                        weight=123,
            
                        # the properties below are optional
                        session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                            idle_ttl=123,
                            maximum_ttl=123
                        )
                    ),
                    traffic_config=cloudfront.CfnContinuousDeploymentPolicy.TrafficConfigProperty(
                        type="type",
            
                        # the properties below are optional
                        single_header_config=cloudfront.CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty(
                            header="header",
                            value="value"
                        ),
                        single_weight_config=cloudfront.CfnContinuousDeploymentPolicy.SingleWeightConfigProperty(
                            weight=123,
            
                            # the properties below are optional
                            session_stickiness_config=cloudfront.CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty(
                                idle_ttl=123,
                                maximum_ttl=123
                            )
                        )
                    ),
                    type="type"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1d05eaadb3d9addfa31ffbe5c17411fc95adb41047f3e3765293c98277e66bd)
            check_type(argname="argument continuous_deployment_policy_config", value=continuous_deployment_policy_config, expected_type=type_hints["continuous_deployment_policy_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "continuous_deployment_policy_config": continuous_deployment_policy_config,
        }

    @builtins.property
    def continuous_deployment_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty]:
        '''Contains the configuration for a continuous deployment policy.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-continuousdeploymentpolicy.html#cfn-cloudfront-continuousdeploymentpolicy-continuousdeploymentpolicyconfig
        '''
        result = self._values.get("continuous_deployment_policy_config")
        assert result is not None, "Required property 'continuous_deployment_policy_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnContinuousDeploymentPolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
class CfnDistribution(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution",
):
    '''A distribution tells CloudFront where you want content to be delivered from, and the details about how to track and manage content delivery.

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html
    :cloudformationResource: AWS::CloudFront::Distribution
    :exampleMetadata: infused

    Example::

        # source_bucket: s3.Bucket
        
        
        my_distribution = cloudfront.Distribution(self, "MyCfWebDistribution",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(source_bucket)
            )
        )
        cfn_distribution = my_distribution.node.default_child
        cfn_distribution.override_logical_id("MyDistributionCFDistribution3H55TI9Q")
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.DistributionConfigProperty", typing.Dict[builtins.str, typing.Any]]],
        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param distribution_config: The distribution's configuration.
        :param tags: A complex type that contains zero or more ``Tag`` elements.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81eda5f01ae8971b275cf76ed8b337277ad192ff5b49de8c33ebe25fd13da073)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnDistributionProps(
            distribution_config=distribution_config, tags=tags
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40ba9750b9508c380e2724727094e58eb27b5c37b6b692cd0ef7c46535b474ea)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8bfc436bc745342bcff636516edf9ce81ca8e92694d3307ec6ab9bec0002f395)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrDomainName")
    def attr_domain_name(self) -> builtins.str:
        '''The domain name of the resource, such as ``d111111abcdef8.cloudfront.net`` .

        :cloudformationAttribute: DomainName
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrDomainName"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The distribution's identifier.

        For example: ``E1U5RQF7T870K0`` .

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="tags")
    def tags(self) -> _TagManager_0a598cb3:
        '''Tag Manager which manages the tags for this resource.'''
        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "tags"))

    @builtins.property
    @jsii.member(jsii_name="distributionConfig")
    def distribution_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.DistributionConfigProperty"]:
        '''The distribution's configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.DistributionConfigProperty"], jsii.get(self, "distributionConfig"))

    @distribution_config.setter
    def distribution_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnDistribution.DistributionConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e8ff8a9cdfd4490d2e3cfaa371fe6e07d1dd8cd413e3d3ac95e589565d9ed0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "distributionConfig", value)

    @builtins.property
    @jsii.member(jsii_name="tagsRaw")
    def tags_raw(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
        '''A complex type that contains zero or more ``Tag`` elements.'''
        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "tagsRaw"))

    @tags_raw.setter
    def tags_raw(self, value: typing.Optional[typing.List[_CfnTag_f6864754]]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56e2d827e2f2ba5a0841aa9995f521ce75ad3be3fba3d8a6a555ca39d319d2f4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "tagsRaw", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.CacheBehaviorProperty",
        jsii_struct_bases=[],
        name_mapping={
            "path_pattern": "pathPattern",
            "target_origin_id": "targetOriginId",
            "viewer_protocol_policy": "viewerProtocolPolicy",
            "allowed_methods": "allowedMethods",
            "cached_methods": "cachedMethods",
            "cache_policy_id": "cachePolicyId",
            "compress": "compress",
            "default_ttl": "defaultTtl",
            "field_level_encryption_id": "fieldLevelEncryptionId",
            "forwarded_values": "forwardedValues",
            "function_associations": "functionAssociations",
            "lambda_function_associations": "lambdaFunctionAssociations",
            "max_ttl": "maxTtl",
            "min_ttl": "minTtl",
            "origin_request_policy_id": "originRequestPolicyId",
            "realtime_log_config_arn": "realtimeLogConfigArn",
            "response_headers_policy_id": "responseHeadersPolicyId",
            "smooth_streaming": "smoothStreaming",
            "trusted_key_groups": "trustedKeyGroups",
            "trusted_signers": "trustedSigners",
        },
    )
    class CacheBehaviorProperty:
        def __init__(
            self,
            *,
            path_pattern: builtins.str,
            target_origin_id: builtins.str,
            viewer_protocol_policy: builtins.str,
            allowed_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
            cached_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
            cache_policy_id: typing.Optional[builtins.str] = None,
            compress: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            default_ttl: typing.Optional[jsii.Number] = None,
            field_level_encryption_id: typing.Optional[builtins.str] = None,
            forwarded_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.ForwardedValuesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.FunctionAssociationProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            lambda_function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LambdaFunctionAssociationProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            max_ttl: typing.Optional[jsii.Number] = None,
            min_ttl: typing.Optional[jsii.Number] = None,
            origin_request_policy_id: typing.Optional[builtins.str] = None,
            realtime_log_config_arn: typing.Optional[builtins.str] = None,
            response_headers_policy_id: typing.Optional[builtins.str] = None,
            smooth_streaming: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            trusted_key_groups: typing.Optional[typing.Sequence[builtins.str]] = None,
            trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''A complex type that describes how CloudFront processes requests.

            You must create at least as many cache behaviors (including the default cache behavior) as you have origins if you want CloudFront to serve objects from all of the origins. Each cache behavior specifies the one origin from which you want CloudFront to get objects. If you have two origins and only the default cache behavior, the default cache behavior will cause CloudFront to get objects from one of the origins, but the other origin is never used.

            For the current quota (formerly known as limit) on the number of cache behaviors that you can add to a distribution, see `Quotas <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you don't want to specify any cache behaviors, include only an empty ``CacheBehaviors`` element. Don't include an empty ``CacheBehavior`` element because this is invalid.

            To delete all cache behaviors in an existing distribution, update the distribution configuration and include only an empty ``CacheBehaviors`` element.

            To add, change, or remove one or more cache behaviors, update the distribution configuration and specify all of the cache behaviors that you want to include in the updated distribution.

            For more information about cache behaviors, see `Cache Behavior Settings <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesCacheBehavior>`_ in the *Amazon CloudFront Developer Guide* .

            :param path_pattern: The pattern (for example, ``images/*.jpg`` ) that specifies which requests to apply the behavior to. When CloudFront receives a viewer request, the requested path is compared with path patterns in the order in which cache behaviors are listed in the distribution. .. epigraph:: You can optionally include a slash ( ``/`` ) at the beginning of the path pattern. For example, ``/images/*.jpg`` . CloudFront behavior is the same with or without the leading ``/`` . The path pattern for the default cache behavior is ``*`` and cannot be changed. If the request for an object does not match the path pattern for any cache behaviors, CloudFront applies the behavior in the default cache behavior. For more information, see `Path Pattern <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesPathPattern>`_ in the *Amazon CloudFront Developer Guide* .
            :param target_origin_id: The value of ``ID`` for the origin that you want CloudFront to route requests to when they match this cache behavior.
            :param viewer_protocol_policy: The protocol that viewers can use to access the files in the origin specified by ``TargetOriginId`` when a request matches the path pattern in ``PathPattern`` . You can specify the following options: - ``allow-all`` : Viewers can use HTTP or HTTPS. - ``redirect-to-https`` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL. - ``https-only`` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden). For more information about requiring the HTTPS protocol, see `Requiring HTTPS Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html>`_ in the *Amazon CloudFront Developer Guide* . .. epigraph:: The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects' cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see `Managing Cache Expiration <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param allowed_methods: A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin. There are three choices: - CloudFront forwards only ``GET`` and ``HEAD`` requests. - CloudFront forwards only ``GET`` , ``HEAD`` , and ``OPTIONS`` requests. - CloudFront forwards ``GET, HEAD, OPTIONS, PUT, PATCH, POST`` , and ``DELETE`` requests. If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.
            :param cached_methods: A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods. There are two choices: - CloudFront caches responses to ``GET`` and ``HEAD`` requests. - CloudFront caches responses to ``GET`` , ``HEAD`` , and ``OPTIONS`` requests. If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.
            :param cache_policy_id: The unique identifier of the cache policy that is attached to this cache behavior. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . A ``CacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` .
            :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. If so, specify true; if not, specify false. For more information, see `Serving Compressed Files <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - false
            :param default_ttl: This field is deprecated. We recommend that you use the ``DefaultTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - 86400
            :param field_level_encryption_id: The value of ``ID`` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for this cache behavior. Default: - ""
            :param forwarded_values: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see `Working with policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html>`_ in the *Amazon CloudFront Developer Guide* . If you want to include values in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* . A ``CacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` . A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.
            :param function_associations: A list of CloudFront functions that are associated with this cache behavior. CloudFront functions must be published to the ``LIVE`` stage to associate them with a cache behavior.
            :param lambda_function_associations: A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.
            :param max_ttl: This field is deprecated. We recommend that you use the ``MaxTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - 31536000
            :param min_ttl: This field is deprecated. We recommend that you use the ``MinTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . You must specify ``0`` for ``MinTTL`` if you configure CloudFront to forward all headers to your origin (under ``Headers`` , if you specify ``1`` for ``Quantity`` and ``*`` for ``Name`` ). Default: - 0
            :param origin_request_policy_id: The unique identifier of the origin request policy that is attached to this cache behavior. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param realtime_log_config_arn: The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior. For more information, see `Real-time logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param response_headers_policy_id: The identifier for a response headers policy.
            :param smooth_streaming: Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior. If so, specify ``true`` ; if not, specify ``false`` . If you specify ``true`` for ``SmoothStreaming`` , you can still distribute other content using this cache behavior if the content matches the value of ``PathPattern`` . Default: - false
            :param trusted_key_groups: A list of key groups that CloudFront can use to validate signed URLs or signed cookies. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param trusted_signers: .. epigraph:: We recommend using ``TrustedKeyGroups`` instead of ``TrustedSigners`` . A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies. When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in the trusted signer's AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cache_behavior_property = cloudfront.CfnDistribution.CacheBehaviorProperty(
                    path_pattern="pathPattern",
                    target_origin_id="targetOriginId",
                    viewer_protocol_policy="viewerProtocolPolicy",
                
                    # the properties below are optional
                    allowed_methods=["allowedMethods"],
                    cached_methods=["cachedMethods"],
                    cache_policy_id="cachePolicyId",
                    compress=False,
                    default_ttl=123,
                    field_level_encryption_id="fieldLevelEncryptionId",
                    forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                        query_string=False,
                
                        # the properties below are optional
                        cookies=cloudfront.CfnDistribution.CookiesProperty(
                            forward="forward",
                
                            # the properties below are optional
                            whitelisted_names=["whitelistedNames"]
                        ),
                        headers=["headers"],
                        query_string_cache_keys=["queryStringCacheKeys"]
                    ),
                    function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                        event_type="eventType",
                        function_arn="functionArn"
                    )],
                    lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                        event_type="eventType",
                        include_body=False,
                        lambda_function_arn="lambdaFunctionArn"
                    )],
                    max_ttl=123,
                    min_ttl=123,
                    origin_request_policy_id="originRequestPolicyId",
                    realtime_log_config_arn="realtimeLogConfigArn",
                    response_headers_policy_id="responseHeadersPolicyId",
                    smooth_streaming=False,
                    trusted_key_groups=["trustedKeyGroups"],
                    trusted_signers=["trustedSigners"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__40fab044003cdf2432d623590b2a89d0545d13047f180f029d22adc95cf31c5b)
                check_type(argname="argument path_pattern", value=path_pattern, expected_type=type_hints["path_pattern"])
                check_type(argname="argument target_origin_id", value=target_origin_id, expected_type=type_hints["target_origin_id"])
                check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
                check_type(argname="argument allowed_methods", value=allowed_methods, expected_type=type_hints["allowed_methods"])
                check_type(argname="argument cached_methods", value=cached_methods, expected_type=type_hints["cached_methods"])
                check_type(argname="argument cache_policy_id", value=cache_policy_id, expected_type=type_hints["cache_policy_id"])
                check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
                check_type(argname="argument default_ttl", value=default_ttl, expected_type=type_hints["default_ttl"])
                check_type(argname="argument field_level_encryption_id", value=field_level_encryption_id, expected_type=type_hints["field_level_encryption_id"])
                check_type(argname="argument forwarded_values", value=forwarded_values, expected_type=type_hints["forwarded_values"])
                check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
                check_type(argname="argument lambda_function_associations", value=lambda_function_associations, expected_type=type_hints["lambda_function_associations"])
                check_type(argname="argument max_ttl", value=max_ttl, expected_type=type_hints["max_ttl"])
                check_type(argname="argument min_ttl", value=min_ttl, expected_type=type_hints["min_ttl"])
                check_type(argname="argument origin_request_policy_id", value=origin_request_policy_id, expected_type=type_hints["origin_request_policy_id"])
                check_type(argname="argument realtime_log_config_arn", value=realtime_log_config_arn, expected_type=type_hints["realtime_log_config_arn"])
                check_type(argname="argument response_headers_policy_id", value=response_headers_policy_id, expected_type=type_hints["response_headers_policy_id"])
                check_type(argname="argument smooth_streaming", value=smooth_streaming, expected_type=type_hints["smooth_streaming"])
                check_type(argname="argument trusted_key_groups", value=trusted_key_groups, expected_type=type_hints["trusted_key_groups"])
                check_type(argname="argument trusted_signers", value=trusted_signers, expected_type=type_hints["trusted_signers"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "path_pattern": path_pattern,
                "target_origin_id": target_origin_id,
                "viewer_protocol_policy": viewer_protocol_policy,
            }
            if allowed_methods is not None:
                self._values["allowed_methods"] = allowed_methods
            if cached_methods is not None:
                self._values["cached_methods"] = cached_methods
            if cache_policy_id is not None:
                self._values["cache_policy_id"] = cache_policy_id
            if compress is not None:
                self._values["compress"] = compress
            if default_ttl is not None:
                self._values["default_ttl"] = default_ttl
            if field_level_encryption_id is not None:
                self._values["field_level_encryption_id"] = field_level_encryption_id
            if forwarded_values is not None:
                self._values["forwarded_values"] = forwarded_values
            if function_associations is not None:
                self._values["function_associations"] = function_associations
            if lambda_function_associations is not None:
                self._values["lambda_function_associations"] = lambda_function_associations
            if max_ttl is not None:
                self._values["max_ttl"] = max_ttl
            if min_ttl is not None:
                self._values["min_ttl"] = min_ttl
            if origin_request_policy_id is not None:
                self._values["origin_request_policy_id"] = origin_request_policy_id
            if realtime_log_config_arn is not None:
                self._values["realtime_log_config_arn"] = realtime_log_config_arn
            if response_headers_policy_id is not None:
                self._values["response_headers_policy_id"] = response_headers_policy_id
            if smooth_streaming is not None:
                self._values["smooth_streaming"] = smooth_streaming
            if trusted_key_groups is not None:
                self._values["trusted_key_groups"] = trusted_key_groups
            if trusted_signers is not None:
                self._values["trusted_signers"] = trusted_signers

        @builtins.property
        def path_pattern(self) -> builtins.str:
            '''The pattern (for example, ``images/*.jpg`` ) that specifies which requests to apply the behavior to. When CloudFront receives a viewer request, the requested path is compared with path patterns in the order in which cache behaviors are listed in the distribution.

            .. epigraph::

               You can optionally include a slash ( ``/`` ) at the beginning of the path pattern. For example, ``/images/*.jpg`` . CloudFront behavior is the same with or without the leading ``/`` .

            The path pattern for the default cache behavior is ``*`` and cannot be changed. If the request for an object does not match the path pattern for any cache behaviors, CloudFront applies the behavior in the default cache behavior.

            For more information, see `Path Pattern <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesPathPattern>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-pathpattern
            '''
            result = self._values.get("path_pattern")
            assert result is not None, "Required property 'path_pattern' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def target_origin_id(self) -> builtins.str:
            '''The value of ``ID`` for the origin that you want CloudFront to route requests to when they match this cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-targetoriginid
            '''
            result = self._values.get("target_origin_id")
            assert result is not None, "Required property 'target_origin_id' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def viewer_protocol_policy(self) -> builtins.str:
            '''The protocol that viewers can use to access the files in the origin specified by ``TargetOriginId`` when a request matches the path pattern in ``PathPattern`` .

            You can specify the following options:

            - ``allow-all`` : Viewers can use HTTP or HTTPS.
            - ``redirect-to-https`` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL.
            - ``https-only`` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden).

            For more information about requiring the HTTPS protocol, see `Requiring HTTPS Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html>`_ in the *Amazon CloudFront Developer Guide* .
            .. epigraph::

               The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects' cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see `Managing Cache Expiration <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-viewerprotocolpolicy
            '''
            result = self._values.get("viewer_protocol_policy")
            assert result is not None, "Required property 'viewer_protocol_policy' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def allowed_methods(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.

            There are three choices:

            - CloudFront forwards only ``GET`` and ``HEAD`` requests.
            - CloudFront forwards only ``GET`` , ``HEAD`` , and ``OPTIONS`` requests.
            - CloudFront forwards ``GET, HEAD, OPTIONS, PUT, PATCH, POST`` , and ``DELETE`` requests.

            If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-allowedmethods
            '''
            result = self._values.get("allowed_methods")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def cached_methods(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods.

            There are two choices:

            - CloudFront caches responses to ``GET`` and ``HEAD`` requests.
            - CloudFront caches responses to ``GET`` , ``HEAD`` , and ``OPTIONS`` requests.

            If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-cachedmethods
            '''
            result = self._values.get("cached_methods")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def cache_policy_id(self) -> typing.Optional[builtins.str]:
            '''The unique identifier of the cache policy that is attached to this cache behavior.

            For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            A ``CacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-cachepolicyid
            '''
            result = self._values.get("cache_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def compress(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''Whether you want CloudFront to automatically compress certain files for this cache behavior.

            If so, specify true; if not, specify false. For more information, see `Serving Compressed Files <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - false

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-compress
            '''
            result = self._values.get("compress")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def default_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``DefaultTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 86400

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-defaultttl
            '''
            result = self._values.get("default_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def field_level_encryption_id(self) -> typing.Optional[builtins.str]:
            '''The value of ``ID`` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for this cache behavior.

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-fieldlevelencryptionid
            '''
            result = self._values.get("field_level_encryption_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def forwarded_values(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ForwardedValuesProperty"]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see `Working with policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to include values in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            A ``CacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` .

            A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-forwardedvalues
            '''
            result = self._values.get("forwarded_values")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ForwardedValuesProperty"]], result)

        @builtins.property
        def function_associations(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.FunctionAssociationProperty"]]]]:
            '''A list of CloudFront functions that are associated with this cache behavior.

            CloudFront functions must be published to the ``LIVE`` stage to associate them with a cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-functionassociations
            '''
            result = self._values.get("function_associations")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.FunctionAssociationProperty"]]]], result)

        @builtins.property
        def lambda_function_associations(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LambdaFunctionAssociationProperty"]]]]:
            '''A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-lambdafunctionassociations
            '''
            result = self._values.get("lambda_function_associations")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LambdaFunctionAssociationProperty"]]]], result)

        @builtins.property
        def max_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``MaxTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 31536000

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-maxttl
            '''
            result = self._values.get("max_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def min_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``MinTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            You must specify ``0`` for ``MinTTL`` if you configure CloudFront to forward all headers to your origin (under ``Headers`` , if you specify ``1`` for ``Quantity`` and ``*`` for ``Name`` ).

            :default: - 0

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-minttl
            '''
            result = self._values.get("min_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def origin_request_policy_id(self) -> typing.Optional[builtins.str]:
            '''The unique identifier of the origin request policy that is attached to this cache behavior.

            For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-originrequestpolicyid
            '''
            result = self._values.get("origin_request_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def realtime_log_config_arn(self) -> typing.Optional[builtins.str]:
            '''The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior.

            For more information, see `Real-time logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-realtimelogconfigarn
            '''
            result = self._values.get("realtime_log_config_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def response_headers_policy_id(self) -> typing.Optional[builtins.str]:
            '''The identifier for a response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-responseheaderspolicyid
            '''
            result = self._values.get("response_headers_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def smooth_streaming(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.

            If so, specify ``true`` ; if not, specify ``false`` . If you specify ``true`` for ``SmoothStreaming`` , you can still distribute other content using this cache behavior if the content matches the value of ``PathPattern`` .

            :default: - false

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-smoothstreaming
            '''
            result = self._values.get("smooth_streaming")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def trusted_key_groups(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A list of key groups that CloudFront can use to validate signed URLs or signed cookies.

            When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-trustedkeygroups
            '''
            result = self._values.get("trusted_key_groups")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def trusted_signers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''.. epigraph::

   We recommend using ``TrustedKeyGroups`` instead of ``TrustedSigners`` .

            A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies.

            When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in the trusted signer's AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cachebehavior.html#cfn-cloudfront-distribution-cachebehavior-trustedsigners
            '''
            result = self._values.get("trusted_signers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CacheBehaviorProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.CookiesProperty",
        jsii_struct_bases=[],
        name_mapping={"forward": "forward", "whitelisted_names": "whitelistedNames"},
    )
    class CookiesProperty:
        def __init__(
            self,
            *,
            forward: builtins.str,
            whitelisted_names: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            A complex type that specifies whether you want CloudFront to forward cookies to the origin and, if so, which ones. For more information about forwarding cookies to the origin, see `How CloudFront Forwards, Caches, and Logs Cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html>`_ in the *Amazon CloudFront Developer Guide* .

            :param forward: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send cookies to the origin but not include them in the cache key, use origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . Specifies which cookies to forward to the origin for this cache behavior: all, none, or the list of cookies specified in the ``WhitelistedNames`` complex type. Amazon S3 doesn't process cookies. When the cache behavior is forwarding requests to an Amazon S3 origin, specify none for the ``Forward`` element.
            :param whitelisted_names: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . Required if you specify ``whitelist`` for the value of ``Forward`` . A complex type that specifies how many different cookies you want CloudFront to forward to the origin for this cache behavior and, if you want to forward selected cookies, the names of those cookies. If you specify ``all`` or ``none`` for the value of ``Forward`` , omit ``WhitelistedNames`` . If you change the value of ``Forward`` from ``whitelist`` to ``all`` or ``none`` and you don't delete the ``WhitelistedNames`` element and its child elements, CloudFront deletes them automatically. For the current limit on the number of cookie names that you can whitelist for each cache behavior, see `CloudFront Limits <https://docs.aws.amazon.com/general/latest/gr/xrefaws_service_limits.html#limits_cloudfront>`_ in the *AWS General Reference* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cookies.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cookies_property = cloudfront.CfnDistribution.CookiesProperty(
                    forward="forward",
                
                    # the properties below are optional
                    whitelisted_names=["whitelistedNames"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e44b3a9bc1a7e09b4dab8efd6baa05a8a81a531ccffdb2ea115b073bdbbb25e0)
                check_type(argname="argument forward", value=forward, expected_type=type_hints["forward"])
                check_type(argname="argument whitelisted_names", value=whitelisted_names, expected_type=type_hints["whitelisted_names"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "forward": forward,
            }
            if whitelisted_names is not None:
                self._values["whitelisted_names"] = whitelisted_names

        @builtins.property
        def forward(self) -> builtins.str:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send cookies to the origin but not include them in the cache key, use origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            Specifies which cookies to forward to the origin for this cache behavior: all, none, or the list of cookies specified in the ``WhitelistedNames`` complex type.

            Amazon S3 doesn't process cookies. When the cache behavior is forwarding requests to an Amazon S3 origin, specify none for the ``Forward`` element.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cookies.html#cfn-cloudfront-distribution-cookies-forward
            '''
            result = self._values.get("forward")
            assert result is not None, "Required property 'forward' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def whitelisted_names(self) -> typing.Optional[typing.List[builtins.str]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            Required if you specify ``whitelist`` for the value of ``Forward`` . A complex type that specifies how many different cookies you want CloudFront to forward to the origin for this cache behavior and, if you want to forward selected cookies, the names of those cookies.

            If you specify ``all`` or ``none`` for the value of ``Forward`` , omit ``WhitelistedNames`` . If you change the value of ``Forward`` from ``whitelist`` to ``all`` or ``none`` and you don't delete the ``WhitelistedNames`` element and its child elements, CloudFront deletes them automatically.

            For the current limit on the number of cookie names that you can whitelist for each cache behavior, see `CloudFront Limits <https://docs.aws.amazon.com/general/latest/gr/xrefaws_service_limits.html#limits_cloudfront>`_ in the *AWS General Reference* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-cookies.html#cfn-cloudfront-distribution-cookies-whitelistednames
            '''
            result = self._values.get("whitelisted_names")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CookiesProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.CustomErrorResponseProperty",
        jsii_struct_bases=[],
        name_mapping={
            "error_code": "errorCode",
            "error_caching_min_ttl": "errorCachingMinTtl",
            "response_code": "responseCode",
            "response_page_path": "responsePagePath",
        },
    )
    class CustomErrorResponseProperty:
        def __init__(
            self,
            *,
            error_code: jsii.Number,
            error_caching_min_ttl: typing.Optional[jsii.Number] = None,
            response_code: typing.Optional[jsii.Number] = None,
            response_page_path: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A complex type that controls:.

            - Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer.
            - How long CloudFront caches HTTP status codes in the 4xx and 5xx range.

            For more information about custom error pages, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* .

            :param error_code: The HTTP status code for which you want to specify a custom error page and/or a caching duration.
            :param error_caching_min_ttl: The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in ``ErrorCode`` . When this time period has elapsed, CloudFront queries your origin to see whether the problem that caused the error has been resolved and the requested object is now available. For more information, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - 300
            :param response_code: The HTTP status code that you want CloudFront to return to the viewer along with the custom error page. There are a variety of reasons that you might want CloudFront to return a status code different from the status code that your origin returned to CloudFront, for example: - Some Internet devices (some firewalls and corporate proxies, for example) intercept HTTP 4xx and 5xx and prevent the response from being returned to the viewer. If you substitute ``200`` , the response typically won't be intercepted. - If you don't care about distinguishing among different client errors or server errors, you can specify ``400`` or ``500`` as the ``ResponseCode`` for all 4xx or 5xx errors. - You might want to return a ``200`` status code (OK) and static website so your customers don't know that your website is down. If you specify a value for ``ResponseCode`` , you must also specify a value for ``ResponsePagePath`` .
            :param response_page_path: The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by ``ErrorCode`` , for example, ``/4xx-errors/403-forbidden.html`` . If you want to store your objects and your custom error pages in different locations, your distribution must include a cache behavior for which the following is true:. - The value of ``PathPattern`` matches the path to your custom error messages. For example, suppose you saved custom error pages for 4xx errors in an Amazon S3 bucket in a directory named ``/4xx-errors`` . Your distribution must include a cache behavior for which the path pattern routes requests for your custom error pages to that location, for example, ``/4xx-errors/*`` . - The value of ``TargetOriginId`` specifies the value of the ``ID`` element for the origin that contains your custom error pages. If you specify a value for ``ResponsePagePath`` , you must also specify a value for ``ResponseCode`` . We recommend that you store custom error pages in an Amazon S3 bucket. If you store custom error pages on an HTTP server and the server starts to return 5xx errors, CloudFront can't get the files that you want to return to viewers because the origin server is unavailable.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customerrorresponse.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                custom_error_response_property = cloudfront.CfnDistribution.CustomErrorResponseProperty(
                    error_code=123,
                
                    # the properties below are optional
                    error_caching_min_ttl=123,
                    response_code=123,
                    response_page_path="responsePagePath"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__165a54d7c992e96bdb527d46ec00363098905c57e6a02574f448cc32b8103dc8)
                check_type(argname="argument error_code", value=error_code, expected_type=type_hints["error_code"])
                check_type(argname="argument error_caching_min_ttl", value=error_caching_min_ttl, expected_type=type_hints["error_caching_min_ttl"])
                check_type(argname="argument response_code", value=response_code, expected_type=type_hints["response_code"])
                check_type(argname="argument response_page_path", value=response_page_path, expected_type=type_hints["response_page_path"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "error_code": error_code,
            }
            if error_caching_min_ttl is not None:
                self._values["error_caching_min_ttl"] = error_caching_min_ttl
            if response_code is not None:
                self._values["response_code"] = response_code
            if response_page_path is not None:
                self._values["response_page_path"] = response_page_path

        @builtins.property
        def error_code(self) -> jsii.Number:
            '''The HTTP status code for which you want to specify a custom error page and/or a caching duration.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customerrorresponse.html#cfn-cloudfront-distribution-customerrorresponse-errorcode
            '''
            result = self._values.get("error_code")
            assert result is not None, "Required property 'error_code' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def error_caching_min_ttl(self) -> typing.Optional[jsii.Number]:
            '''The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in ``ErrorCode`` .

            When this time period has elapsed, CloudFront queries your origin to see whether the problem that caused the error has been resolved and the requested object is now available.

            For more information, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 300

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customerrorresponse.html#cfn-cloudfront-distribution-customerrorresponse-errorcachingminttl
            '''
            result = self._values.get("error_caching_min_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def response_code(self) -> typing.Optional[jsii.Number]:
            '''The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.

            There are a variety of reasons that you might want CloudFront to return a status code different from the status code that your origin returned to CloudFront, for example:

            - Some Internet devices (some firewalls and corporate proxies, for example) intercept HTTP 4xx and 5xx and prevent the response from being returned to the viewer. If you substitute ``200`` , the response typically won't be intercepted.
            - If you don't care about distinguishing among different client errors or server errors, you can specify ``400`` or ``500`` as the ``ResponseCode`` for all 4xx or 5xx errors.
            - You might want to return a ``200`` status code (OK) and static website so your customers don't know that your website is down.

            If you specify a value for ``ResponseCode`` , you must also specify a value for ``ResponsePagePath`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customerrorresponse.html#cfn-cloudfront-distribution-customerrorresponse-responsecode
            '''
            result = self._values.get("response_code")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def response_page_path(self) -> typing.Optional[builtins.str]:
            '''The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the HTTP status code specified by ``ErrorCode`` , for example, ``/4xx-errors/403-forbidden.html`` . If you want to store your objects and your custom error pages in different locations, your distribution must include a cache behavior for which the following is true:.

            - The value of ``PathPattern`` matches the path to your custom error messages. For example, suppose you saved custom error pages for 4xx errors in an Amazon S3 bucket in a directory named ``/4xx-errors`` . Your distribution must include a cache behavior for which the path pattern routes requests for your custom error pages to that location, for example, ``/4xx-errors/*`` .
            - The value of ``TargetOriginId`` specifies the value of the ``ID`` element for the origin that contains your custom error pages.

            If you specify a value for ``ResponsePagePath`` , you must also specify a value for ``ResponseCode`` .

            We recommend that you store custom error pages in an Amazon S3 bucket. If you store custom error pages on an HTTP server and the server starts to return 5xx errors, CloudFront can't get the files that you want to return to viewers because the origin server is unavailable.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customerrorresponse.html#cfn-cloudfront-distribution-customerrorresponse-responsepagepath
            '''
            result = self._values.get("response_page_path")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CustomErrorResponseProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.CustomOriginConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "origin_protocol_policy": "originProtocolPolicy",
            "http_port": "httpPort",
            "https_port": "httpsPort",
            "origin_keepalive_timeout": "originKeepaliveTimeout",
            "origin_read_timeout": "originReadTimeout",
            "origin_ssl_protocols": "originSslProtocols",
        },
    )
    class CustomOriginConfigProperty:
        def __init__(
            self,
            *,
            origin_protocol_policy: builtins.str,
            http_port: typing.Optional[jsii.Number] = None,
            https_port: typing.Optional[jsii.Number] = None,
            origin_keepalive_timeout: typing.Optional[jsii.Number] = None,
            origin_read_timeout: typing.Optional[jsii.Number] = None,
            origin_ssl_protocols: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''A custom origin.

            A custom origin is any origin that is *not* an Amazon S3 bucket, with one exception. An Amazon S3 bucket that is `configured with static website hosting <https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html>`_ *is* a custom origin.

            :param origin_protocol_policy: Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin. Valid values are:. - ``http-only`` – CloudFront always uses HTTP to connect to the origin. - ``match-viewer`` – CloudFront connects to the origin using the same protocol that the viewer used to connect to CloudFront. - ``https-only`` – CloudFront always uses HTTPS to connect to the origin.
            :param http_port: The HTTP port that CloudFront uses to connect to the origin. Specify the HTTP port that the origin listens on. Default: - 80
            :param https_port: The HTTPS port that CloudFront uses to connect to the origin. Specify the HTTPS port that the origin listens on. Default: - 443
            :param origin_keepalive_timeout: Specifies how long, in seconds, CloudFront persists its connection to the origin. The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds. For more information, see `Origin Keep-alive Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 5
            :param origin_read_timeout: Specifies how long, in seconds, CloudFront waits for a response from the origin. This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds. For more information, see `Origin Response Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* . Default: - 30
            :param origin_ssl_protocols: Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS. Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` . For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                custom_origin_config_property = cloudfront.CfnDistribution.CustomOriginConfigProperty(
                    origin_protocol_policy="originProtocolPolicy",
                
                    # the properties below are optional
                    http_port=123,
                    https_port=123,
                    origin_keepalive_timeout=123,
                    origin_read_timeout=123,
                    origin_ssl_protocols=["originSslProtocols"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__4818766b050bad18cc83a1490771aa31b5eaddfe75b97673cb8c97008d6067b6)
                check_type(argname="argument origin_protocol_policy", value=origin_protocol_policy, expected_type=type_hints["origin_protocol_policy"])
                check_type(argname="argument http_port", value=http_port, expected_type=type_hints["http_port"])
                check_type(argname="argument https_port", value=https_port, expected_type=type_hints["https_port"])
                check_type(argname="argument origin_keepalive_timeout", value=origin_keepalive_timeout, expected_type=type_hints["origin_keepalive_timeout"])
                check_type(argname="argument origin_read_timeout", value=origin_read_timeout, expected_type=type_hints["origin_read_timeout"])
                check_type(argname="argument origin_ssl_protocols", value=origin_ssl_protocols, expected_type=type_hints["origin_ssl_protocols"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "origin_protocol_policy": origin_protocol_policy,
            }
            if http_port is not None:
                self._values["http_port"] = http_port
            if https_port is not None:
                self._values["https_port"] = https_port
            if origin_keepalive_timeout is not None:
                self._values["origin_keepalive_timeout"] = origin_keepalive_timeout
            if origin_read_timeout is not None:
                self._values["origin_read_timeout"] = origin_read_timeout
            if origin_ssl_protocols is not None:
                self._values["origin_ssl_protocols"] = origin_ssl_protocols

        @builtins.property
        def origin_protocol_policy(self) -> builtins.str:
            '''Specifies the protocol (HTTP or HTTPS) that CloudFront uses to connect to the origin. Valid values are:.

            - ``http-only`` – CloudFront always uses HTTP to connect to the origin.
            - ``match-viewer`` – CloudFront connects to the origin using the same protocol that the viewer used to connect to CloudFront.
            - ``https-only`` – CloudFront always uses HTTPS to connect to the origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-originprotocolpolicy
            '''
            result = self._values.get("origin_protocol_policy")
            assert result is not None, "Required property 'origin_protocol_policy' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def http_port(self) -> typing.Optional[jsii.Number]:
            '''The HTTP port that CloudFront uses to connect to the origin.

            Specify the HTTP port that the origin listens on.

            :default: - 80

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-httpport
            '''
            result = self._values.get("http_port")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def https_port(self) -> typing.Optional[jsii.Number]:
            '''The HTTPS port that CloudFront uses to connect to the origin.

            Specify the HTTPS port that the origin listens on.

            :default: - 443

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-httpsport
            '''
            result = self._values.get("https_port")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def origin_keepalive_timeout(self) -> typing.Optional[jsii.Number]:
            '''Specifies how long, in seconds, CloudFront persists its connection to the origin.

            The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 5 seconds.

            For more information, see `Origin Keep-alive Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginKeepaliveTimeout>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 5

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-originkeepalivetimeout
            '''
            result = self._values.get("origin_keepalive_timeout")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def origin_read_timeout(self) -> typing.Optional[jsii.Number]:
            '''Specifies how long, in seconds, CloudFront waits for a response from the origin.

            This is also known as the *origin response timeout* . The minimum timeout is 1 second, the maximum is 60 seconds, and the default (if you don't specify otherwise) is 30 seconds.

            For more information, see `Origin Response Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 30

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-originreadtimeout
            '''
            result = self._values.get("origin_read_timeout")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def origin_ssl_protocols(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Specifies the minimum SSL/TLS protocol that CloudFront uses when connecting to your origin over HTTPS.

            Valid values include ``SSLv3`` , ``TLSv1`` , ``TLSv1.1`` , and ``TLSv1.2`` .

            For more information, see `Minimum Origin SSL Protocol <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginSSLProtocols>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-customoriginconfig.html#cfn-cloudfront-distribution-customoriginconfig-originsslprotocols
            '''
            result = self._values.get("origin_ssl_protocols")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CustomOriginConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.DefaultCacheBehaviorProperty",
        jsii_struct_bases=[],
        name_mapping={
            "target_origin_id": "targetOriginId",
            "viewer_protocol_policy": "viewerProtocolPolicy",
            "allowed_methods": "allowedMethods",
            "cached_methods": "cachedMethods",
            "cache_policy_id": "cachePolicyId",
            "compress": "compress",
            "default_ttl": "defaultTtl",
            "field_level_encryption_id": "fieldLevelEncryptionId",
            "forwarded_values": "forwardedValues",
            "function_associations": "functionAssociations",
            "lambda_function_associations": "lambdaFunctionAssociations",
            "max_ttl": "maxTtl",
            "min_ttl": "minTtl",
            "origin_request_policy_id": "originRequestPolicyId",
            "realtime_log_config_arn": "realtimeLogConfigArn",
            "response_headers_policy_id": "responseHeadersPolicyId",
            "smooth_streaming": "smoothStreaming",
            "trusted_key_groups": "trustedKeyGroups",
            "trusted_signers": "trustedSigners",
        },
    )
    class DefaultCacheBehaviorProperty:
        def __init__(
            self,
            *,
            target_origin_id: builtins.str,
            viewer_protocol_policy: builtins.str,
            allowed_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
            cached_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
            cache_policy_id: typing.Optional[builtins.str] = None,
            compress: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            default_ttl: typing.Optional[jsii.Number] = None,
            field_level_encryption_id: typing.Optional[builtins.str] = None,
            forwarded_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.ForwardedValuesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.FunctionAssociationProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            lambda_function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LambdaFunctionAssociationProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            max_ttl: typing.Optional[jsii.Number] = None,
            min_ttl: typing.Optional[jsii.Number] = None,
            origin_request_policy_id: typing.Optional[builtins.str] = None,
            realtime_log_config_arn: typing.Optional[builtins.str] = None,
            response_headers_policy_id: typing.Optional[builtins.str] = None,
            smooth_streaming: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            trusted_key_groups: typing.Optional[typing.Sequence[builtins.str]] = None,
            trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''A complex type that describes the default cache behavior if you don't specify a ``CacheBehavior`` element or if request URLs don't match any of the values of ``PathPattern`` in ``CacheBehavior`` elements.

            You must create exactly one default cache behavior.

            :param target_origin_id: The value of ``ID`` for the origin that you want CloudFront to route requests to when they use the default cache behavior.
            :param viewer_protocol_policy: The protocol that viewers can use to access the files in the origin specified by ``TargetOriginId`` when a request matches the path pattern in ``PathPattern`` . You can specify the following options: - ``allow-all`` : Viewers can use HTTP or HTTPS. - ``redirect-to-https`` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL. - ``https-only`` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden). For more information about requiring the HTTPS protocol, see `Requiring HTTPS Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html>`_ in the *Amazon CloudFront Developer Guide* . .. epigraph:: The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects' cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see `Managing Cache Expiration <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param allowed_methods: A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin. There are three choices: - CloudFront forwards only ``GET`` and ``HEAD`` requests. - CloudFront forwards only ``GET`` , ``HEAD`` , and ``OPTIONS`` requests. - CloudFront forwards ``GET, HEAD, OPTIONS, PUT, PATCH, POST`` , and ``DELETE`` requests. If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.
            :param cached_methods: A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods. There are two choices: - CloudFront caches responses to ``GET`` and ``HEAD`` requests. - CloudFront caches responses to ``GET`` , ``HEAD`` , and ``OPTIONS`` requests. If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.
            :param cache_policy_id: The unique identifier of the cache policy that is attached to the default cache behavior. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . A ``DefaultCacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` . Default: - ""
            :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. If so, specify ``true`` ; if not, specify ``false`` . For more information, see `Serving Compressed Files <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - false
            :param default_ttl: This field is deprecated. We recommend that you use the ``DefaultTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - 86400
            :param field_level_encryption_id: The value of ``ID`` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for the default cache behavior. Default: - ""
            :param forwarded_values: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see `Working with policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html>`_ in the *Amazon CloudFront Developer Guide* . If you want to include values in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* . A ``DefaultCacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` . A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.
            :param function_associations: A list of CloudFront functions that are associated with this cache behavior. Your functions must be published to the ``LIVE`` stage to associate them with a cache behavior.
            :param lambda_function_associations: A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.
            :param max_ttl: This field is deprecated. We recommend that you use the ``MaxTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - 31536000
            :param min_ttl: This field is deprecated. We recommend that you use the ``MinTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* . The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* . You must specify ``0`` for ``MinTTL`` if you configure CloudFront to forward all headers to your origin (under ``Headers`` , if you specify ``1`` for ``Quantity`` and ``*`` for ``Name`` ). Default: - 0
            :param origin_request_policy_id: The unique identifier of the origin request policy that is attached to the default cache behavior. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
            :param realtime_log_config_arn: The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior. For more information, see `Real-time logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
            :param response_headers_policy_id: The identifier for a response headers policy. Default: - ""
            :param smooth_streaming: Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior. If so, specify ``true`` ; if not, specify ``false`` . If you specify ``true`` for ``SmoothStreaming`` , you can still distribute other content using this cache behavior if the content matches the value of ``PathPattern`` . Default: - false
            :param trusted_key_groups: A list of key groups that CloudFront can use to validate signed URLs or signed cookies. When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param trusted_signers: .. epigraph:: We recommend using ``TrustedKeyGroups`` instead of ``TrustedSigners`` . A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies. When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in a trusted signer's AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                default_cache_behavior_property = cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
                    target_origin_id="targetOriginId",
                    viewer_protocol_policy="viewerProtocolPolicy",
                
                    # the properties below are optional
                    allowed_methods=["allowedMethods"],
                    cached_methods=["cachedMethods"],
                    cache_policy_id="cachePolicyId",
                    compress=False,
                    default_ttl=123,
                    field_level_encryption_id="fieldLevelEncryptionId",
                    forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                        query_string=False,
                
                        # the properties below are optional
                        cookies=cloudfront.CfnDistribution.CookiesProperty(
                            forward="forward",
                
                            # the properties below are optional
                            whitelisted_names=["whitelistedNames"]
                        ),
                        headers=["headers"],
                        query_string_cache_keys=["queryStringCacheKeys"]
                    ),
                    function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                        event_type="eventType",
                        function_arn="functionArn"
                    )],
                    lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                        event_type="eventType",
                        include_body=False,
                        lambda_function_arn="lambdaFunctionArn"
                    )],
                    max_ttl=123,
                    min_ttl=123,
                    origin_request_policy_id="originRequestPolicyId",
                    realtime_log_config_arn="realtimeLogConfigArn",
                    response_headers_policy_id="responseHeadersPolicyId",
                    smooth_streaming=False,
                    trusted_key_groups=["trustedKeyGroups"],
                    trusted_signers=["trustedSigners"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__acf9839d8791146628088e2f7ab6072f3232af301427572733ecdb1c51a7b94f)
                check_type(argname="argument target_origin_id", value=target_origin_id, expected_type=type_hints["target_origin_id"])
                check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
                check_type(argname="argument allowed_methods", value=allowed_methods, expected_type=type_hints["allowed_methods"])
                check_type(argname="argument cached_methods", value=cached_methods, expected_type=type_hints["cached_methods"])
                check_type(argname="argument cache_policy_id", value=cache_policy_id, expected_type=type_hints["cache_policy_id"])
                check_type(argname="argument compress", value=compress, expected_type=type_hints["compress"])
                check_type(argname="argument default_ttl", value=default_ttl, expected_type=type_hints["default_ttl"])
                check_type(argname="argument field_level_encryption_id", value=field_level_encryption_id, expected_type=type_hints["field_level_encryption_id"])
                check_type(argname="argument forwarded_values", value=forwarded_values, expected_type=type_hints["forwarded_values"])
                check_type(argname="argument function_associations", value=function_associations, expected_type=type_hints["function_associations"])
                check_type(argname="argument lambda_function_associations", value=lambda_function_associations, expected_type=type_hints["lambda_function_associations"])
                check_type(argname="argument max_ttl", value=max_ttl, expected_type=type_hints["max_ttl"])
                check_type(argname="argument min_ttl", value=min_ttl, expected_type=type_hints["min_ttl"])
                check_type(argname="argument origin_request_policy_id", value=origin_request_policy_id, expected_type=type_hints["origin_request_policy_id"])
                check_type(argname="argument realtime_log_config_arn", value=realtime_log_config_arn, expected_type=type_hints["realtime_log_config_arn"])
                check_type(argname="argument response_headers_policy_id", value=response_headers_policy_id, expected_type=type_hints["response_headers_policy_id"])
                check_type(argname="argument smooth_streaming", value=smooth_streaming, expected_type=type_hints["smooth_streaming"])
                check_type(argname="argument trusted_key_groups", value=trusted_key_groups, expected_type=type_hints["trusted_key_groups"])
                check_type(argname="argument trusted_signers", value=trusted_signers, expected_type=type_hints["trusted_signers"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "target_origin_id": target_origin_id,
                "viewer_protocol_policy": viewer_protocol_policy,
            }
            if allowed_methods is not None:
                self._values["allowed_methods"] = allowed_methods
            if cached_methods is not None:
                self._values["cached_methods"] = cached_methods
            if cache_policy_id is not None:
                self._values["cache_policy_id"] = cache_policy_id
            if compress is not None:
                self._values["compress"] = compress
            if default_ttl is not None:
                self._values["default_ttl"] = default_ttl
            if field_level_encryption_id is not None:
                self._values["field_level_encryption_id"] = field_level_encryption_id
            if forwarded_values is not None:
                self._values["forwarded_values"] = forwarded_values
            if function_associations is not None:
                self._values["function_associations"] = function_associations
            if lambda_function_associations is not None:
                self._values["lambda_function_associations"] = lambda_function_associations
            if max_ttl is not None:
                self._values["max_ttl"] = max_ttl
            if min_ttl is not None:
                self._values["min_ttl"] = min_ttl
            if origin_request_policy_id is not None:
                self._values["origin_request_policy_id"] = origin_request_policy_id
            if realtime_log_config_arn is not None:
                self._values["realtime_log_config_arn"] = realtime_log_config_arn
            if response_headers_policy_id is not None:
                self._values["response_headers_policy_id"] = response_headers_policy_id
            if smooth_streaming is not None:
                self._values["smooth_streaming"] = smooth_streaming
            if trusted_key_groups is not None:
                self._values["trusted_key_groups"] = trusted_key_groups
            if trusted_signers is not None:
                self._values["trusted_signers"] = trusted_signers

        @builtins.property
        def target_origin_id(self) -> builtins.str:
            '''The value of ``ID`` for the origin that you want CloudFront to route requests to when they use the default cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-targetoriginid
            '''
            result = self._values.get("target_origin_id")
            assert result is not None, "Required property 'target_origin_id' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def viewer_protocol_policy(self) -> builtins.str:
            '''The protocol that viewers can use to access the files in the origin specified by ``TargetOriginId`` when a request matches the path pattern in ``PathPattern`` .

            You can specify the following options:

            - ``allow-all`` : Viewers can use HTTP or HTTPS.
            - ``redirect-to-https`` : If a viewer submits an HTTP request, CloudFront returns an HTTP status code of 301 (Moved Permanently) to the viewer along with the HTTPS URL. The viewer then resubmits the request using the new URL.
            - ``https-only`` : If a viewer sends an HTTP request, CloudFront returns an HTTP status code of 403 (Forbidden).

            For more information about requiring the HTTPS protocol, see `Requiring HTTPS Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-viewers-to-cloudfront.html>`_ in the *Amazon CloudFront Developer Guide* .
            .. epigraph::

               The only way to guarantee that viewers retrieve an object that was fetched from the origin using HTTPS is never to use any other protocol to fetch the object. If you have recently changed from HTTP to HTTPS, we recommend that you clear your objects' cache because cached objects are protocol agnostic. That means that an edge location will return an object from the cache regardless of whether the current request protocol matches the protocol used previously. For more information, see `Managing Cache Expiration <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-viewerprotocolpolicy
            '''
            result = self._values.get("viewer_protocol_policy")
            assert result is not None, "Required property 'viewer_protocol_policy' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def allowed_methods(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.

            There are three choices:

            - CloudFront forwards only ``GET`` and ``HEAD`` requests.
            - CloudFront forwards only ``GET`` , ``HEAD`` , and ``OPTIONS`` requests.
            - CloudFront forwards ``GET, HEAD, OPTIONS, PUT, PATCH, POST`` , and ``DELETE`` requests.

            If you pick the third choice, you may need to restrict access to your Amazon S3 bucket or to your custom origin so users can't perform operations that you don't want them to. For example, you might not want users to have permissions to delete objects from your origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-allowedmethods
            '''
            result = self._values.get("allowed_methods")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def cached_methods(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that controls whether CloudFront caches the response to requests using the specified HTTP methods.

            There are two choices:

            - CloudFront caches responses to ``GET`` and ``HEAD`` requests.
            - CloudFront caches responses to ``GET`` , ``HEAD`` , and ``OPTIONS`` requests.

            If you pick the second choice for your Amazon S3 Origin, you may need to forward Access-Control-Request-Method, Access-Control-Request-Headers, and Origin headers for the responses to be cached correctly.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-cachedmethods
            '''
            result = self._values.get("cached_methods")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def cache_policy_id(self) -> typing.Optional[builtins.str]:
            '''The unique identifier of the cache policy that is attached to the default cache behavior.

            For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            A ``DefaultCacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-cachepolicyid
            '''
            result = self._values.get("cache_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def compress(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''Whether you want CloudFront to automatically compress certain files for this cache behavior.

            If so, specify ``true`` ; if not, specify ``false`` . For more information, see `Serving Compressed Files <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - false

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-compress
            '''
            result = self._values.get("compress")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def default_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``DefaultTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The default amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin does not add HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 86400

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-defaultttl
            '''
            result = self._values.get("default_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def field_level_encryption_id(self) -> typing.Optional[builtins.str]:
            '''The value of ``ID`` for the field-level encryption configuration that you want CloudFront to use for encrypting specific fields of data for the default cache behavior.

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-fieldlevelencryptionid
            '''
            result = self._values.get("field_level_encryption_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def forwarded_values(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ForwardedValuesProperty"]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field. For more information, see `Working with policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to include values in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            A ``DefaultCacheBehavior`` must include either a ``CachePolicyId`` or ``ForwardedValues`` . We recommend that you use a ``CachePolicyId`` .

            A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-forwardedvalues
            '''
            result = self._values.get("forwarded_values")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ForwardedValuesProperty"]], result)

        @builtins.property
        def function_associations(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.FunctionAssociationProperty"]]]]:
            '''A list of CloudFront functions that are associated with this cache behavior.

            Your functions must be published to the ``LIVE`` stage to associate them with a cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-functionassociations
            '''
            result = self._values.get("function_associations")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.FunctionAssociationProperty"]]]], result)

        @builtins.property
        def lambda_function_associations(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LambdaFunctionAssociationProperty"]]]]:
            '''A complex type that contains zero or more Lambda@Edge function associations for a cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-lambdafunctionassociations
            '''
            result = self._values.get("lambda_function_associations")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LambdaFunctionAssociationProperty"]]]], result)

        @builtins.property
        def max_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``MaxTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The maximum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. The value that you specify applies only when your origin adds HTTP headers such as ``Cache-Control max-age`` , ``Cache-Control s-maxage`` , and ``Expires`` to objects. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - 31536000

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-maxttl
            '''
            result = self._values.get("max_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def min_ttl(self) -> typing.Optional[jsii.Number]:
            '''This field is deprecated.

            We recommend that you use the ``MinTTL`` field in a cache policy instead of this field. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ or `Using the managed cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            The minimum amount of time that you want objects to stay in CloudFront caches before CloudFront forwards another request to your origin to determine whether the object has been updated. For more information, see `Managing How Long Content Stays in an Edge Cache (Expiration) <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Expiration.html>`_ in the *Amazon CloudFront Developer Guide* .

            You must specify ``0`` for ``MinTTL`` if you configure CloudFront to forward all headers to your origin (under ``Headers`` , if you specify ``1`` for ``Quantity`` and ``*`` for ``Name`` ).

            :default: - 0

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-minttl
            '''
            result = self._values.get("min_ttl")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def origin_request_policy_id(self) -> typing.Optional[builtins.str]:
            '''The unique identifier of the origin request policy that is attached to the default cache behavior.

            For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ or `Using the managed origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-origin-request-policies.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-originrequestpolicyid
            '''
            result = self._values.get("origin_request_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def realtime_log_config_arn(self) -> typing.Optional[builtins.str]:
            '''The Amazon Resource Name (ARN) of the real-time log configuration that is attached to this cache behavior.

            For more information, see `Real-time logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-realtimelogconfigarn
            '''
            result = self._values.get("realtime_log_config_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def response_headers_policy_id(self) -> typing.Optional[builtins.str]:
            '''The identifier for a response headers policy.

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-responseheaderspolicyid
            '''
            result = self._values.get("response_headers_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def smooth_streaming(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''Indicates whether you want to distribute media files in the Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.

            If so, specify ``true`` ; if not, specify ``false`` . If you specify ``true`` for ``SmoothStreaming`` , you can still distribute other content using this cache behavior if the content matches the value of ``PathPattern`` .

            :default: - false

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-smoothstreaming
            '''
            result = self._values.get("smooth_streaming")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def trusted_key_groups(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A list of key groups that CloudFront can use to validate signed URLs or signed cookies.

            When a cache behavior contains trusted key groups, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-trustedkeygroups
            '''
            result = self._values.get("trusted_key_groups")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def trusted_signers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''.. epigraph::

   We recommend using ``TrustedKeyGroups`` instead of ``TrustedSigners`` .

            A list of AWS account IDs whose public keys CloudFront can use to validate signed URLs or signed cookies.

            When a cache behavior contains trusted signers, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with the private key of a CloudFront key pair in a trusted signer's AWS account . The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see `Serving private content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-defaultcachebehavior.html#cfn-cloudfront-distribution-defaultcachebehavior-trustedsigners
            '''
            result = self._values.get("trusted_signers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "DefaultCacheBehaviorProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.DistributionConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "default_cache_behavior": "defaultCacheBehavior",
            "enabled": "enabled",
            "aliases": "aliases",
            "cache_behaviors": "cacheBehaviors",
            "cnam_es": "cnamEs",
            "comment": "comment",
            "continuous_deployment_policy_id": "continuousDeploymentPolicyId",
            "custom_error_responses": "customErrorResponses",
            "custom_origin": "customOrigin",
            "default_root_object": "defaultRootObject",
            "http_version": "httpVersion",
            "ipv6_enabled": "ipv6Enabled",
            "logging": "logging",
            "origin_groups": "originGroups",
            "origins": "origins",
            "price_class": "priceClass",
            "restrictions": "restrictions",
            "s3_origin": "s3Origin",
            "staging": "staging",
            "viewer_certificate": "viewerCertificate",
            "web_acl_id": "webAclId",
        },
    )
    class DistributionConfigProperty:
        def __init__(
            self,
            *,
            default_cache_behavior: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.DefaultCacheBehaviorProperty", typing.Dict[builtins.str, typing.Any]]],
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
            cache_behaviors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CacheBehaviorProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            cnam_es: typing.Optional[typing.Sequence[builtins.str]] = None,
            comment: typing.Optional[builtins.str] = None,
            continuous_deployment_policy_id: typing.Optional[builtins.str] = None,
            custom_error_responses: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CustomErrorResponseProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            custom_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LegacyCustomOriginProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            default_root_object: typing.Optional[builtins.str] = None,
            http_version: typing.Optional[builtins.str] = None,
            ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            logging: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LoggingProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            origin_groups: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginGroupsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            origins: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            price_class: typing.Optional[builtins.str] = None,
            restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.RestrictionsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            s3_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.LegacyS3OriginProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            staging: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            viewer_certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.ViewerCertificateProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            web_acl_id: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A distribution configuration.

            :param default_cache_behavior: A complex type that describes the default cache behavior if you don't specify a ``CacheBehavior`` element or if files don't match any of the values of ``PathPattern`` in ``CacheBehavior`` elements. You must create exactly one default cache behavior.
            :param enabled: From this field, you can enable or disable the selected distribution.
            :param aliases: A complex type that contains information about CNAMEs (alternate domain names), if any, for this distribution.
            :param cache_behaviors: A complex type that contains zero or more ``CacheBehavior`` elements.
            :param cnam_es: 
            :param comment: A comment to describe the distribution. The comment cannot be longer than 128 characters. Default: - ""
            :param continuous_deployment_policy_id: The identifier of a continuous deployment policy. For more information, see ``CreateContinuousDeploymentPolicy`` .
            :param custom_error_responses: A complex type that controls the following:. - Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer. - How long CloudFront caches HTTP status codes in the 4xx and 5xx range. For more information about custom error pages, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param custom_origin: 
            :param default_root_object: The object that you want CloudFront to request from your origin (for example, ``index.html`` ) when a viewer requests the root URL for your distribution ( ``https://www.example.com`` ) instead of an object in your distribution ( ``https://www.example.com/product-description.html`` ). Specifying a default root object avoids exposing the contents of your distribution. Specify only the object name, for example, ``index.html`` . Don't add a ``/`` before the object name. If you don't want to specify a default root object when you create a distribution, include an empty ``DefaultRootObject`` element. To delete the default root object from an existing distribution, update the distribution configuration and include an empty ``DefaultRootObject`` element. To replace the default root object, update the distribution configuration and specify the new object. For more information about the default root object, see `Creating a Default Root Object <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
            :param http_version: (Optional) Specify the maximum HTTP version(s) that you want viewers to use to communicate with CloudFront . The default value for new distributions is ``http1.1`` . For viewers and CloudFront to use HTTP/2, viewers must support TLSv1.2 or later, and must support Server Name Indication (SNI). For viewers and CloudFront to use HTTP/3, viewers must support TLSv1.3 and Server Name Indication (SNI). CloudFront supports HTTP/3 connection migration to allow the viewer to switch networks without losing connection. For more information about connection migration, see `Connection Migration <https://docs.aws.amazon.com/https://www.rfc-editor.org/rfc/rfc9000.html#name-connection-migration>`_ at RFC 9000. For more information about supported TLSv1.3 ciphers, see `Supported protocols and ciphers between viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html>`_ . Default: - "http1.1"
            :param ipv6_enabled: If you want CloudFront to respond to IPv6 DNS requests with an IPv6 address for your distribution, specify ``true`` . If you specify ``false`` , CloudFront responds to IPv6 DNS requests with the DNS response code ``NOERROR`` and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution. In general, you should enable IPv6 if you have users on IPv6 networks who want to access your content. However, if you're using signed URLs or signed cookies to restrict access to your content, and if you're using a custom policy that includes the ``IpAddress`` parameter to restrict the IP addresses that can access your content, don't enable IPv6. If you want to restrict access to some content by IP address and not restrict access to other content (or restrict access but not by IP address), you can create two distributions. For more information, see `Creating a Signed URL Using a Custom Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html>`_ in the *Amazon CloudFront Developer Guide* . If you're using an Amazon Route 53 AWS Integration alias resource record set to route traffic to your CloudFront distribution, you need to create a second alias resource record set when both of the following are true: - You enable IPv6 for the distribution - You're using alternate domain names in the URLs for your objects For more information, see `Routing Traffic to an Amazon CloudFront Web Distribution by Using Your Domain Name <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html>`_ in the *Amazon Route 53 AWS Integration Developer Guide* . If you created a CNAME resource record set, either with Amazon Route 53 AWS Integration or with another DNS service, you don't need to make any changes. A CNAME record will route traffic to your distribution regardless of the IP address format of the viewer request.
            :param logging: A complex type that controls whether access logs are written for the distribution. For more information about logging, see `Access Logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param origin_groups: A complex type that contains information about origin groups for this distribution.
            :param origins: A complex type that contains information about origins for this distribution.
            :param price_class: The price class that corresponds with the maximum price that you want to pay for CloudFront service. If you specify ``PriceClass_All`` , CloudFront responds to requests for your objects from all CloudFront edge locations. If you specify a price class other than ``PriceClass_All`` , CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class. Viewers who are in or near regions that are excluded from your specified price class may encounter slower performance. For more information about price classes, see `Choosing the Price Class for a CloudFront Distribution <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PriceClass.html>`_ in the *Amazon CloudFront Developer Guide* . For information about CloudFront pricing, including how price classes (such as Price Class 100) map to CloudFront regions, see `Amazon CloudFront Pricing <https://docs.aws.amazon.com/cloudfront/pricing/>`_ . Default: - "PriceClass_All"
            :param restrictions: A complex type that identifies ways in which you want to restrict distribution of your content.
            :param s3_origin: 
            :param staging: A Boolean that indicates whether this is a staging distribution. When this value is ``true`` , this is a staging distribution. When this value is ``false`` , this is not a staging distribution.
            :param viewer_certificate: A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.
            :param web_acl_id: A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution. To specify a web ACL created using the latest version of AWS WAF , use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`` . To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a`` . AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to CloudFront, and lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront responds to requests either with the requested content or with an HTTP 403 status code (Forbidden). You can also configure CloudFront to return a custom error page when a request is blocked. For more information about AWS WAF , see the `AWS WAF Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html>`_ . Default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                distribution_config_property = cloudfront.CfnDistribution.DistributionConfigProperty(
                    default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
                        target_origin_id="targetOriginId",
                        viewer_protocol_policy="viewerProtocolPolicy",
                
                        # the properties below are optional
                        allowed_methods=["allowedMethods"],
                        cached_methods=["cachedMethods"],
                        cache_policy_id="cachePolicyId",
                        compress=False,
                        default_ttl=123,
                        field_level_encryption_id="fieldLevelEncryptionId",
                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                            query_string=False,
                
                            # the properties below are optional
                            cookies=cloudfront.CfnDistribution.CookiesProperty(
                                forward="forward",
                
                                # the properties below are optional
                                whitelisted_names=["whitelistedNames"]
                            ),
                            headers=["headers"],
                            query_string_cache_keys=["queryStringCacheKeys"]
                        ),
                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                            event_type="eventType",
                            function_arn="functionArn"
                        )],
                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                            event_type="eventType",
                            include_body=False,
                            lambda_function_arn="lambdaFunctionArn"
                        )],
                        max_ttl=123,
                        min_ttl=123,
                        origin_request_policy_id="originRequestPolicyId",
                        realtime_log_config_arn="realtimeLogConfigArn",
                        response_headers_policy_id="responseHeadersPolicyId",
                        smooth_streaming=False,
                        trusted_key_groups=["trustedKeyGroups"],
                        trusted_signers=["trustedSigners"]
                    ),
                    enabled=False,
                
                    # the properties below are optional
                    aliases=["aliases"],
                    cache_behaviors=[cloudfront.CfnDistribution.CacheBehaviorProperty(
                        path_pattern="pathPattern",
                        target_origin_id="targetOriginId",
                        viewer_protocol_policy="viewerProtocolPolicy",
                
                        # the properties below are optional
                        allowed_methods=["allowedMethods"],
                        cached_methods=["cachedMethods"],
                        cache_policy_id="cachePolicyId",
                        compress=False,
                        default_ttl=123,
                        field_level_encryption_id="fieldLevelEncryptionId",
                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                            query_string=False,
                
                            # the properties below are optional
                            cookies=cloudfront.CfnDistribution.CookiesProperty(
                                forward="forward",
                
                                # the properties below are optional
                                whitelisted_names=["whitelistedNames"]
                            ),
                            headers=["headers"],
                            query_string_cache_keys=["queryStringCacheKeys"]
                        ),
                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                            event_type="eventType",
                            function_arn="functionArn"
                        )],
                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                            event_type="eventType",
                            include_body=False,
                            lambda_function_arn="lambdaFunctionArn"
                        )],
                        max_ttl=123,
                        min_ttl=123,
                        origin_request_policy_id="originRequestPolicyId",
                        realtime_log_config_arn="realtimeLogConfigArn",
                        response_headers_policy_id="responseHeadersPolicyId",
                        smooth_streaming=False,
                        trusted_key_groups=["trustedKeyGroups"],
                        trusted_signers=["trustedSigners"]
                    )],
                    cnam_es=["cnamEs"],
                    comment="comment",
                    continuous_deployment_policy_id="continuousDeploymentPolicyId",
                    custom_error_responses=[cloudfront.CfnDistribution.CustomErrorResponseProperty(
                        error_code=123,
                
                        # the properties below are optional
                        error_caching_min_ttl=123,
                        response_code=123,
                        response_page_path="responsePagePath"
                    )],
                    custom_origin=cloudfront.CfnDistribution.LegacyCustomOriginProperty(
                        dns_name="dnsName",
                        origin_protocol_policy="originProtocolPolicy",
                        origin_ssl_protocols=["originSslProtocols"],
                
                        # the properties below are optional
                        http_port=123,
                        https_port=123
                    ),
                    default_root_object="defaultRootObject",
                    http_version="httpVersion",
                    ipv6_enabled=False,
                    logging=cloudfront.CfnDistribution.LoggingProperty(
                        bucket="bucket",
                
                        # the properties below are optional
                        include_cookies=False,
                        prefix="prefix"
                    ),
                    origin_groups=cloudfront.CfnDistribution.OriginGroupsProperty(
                        quantity=123,
                
                        # the properties below are optional
                        items=[cloudfront.CfnDistribution.OriginGroupProperty(
                            failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
                                status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
                                    items=[123],
                                    quantity=123
                                )
                            ),
                            id="id",
                            members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
                                items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
                                    origin_id="originId"
                                )],
                                quantity=123
                            )
                        )]
                    ),
                    origins=[cloudfront.CfnDistribution.OriginProperty(
                        domain_name="domainName",
                        id="id",
                
                        # the properties below are optional
                        connection_attempts=123,
                        connection_timeout=123,
                        custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
                            origin_protocol_policy="originProtocolPolicy",
                
                            # the properties below are optional
                            http_port=123,
                            https_port=123,
                            origin_keepalive_timeout=123,
                            origin_read_timeout=123,
                            origin_ssl_protocols=["originSslProtocols"]
                        ),
                        origin_access_control_id="originAccessControlId",
                        origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
                            header_name="headerName",
                            header_value="headerValue"
                        )],
                        origin_path="originPath",
                        origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
                            enabled=False,
                            origin_shield_region="originShieldRegion"
                        ),
                        s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
                            origin_access_identity="originAccessIdentity"
                        )
                    )],
                    price_class="priceClass",
                    restrictions=cloudfront.CfnDistribution.RestrictionsProperty(
                        geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
                            restriction_type="restrictionType",
                
                            # the properties below are optional
                            locations=["locations"]
                        )
                    ),
                    s3_origin=cloudfront.CfnDistribution.LegacyS3OriginProperty(
                        dns_name="dnsName",
                
                        # the properties below are optional
                        origin_access_identity="originAccessIdentity"
                    ),
                    staging=False,
                    viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty(
                        acm_certificate_arn="acmCertificateArn",
                        cloud_front_default_certificate=False,
                        iam_certificate_id="iamCertificateId",
                        minimum_protocol_version="minimumProtocolVersion",
                        ssl_support_method="sslSupportMethod"
                    ),
                    web_acl_id="webAclId"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__924aa31797d5562075c15043a82632c8afbc217d476fdf805d7efea103da3360)
                check_type(argname="argument default_cache_behavior", value=default_cache_behavior, expected_type=type_hints["default_cache_behavior"])
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument aliases", value=aliases, expected_type=type_hints["aliases"])
                check_type(argname="argument cache_behaviors", value=cache_behaviors, expected_type=type_hints["cache_behaviors"])
                check_type(argname="argument cnam_es", value=cnam_es, expected_type=type_hints["cnam_es"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
                check_type(argname="argument continuous_deployment_policy_id", value=continuous_deployment_policy_id, expected_type=type_hints["continuous_deployment_policy_id"])
                check_type(argname="argument custom_error_responses", value=custom_error_responses, expected_type=type_hints["custom_error_responses"])
                check_type(argname="argument custom_origin", value=custom_origin, expected_type=type_hints["custom_origin"])
                check_type(argname="argument default_root_object", value=default_root_object, expected_type=type_hints["default_root_object"])
                check_type(argname="argument http_version", value=http_version, expected_type=type_hints["http_version"])
                check_type(argname="argument ipv6_enabled", value=ipv6_enabled, expected_type=type_hints["ipv6_enabled"])
                check_type(argname="argument logging", value=logging, expected_type=type_hints["logging"])
                check_type(argname="argument origin_groups", value=origin_groups, expected_type=type_hints["origin_groups"])
                check_type(argname="argument origins", value=origins, expected_type=type_hints["origins"])
                check_type(argname="argument price_class", value=price_class, expected_type=type_hints["price_class"])
                check_type(argname="argument restrictions", value=restrictions, expected_type=type_hints["restrictions"])
                check_type(argname="argument s3_origin", value=s3_origin, expected_type=type_hints["s3_origin"])
                check_type(argname="argument staging", value=staging, expected_type=type_hints["staging"])
                check_type(argname="argument viewer_certificate", value=viewer_certificate, expected_type=type_hints["viewer_certificate"])
                check_type(argname="argument web_acl_id", value=web_acl_id, expected_type=type_hints["web_acl_id"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "default_cache_behavior": default_cache_behavior,
                "enabled": enabled,
            }
            if aliases is not None:
                self._values["aliases"] = aliases
            if cache_behaviors is not None:
                self._values["cache_behaviors"] = cache_behaviors
            if cnam_es is not None:
                self._values["cnam_es"] = cnam_es
            if comment is not None:
                self._values["comment"] = comment
            if continuous_deployment_policy_id is not None:
                self._values["continuous_deployment_policy_id"] = continuous_deployment_policy_id
            if custom_error_responses is not None:
                self._values["custom_error_responses"] = custom_error_responses
            if custom_origin is not None:
                self._values["custom_origin"] = custom_origin
            if default_root_object is not None:
                self._values["default_root_object"] = default_root_object
            if http_version is not None:
                self._values["http_version"] = http_version
            if ipv6_enabled is not None:
                self._values["ipv6_enabled"] = ipv6_enabled
            if logging is not None:
                self._values["logging"] = logging
            if origin_groups is not None:
                self._values["origin_groups"] = origin_groups
            if origins is not None:
                self._values["origins"] = origins
            if price_class is not None:
                self._values["price_class"] = price_class
            if restrictions is not None:
                self._values["restrictions"] = restrictions
            if s3_origin is not None:
                self._values["s3_origin"] = s3_origin
            if staging is not None:
                self._values["staging"] = staging
            if viewer_certificate is not None:
                self._values["viewer_certificate"] = viewer_certificate
            if web_acl_id is not None:
                self._values["web_acl_id"] = web_acl_id

        @builtins.property
        def default_cache_behavior(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.DefaultCacheBehaviorProperty"]:
            '''A complex type that describes the default cache behavior if you don't specify a ``CacheBehavior`` element or if files don't match any of the values of ``PathPattern`` in ``CacheBehavior`` elements.

            You must create exactly one default cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-defaultcachebehavior
            '''
            result = self._values.get("default_cache_behavior")
            assert result is not None, "Required property 'default_cache_behavior' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.DefaultCacheBehaviorProperty"], result)

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''From this field, you can enable or disable the selected distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def aliases(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that contains information about CNAMEs (alternate domain names), if any, for this distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-aliases
            '''
            result = self._values.get("aliases")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def cache_behaviors(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CacheBehaviorProperty"]]]]:
            '''A complex type that contains zero or more ``CacheBehavior`` elements.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-cachebehaviors
            '''
            result = self._values.get("cache_behaviors")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CacheBehaviorProperty"]]]], result)

        @builtins.property
        def cnam_es(self) -> typing.Optional[typing.List[builtins.str]]:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-cnames
            '''
            result = self._values.get("cnam_es")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the distribution.

            The comment cannot be longer than 128 characters.

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def continuous_deployment_policy_id(self) -> typing.Optional[builtins.str]:
            '''The identifier of a continuous deployment policy.

            For more information, see ``CreateContinuousDeploymentPolicy`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-continuousdeploymentpolicyid
            '''
            result = self._values.get("continuous_deployment_policy_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def custom_error_responses(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CustomErrorResponseProperty"]]]]:
            '''A complex type that controls the following:.

            - Whether CloudFront replaces HTTP status codes in the 4xx and 5xx range with custom error messages before returning the response to the viewer.
            - How long CloudFront caches HTTP status codes in the 4xx and 5xx range.

            For more information about custom error pages, see `Customizing Error Responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/custom-error-pages.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-customerrorresponses
            '''
            result = self._values.get("custom_error_responses")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CustomErrorResponseProperty"]]]], result)

        @builtins.property
        def custom_origin(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LegacyCustomOriginProperty"]]:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-customorigin
            '''
            result = self._values.get("custom_origin")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LegacyCustomOriginProperty"]], result)

        @builtins.property
        def default_root_object(self) -> typing.Optional[builtins.str]:
            '''The object that you want CloudFront to request from your origin (for example, ``index.html`` ) when a viewer requests the root URL for your distribution ( ``https://www.example.com`` ) instead of an object in your distribution ( ``https://www.example.com/product-description.html`` ). Specifying a default root object avoids exposing the contents of your distribution.

            Specify only the object name, for example, ``index.html`` . Don't add a ``/`` before the object name.

            If you don't want to specify a default root object when you create a distribution, include an empty ``DefaultRootObject`` element.

            To delete the default root object from an existing distribution, update the distribution configuration and include an empty ``DefaultRootObject`` element.

            To replace the default root object, update the distribution configuration and specify the new object.

            For more information about the default root object, see `Creating a Default Root Object <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DefaultRootObject.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-defaultrootobject
            '''
            result = self._values.get("default_root_object")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def http_version(self) -> typing.Optional[builtins.str]:
            '''(Optional) Specify the maximum HTTP version(s) that you want viewers to use to communicate with CloudFront .

            The default value for new distributions is ``http1.1`` .

            For viewers and CloudFront to use HTTP/2, viewers must support TLSv1.2 or later, and must support Server Name Indication (SNI).

            For viewers and CloudFront to use HTTP/3, viewers must support TLSv1.3 and Server Name Indication (SNI). CloudFront supports HTTP/3 connection migration to allow the viewer to switch networks without losing connection. For more information about connection migration, see `Connection Migration <https://docs.aws.amazon.com/https://www.rfc-editor.org/rfc/rfc9000.html#name-connection-migration>`_ at RFC 9000. For more information about supported TLSv1.3 ciphers, see `Supported protocols and ciphers between viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html>`_ .

            :default: - "http1.1"

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-httpversion
            '''
            result = self._values.get("http_version")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def ipv6_enabled(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''If you want CloudFront to respond to IPv6 DNS requests with an IPv6 address for your distribution, specify ``true`` .

            If you specify ``false`` , CloudFront responds to IPv6 DNS requests with the DNS response code ``NOERROR`` and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution.

            In general, you should enable IPv6 if you have users on IPv6 networks who want to access your content. However, if you're using signed URLs or signed cookies to restrict access to your content, and if you're using a custom policy that includes the ``IpAddress`` parameter to restrict the IP addresses that can access your content, don't enable IPv6. If you want to restrict access to some content by IP address and not restrict access to other content (or restrict access but not by IP address), you can create two distributions. For more information, see `Creating a Signed URL Using a Custom Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-creating-signed-url-custom-policy.html>`_ in the *Amazon CloudFront Developer Guide* .

            If you're using an Amazon Route 53 AWS Integration alias resource record set to route traffic to your CloudFront distribution, you need to create a second alias resource record set when both of the following are true:

            - You enable IPv6 for the distribution
            - You're using alternate domain names in the URLs for your objects

            For more information, see `Routing Traffic to an Amazon CloudFront Web Distribution by Using Your Domain Name <https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-to-cloudfront-distribution.html>`_ in the *Amazon Route 53 AWS Integration Developer Guide* .

            If you created a CNAME resource record set, either with Amazon Route 53 AWS Integration or with another DNS service, you don't need to make any changes. A CNAME record will route traffic to your distribution regardless of the IP address format of the viewer request.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-ipv6enabled
            '''
            result = self._values.get("ipv6_enabled")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def logging(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LoggingProperty"]]:
            '''A complex type that controls whether access logs are written for the distribution.

            For more information about logging, see `Access Logs <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-logging
            '''
            result = self._values.get("logging")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LoggingProperty"]], result)

        @builtins.property
        def origin_groups(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupsProperty"]]:
            '''A complex type that contains information about origin groups for this distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-origingroups
            '''
            result = self._values.get("origin_groups")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupsProperty"]], result)

        @builtins.property
        def origins(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginProperty"]]]]:
            '''A complex type that contains information about origins for this distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-origins
            '''
            result = self._values.get("origins")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginProperty"]]]], result)

        @builtins.property
        def price_class(self) -> typing.Optional[builtins.str]:
            '''The price class that corresponds with the maximum price that you want to pay for CloudFront service.

            If you specify ``PriceClass_All`` , CloudFront responds to requests for your objects from all CloudFront edge locations.

            If you specify a price class other than ``PriceClass_All`` , CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class. Viewers who are in or near regions that are excluded from your specified price class may encounter slower performance.

            For more information about price classes, see `Choosing the Price Class for a CloudFront Distribution <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PriceClass.html>`_ in the *Amazon CloudFront Developer Guide* . For information about CloudFront pricing, including how price classes (such as Price Class 100) map to CloudFront regions, see `Amazon CloudFront Pricing <https://docs.aws.amazon.com/cloudfront/pricing/>`_ .

            :default: - "PriceClass_All"

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-priceclass
            '''
            result = self._values.get("price_class")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def restrictions(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.RestrictionsProperty"]]:
            '''A complex type that identifies ways in which you want to restrict distribution of your content.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions
            '''
            result = self._values.get("restrictions")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.RestrictionsProperty"]], result)

        @builtins.property
        def s3_origin(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LegacyS3OriginProperty"]]:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-s3origin
            '''
            result = self._values.get("s3_origin")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.LegacyS3OriginProperty"]], result)

        @builtins.property
        def staging(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A Boolean that indicates whether this is a staging distribution.

            When this value is ``true`` , this is a staging distribution. When this value is ``false`` , this is not a staging distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-staging
            '''
            result = self._values.get("staging")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def viewer_certificate(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ViewerCertificateProperty"]]:
            '''A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-viewercertificate
            '''
            result = self._values.get("viewer_certificate")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.ViewerCertificateProperty"]], result)

        @builtins.property
        def web_acl_id(self) -> typing.Optional[builtins.str]:
            '''A unique identifier that specifies the AWS WAF web ACL, if any, to associate with this distribution.

            To specify a web ACL created using the latest version of AWS WAF , use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a`` . To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a`` .

            AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to CloudFront, and lets you control access to your content. Based on conditions that you specify, such as the IP addresses that requests originate from or the values of query strings, CloudFront responds to requests either with the requested content or with an HTTP 403 status code (Forbidden). You can also configure CloudFront to return a custom error page when a request is blocked. For more information about AWS WAF , see the `AWS WAF Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html>`_ .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-webaclid
            '''
            result = self._values.get("web_acl_id")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "DistributionConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.ForwardedValuesProperty",
        jsii_struct_bases=[],
        name_mapping={
            "query_string": "queryString",
            "cookies": "cookies",
            "headers": "headers",
            "query_string_cache_keys": "queryStringCacheKeys",
        },
    )
    class ForwardedValuesProperty:
        def __init__(
            self,
            *,
            query_string: typing.Union[builtins.bool, _IResolvable_da3f097b],
            cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CookiesProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            headers: typing.Optional[typing.Sequence[builtins.str]] = None,
            query_string_cache_keys: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include values in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send values to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            A complex type that specifies how CloudFront handles query strings, cookies, and HTTP headers.

            :param query_string: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include query strings in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior and cache based on the query string parameters. CloudFront behavior depends on the value of ``QueryString`` and on the values that you specify for ``QueryStringCacheKeys`` , if any: If you specify true for ``QueryString`` and you don't specify any values for ``QueryStringCacheKeys`` , CloudFront forwards all query string parameters to the origin and caches based on all query string parameters. Depending on how many query string parameters and values you have, this can adversely affect performance because CloudFront must forward more requests to the origin. If you specify true for ``QueryString`` and you specify one or more values for ``QueryStringCacheKeys`` , CloudFront forwards all query string parameters to the origin, but it only caches based on the query string parameters that you specify. If you specify false for ``QueryString`` , CloudFront doesn't forward any query string parameters to the origin, and doesn't cache based on query string parameters. For more information, see `Configuring CloudFront to Cache Based on Query String Parameters <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/QueryStringParameters.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param cookies: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . A complex type that specifies whether you want CloudFront to forward cookies to the origin and, if so, which ones. For more information about forwarding cookies to the origin, see `How CloudFront Forwards, Caches, and Logs Cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param headers: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include headers in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send headers to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . A complex type that specifies the ``Headers`` , if any, that you want CloudFront to forward to the origin for this cache behavior (whitelisted headers). For the headers that you specify, CloudFront also caches separate versions of a specified object that is based on the header values in viewer requests. For more information, see `Caching Content Based on Request Headers <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param query_string_cache_keys: This field is deprecated. We recommend that you use a cache policy or an origin request policy instead of this field. If you want to include query strings in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* . If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* . A complex type that contains information about the query string parameters that you want CloudFront to use for caching for this cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                forwarded_values_property = cloudfront.CfnDistribution.ForwardedValuesProperty(
                    query_string=False,
                
                    # the properties below are optional
                    cookies=cloudfront.CfnDistribution.CookiesProperty(
                        forward="forward",
                
                        # the properties below are optional
                        whitelisted_names=["whitelistedNames"]
                    ),
                    headers=["headers"],
                    query_string_cache_keys=["queryStringCacheKeys"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__829a3114025a8daee956dbcc0afa807f920ef6f096374b00826b1646ad863c3e)
                check_type(argname="argument query_string", value=query_string, expected_type=type_hints["query_string"])
                check_type(argname="argument cookies", value=cookies, expected_type=type_hints["cookies"])
                check_type(argname="argument headers", value=headers, expected_type=type_hints["headers"])
                check_type(argname="argument query_string_cache_keys", value=query_string_cache_keys, expected_type=type_hints["query_string_cache_keys"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "query_string": query_string,
            }
            if cookies is not None:
                self._values["cookies"] = cookies
            if headers is not None:
                self._values["headers"] = headers
            if query_string_cache_keys is not None:
                self._values["query_string_cache_keys"] = query_string_cache_keys

        @builtins.property
        def query_string(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include query strings in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior and cache based on the query string parameters. CloudFront behavior depends on the value of ``QueryString`` and on the values that you specify for ``QueryStringCacheKeys`` , if any:

            If you specify true for ``QueryString`` and you don't specify any values for ``QueryStringCacheKeys`` , CloudFront forwards all query string parameters to the origin and caches based on all query string parameters. Depending on how many query string parameters and values you have, this can adversely affect performance because CloudFront must forward more requests to the origin.

            If you specify true for ``QueryString`` and you specify one or more values for ``QueryStringCacheKeys`` , CloudFront forwards all query string parameters to the origin, but it only caches based on the query string parameters that you specify.

            If you specify false for ``QueryString`` , CloudFront doesn't forward any query string parameters to the origin, and doesn't cache based on query string parameters.

            For more information, see `Configuring CloudFront to Cache Based on Query String Parameters <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/QueryStringParameters.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html#cfn-cloudfront-distribution-forwardedvalues-querystring
            '''
            result = self._values.get("query_string")
            assert result is not None, "Required property 'query_string' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def cookies(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CookiesProperty"]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include cookies in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send cookies to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            A complex type that specifies whether you want CloudFront to forward cookies to the origin and, if so, which ones. For more information about forwarding cookies to the origin, see `How CloudFront Forwards, Caches, and Logs Cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html#cfn-cloudfront-distribution-forwardedvalues-cookies
            '''
            result = self._values.get("cookies")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CookiesProperty"]], result)

        @builtins.property
        def headers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include headers in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send headers to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            A complex type that specifies the ``Headers`` , if any, that you want CloudFront to forward to the origin for this cache behavior (whitelisted headers). For the headers that you specify, CloudFront also caches separate versions of a specified object that is based on the header values in viewer requests.

            For more information, see `Caching Content Based on Request Headers <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/header-caching.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html#cfn-cloudfront-distribution-forwardedvalues-headers
            '''
            result = self._values.get("headers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def query_string_cache_keys(self) -> typing.Optional[typing.List[builtins.str]]:
            '''This field is deprecated.

            We recommend that you use a cache policy or an origin request policy instead of this field.

            If you want to include query strings in the cache key, use a cache policy. For more information, see `Creating cache policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html#cache-key-create-cache-policy>`_ in the *Amazon CloudFront Developer Guide* .

            If you want to send query strings to the origin but not include them in the cache key, use an origin request policy. For more information, see `Creating origin request policies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-origin-requests.html#origin-request-create-origin-request-policy>`_ in the *Amazon CloudFront Developer Guide* .

            A complex type that contains information about the query string parameters that you want CloudFront to use for caching for this cache behavior.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-forwardedvalues.html#cfn-cloudfront-distribution-forwardedvalues-querystringcachekeys
            '''
            result = self._values.get("query_string_cache_keys")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ForwardedValuesProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.FunctionAssociationProperty",
        jsii_struct_bases=[],
        name_mapping={"event_type": "eventType", "function_arn": "functionArn"},
    )
    class FunctionAssociationProperty:
        def __init__(
            self,
            *,
            event_type: typing.Optional[builtins.str] = None,
            function_arn: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A CloudFront function that is associated with a cache behavior in a CloudFront distribution.

            :param event_type: The event type of the function, either ``viewer-request`` or ``viewer-response`` . You cannot use origin-facing event types ( ``origin-request`` and ``origin-response`` ) with a CloudFront function.
            :param function_arn: The Amazon Resource Name (ARN) of the function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-functionassociation.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                function_association_property = cloudfront.CfnDistribution.FunctionAssociationProperty(
                    event_type="eventType",
                    function_arn="functionArn"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__9bbc3ed014a608917a180d2a9867ec9646bbd29af02fa61a3a829f7b27e15e81)
                check_type(argname="argument event_type", value=event_type, expected_type=type_hints["event_type"])
                check_type(argname="argument function_arn", value=function_arn, expected_type=type_hints["function_arn"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if event_type is not None:
                self._values["event_type"] = event_type
            if function_arn is not None:
                self._values["function_arn"] = function_arn

        @builtins.property
        def event_type(self) -> typing.Optional[builtins.str]:
            '''The event type of the function, either ``viewer-request`` or ``viewer-response`` .

            You cannot use origin-facing event types ( ``origin-request`` and ``origin-response`` ) with a CloudFront function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-functionassociation.html#cfn-cloudfront-distribution-functionassociation-eventtype
            '''
            result = self._values.get("event_type")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def function_arn(self) -> typing.Optional[builtins.str]:
            '''The Amazon Resource Name (ARN) of the function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-functionassociation.html#cfn-cloudfront-distribution-functionassociation-functionarn
            '''
            result = self._values.get("function_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "FunctionAssociationProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.GeoRestrictionProperty",
        jsii_struct_bases=[],
        name_mapping={"restriction_type": "restrictionType", "locations": "locations"},
    )
    class GeoRestrictionProperty:
        def __init__(
            self,
            *,
            restriction_type: builtins.str,
            locations: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''A complex type that controls the countries in which your content is distributed.

            CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.

            :param restriction_type: The method that you want to use to restrict distribution of your content by country:. - ``none`` : No geo restriction is enabled, meaning access to content is not restricted by client geo location. - ``blacklist`` : The ``Location`` elements specify the countries in which you don't want CloudFront to distribute your content. - ``whitelist`` : The ``Location`` elements specify the countries in which you want CloudFront to distribute your content.
            :param locations: A complex type that contains a ``Location`` element for each country in which you want CloudFront either to distribute your content ( ``whitelist`` ) or not distribute your content ( ``blacklist`` ). The ``Location`` element is a two-letter, uppercase country code for a country that you want to include in your ``blacklist`` or ``whitelist`` . Include one ``Location`` element for each country. CloudFront and ``MaxMind`` both use ``ISO 3166`` country codes. For the current list of countries and the corresponding codes, see ``ISO 3166-1-alpha-2`` code on the *International Organization for Standardization* website. You can also refer to the country list on the CloudFront console, which includes both country names and codes.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-georestriction.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                geo_restriction_property = cloudfront.CfnDistribution.GeoRestrictionProperty(
                    restriction_type="restrictionType",
                
                    # the properties below are optional
                    locations=["locations"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__95bd46ae407889173be5aed0249979fa29060c3f563d398aac36961967e9ce36)
                check_type(argname="argument restriction_type", value=restriction_type, expected_type=type_hints["restriction_type"])
                check_type(argname="argument locations", value=locations, expected_type=type_hints["locations"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "restriction_type": restriction_type,
            }
            if locations is not None:
                self._values["locations"] = locations

        @builtins.property
        def restriction_type(self) -> builtins.str:
            '''The method that you want to use to restrict distribution of your content by country:.

            - ``none`` : No geo restriction is enabled, meaning access to content is not restricted by client geo location.
            - ``blacklist`` : The ``Location`` elements specify the countries in which you don't want CloudFront to distribute your content.
            - ``whitelist`` : The ``Location`` elements specify the countries in which you want CloudFront to distribute your content.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-georestriction.html#cfn-cloudfront-distribution-georestriction-restrictiontype
            '''
            result = self._values.get("restriction_type")
            assert result is not None, "Required property 'restriction_type' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def locations(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that contains a ``Location`` element for each country in which you want CloudFront either to distribute your content ( ``whitelist`` ) or not distribute your content ( ``blacklist`` ).

            The ``Location`` element is a two-letter, uppercase country code for a country that you want to include in your ``blacklist`` or ``whitelist`` . Include one ``Location`` element for each country.

            CloudFront and ``MaxMind`` both use ``ISO 3166`` country codes. For the current list of countries and the corresponding codes, see ``ISO 3166-1-alpha-2`` code on the *International Organization for Standardization* website. You can also refer to the country list on the CloudFront console, which includes both country names and codes.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-georestriction.html#cfn-cloudfront-distribution-georestriction-locations
            '''
            result = self._values.get("locations")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "GeoRestrictionProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.LambdaFunctionAssociationProperty",
        jsii_struct_bases=[],
        name_mapping={
            "event_type": "eventType",
            "include_body": "includeBody",
            "lambda_function_arn": "lambdaFunctionArn",
        },
    )
    class LambdaFunctionAssociationProperty:
        def __init__(
            self,
            *,
            event_type: typing.Optional[builtins.str] = None,
            include_body: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            lambda_function_arn: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A complex type that contains a Lambda@Edge function association.

            :param event_type: Specifies the event type that triggers a Lambda@Edge function invocation. You can specify the following values:. - ``viewer-request`` : The function executes when CloudFront receives a request from a viewer and before it checks to see whether the requested object is in the edge cache. - ``origin-request`` : The function executes only when CloudFront sends a request to your origin. When the requested object is in the edge cache, the function doesn't execute. - ``origin-response`` : The function executes after CloudFront receives a response from the origin and before it caches the object in the response. When the requested object is in the edge cache, the function doesn't execute. - ``viewer-response`` : The function executes before CloudFront returns the requested object to the viewer. The function executes regardless of whether the object was already in the edge cache. If the origin returns an HTTP status code other than HTTP 200 (OK), the function doesn't execute.
            :param include_body: A flag that allows a Lambda@Edge function to have read access to the body content. For more information, see `Accessing the Request Body by Choosing the Include Body Option <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html>`_ in the Amazon CloudFront Developer Guide.
            :param lambda_function_arn: The ARN of the Lambda@Edge function. You must specify the ARN of a function version; you can't specify an alias or $LATEST.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-lambdafunctionassociation.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                lambda_function_association_property = cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                    event_type="eventType",
                    include_body=False,
                    lambda_function_arn="lambdaFunctionArn"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e6f5cc34036eacd4d5965f3264d177a65ea02e95ec0abf14ad79fd49e7743885)
                check_type(argname="argument event_type", value=event_type, expected_type=type_hints["event_type"])
                check_type(argname="argument include_body", value=include_body, expected_type=type_hints["include_body"])
                check_type(argname="argument lambda_function_arn", value=lambda_function_arn, expected_type=type_hints["lambda_function_arn"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if event_type is not None:
                self._values["event_type"] = event_type
            if include_body is not None:
                self._values["include_body"] = include_body
            if lambda_function_arn is not None:
                self._values["lambda_function_arn"] = lambda_function_arn

        @builtins.property
        def event_type(self) -> typing.Optional[builtins.str]:
            '''Specifies the event type that triggers a Lambda@Edge function invocation. You can specify the following values:.

            - ``viewer-request`` : The function executes when CloudFront receives a request from a viewer and before it checks to see whether the requested object is in the edge cache.
            - ``origin-request`` : The function executes only when CloudFront sends a request to your origin. When the requested object is in the edge cache, the function doesn't execute.
            - ``origin-response`` : The function executes after CloudFront receives a response from the origin and before it caches the object in the response. When the requested object is in the edge cache, the function doesn't execute.
            - ``viewer-response`` : The function executes before CloudFront returns the requested object to the viewer. The function executes regardless of whether the object was already in the edge cache.

            If the origin returns an HTTP status code other than HTTP 200 (OK), the function doesn't execute.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-lambdafunctionassociation.html#cfn-cloudfront-distribution-lambdafunctionassociation-eventtype
            '''
            result = self._values.get("event_type")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def include_body(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A flag that allows a Lambda@Edge function to have read access to the body content.

            For more information, see `Accessing the Request Body by Choosing the Include Body Option <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html>`_ in the Amazon CloudFront Developer Guide.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-lambdafunctionassociation.html#cfn-cloudfront-distribution-lambdafunctionassociation-includebody
            '''
            result = self._values.get("include_body")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def lambda_function_arn(self) -> typing.Optional[builtins.str]:
            '''The ARN of the Lambda@Edge function.

            You must specify the ARN of a function version; you can't specify an alias or $LATEST.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-lambdafunctionassociation.html#cfn-cloudfront-distribution-lambdafunctionassociation-lambdafunctionarn
            '''
            result = self._values.get("lambda_function_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "LambdaFunctionAssociationProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.LegacyCustomOriginProperty",
        jsii_struct_bases=[],
        name_mapping={
            "dns_name": "dnsName",
            "origin_protocol_policy": "originProtocolPolicy",
            "origin_ssl_protocols": "originSslProtocols",
            "http_port": "httpPort",
            "https_port": "httpsPort",
        },
    )
    class LegacyCustomOriginProperty:
        def __init__(
            self,
            *,
            dns_name: builtins.str,
            origin_protocol_policy: builtins.str,
            origin_ssl_protocols: typing.Sequence[builtins.str],
            http_port: typing.Optional[jsii.Number] = None,
            https_port: typing.Optional[jsii.Number] = None,
        ) -> None:
            '''
            :param dns_name: 
            :param origin_protocol_policy: 
            :param origin_ssl_protocols: 
            :param http_port: Default: - 80
            :param https_port: Default: - 443

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                legacy_custom_origin_property = cloudfront.CfnDistribution.LegacyCustomOriginProperty(
                    dns_name="dnsName",
                    origin_protocol_policy="originProtocolPolicy",
                    origin_ssl_protocols=["originSslProtocols"],
                
                    # the properties below are optional
                    http_port=123,
                    https_port=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__61d8581e13d95eb21648e21c4a5ac7785469e1c5145e441295fae6aaaa4023c4)
                check_type(argname="argument dns_name", value=dns_name, expected_type=type_hints["dns_name"])
                check_type(argname="argument origin_protocol_policy", value=origin_protocol_policy, expected_type=type_hints["origin_protocol_policy"])
                check_type(argname="argument origin_ssl_protocols", value=origin_ssl_protocols, expected_type=type_hints["origin_ssl_protocols"])
                check_type(argname="argument http_port", value=http_port, expected_type=type_hints["http_port"])
                check_type(argname="argument https_port", value=https_port, expected_type=type_hints["https_port"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "dns_name": dns_name,
                "origin_protocol_policy": origin_protocol_policy,
                "origin_ssl_protocols": origin_ssl_protocols,
            }
            if http_port is not None:
                self._values["http_port"] = http_port
            if https_port is not None:
                self._values["https_port"] = https_port

        @builtins.property
        def dns_name(self) -> builtins.str:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html#cfn-cloudfront-distribution-legacycustomorigin-dnsname
            '''
            result = self._values.get("dns_name")
            assert result is not None, "Required property 'dns_name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def origin_protocol_policy(self) -> builtins.str:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html#cfn-cloudfront-distribution-legacycustomorigin-originprotocolpolicy
            '''
            result = self._values.get("origin_protocol_policy")
            assert result is not None, "Required property 'origin_protocol_policy' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def origin_ssl_protocols(self) -> typing.List[builtins.str]:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html#cfn-cloudfront-distribution-legacycustomorigin-originsslprotocols
            '''
            result = self._values.get("origin_ssl_protocols")
            assert result is not None, "Required property 'origin_ssl_protocols' is missing"
            return typing.cast(typing.List[builtins.str], result)

        @builtins.property
        def http_port(self) -> typing.Optional[jsii.Number]:
            '''
            :default: - 80

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html#cfn-cloudfront-distribution-legacycustomorigin-httpport
            '''
            result = self._values.get("http_port")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def https_port(self) -> typing.Optional[jsii.Number]:
            '''
            :default: - 443

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacycustomorigin.html#cfn-cloudfront-distribution-legacycustomorigin-httpsport
            '''
            result = self._values.get("https_port")
            return typing.cast(typing.Optional[jsii.Number], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "LegacyCustomOriginProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.LegacyS3OriginProperty",
        jsii_struct_bases=[],
        name_mapping={
            "dns_name": "dnsName",
            "origin_access_identity": "originAccessIdentity",
        },
    )
    class LegacyS3OriginProperty:
        def __init__(
            self,
            *,
            dns_name: builtins.str,
            origin_access_identity: typing.Optional[builtins.str] = None,
        ) -> None:
            '''
            :param dns_name: 
            :param origin_access_identity: Default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacys3origin.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                legacy_s3_origin_property = cloudfront.CfnDistribution.LegacyS3OriginProperty(
                    dns_name="dnsName",
                
                    # the properties below are optional
                    origin_access_identity="originAccessIdentity"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e695ac5bc48e85bf9919e26bdb45e3de2d237ba2e8d90acd19414f7650ebf32c)
                check_type(argname="argument dns_name", value=dns_name, expected_type=type_hints["dns_name"])
                check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "dns_name": dns_name,
            }
            if origin_access_identity is not None:
                self._values["origin_access_identity"] = origin_access_identity

        @builtins.property
        def dns_name(self) -> builtins.str:
            '''
            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacys3origin.html#cfn-cloudfront-distribution-legacys3origin-dnsname
            '''
            result = self._values.get("dns_name")
            assert result is not None, "Required property 'dns_name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def origin_access_identity(self) -> typing.Optional[builtins.str]:
            '''
            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-legacys3origin.html#cfn-cloudfront-distribution-legacys3origin-originaccessidentity
            '''
            result = self._values.get("origin_access_identity")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "LegacyS3OriginProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.LoggingProperty",
        jsii_struct_bases=[],
        name_mapping={
            "bucket": "bucket",
            "include_cookies": "includeCookies",
            "prefix": "prefix",
        },
    )
    class LoggingProperty:
        def __init__(
            self,
            *,
            bucket: builtins.str,
            include_cookies: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            prefix: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A complex type that controls whether access logs are written for the distribution.

            :param bucket: The Amazon S3 bucket to store the access logs in, for example, ``myawslogbucket.s3.amazonaws.com`` .
            :param include_cookies: Specifies whether you want CloudFront to include cookies in access logs, specify ``true`` for ``IncludeCookies`` . If you choose to include cookies in logs, CloudFront logs all cookies regardless of how you configure the cache behaviors for this distribution. If you don't want to include cookies when you create a distribution or if you want to disable include cookies for an existing distribution, specify ``false`` for ``IncludeCookies`` . Default: - false
            :param prefix: An optional string that you want CloudFront to prefix to the access log ``filenames`` for this distribution, for example, ``myprefix/`` . If you want to enable logging, but you don't want to specify a prefix, you still must include an empty ``Prefix`` element in the ``Logging`` element. Default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-logging.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                logging_property = cloudfront.CfnDistribution.LoggingProperty(
                    bucket="bucket",
                
                    # the properties below are optional
                    include_cookies=False,
                    prefix="prefix"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__7a0c3d5ebfffb13f35ce0b0ca8f717738914598e4bca9e7b40ad11010a9c3b2c)
                check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
                check_type(argname="argument include_cookies", value=include_cookies, expected_type=type_hints["include_cookies"])
                check_type(argname="argument prefix", value=prefix, expected_type=type_hints["prefix"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "bucket": bucket,
            }
            if include_cookies is not None:
                self._values["include_cookies"] = include_cookies
            if prefix is not None:
                self._values["prefix"] = prefix

        @builtins.property
        def bucket(self) -> builtins.str:
            '''The Amazon S3 bucket to store the access logs in, for example, ``myawslogbucket.s3.amazonaws.com`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-logging.html#cfn-cloudfront-distribution-logging-bucket
            '''
            result = self._values.get("bucket")
            assert result is not None, "Required property 'bucket' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def include_cookies(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''Specifies whether you want CloudFront to include cookies in access logs, specify ``true`` for ``IncludeCookies`` .

            If you choose to include cookies in logs, CloudFront logs all cookies regardless of how you configure the cache behaviors for this distribution. If you don't want to include cookies when you create a distribution or if you want to disable include cookies for an existing distribution, specify ``false`` for ``IncludeCookies`` .

            :default: - false

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-logging.html#cfn-cloudfront-distribution-logging-includecookies
            '''
            result = self._values.get("include_cookies")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def prefix(self) -> typing.Optional[builtins.str]:
            '''An optional string that you want CloudFront to prefix to the access log ``filenames`` for this distribution, for example, ``myprefix/`` .

            If you want to enable logging, but you don't want to specify a prefix, you still must include an empty ``Prefix`` element in the ``Logging`` element.

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-logging.html#cfn-cloudfront-distribution-logging-prefix
            '''
            result = self._values.get("prefix")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "LoggingProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginCustomHeaderProperty",
        jsii_struct_bases=[],
        name_mapping={"header_name": "headerName", "header_value": "headerValue"},
    )
    class OriginCustomHeaderProperty:
        def __init__(
            self,
            *,
            header_name: builtins.str,
            header_value: builtins.str,
        ) -> None:
            '''A complex type that contains ``HeaderName`` and ``HeaderValue`` elements, if any, for this distribution.

            :param header_name: The name of a header that you want CloudFront to send to your origin. For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/forward-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param header_value: The value for the header that you specified in the ``HeaderName`` field.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origincustomheader.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_custom_header_property = cloudfront.CfnDistribution.OriginCustomHeaderProperty(
                    header_name="headerName",
                    header_value="headerValue"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__2cfa720a0d1d1c1fc7e085212905816d0c4e3cf518185fada3a39b9191cb0c0c)
                check_type(argname="argument header_name", value=header_name, expected_type=type_hints["header_name"])
                check_type(argname="argument header_value", value=header_value, expected_type=type_hints["header_value"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header_name": header_name,
                "header_value": header_value,
            }

        @builtins.property
        def header_name(self) -> builtins.str:
            '''The name of a header that you want CloudFront to send to your origin.

            For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/forward-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origincustomheader.html#cfn-cloudfront-distribution-origincustomheader-headername
            '''
            result = self._values.get("header_name")
            assert result is not None, "Required property 'header_name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def header_value(self) -> builtins.str:
            '''The value for the header that you specified in the ``HeaderName`` field.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origincustomheader.html#cfn-cloudfront-distribution-origincustomheader-headervalue
            '''
            result = self._values.get("header_value")
            assert result is not None, "Required property 'header_value' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginCustomHeaderProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty",
        jsii_struct_bases=[],
        name_mapping={"status_codes": "statusCodes"},
    )
    class OriginGroupFailoverCriteriaProperty:
        def __init__(
            self,
            *,
            status_codes: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.StatusCodesProperty", typing.Dict[builtins.str, typing.Any]]],
        ) -> None:
            '''A complex data type that includes information about the failover criteria for an origin group, including the status codes for which CloudFront will failover from the primary origin to the second origin.

            :param status_codes: The status codes that, when returned from the primary origin, will trigger CloudFront to failover to the second origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupfailovercriteria.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_group_failover_criteria_property = cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
                    status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
                        items=[123],
                        quantity=123
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__61dbb5bd2192479404eecdd9474c5bb62ba9671ee119d5f3f1b80dd80facd8a1)
                check_type(argname="argument status_codes", value=status_codes, expected_type=type_hints["status_codes"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "status_codes": status_codes,
            }

        @builtins.property
        def status_codes(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.StatusCodesProperty"]:
            '''The status codes that, when returned from the primary origin, will trigger CloudFront to failover to the second origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupfailovercriteria.html#cfn-cloudfront-distribution-origingroupfailovercriteria-statuscodes
            '''
            result = self._values.get("status_codes")
            assert result is not None, "Required property 'status_codes' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.StatusCodesProperty"], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginGroupFailoverCriteriaProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginGroupMemberProperty",
        jsii_struct_bases=[],
        name_mapping={"origin_id": "originId"},
    )
    class OriginGroupMemberProperty:
        def __init__(self, *, origin_id: builtins.str) -> None:
            '''An origin in an origin group.

            :param origin_id: The ID for an origin in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupmember.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_group_member_property = cloudfront.CfnDistribution.OriginGroupMemberProperty(
                    origin_id="originId"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__16bee92bcc24808d9dce56a72933a19326adcd53d49a178fd14a6e5ab68982e7)
                check_type(argname="argument origin_id", value=origin_id, expected_type=type_hints["origin_id"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "origin_id": origin_id,
            }

        @builtins.property
        def origin_id(self) -> builtins.str:
            '''The ID for an origin in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupmember.html#cfn-cloudfront-distribution-origingroupmember-originid
            '''
            result = self._values.get("origin_id")
            assert result is not None, "Required property 'origin_id' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginGroupMemberProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginGroupMembersProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items", "quantity": "quantity"},
    )
    class OriginGroupMembersProperty:
        def __init__(
            self,
            *,
            items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginGroupMemberProperty", typing.Dict[builtins.str, typing.Any]]]]],
            quantity: jsii.Number,
        ) -> None:
            '''A complex data type for the origins included in an origin group.

            :param items: Items (origins) in an origin group.
            :param quantity: The number of origins in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupmembers.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_group_members_property = cloudfront.CfnDistribution.OriginGroupMembersProperty(
                    items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
                        origin_id="originId"
                    )],
                    quantity=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__60f8ca14147351b458f575f380aa1c1cdcc066feae932cfccffead8ab29b0677)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
                check_type(argname="argument quantity", value=quantity, expected_type=type_hints["quantity"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
                "quantity": quantity,
            }

        @builtins.property
        def items(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupMemberProperty"]]]:
            '''Items (origins) in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupmembers.html#cfn-cloudfront-distribution-origingroupmembers-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupMemberProperty"]]], result)

        @builtins.property
        def quantity(self) -> jsii.Number:
            '''The number of origins in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroupmembers.html#cfn-cloudfront-distribution-origingroupmembers-quantity
            '''
            result = self._values.get("quantity")
            assert result is not None, "Required property 'quantity' is missing"
            return typing.cast(jsii.Number, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginGroupMembersProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginGroupProperty",
        jsii_struct_bases=[],
        name_mapping={
            "failover_criteria": "failoverCriteria",
            "id": "id",
            "members": "members",
        },
    )
    class OriginGroupProperty:
        def __init__(
            self,
            *,
            failover_criteria: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginGroupFailoverCriteriaProperty", typing.Dict[builtins.str, typing.Any]]],
            id: builtins.str,
            members: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginGroupMembersProperty", typing.Dict[builtins.str, typing.Any]]],
        ) -> None:
            '''An origin group includes two origins (a primary origin and a second origin to failover to) and a failover criteria that you specify.

            You create an origin group to support origin failover in CloudFront. When you create or update a distribution, you can specify the origin group instead of a single origin, and CloudFront will failover from the primary origin to the second origin under the failover conditions that you've chosen.

            :param failover_criteria: A complex type that contains information about the failover criteria for an origin group.
            :param id: The origin group's ID.
            :param members: A complex type that contains information about the origins in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroup.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_group_property = cloudfront.CfnDistribution.OriginGroupProperty(
                    failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
                        status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
                            items=[123],
                            quantity=123
                        )
                    ),
                    id="id",
                    members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
                        items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
                            origin_id="originId"
                        )],
                        quantity=123
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__bd08423916d03eaf406b848a8b7d04e6dad1de842d0f03928145ff201c7ef387)
                check_type(argname="argument failover_criteria", value=failover_criteria, expected_type=type_hints["failover_criteria"])
                check_type(argname="argument id", value=id, expected_type=type_hints["id"])
                check_type(argname="argument members", value=members, expected_type=type_hints["members"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "failover_criteria": failover_criteria,
                "id": id,
                "members": members,
            }

        @builtins.property
        def failover_criteria(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupFailoverCriteriaProperty"]:
            '''A complex type that contains information about the failover criteria for an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroup.html#cfn-cloudfront-distribution-origingroup-failovercriteria
            '''
            result = self._values.get("failover_criteria")
            assert result is not None, "Required property 'failover_criteria' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupFailoverCriteriaProperty"], result)

        @builtins.property
        def id(self) -> builtins.str:
            '''The origin group's ID.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroup.html#cfn-cloudfront-distribution-origingroup-id
            '''
            result = self._values.get("id")
            assert result is not None, "Required property 'id' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def members(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupMembersProperty"]:
            '''A complex type that contains information about the origins in an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroup.html#cfn-cloudfront-distribution-origingroup-members
            '''
            result = self._values.get("members")
            assert result is not None, "Required property 'members' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupMembersProperty"], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginGroupProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginGroupsProperty",
        jsii_struct_bases=[],
        name_mapping={"quantity": "quantity", "items": "items"},
    )
    class OriginGroupsProperty:
        def __init__(
            self,
            *,
            quantity: jsii.Number,
            items: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginGroupProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
        ) -> None:
            '''A complex data type for the origin groups specified for a distribution.

            :param quantity: The number of origin groups.
            :param items: The items (origin groups) in a distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroups.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_groups_property = cloudfront.CfnDistribution.OriginGroupsProperty(
                    quantity=123,
                
                    # the properties below are optional
                    items=[cloudfront.CfnDistribution.OriginGroupProperty(
                        failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
                            status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
                                items=[123],
                                quantity=123
                            )
                        ),
                        id="id",
                        members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
                            items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
                                origin_id="originId"
                            )],
                            quantity=123
                        )
                    )]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__1ec6db0461baa77c3c5f4808e0fd24051c8b01a4b3b804d8c8e89cc3537cce65)
                check_type(argname="argument quantity", value=quantity, expected_type=type_hints["quantity"])
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "quantity": quantity,
            }
            if items is not None:
                self._values["items"] = items

        @builtins.property
        def quantity(self) -> jsii.Number:
            '''The number of origin groups.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroups.html#cfn-cloudfront-distribution-origingroups-quantity
            '''
            result = self._values.get("quantity")
            assert result is not None, "Required property 'quantity' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def items(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupProperty"]]]]:
            '''The items (origin groups) in a distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origingroups.html#cfn-cloudfront-distribution-origingroups-items
            '''
            result = self._values.get("items")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginGroupProperty"]]]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginGroupsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginProperty",
        jsii_struct_bases=[],
        name_mapping={
            "domain_name": "domainName",
            "id": "id",
            "connection_attempts": "connectionAttempts",
            "connection_timeout": "connectionTimeout",
            "custom_origin_config": "customOriginConfig",
            "origin_access_control_id": "originAccessControlId",
            "origin_custom_headers": "originCustomHeaders",
            "origin_path": "originPath",
            "origin_shield": "originShield",
            "s3_origin_config": "s3OriginConfig",
        },
    )
    class OriginProperty:
        def __init__(
            self,
            *,
            domain_name: builtins.str,
            id: builtins.str,
            connection_attempts: typing.Optional[jsii.Number] = None,
            connection_timeout: typing.Optional[jsii.Number] = None,
            custom_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.CustomOriginConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            origin_access_control_id: typing.Optional[builtins.str] = None,
            origin_custom_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginCustomHeaderProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
            origin_path: typing.Optional[builtins.str] = None,
            origin_shield: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.OriginShieldProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            s3_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.S3OriginConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''An origin.

            An origin is the location where content is stored, and from which CloudFront gets content to serve to viewers. To specify an origin:

            - Use ``S3OriginConfig`` to specify an Amazon S3 bucket that is not configured with static website hosting.
            - Use ``CustomOriginConfig`` to specify all other kinds of origins, including:
            - An Amazon S3 bucket that is configured with static website hosting
            - An Elastic Load Balancing load balancer
            - An AWS Elemental MediaPackage endpoint
            - An AWS Elemental MediaStore container
            - Any other HTTP server, running on an Amazon EC2 instance or any other kind of host

            For the current maximum number of origins that you can specify per distribution, see `General Quotas on Web Distributions <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#limits-web-distributions>`_ in the *Amazon CloudFront Developer Guide* (quotas were formerly referred to as limits).

            :param domain_name: The domain name for the origin. For more information, see `Origin Domain Name <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesDomainName>`_ in the *Amazon CloudFront Developer Guide* .
            :param id: A unique identifier for the origin. This value must be unique within the distribution. Use this value to specify the ``TargetOriginId`` in a ``CacheBehavior`` or ``DefaultCacheBehavior`` .
            :param connection_attempts: The number of times that CloudFront attempts to connect to the origin. The minimum number is 1, the maximum is 3, and the default (if you don't specify otherwise) is 3. For a custom origin (including an Amazon S3 bucket that's configured with static website hosting), this value also specifies the number of times that CloudFront attempts to get a response from the origin, in the case of an `Origin Response Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ . For more information, see `Origin Connection Attempts <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-attempts>`_ in the *Amazon CloudFront Developer Guide* .
            :param connection_timeout: The number of seconds that CloudFront waits when trying to establish a connection to the origin. The minimum timeout is 1 second, the maximum is 10 seconds, and the default (if you don't specify otherwise) is 10 seconds. For more information, see `Origin Connection Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-timeout>`_ in the *Amazon CloudFront Developer Guide* .
            :param custom_origin_config: Use this type to specify an origin that is not an Amazon S3 bucket, with one exception. If the Amazon S3 bucket is configured with static website hosting, use this type. If the Amazon S3 bucket is not configured with static website hosting, use the ``S3OriginConfig`` type instead.
            :param origin_access_control_id: The unique identifier of an origin access control for this origin. For more information, see `Restricting access to an Amazon S3 origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param origin_custom_headers: A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin. For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""
            :param origin_shield: CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param s3_origin_config: Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting. To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_property = cloudfront.CfnDistribution.OriginProperty(
                    domain_name="domainName",
                    id="id",
                
                    # the properties below are optional
                    connection_attempts=123,
                    connection_timeout=123,
                    custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
                        origin_protocol_policy="originProtocolPolicy",
                
                        # the properties below are optional
                        http_port=123,
                        https_port=123,
                        origin_keepalive_timeout=123,
                        origin_read_timeout=123,
                        origin_ssl_protocols=["originSslProtocols"]
                    ),
                    origin_access_control_id="originAccessControlId",
                    origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
                        header_name="headerName",
                        header_value="headerValue"
                    )],
                    origin_path="originPath",
                    origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
                        enabled=False,
                        origin_shield_region="originShieldRegion"
                    ),
                    s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
                        origin_access_identity="originAccessIdentity"
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__cb4237408749840dbecf9d9aed57975910052da22b994c7e13cc97c984a6e868)
                check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
                check_type(argname="argument id", value=id, expected_type=type_hints["id"])
                check_type(argname="argument connection_attempts", value=connection_attempts, expected_type=type_hints["connection_attempts"])
                check_type(argname="argument connection_timeout", value=connection_timeout, expected_type=type_hints["connection_timeout"])
                check_type(argname="argument custom_origin_config", value=custom_origin_config, expected_type=type_hints["custom_origin_config"])
                check_type(argname="argument origin_access_control_id", value=origin_access_control_id, expected_type=type_hints["origin_access_control_id"])
                check_type(argname="argument origin_custom_headers", value=origin_custom_headers, expected_type=type_hints["origin_custom_headers"])
                check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
                check_type(argname="argument origin_shield", value=origin_shield, expected_type=type_hints["origin_shield"])
                check_type(argname="argument s3_origin_config", value=s3_origin_config, expected_type=type_hints["s3_origin_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "domain_name": domain_name,
                "id": id,
            }
            if connection_attempts is not None:
                self._values["connection_attempts"] = connection_attempts
            if connection_timeout is not None:
                self._values["connection_timeout"] = connection_timeout
            if custom_origin_config is not None:
                self._values["custom_origin_config"] = custom_origin_config
            if origin_access_control_id is not None:
                self._values["origin_access_control_id"] = origin_access_control_id
            if origin_custom_headers is not None:
                self._values["origin_custom_headers"] = origin_custom_headers
            if origin_path is not None:
                self._values["origin_path"] = origin_path
            if origin_shield is not None:
                self._values["origin_shield"] = origin_shield
            if s3_origin_config is not None:
                self._values["s3_origin_config"] = s3_origin_config

        @builtins.property
        def domain_name(self) -> builtins.str:
            '''The domain name for the origin.

            For more information, see `Origin Domain Name <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesDomainName>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-domainname
            '''
            result = self._values.get("domain_name")
            assert result is not None, "Required property 'domain_name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def id(self) -> builtins.str:
            '''A unique identifier for the origin. This value must be unique within the distribution.

            Use this value to specify the ``TargetOriginId`` in a ``CacheBehavior`` or ``DefaultCacheBehavior`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-id
            '''
            result = self._values.get("id")
            assert result is not None, "Required property 'id' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def connection_attempts(self) -> typing.Optional[jsii.Number]:
            '''The number of times that CloudFront attempts to connect to the origin.

            The minimum number is 1, the maximum is 3, and the default (if you don't specify otherwise) is 3.

            For a custom origin (including an Amazon S3 bucket that's configured with static website hosting), this value also specifies the number of times that CloudFront attempts to get a response from the origin, in the case of an `Origin Response Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginResponseTimeout>`_ .

            For more information, see `Origin Connection Attempts <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-attempts>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-connectionattempts
            '''
            result = self._values.get("connection_attempts")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def connection_timeout(self) -> typing.Optional[jsii.Number]:
            '''The number of seconds that CloudFront waits when trying to establish a connection to the origin.

            The minimum timeout is 1 second, the maximum is 10 seconds, and the default (if you don't specify otherwise) is 10 seconds.

            For more information, see `Origin Connection Timeout <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#origin-connection-timeout>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-connectiontimeout
            '''
            result = self._values.get("connection_timeout")
            return typing.cast(typing.Optional[jsii.Number], result)

        @builtins.property
        def custom_origin_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CustomOriginConfigProperty"]]:
            '''Use this type to specify an origin that is not an Amazon S3 bucket, with one exception.

            If the Amazon S3 bucket is configured with static website hosting, use this type. If the Amazon S3 bucket is not configured with static website hosting, use the ``S3OriginConfig`` type instead.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-customoriginconfig
            '''
            result = self._values.get("custom_origin_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.CustomOriginConfigProperty"]], result)

        @builtins.property
        def origin_access_control_id(self) -> typing.Optional[builtins.str]:
            '''The unique identifier of an origin access control for this origin.

            For more information, see `Restricting access to an Amazon S3 origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originaccesscontrolid
            '''
            result = self._values.get("origin_access_control_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def origin_custom_headers(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]]:
            '''A list of HTTP header names and values that CloudFront adds to the requests that it sends to the origin.

            For more information, see `Adding Custom Headers to Origin Requests <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/add-origin-custom-headers.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-origincustomheaders
            '''
            result = self._values.get("origin_custom_headers")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginCustomHeaderProperty"]]]], result)

        @builtins.property
        def origin_path(self) -> typing.Optional[builtins.str]:
            '''An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.

            For more information, see `Origin Path <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValuesOriginPath>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originpath
            '''
            result = self._values.get("origin_path")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def origin_shield(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]]:
            '''CloudFront Origin Shield. Using Origin Shield can help reduce the load on your origin.

            For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-originshield
            '''
            result = self._values.get("origin_shield")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.OriginShieldProperty"]], result)

        @builtins.property
        def s3_origin_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]]:
            '''Use this type to specify an origin that is an Amazon S3 bucket that is not configured with static website hosting.

            To specify any other type of origin, including an Amazon S3 bucket that is configured with static website hosting, use the ``CustomOriginConfig`` type instead.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-origin.html#cfn-cloudfront-distribution-origin-s3originconfig
            '''
            result = self._values.get("s3_origin_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDistribution.S3OriginConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.OriginShieldProperty",
        jsii_struct_bases=[],
        name_mapping={
            "enabled": "enabled",
            "origin_shield_region": "originShieldRegion",
        },
    )
    class OriginShieldProperty:
        def __init__(
            self,
            *,
            enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            origin_shield_region: typing.Optional[builtins.str] = None,
        ) -> None:
            '''CloudFront Origin Shield.

            Using Origin Shield can help reduce the load on your origin. For more information, see `Using Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html>`_ in the *Amazon CloudFront Developer Guide* .

            :param enabled: A flag that specifies whether Origin Shield is enabled. When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.
            :param origin_shield_region: The AWS Region for Origin Shield. Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` . When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_shield_property = cloudfront.CfnDistribution.OriginShieldProperty(
                    enabled=False,
                    origin_shield_region="originShieldRegion"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__d2a25e92d5905a4c19d3636ff8b631afa34a538497a13fa9d29e56ca404539e4)
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if enabled is not None:
                self._values["enabled"] = enabled
            if origin_shield_region is not None:
                self._values["origin_shield_region"] = origin_shield_region

        @builtins.property
        def enabled(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A flag that specifies whether Origin Shield is enabled.

            When it's enabled, CloudFront routes all requests through Origin Shield, which can help protect your origin. When it's disabled, CloudFront might send requests directly to your origin from multiple edge locations or regional edge caches.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-enabled
            '''
            result = self._values.get("enabled")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def origin_shield_region(self) -> typing.Optional[builtins.str]:
            '''The AWS Region for Origin Shield.

            Specify the AWS Region that has the lowest latency to your origin. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as ``us-east-2`` .

            When you enable CloudFront Origin Shield, you must specify the AWS Region for Origin Shield. For the list of AWS Regions that you can specify, and for help choosing the best Region for your origin, see `Choosing the AWS Region for Origin Shield <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html#choose-origin-shield-region>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-originshield.html#cfn-cloudfront-distribution-originshield-originshieldregion
            '''
            result = self._values.get("origin_shield_region")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginShieldProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.RestrictionsProperty",
        jsii_struct_bases=[],
        name_mapping={"geo_restriction": "geoRestriction"},
    )
    class RestrictionsProperty:
        def __init__(
            self,
            *,
            geo_restriction: typing.Union[_IResolvable_da3f097b, typing.Union["CfnDistribution.GeoRestrictionProperty", typing.Dict[builtins.str, typing.Any]]],
        ) -> None:
            '''A complex type that identifies ways in which you want to restrict distribution of your content.

            :param geo_restriction: A complex type that controls the countries in which your content is distributed. CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                restrictions_property = cloudfront.CfnDistribution.RestrictionsProperty(
                    geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
                        restriction_type="restrictionType",
                
                        # the properties below are optional
                        locations=["locations"]
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa9638220c0d)
                check_type(argname="argument geo_restriction", value=geo_restriction, expected_type=type_hints["geo_restriction"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "geo_restriction": geo_restriction,
            }

        @builtins.property
        def geo_restriction(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"]:
            '''A complex type that controls the countries in which your content is distributed.

            CloudFront determines the location of your users using ``MaxMind`` GeoIP databases. To disable geo restriction, remove the `Restrictions <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-restrictions>`_ property from your stack template.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-restrictions.html#cfn-cloudfront-distribution-restrictions-georestriction
            '''
            result = self._values.get("geo_restriction")
            assert result is not None, "Required property 'geo_restriction' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnDistribution.GeoRestrictionProperty"], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "RestrictionsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.S3OriginConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"origin_access_identity": "originAccessIdentity"},
    )
    class S3OriginConfigProperty:
        def __init__(
            self,
            *,
            origin_access_identity: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A complex type that contains information about the Amazon S3 origin.

            If the origin is a custom origin or an S3 bucket that is configured as a website endpoint, use the ``CustomOriginConfig`` element instead.

            :param origin_access_identity: The CloudFront origin access identity to associate with the origin. Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is: origin-access-identity/cloudfront/ *ID-of-origin-access-identity* where ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity. If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element. To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element. To replace the origin access identity, update the distribution configuration and specify the new origin access identity. For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* . Default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                s3_origin_config_property = cloudfront.CfnDistribution.S3OriginConfigProperty(
                    origin_access_identity="originAccessIdentity"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7)
                check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if origin_access_identity is not None:
                self._values["origin_access_identity"] = origin_access_identity

        @builtins.property
        def origin_access_identity(self) -> typing.Optional[builtins.str]:
            '''The CloudFront origin access identity to associate with the origin.

            Use an origin access identity to configure the origin so that viewers can *only* access objects in an Amazon S3 bucket through CloudFront. The format of the value is:

            origin-access-identity/cloudfront/ *ID-of-origin-access-identity*

            where ``*ID-of-origin-access-identity*`` is the value that CloudFront returned in the ``ID`` element when you created the origin access identity.

            If you want viewers to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element.

            To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element.

            To replace the origin access identity, update the distribution configuration and specify the new origin access identity.

            For more information about the origin access identity, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :default: - ""

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-s3originconfig.html#cfn-cloudfront-distribution-s3originconfig-originaccessidentity
            '''
            result = self._values.get("origin_access_identity")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "S3OriginConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.StatusCodesProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items", "quantity": "quantity"},
    )
    class StatusCodesProperty:
        def __init__(
            self,
            *,
            items: typing.Union[_IResolvable_da3f097b, typing.Sequence[jsii.Number]],
            quantity: jsii.Number,
        ) -> None:
            '''A complex data type for the status codes that you specify that, when returned by a primary origin, trigger CloudFront to failover to a second origin.

            :param items: The items (status codes) for an origin group.
            :param quantity: The number of status codes.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                status_codes_property = cloudfront.CfnDistribution.StatusCodesProperty(
                    items=[123],
                    quantity=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__7b8b62ce6bf1ec6151566719caf2d665f3f7fea596e402fba7354f19f781f23c)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
                check_type(argname="argument quantity", value=quantity, expected_type=type_hints["quantity"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
                "quantity": quantity,
            }

        @builtins.property
        def items(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, typing.List[jsii.Number]]:
            '''The items (status codes) for an origin group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[jsii.Number]], result)

        @builtins.property
        def quantity(self) -> jsii.Number:
            '''The number of status codes.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-statuscodes.html#cfn-cloudfront-distribution-statuscodes-quantity
            '''
            result = self._values.get("quantity")
            assert result is not None, "Required property 'quantity' is missing"
            return typing.cast(jsii.Number, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "StatusCodesProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistribution.ViewerCertificateProperty",
        jsii_struct_bases=[],
        name_mapping={
            "acm_certificate_arn": "acmCertificateArn",
            "cloud_front_default_certificate": "cloudFrontDefaultCertificate",
            "iam_certificate_id": "iamCertificateId",
            "minimum_protocol_version": "minimumProtocolVersion",
            "ssl_support_method": "sslSupportMethod",
        },
    )
    class ViewerCertificateProperty:
        def __init__(
            self,
            *,
            acm_certificate_arn: typing.Optional[builtins.str] = None,
            cloud_front_default_certificate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            iam_certificate_id: typing.Optional[builtins.str] = None,
            minimum_protocol_version: typing.Optional[builtins.str] = None,
            ssl_support_method: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A complex type that determines the distribution's SSL/TLS configuration for communicating with viewers.

            If the distribution doesn't use ``Aliases`` (also known as alternate domain names or CNAMEs)—that is, if the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` —set ``CloudFrontDefaultCertificate`` to ``true`` and leave all other fields empty.

            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), use the fields in this type to specify the following settings:

            - Which viewers the distribution accepts HTTPS connections from: only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ (recommended), or all viewers including those that don't support SNI.
            - To accept HTTPS connections from only viewers that support SNI, set ``SSLSupportMethod`` to ``sni-only`` . This is recommended. Most browsers and clients support SNI. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
            - To accept HTTPS connections from all viewers, including those that don't support SNI, set ``SSLSupportMethod`` to ``vip`` . This is not recommended, and results in additional monthly charges from CloudFront. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
            - The minimum SSL/TLS protocol version that the distribution can use to communicate with viewers. To specify a minimum version, choose a value for ``MinimumProtocolVersion`` . For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ in the *Amazon CloudFront Developer Guide* .
            - The location of the SSL/TLS certificate, `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ (recommended) or `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ . You specify the location by setting a value in one of the following fields (not both):
            - ``ACMCertificateArn`` (In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.)
            - ``IAMCertificateId`` (In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.)

            All distributions support HTTPS connections from viewers. To require viewers to use HTTPS only, or to redirect them from HTTP to HTTPS, use ``ViewerProtocolPolicy`` in the ``CacheBehavior`` or ``DefaultCacheBehavior`` . To specify how CloudFront should use SSL/TLS to communicate with your custom origin, use ``CustomOriginConfig`` .

            For more information, see `Using HTTPS with CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https.html>`_ and `Using Alternate Domain Names and HTTPS <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-https-alternate-domain-names.html>`_ in the *Amazon CloudFront Developer Guide* .

            :param acm_certificate_arn: .. epigraph:: In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ). If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
            :param cloud_front_default_certificate: If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` . If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields: - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both) - ``MinimumProtocolVersion`` - ``SslSupportMethod``
            :param iam_certificate_id: .. epigraph:: In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate. If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)
            :param minimum_protocol_version: If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers. The security policy determines two settings: - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers. - The ciphers that CloudFront can use to encrypt the content that it returns to viewers. For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* . .. epigraph:: On the CloudFront console, this setting is called *Security Policy* . When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.) If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.
            :param ssl_support_method: .. epigraph:: In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization. If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from. - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI. - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront. - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `AWS Support Center <https://docs.aws.amazon.com/support/home>`_ . If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                viewer_certificate_property = cloudfront.CfnDistribution.ViewerCertificateProperty(
                    acm_certificate_arn="acmCertificateArn",
                    cloud_front_default_certificate=False,
                    iam_certificate_id="iamCertificateId",
                    minimum_protocol_version="minimumProtocolVersion",
                    ssl_support_method="sslSupportMethod"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__511560286b35778c69f3d2a23120607f1ab2e58901f0c1ba7acd75a338eb699e)
                check_type(argname="argument acm_certificate_arn", value=acm_certificate_arn, expected_type=type_hints["acm_certificate_arn"])
                check_type(argname="argument cloud_front_default_certificate", value=cloud_front_default_certificate, expected_type=type_hints["cloud_front_default_certificate"])
                check_type(argname="argument iam_certificate_id", value=iam_certificate_id, expected_type=type_hints["iam_certificate_id"])
                check_type(argname="argument minimum_protocol_version", value=minimum_protocol_version, expected_type=type_hints["minimum_protocol_version"])
                check_type(argname="argument ssl_support_method", value=ssl_support_method, expected_type=type_hints["ssl_support_method"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if acm_certificate_arn is not None:
                self._values["acm_certificate_arn"] = acm_certificate_arn
            if cloud_front_default_certificate is not None:
                self._values["cloud_front_default_certificate"] = cloud_front_default_certificate
            if iam_certificate_id is not None:
                self._values["iam_certificate_id"] = iam_certificate_id
            if minimum_protocol_version is not None:
                self._values["minimum_protocol_version"] = minimum_protocol_version
            if ssl_support_method is not None:
                self._values["ssl_support_method"] = ssl_support_method

        @builtins.property
        def acm_certificate_arn(self) -> typing.Optional[builtins.str]:
            '''.. epigraph::

   In CloudFormation, this field name is ``AcmCertificateArn`` . Note the different capitalization.

            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Certificate Manager (ACM) <https://docs.aws.amazon.com/acm/latest/userguide/acm-overview.html>`_ , provide the Amazon Resource Name (ARN) of the ACM certificate. CloudFront only supports ACM certificates in the US East (N. Virginia) Region ( ``us-east-1`` ).

            If you specify an ACM certificate ARN, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-acmcertificatearn
            '''
            result = self._values.get("acm_certificate_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def cloud_front_default_certificate(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , set this field to ``true`` .

            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), omit this field and specify values for the following fields:

            - ``AcmCertificateArn`` or ``IamCertificateId`` (specify a value for one, not both)
            - ``MinimumProtocolVersion``
            - ``SslSupportMethod``

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-cloudfrontdefaultcertificate
            '''
            result = self._values.get("cloud_front_default_certificate")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def iam_certificate_id(self) -> typing.Optional[builtins.str]:
            '''.. epigraph::

   In CloudFormation, this field name is ``IamCertificateId`` . Note the different capitalization.

            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs) and the SSL/TLS certificate is stored in `AWS Identity and Access Management (IAM) <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html>`_ , provide the ID of the IAM certificate.

            If you specify an IAM certificate ID, you must also specify values for ``MinimumProtocolVersion`` and ``SSLSupportMethod`` . (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-iamcertificateid
            '''
            result = self._values.get("iam_certificate_id")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def minimum_protocol_version(self) -> typing.Optional[builtins.str]:
            '''If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify the security policy that you want CloudFront to use for HTTPS connections with viewers.

            The security policy determines two settings:

            - The minimum SSL/TLS protocol that CloudFront can use to communicate with viewers.
            - The ciphers that CloudFront can use to encrypt the content that it returns to viewers.

            For more information, see `Security Policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-values-specify.html#DownloadDistValues-security-policy>`_ and `Supported Protocols and Ciphers Between Viewers and CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html#secure-connections-supported-ciphers>`_ in the *Amazon CloudFront Developer Guide* .
            .. epigraph::

               On the CloudFront console, this setting is called *Security Policy* .

            When you're using SNI only (you set ``SSLSupportMethod`` to ``sni-only`` ), you must specify ``TLSv1`` or higher. (In CloudFormation, the field name is ``SslSupportMethod`` . Note the different capitalization.)

            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` (you set ``CloudFrontDefaultCertificate`` to ``true`` ), CloudFront automatically sets the security policy to ``TLSv1`` regardless of the value that you set here.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-minimumprotocolversion
            '''
            result = self._values.get("minimum_protocol_version")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def ssl_support_method(self) -> typing.Optional[builtins.str]:
            '''.. epigraph::

   In CloudFormation, this field name is ``SslSupportMethod`` . Note the different capitalization.

            If the distribution uses ``Aliases`` (alternate domain names or CNAMEs), specify which viewers the distribution accepts HTTPS connections from.

            - ``sni-only`` – The distribution accepts HTTPS connections from only viewers that support `server name indication (SNI) <https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Server_Name_Indication>`_ . This is recommended. Most browsers and clients support SNI.
            - ``vip`` – The distribution accepts HTTPS connections from all viewers including those that don't support SNI. This is not recommended, and results in additional monthly charges from CloudFront.
            - ``static-ip`` - Do not specify this value unless your distribution has been enabled for this feature by the CloudFront team. If you have a use case that requires static IP addresses for a distribution, contact CloudFront through the `AWS Support Center <https://docs.aws.amazon.com/support/home>`_ .

            If the distribution uses the CloudFront domain name such as ``d111111abcdef8.cloudfront.net`` , don't set a value for this field.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-viewercertificate.html#cfn-cloudfront-distribution-viewercertificate-sslsupportmethod
            '''
            result = self._values.get("ssl_support_method")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ViewerCertificateProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnDistributionProps",
    jsii_struct_bases=[],
    name_mapping={"distribution_config": "distributionConfig", "tags": "tags"},
)
class CfnDistributionProps:
    def __init__(
        self,
        *,
        distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''Properties for defining a ``CfnDistribution``.

        :param distribution_config: The distribution's configuration.
        :param tags: A complex type that contains zero or more ``Tag`` elements.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_distribution_props = cloudfront.CfnDistributionProps(
                distribution_config=cloudfront.CfnDistribution.DistributionConfigProperty(
                    default_cache_behavior=cloudfront.CfnDistribution.DefaultCacheBehaviorProperty(
                        target_origin_id="targetOriginId",
                        viewer_protocol_policy="viewerProtocolPolicy",
            
                        # the properties below are optional
                        allowed_methods=["allowedMethods"],
                        cached_methods=["cachedMethods"],
                        cache_policy_id="cachePolicyId",
                        compress=False,
                        default_ttl=123,
                        field_level_encryption_id="fieldLevelEncryptionId",
                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                            query_string=False,
            
                            # the properties below are optional
                            cookies=cloudfront.CfnDistribution.CookiesProperty(
                                forward="forward",
            
                                # the properties below are optional
                                whitelisted_names=["whitelistedNames"]
                            ),
                            headers=["headers"],
                            query_string_cache_keys=["queryStringCacheKeys"]
                        ),
                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                            event_type="eventType",
                            function_arn="functionArn"
                        )],
                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                            event_type="eventType",
                            include_body=False,
                            lambda_function_arn="lambdaFunctionArn"
                        )],
                        max_ttl=123,
                        min_ttl=123,
                        origin_request_policy_id="originRequestPolicyId",
                        realtime_log_config_arn="realtimeLogConfigArn",
                        response_headers_policy_id="responseHeadersPolicyId",
                        smooth_streaming=False,
                        trusted_key_groups=["trustedKeyGroups"],
                        trusted_signers=["trustedSigners"]
                    ),
                    enabled=False,
            
                    # the properties below are optional
                    aliases=["aliases"],
                    cache_behaviors=[cloudfront.CfnDistribution.CacheBehaviorProperty(
                        path_pattern="pathPattern",
                        target_origin_id="targetOriginId",
                        viewer_protocol_policy="viewerProtocolPolicy",
            
                        # the properties below are optional
                        allowed_methods=["allowedMethods"],
                        cached_methods=["cachedMethods"],
                        cache_policy_id="cachePolicyId",
                        compress=False,
                        default_ttl=123,
                        field_level_encryption_id="fieldLevelEncryptionId",
                        forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                            query_string=False,
            
                            # the properties below are optional
                            cookies=cloudfront.CfnDistribution.CookiesProperty(
                                forward="forward",
            
                                # the properties below are optional
                                whitelisted_names=["whitelistedNames"]
                            ),
                            headers=["headers"],
                            query_string_cache_keys=["queryStringCacheKeys"]
                        ),
                        function_associations=[cloudfront.CfnDistribution.FunctionAssociationProperty(
                            event_type="eventType",
                            function_arn="functionArn"
                        )],
                        lambda_function_associations=[cloudfront.CfnDistribution.LambdaFunctionAssociationProperty(
                            event_type="eventType",
                            include_body=False,
                            lambda_function_arn="lambdaFunctionArn"
                        )],
                        max_ttl=123,
                        min_ttl=123,
                        origin_request_policy_id="originRequestPolicyId",
                        realtime_log_config_arn="realtimeLogConfigArn",
                        response_headers_policy_id="responseHeadersPolicyId",
                        smooth_streaming=False,
                        trusted_key_groups=["trustedKeyGroups"],
                        trusted_signers=["trustedSigners"]
                    )],
                    cnam_es=["cnamEs"],
                    comment="comment",
                    continuous_deployment_policy_id="continuousDeploymentPolicyId",
                    custom_error_responses=[cloudfront.CfnDistribution.CustomErrorResponseProperty(
                        error_code=123,
            
                        # the properties below are optional
                        error_caching_min_ttl=123,
                        response_code=123,
                        response_page_path="responsePagePath"
                    )],
                    custom_origin=cloudfront.CfnDistribution.LegacyCustomOriginProperty(
                        dns_name="dnsName",
                        origin_protocol_policy="originProtocolPolicy",
                        origin_ssl_protocols=["originSslProtocols"],
            
                        # the properties below are optional
                        http_port=123,
                        https_port=123
                    ),
                    default_root_object="defaultRootObject",
                    http_version="httpVersion",
                    ipv6_enabled=False,
                    logging=cloudfront.CfnDistribution.LoggingProperty(
                        bucket="bucket",
            
                        # the properties below are optional
                        include_cookies=False,
                        prefix="prefix"
                    ),
                    origin_groups=cloudfront.CfnDistribution.OriginGroupsProperty(
                        quantity=123,
            
                        # the properties below are optional
                        items=[cloudfront.CfnDistribution.OriginGroupProperty(
                            failover_criteria=cloudfront.CfnDistribution.OriginGroupFailoverCriteriaProperty(
                                status_codes=cloudfront.CfnDistribution.StatusCodesProperty(
                                    items=[123],
                                    quantity=123
                                )
                            ),
                            id="id",
                            members=cloudfront.CfnDistribution.OriginGroupMembersProperty(
                                items=[cloudfront.CfnDistribution.OriginGroupMemberProperty(
                                    origin_id="originId"
                                )],
                                quantity=123
                            )
                        )]
                    ),
                    origins=[cloudfront.CfnDistribution.OriginProperty(
                        domain_name="domainName",
                        id="id",
            
                        # the properties below are optional
                        connection_attempts=123,
                        connection_timeout=123,
                        custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
                            origin_protocol_policy="originProtocolPolicy",
            
                            # the properties below are optional
                            http_port=123,
                            https_port=123,
                            origin_keepalive_timeout=123,
                            origin_read_timeout=123,
                            origin_ssl_protocols=["originSslProtocols"]
                        ),
                        origin_access_control_id="originAccessControlId",
                        origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
                            header_name="headerName",
                            header_value="headerValue"
                        )],
                        origin_path="originPath",
                        origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
                            enabled=False,
                            origin_shield_region="originShieldRegion"
                        ),
                        s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
                            origin_access_identity="originAccessIdentity"
                        )
                    )],
                    price_class="priceClass",
                    restrictions=cloudfront.CfnDistribution.RestrictionsProperty(
                        geo_restriction=cloudfront.CfnDistribution.GeoRestrictionProperty(
                            restriction_type="restrictionType",
            
                            # the properties below are optional
                            locations=["locations"]
                        )
                    ),
                    s3_origin=cloudfront.CfnDistribution.LegacyS3OriginProperty(
                        dns_name="dnsName",
            
                        # the properties below are optional
                        origin_access_identity="originAccessIdentity"
                    ),
                    staging=False,
                    viewer_certificate=cloudfront.CfnDistribution.ViewerCertificateProperty(
                        acm_certificate_arn="acmCertificateArn",
                        cloud_front_default_certificate=False,
                        iam_certificate_id="iamCertificateId",
                        minimum_protocol_version="minimumProtocolVersion",
                        ssl_support_method="sslSupportMethod"
                    ),
                    web_acl_id="webAclId"
                ),
            
                # the properties below are optional
                tags=[CfnTag(
                    key="key",
                    value="value"
                )]
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7553d47847912fd83a61da98a84c9c8cb5fdb95cf08048d70723db17c73053a)
            check_type(argname="argument distribution_config", value=distribution_config, expected_type=type_hints["distribution_config"])
            check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "distribution_config": distribution_config,
        }
        if tags is not None:
            self._values["tags"] = tags

    @builtins.property
    def distribution_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty]:
        '''The distribution's configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-distributionconfig
        '''
        result = self._values.get("distribution_config")
        assert result is not None, "Required property 'distribution_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty], result)

    @builtins.property
    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
        '''A complex type that contains zero or more ``Tag`` elements.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-distribution.html#cfn-cloudfront-distribution-tags
        '''
        result = self._values.get("tags")
        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnDistributionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnFunction(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnFunction",
):
    '''Creates a CloudFront function.

    To create a function, you provide the function code and some configuration information about the function. The response contains an Amazon Resource Name (ARN) that uniquely identifies the function, and the function’s stage.

    By default, when you create a function, it’s in the ``DEVELOPMENT`` stage. In this stage, you can `test the function <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/test-function.html>`_ in the CloudFront console (or with ``TestFunction`` in the CloudFront API).

    When you’re ready to use your function with a CloudFront distribution, publish the function to the ``LIVE`` stage. You can do this in the CloudFront console, with ``PublishFunction`` in the CloudFront API, or by updating the ``AWS::CloudFront::Function`` resource with the ``AutoPublish`` property set to ``true`` . When the function is published to the ``LIVE`` stage, you can attach it to a distribution’s cache behavior, using the function’s ARN.

    To automatically publish the function to the ``LIVE`` stage when it’s created, set the ``AutoPublish`` property to ``true`` .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html
    :cloudformationResource: AWS::CloudFront::Function
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_function = cloudfront.CfnFunction(self, "MyCfnFunction",
            function_code="functionCode",
            function_config=cloudfront.CfnFunction.FunctionConfigProperty(
                comment="comment",
                runtime="runtime",
        
                # the properties below are optional
                key_value_store_associations=[cloudfront.CfnFunction.KeyValueStoreAssociationProperty(
                    key_value_store_arn="keyValueStoreArn"
                )]
            ),
            name="name",
        
            # the properties below are optional
            auto_publish=False,
            function_metadata=cloudfront.CfnFunction.FunctionMetadataProperty(
                function_arn="functionArn"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        function_code: builtins.str,
        function_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnFunction.FunctionConfigProperty", typing.Dict[builtins.str, typing.Any]]],
        name: builtins.str,
        auto_publish: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
        function_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFunction.FunctionMetadataProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param function_code: The function code. For more information about writing a CloudFront function, see `Writing function code for CloudFront Functions <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html>`_ in the *Amazon CloudFront Developer Guide* .
        :param function_config: Contains configuration information about a CloudFront function.
        :param name: A name to identify the function.
        :param auto_publish: A flag that determines whether to automatically publish the function to the ``LIVE`` stage when it’s created. To automatically publish to the ``LIVE`` stage, set this property to ``true`` .
        :param function_metadata: Contains metadata about a CloudFront function.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7fd6686720dc42916d1486e9d86a083535cb418c14fb4746839d47b9f77562f0)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnFunctionProps(
            function_code=function_code,
            function_config=function_config,
            name=name,
            auto_publish=auto_publish,
            function_metadata=function_metadata,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__676078cdc388a90c2898708674577c94e68ab34efc8ba4848182b1bbcc55aa64)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be848cae7d7e602d35f1328d28b404d48c64e114b3652041c8e99479f97f7326)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrFunctionArn")
    def attr_function_arn(self) -> builtins.str:
        '''The ARN of the function. For example:.

        ``arn:aws:cloudfront::123456789012:function/ExampleFunction`` .

        To get the function ARN, use the following syntax:

        ``!GetAtt *Function_Logical_ID* .FunctionMetadata.FunctionARN``

        :cloudformationAttribute: FunctionARN
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrFunctionArn"))

    @builtins.property
    @jsii.member(jsii_name="attrFunctionMetadataFunctionArn")
    def attr_function_metadata_function_arn(self) -> builtins.str:
        '''
        :cloudformationAttribute: FunctionMetadata.FunctionARN
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrFunctionMetadataFunctionArn"))

    @builtins.property
    @jsii.member(jsii_name="attrStage")
    def attr_stage(self) -> builtins.str:
        '''
        :cloudformationAttribute: Stage
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrStage"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="functionCode")
    def function_code(self) -> builtins.str:
        '''The function code.'''
        return typing.cast(builtins.str, jsii.get(self, "functionCode"))

    @function_code.setter
    def function_code(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97599332fb85693253c87028142c0596a8f097fc2e5e5c08def898b5d875a746)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "functionCode", value)

    @builtins.property
    @jsii.member(jsii_name="functionConfig")
    def function_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionConfigProperty"]:
        '''Contains configuration information about a CloudFront function.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionConfigProperty"], jsii.get(self, "functionConfig"))

    @function_config.setter
    def function_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e1085109b32e0c76599f999f799894997c5e13b7588671859ed027f4d0eceaf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "functionConfig", value)

    @builtins.property
    @jsii.member(jsii_name="name")
    def name(self) -> builtins.str:
        '''A name to identify the function.'''
        return typing.cast(builtins.str, jsii.get(self, "name"))

    @name.setter
    def name(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49e27efb9a632d18d709cce44f4c9025bc32523c224dcb735351068e4a2f071f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "name", value)

    @builtins.property
    @jsii.member(jsii_name="autoPublish")
    def auto_publish(
        self,
    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
        '''A flag that determines whether to automatically publish the function to the ``LIVE`` stage when it’s created.'''
        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], jsii.get(self, "autoPublish"))

    @auto_publish.setter
    def auto_publish(
        self,
        value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__827ae5409caf9c9196670ea90d3ee72840fe49ac20cace1bd57d5f83fc2617cc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "autoPublish", value)

    @builtins.property
    @jsii.member(jsii_name="functionMetadata")
    def function_metadata(
        self,
    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionMetadataProperty"]]:
        '''Contains metadata about a CloudFront function.'''
        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionMetadataProperty"]], jsii.get(self, "functionMetadata"))

    @function_metadata.setter
    def function_metadata(
        self,
        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnFunction.FunctionMetadataProperty"]],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe3c43f2af2adeb7b33e657cb565ba1627c04114bab013dcd445631d30026b9e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "functionMetadata", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnFunction.FunctionConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "comment": "comment",
            "runtime": "runtime",
            "key_value_store_associations": "keyValueStoreAssociations",
        },
    )
    class FunctionConfigProperty:
        def __init__(
            self,
            *,
            comment: builtins.str,
            runtime: builtins.str,
            key_value_store_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnFunction.KeyValueStoreAssociationProperty", typing.Dict[builtins.str, typing.Any]]]]]] = None,
        ) -> None:
            '''Contains configuration information about a CloudFront function.

            :param comment: A comment to describe the function.
            :param runtime: The function's runtime environment version.
            :param key_value_store_associations: The configuration for the key value store associations.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                function_config_property = cloudfront.CfnFunction.FunctionConfigProperty(
                    comment="comment",
                    runtime="runtime",
                
                    # the properties below are optional
                    key_value_store_associations=[cloudfront.CfnFunction.KeyValueStoreAssociationProperty(
                        key_value_store_arn="keyValueStoreArn"
                    )]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__e34db5cf326a0cd47f00dc35b60e1fbde4ec723cb88839d65178012682abd233)
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
                check_type(argname="argument runtime", value=runtime, expected_type=type_hints["runtime"])
                check_type(argname="argument key_value_store_associations", value=key_value_store_associations, expected_type=type_hints["key_value_store_associations"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "comment": comment,
                "runtime": runtime,
            }
            if key_value_store_associations is not None:
                self._values["key_value_store_associations"] = key_value_store_associations

        @builtins.property
        def comment(self) -> builtins.str:
            '''A comment to describe the function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionconfig.html#cfn-cloudfront-function-functionconfig-comment
            '''
            result = self._values.get("comment")
            assert result is not None, "Required property 'comment' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def runtime(self) -> builtins.str:
            '''The function's runtime environment version.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionconfig.html#cfn-cloudfront-function-functionconfig-runtime
            '''
            result = self._values.get("runtime")
            assert result is not None, "Required property 'runtime' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def key_value_store_associations(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnFunction.KeyValueStoreAssociationProperty"]]]]:
            '''The configuration for the key value store associations.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionconfig.html#cfn-cloudfront-function-functionconfig-keyvaluestoreassociations
            '''
            result = self._values.get("key_value_store_associations")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnFunction.KeyValueStoreAssociationProperty"]]]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "FunctionConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnFunction.FunctionMetadataProperty",
        jsii_struct_bases=[],
        name_mapping={"function_arn": "functionArn"},
    )
    class FunctionMetadataProperty:
        def __init__(
            self,
            *,
            function_arn: typing.Optional[builtins.str] = None,
        ) -> None:
            '''Contains metadata about a CloudFront function.

            :param function_arn: The Amazon Resource Name (ARN) of the function. The ARN uniquely identifies the function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionmetadata.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                function_metadata_property = cloudfront.CfnFunction.FunctionMetadataProperty(
                    function_arn="functionArn"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__4371917f1ba460651436f0ac35c2459332e11b39c45862ccbe97c6bd6041aaed)
                check_type(argname="argument function_arn", value=function_arn, expected_type=type_hints["function_arn"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if function_arn is not None:
                self._values["function_arn"] = function_arn

        @builtins.property
        def function_arn(self) -> typing.Optional[builtins.str]:
            '''The Amazon Resource Name (ARN) of the function.

            The ARN uniquely identifies the function.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-functionmetadata.html#cfn-cloudfront-function-functionmetadata-functionarn
            '''
            result = self._values.get("function_arn")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "FunctionMetadataProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnFunction.KeyValueStoreAssociationProperty",
        jsii_struct_bases=[],
        name_mapping={"key_value_store_arn": "keyValueStoreArn"},
    )
    class KeyValueStoreAssociationProperty:
        def __init__(self, *, key_value_store_arn: builtins.str) -> None:
            '''The key value store association.

            :param key_value_store_arn: The Amazon Resource Name (ARN) of the key value store association.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-keyvaluestoreassociation.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                key_value_store_association_property = cloudfront.CfnFunction.KeyValueStoreAssociationProperty(
                    key_value_store_arn="keyValueStoreArn"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__a7d3d29786c9dae5b37c513099f68b7af9dbc6d9fae4e0cbdcb48e77b4e6f592)
                check_type(argname="argument key_value_store_arn", value=key_value_store_arn, expected_type=type_hints["key_value_store_arn"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "key_value_store_arn": key_value_store_arn,
            }

        @builtins.property
        def key_value_store_arn(self) -> builtins.str:
            '''The Amazon Resource Name (ARN) of the key value store association.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-function-keyvaluestoreassociation.html#cfn-cloudfront-function-keyvaluestoreassociation-keyvaluestorearn
            '''
            result = self._values.get("key_value_store_arn")
            assert result is not None, "Required property 'key_value_store_arn' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "KeyValueStoreAssociationProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnFunctionProps",
    jsii_struct_bases=[],
    name_mapping={
        "function_code": "functionCode",
        "function_config": "functionConfig",
        "name": "name",
        "auto_publish": "autoPublish",
        "function_metadata": "functionMetadata",
    },
)
class CfnFunctionProps:
    def __init__(
        self,
        *,
        function_code: builtins.str,
        function_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
        name: builtins.str,
        auto_publish: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
        function_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionMetadataProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''Properties for defining a ``CfnFunction``.

        :param function_code: The function code. For more information about writing a CloudFront function, see `Writing function code for CloudFront Functions <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html>`_ in the *Amazon CloudFront Developer Guide* .
        :param function_config: Contains configuration information about a CloudFront function.
        :param name: A name to identify the function.
        :param auto_publish: A flag that determines whether to automatically publish the function to the ``LIVE`` stage when it’s created. To automatically publish to the ``LIVE`` stage, set this property to ``true`` .
        :param function_metadata: Contains metadata about a CloudFront function.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_function_props = cloudfront.CfnFunctionProps(
                function_code="functionCode",
                function_config=cloudfront.CfnFunction.FunctionConfigProperty(
                    comment="comment",
                    runtime="runtime",
            
                    # the properties below are optional
                    key_value_store_associations=[cloudfront.CfnFunction.KeyValueStoreAssociationProperty(
                        key_value_store_arn="keyValueStoreArn"
                    )]
                ),
                name="name",
            
                # the properties below are optional
                auto_publish=False,
                function_metadata=cloudfront.CfnFunction.FunctionMetadataProperty(
                    function_arn="functionArn"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8288752acdcd70ed40eb65e878d490645ed376ded173a5c2d02caa4e1e180024)
            check_type(argname="argument function_code", value=function_code, expected_type=type_hints["function_code"])
            check_type(argname="argument function_config", value=function_config, expected_type=type_hints["function_config"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument auto_publish", value=auto_publish, expected_type=type_hints["auto_publish"])
            check_type(argname="argument function_metadata", value=function_metadata, expected_type=type_hints["function_metadata"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "function_code": function_code,
            "function_config": function_config,
            "name": name,
        }
        if auto_publish is not None:
            self._values["auto_publish"] = auto_publish
        if function_metadata is not None:
            self._values["function_metadata"] = function_metadata

    @builtins.property
    def function_code(self) -> builtins.str:
        '''The function code.

        For more information about writing a CloudFront function, see `Writing function code for CloudFront Functions <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/writing-function-code.html>`_ in the *Amazon CloudFront Developer Guide* .

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html#cfn-cloudfront-function-functioncode
        '''
        result = self._values.get("function_code")
        assert result is not None, "Required property 'function_code' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def function_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionConfigProperty]:
        '''Contains configuration information about a CloudFront function.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html#cfn-cloudfront-function-functionconfig
        '''
        result = self._values.get("function_config")
        assert result is not None, "Required property 'function_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionConfigProperty], result)

    @builtins.property
    def name(self) -> builtins.str:
        '''A name to identify the function.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html#cfn-cloudfront-function-name
        '''
        result = self._values.get("name")
        assert result is not None, "Required property 'name' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def auto_publish(
        self,
    ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
        '''A flag that determines whether to automatically publish the function to the ``LIVE`` stage when it’s created.

        To automatically publish to the ``LIVE`` stage, set this property to ``true`` .

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html#cfn-cloudfront-function-autopublish
        '''
        result = self._values.get("auto_publish")
        return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

    @builtins.property
    def function_metadata(
        self,
    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionMetadataProperty]]:
        '''Contains metadata about a CloudFront function.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-function.html#cfn-cloudfront-function-functionmetadata
        '''
        result = self._values.get("function_metadata")
        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionMetadataProperty]], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnFunctionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnKeyGroup(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyGroup",
):
    '''A key group.

    A key group contains a list of public keys that you can use with `CloudFront signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keygroup.html
    :cloudformationResource: AWS::CloudFront::KeyGroup
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_key_group = cloudfront.CfnKeyGroup(self, "MyCfnKeyGroup",
            key_group_config=cloudfront.CfnKeyGroup.KeyGroupConfigProperty(
                items=["items"],
                name="name",
        
                # the properties below are optional
                comment="comment"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        key_group_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnKeyGroup.KeyGroupConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param key_group_config: The key group configuration.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f76122d8eb5a2e346f84a770990097cb3637adebdf9c4e339ad0d33ee6d2602c)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnKeyGroupProps(key_group_config=key_group_config)

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4109b7a561956bf3aa5d6e3fcb68e6a1ee60d3d5519af53727e7a34f1cfebb26)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43ef7a43b54c4e399ff953d311d1306c5d84a03a0f390d5bfbf705dd507dbae0)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The identifier for the key group.

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrLastModifiedTime")
    def attr_last_modified_time(self) -> builtins.str:
        '''The date and time when the key group was last modified.

        :cloudformationAttribute: LastModifiedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="keyGroupConfig")
    def key_group_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnKeyGroup.KeyGroupConfigProperty"]:
        '''The key group configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnKeyGroup.KeyGroupConfigProperty"], jsii.get(self, "keyGroupConfig"))

    @key_group_config.setter
    def key_group_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnKeyGroup.KeyGroupConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f5ed72b1e268631c85b0ecd81a9bcb5dda1c9af4f25021249f63cf35b6102f2a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "keyGroupConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyGroup.KeyGroupConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items", "name": "name", "comment": "comment"},
    )
    class KeyGroupConfigProperty:
        def __init__(
            self,
            *,
            items: typing.Sequence[builtins.str],
            name: builtins.str,
            comment: typing.Optional[builtins.str] = None,
        ) -> None:
            '''A key group configuration.

            A key group contains a list of public keys that you can use with `CloudFront signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ .

            :param items: A list of the identifiers of the public keys in the key group.
            :param name: A name to identify the key group.
            :param comment: A comment to describe the key group. The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keygroup-keygroupconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                key_group_config_property = cloudfront.CfnKeyGroup.KeyGroupConfigProperty(
                    items=["items"],
                    name="name",
                
                    # the properties below are optional
                    comment="comment"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__d3df3a5f11f8060a5933f7e1b9bd07f224d639d93b3e4bbc56115c29e9e42201)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
                "name": name,
            }
            if comment is not None:
                self._values["comment"] = comment

        @builtins.property
        def items(self) -> typing.List[builtins.str]:
            '''A list of the identifiers of the public keys in the key group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keygroup-keygroupconfig.html#cfn-cloudfront-keygroup-keygroupconfig-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.List[builtins.str], result)

        @builtins.property
        def name(self) -> builtins.str:
            '''A name to identify the key group.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keygroup-keygroupconfig.html#cfn-cloudfront-keygroup-keygroupconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the key group.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keygroup-keygroupconfig.html#cfn-cloudfront-keygroup-keygroupconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "KeyGroupConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyGroupProps",
    jsii_struct_bases=[],
    name_mapping={"key_group_config": "keyGroupConfig"},
)
class CfnKeyGroupProps:
    def __init__(
        self,
        *,
        key_group_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyGroup.KeyGroupConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnKeyGroup``.

        :param key_group_config: The key group configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keygroup.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_key_group_props = cloudfront.CfnKeyGroupProps(
                key_group_config=cloudfront.CfnKeyGroup.KeyGroupConfigProperty(
                    items=["items"],
                    name="name",
            
                    # the properties below are optional
                    comment="comment"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e741b07b1138a784b11f2ea580eddc81dd7319624a4af9812aa5af954e6eecd)
            check_type(argname="argument key_group_config", value=key_group_config, expected_type=type_hints["key_group_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "key_group_config": key_group_config,
        }

    @builtins.property
    def key_group_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnKeyGroup.KeyGroupConfigProperty]:
        '''The key group configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keygroup.html#cfn-cloudfront-keygroup-keygroupconfig
        '''
        result = self._values.get("key_group_config")
        assert result is not None, "Required property 'key_group_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnKeyGroup.KeyGroupConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnKeyGroupProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnKeyValueStore(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyValueStore",
):
    '''The key value store.

    Use this to separate data from function code, allowing you to update data without having to publish a new version of a function. The key value store holds keys and their corresponding values.

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keyvaluestore.html
    :cloudformationResource: AWS::CloudFront::KeyValueStore
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_key_value_store = cloudfront.CfnKeyValueStore(self, "MyCfnKeyValueStore",
            name="name",
        
            # the properties below are optional
            comment="comment",
            import_source=cloudfront.CfnKeyValueStore.ImportSourceProperty(
                source_arn="sourceArn",
                source_type="sourceType"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        name: builtins.str,
        comment: typing.Optional[builtins.str] = None,
        import_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnKeyValueStore.ImportSourceProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param name: The name of the key value store.
        :param comment: A comment for the key value store.
        :param import_source: The import source for the key value store.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39a9c43a6e994ac270417da8b032b21384dbcc2f5eb680a69e9a420bb725c8a3)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnKeyValueStoreProps(
            name=name, comment=comment, import_source=import_source
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7cce3c0228e7ed2efc7ae086d760e1644b87da3af4e3ad96f5db8359c9d6a55)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57efaaf906bcd24d4e9a557ea42636dffa0cb26212a58d19d3ab685a531181c8)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrArn")
    def attr_arn(self) -> builtins.str:
        '''The Amazon Resource Name (ARN) of the key value store.

        :cloudformationAttribute: Arn
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrArn"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The unique Id for the key value store.

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrStatus")
    def attr_status(self) -> builtins.str:
        '''
        :cloudformationAttribute: Status
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrStatus"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="name")
    def name(self) -> builtins.str:
        '''The name of the key value store.'''
        return typing.cast(builtins.str, jsii.get(self, "name"))

    @name.setter
    def name(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31c81f83ed9c5a25440ffda441f09dcb33411d9684b0a3146646cb289054da0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "name", value)

    @builtins.property
    @jsii.member(jsii_name="comment")
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment for the key value store.'''
        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "comment"))

    @comment.setter
    def comment(self, value: typing.Optional[builtins.str]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7ef3d5363a87ed84c6584e05c362a97bac2792589a6003e1851446b936205f8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "comment", value)

    @builtins.property
    @jsii.member(jsii_name="importSource")
    def import_source(
        self,
    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnKeyValueStore.ImportSourceProperty"]]:
        '''The import source for the key value store.'''
        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnKeyValueStore.ImportSourceProperty"]], jsii.get(self, "importSource"))

    @import_source.setter
    def import_source(
        self,
        value: typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnKeyValueStore.ImportSourceProperty"]],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bfd48a97d25e7b681206f3f821672b491cdb6e27eb4858257cc5f853e5674c56)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "importSource", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyValueStore.ImportSourceProperty",
        jsii_struct_bases=[],
        name_mapping={"source_arn": "sourceArn", "source_type": "sourceType"},
    )
    class ImportSourceProperty:
        def __init__(
            self,
            *,
            source_arn: builtins.str,
            source_type: builtins.str,
        ) -> None:
            '''The import source for the key value store.

            :param source_arn: The Amazon Resource Name (ARN) of the import source for the key value store.
            :param source_type: The source type of the import source for the key value store.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keyvaluestore-importsource.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                import_source_property = cloudfront.CfnKeyValueStore.ImportSourceProperty(
                    source_arn="sourceArn",
                    source_type="sourceType"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__c607ebfca7e05fb52f9d41898246334c1bd226fe4d739e9e3061836324174f88)
                check_type(argname="argument source_arn", value=source_arn, expected_type=type_hints["source_arn"])
                check_type(argname="argument source_type", value=source_type, expected_type=type_hints["source_type"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "source_arn": source_arn,
                "source_type": source_type,
            }

        @builtins.property
        def source_arn(self) -> builtins.str:
            '''The Amazon Resource Name (ARN) of the import source for the key value store.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keyvaluestore-importsource.html#cfn-cloudfront-keyvaluestore-importsource-sourcearn
            '''
            result = self._values.get("source_arn")
            assert result is not None, "Required property 'source_arn' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def source_type(self) -> builtins.str:
            '''The source type of the import source for the key value store.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-keyvaluestore-importsource.html#cfn-cloudfront-keyvaluestore-importsource-sourcetype
            '''
            result = self._values.get("source_type")
            assert result is not None, "Required property 'source_type' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ImportSourceProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnKeyValueStoreProps",
    jsii_struct_bases=[],
    name_mapping={
        "name": "name",
        "comment": "comment",
        "import_source": "importSource",
    },
)
class CfnKeyValueStoreProps:
    def __init__(
        self,
        *,
        name: builtins.str,
        comment: typing.Optional[builtins.str] = None,
        import_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyValueStore.ImportSourceProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''Properties for defining a ``CfnKeyValueStore``.

        :param name: The name of the key value store.
        :param comment: A comment for the key value store.
        :param import_source: The import source for the key value store.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keyvaluestore.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_key_value_store_props = cloudfront.CfnKeyValueStoreProps(
                name="name",
            
                # the properties below are optional
                comment="comment",
                import_source=cloudfront.CfnKeyValueStore.ImportSourceProperty(
                    source_arn="sourceArn",
                    source_type="sourceType"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46271f68955fd8497d5300c52e033d659758a0ba193251ef2f5c50bdda198fa2)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument import_source", value=import_source, expected_type=type_hints["import_source"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "name": name,
        }
        if comment is not None:
            self._values["comment"] = comment
        if import_source is not None:
            self._values["import_source"] = import_source

    @builtins.property
    def name(self) -> builtins.str:
        '''The name of the key value store.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keyvaluestore.html#cfn-cloudfront-keyvaluestore-name
        '''
        result = self._values.get("name")
        assert result is not None, "Required property 'name' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment for the key value store.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keyvaluestore.html#cfn-cloudfront-keyvaluestore-comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def import_source(
        self,
    ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, CfnKeyValueStore.ImportSourceProperty]]:
        '''The import source for the key value store.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-keyvaluestore.html#cfn-cloudfront-keyvaluestore-importsource
        '''
        result = self._values.get("import_source")
        return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, CfnKeyValueStore.ImportSourceProperty]], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnKeyValueStoreProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnMonitoringSubscription(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnMonitoringSubscription",
):
    '''A monitoring subscription.

    This structure contains information about whether additional CloudWatch metrics are enabled for a given CloudFront distribution.

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-monitoringsubscription.html
    :cloudformationResource: AWS::CloudFront::MonitoringSubscription
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_monitoring_subscription = cloudfront.CfnMonitoringSubscription(self, "MyCfnMonitoringSubscription",
            distribution_id="distributionId",
            monitoring_subscription=cloudfront.CfnMonitoringSubscription.MonitoringSubscriptionProperty(
                realtime_metrics_subscription_config=cloudfront.CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty(
                    realtime_metrics_subscription_status="realtimeMetricsSubscriptionStatus"
                )
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        distribution_id: builtins.str,
        monitoring_subscription: typing.Union[_IResolvable_da3f097b, typing.Union["CfnMonitoringSubscription.MonitoringSubscriptionProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param distribution_id: The ID of the distribution that you are enabling metrics for.
        :param monitoring_subscription: A subscription configuration for additional CloudWatch metrics.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ced3ed079ed433587ef1975eb7679215d61c861fee5ee32066a1c0a3396cd698)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnMonitoringSubscriptionProps(
            distribution_id=distribution_id,
            monitoring_subscription=monitoring_subscription,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f97fee287b7cc733d9e3d225cb221d2e6e85c8827eebd3a31754f7c8730e3f76)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6843f71d8a39e921ed9135a7df139720bb810abd43c3eb2d2fecda4798de72c4)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="distributionId")
    def distribution_id(self) -> builtins.str:
        '''The ID of the distribution that you are enabling metrics for.'''
        return typing.cast(builtins.str, jsii.get(self, "distributionId"))

    @distribution_id.setter
    def distribution_id(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7800c3e8dc8908a3f056fdb42d3210ab64e0eab502963a833ad4c34e4f9fd397)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "distributionId", value)

    @builtins.property
    @jsii.member(jsii_name="monitoringSubscription")
    def monitoring_subscription(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnMonitoringSubscription.MonitoringSubscriptionProperty"]:
        '''A subscription configuration for additional CloudWatch metrics.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnMonitoringSubscription.MonitoringSubscriptionProperty"], jsii.get(self, "monitoringSubscription"))

    @monitoring_subscription.setter
    def monitoring_subscription(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnMonitoringSubscription.MonitoringSubscriptionProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6a73e9da7bd64c6f8edfeda9db92c61f11177fd45e61323cc95783240a1f833)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "monitoringSubscription", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnMonitoringSubscription.MonitoringSubscriptionProperty",
        jsii_struct_bases=[],
        name_mapping={
            "realtime_metrics_subscription_config": "realtimeMetricsSubscriptionConfig",
        },
    )
    class MonitoringSubscriptionProperty:
        def __init__(
            self,
            *,
            realtime_metrics_subscription_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''A monitoring subscription.

            This structure contains information about whether additional CloudWatch metrics are enabled for a given CloudFront distribution.

            :param realtime_metrics_subscription_config: A subscription configuration for additional CloudWatch metrics.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-monitoringsubscription-monitoringsubscription.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                monitoring_subscription_property = cloudfront.CfnMonitoringSubscription.MonitoringSubscriptionProperty(
                    realtime_metrics_subscription_config=cloudfront.CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty(
                        realtime_metrics_subscription_status="realtimeMetricsSubscriptionStatus"
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__2b52c65657e5a9a1c856774b5fc17a8b4ae8f058973cb17f179c4bb277cac388)
                check_type(argname="argument realtime_metrics_subscription_config", value=realtime_metrics_subscription_config, expected_type=type_hints["realtime_metrics_subscription_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if realtime_metrics_subscription_config is not None:
                self._values["realtime_metrics_subscription_config"] = realtime_metrics_subscription_config

        @builtins.property
        def realtime_metrics_subscription_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty"]]:
            '''A subscription configuration for additional CloudWatch metrics.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-monitoringsubscription-monitoringsubscription.html#cfn-cloudfront-monitoringsubscription-monitoringsubscription-realtimemetricssubscriptionconfig
            '''
            result = self._values.get("realtime_metrics_subscription_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "MonitoringSubscriptionProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "realtime_metrics_subscription_status": "realtimeMetricsSubscriptionStatus",
        },
    )
    class RealtimeMetricsSubscriptionConfigProperty:
        def __init__(
            self,
            *,
            realtime_metrics_subscription_status: builtins.str,
        ) -> None:
            '''A subscription configuration for additional CloudWatch metrics.

            :param realtime_metrics_subscription_status: A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-monitoringsubscription-realtimemetricssubscriptionconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                realtime_metrics_subscription_config_property = cloudfront.CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty(
                    realtime_metrics_subscription_status="realtimeMetricsSubscriptionStatus"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__c3261c1424c358856cecb0c4a928988154b733f6cb60193809668157d473c98d)
                check_type(argname="argument realtime_metrics_subscription_status", value=realtime_metrics_subscription_status, expected_type=type_hints["realtime_metrics_subscription_status"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "realtime_metrics_subscription_status": realtime_metrics_subscription_status,
            }

        @builtins.property
        def realtime_metrics_subscription_status(self) -> builtins.str:
            '''A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-monitoringsubscription-realtimemetricssubscriptionconfig.html#cfn-cloudfront-monitoringsubscription-realtimemetricssubscriptionconfig-realtimemetricssubscriptionstatus
            '''
            result = self._values.get("realtime_metrics_subscription_status")
            assert result is not None, "Required property 'realtime_metrics_subscription_status' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "RealtimeMetricsSubscriptionConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnMonitoringSubscriptionProps",
    jsii_struct_bases=[],
    name_mapping={
        "distribution_id": "distributionId",
        "monitoring_subscription": "monitoringSubscription",
    },
)
class CfnMonitoringSubscriptionProps:
    def __init__(
        self,
        *,
        distribution_id: builtins.str,
        monitoring_subscription: typing.Union[_IResolvable_da3f097b, typing.Union[CfnMonitoringSubscription.MonitoringSubscriptionProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnMonitoringSubscription``.

        :param distribution_id: The ID of the distribution that you are enabling metrics for.
        :param monitoring_subscription: A subscription configuration for additional CloudWatch metrics.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-monitoringsubscription.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_monitoring_subscription_props = cloudfront.CfnMonitoringSubscriptionProps(
                distribution_id="distributionId",
                monitoring_subscription=cloudfront.CfnMonitoringSubscription.MonitoringSubscriptionProperty(
                    realtime_metrics_subscription_config=cloudfront.CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty(
                        realtime_metrics_subscription_status="realtimeMetricsSubscriptionStatus"
                    )
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__089c727048b6b3871663119f330661529675476b9932f9b82a2fc2053495a985)
            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
            check_type(argname="argument monitoring_subscription", value=monitoring_subscription, expected_type=type_hints["monitoring_subscription"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "distribution_id": distribution_id,
            "monitoring_subscription": monitoring_subscription,
        }

    @builtins.property
    def distribution_id(self) -> builtins.str:
        '''The ID of the distribution that you are enabling metrics for.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-monitoringsubscription.html#cfn-cloudfront-monitoringsubscription-distributionid
        '''
        result = self._values.get("distribution_id")
        assert result is not None, "Required property 'distribution_id' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def monitoring_subscription(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnMonitoringSubscription.MonitoringSubscriptionProperty]:
        '''A subscription configuration for additional CloudWatch metrics.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-monitoringsubscription.html#cfn-cloudfront-monitoringsubscription-monitoringsubscription
        '''
        result = self._values.get("monitoring_subscription")
        assert result is not None, "Required property 'monitoring_subscription' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnMonitoringSubscription.MonitoringSubscriptionProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnMonitoringSubscriptionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnOriginAccessControl(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginAccessControl",
):
    '''Creates a new origin access control in CloudFront.

    After you create an origin access control, you can add it to an origin in a CloudFront distribution so that CloudFront sends authenticated (signed) requests to the origin.

    This makes it possible to block public access to the origin, allowing viewers (users) to access the origin's content only through CloudFront.

    For more information about using a CloudFront origin access control, see `Restricting access to an AWS origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originaccesscontrol.html
    :cloudformationResource: AWS::CloudFront::OriginAccessControl
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_origin_access_control = cloudfront.CfnOriginAccessControl(self, "MyCfnOriginAccessControl",
            origin_access_control_config=cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
                name="name",
                origin_access_control_origin_type="originAccessControlOriginType",
                signing_behavior="signingBehavior",
                signing_protocol="signingProtocol",
        
                # the properties below are optional
                description="description"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        origin_access_control_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnOriginAccessControl.OriginAccessControlConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param origin_access_control_config: The origin access control.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cede2a2577225484fb142173757735a061c8f8a7b77f7775c71aeb2558ef67b3)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnOriginAccessControlProps(
            origin_access_control_config=origin_access_control_config
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__543dd4c22fad038021b080a1cf4dfdf0974d39f6434fef84a84800ed4ab06110)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__754e4ee68f0c6f44fd3ea6d6c2353cfb7720ea4c3ebc33bfd96ceb4402144bb2)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The unique identifier of the origin access control.

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="originAccessControlConfig")
    def origin_access_control_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnOriginAccessControl.OriginAccessControlConfigProperty"]:
        '''The origin access control.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnOriginAccessControl.OriginAccessControlConfigProperty"], jsii.get(self, "originAccessControlConfig"))

    @origin_access_control_config.setter
    def origin_access_control_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnOriginAccessControl.OriginAccessControlConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ce66d3b823fd9ddad2c2b62c7851eb33500f3dcb8168e58af67867c2f6aae9d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "originAccessControlConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "name": "name",
            "origin_access_control_origin_type": "originAccessControlOriginType",
            "signing_behavior": "signingBehavior",
            "signing_protocol": "signingProtocol",
            "description": "description",
        },
    )
    class OriginAccessControlConfigProperty:
        def __init__(
            self,
            *,
            name: builtins.str,
            origin_access_control_origin_type: builtins.str,
            signing_behavior: builtins.str,
            signing_protocol: builtins.str,
            description: typing.Optional[builtins.str] = None,
        ) -> None:
            '''Creates a new origin access control in CloudFront.

            After you create an origin access control, you can add it to an origin in a CloudFront distribution so that CloudFront sends authenticated (signed) requests to the origin.

            This makes it possible to block public access to the origin, allowing viewers (users) to access the origin's content only through CloudFront.

            For more information about using a CloudFront origin access control, see `Restricting access to an AWS origin <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-origin.html>`_ in the *Amazon CloudFront Developer Guide* .

            :param name: A name to identify the origin access control. You can specify up to 64 characters.
            :param origin_access_control_origin_type: The type of origin that this origin access control is for.
            :param signing_behavior: Specifies which requests CloudFront signs (adds authentication information to). Specify ``always`` for the most common use case. For more information, see `origin access control advanced settings <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#oac-advanced-settings>`_ in the *Amazon CloudFront Developer Guide* . This field can have one of the following values: - ``always`` – CloudFront signs all origin requests, overwriting the ``Authorization`` header from the viewer request if one exists. - ``never`` – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control. - ``no-override`` – If the viewer request doesn't contain the ``Authorization`` header, then CloudFront signs the origin request. If the viewer request contains the ``Authorization`` header, then CloudFront doesn't sign the origin request and instead passes along the ``Authorization`` header from the viewer request. *WARNING: To pass along the ``Authorization`` header from the viewer request, you *must* add the ``Authorization`` header to a `cache policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html>`_ for all cache behaviors that use origins associated with this origin access control.*
            :param signing_protocol: The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests. The only valid value is ``sigv4`` .
            :param description: A description of the origin access control.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_access_control_config_property = cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
                    name="name",
                    origin_access_control_origin_type="originAccessControlOriginType",
                    signing_behavior="signingBehavior",
                    signing_protocol="signingProtocol",
                
                    # the properties below are optional
                    description="description"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__fe6bbad92b3305732dd85f773454e01a0834fcc91bbaf513be994c67698e5e3d)
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument origin_access_control_origin_type", value=origin_access_control_origin_type, expected_type=type_hints["origin_access_control_origin_type"])
                check_type(argname="argument signing_behavior", value=signing_behavior, expected_type=type_hints["signing_behavior"])
                check_type(argname="argument signing_protocol", value=signing_protocol, expected_type=type_hints["signing_protocol"])
                check_type(argname="argument description", value=description, expected_type=type_hints["description"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "name": name,
                "origin_access_control_origin_type": origin_access_control_origin_type,
                "signing_behavior": signing_behavior,
                "signing_protocol": signing_protocol,
            }
            if description is not None:
                self._values["description"] = description

        @builtins.property
        def name(self) -> builtins.str:
            '''A name to identify the origin access control.

            You can specify up to 64 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def origin_access_control_origin_type(self) -> builtins.str:
            '''The type of origin that this origin access control is for.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig-originaccesscontrolorigintype
            '''
            result = self._values.get("origin_access_control_origin_type")
            assert result is not None, "Required property 'origin_access_control_origin_type' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def signing_behavior(self) -> builtins.str:
            '''Specifies which requests CloudFront signs (adds authentication information to).

            Specify ``always`` for the most common use case. For more information, see `origin access control advanced settings <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#oac-advanced-settings>`_ in the *Amazon CloudFront Developer Guide* .

            This field can have one of the following values:

            - ``always`` – CloudFront signs all origin requests, overwriting the ``Authorization`` header from the viewer request if one exists.
            - ``never`` – CloudFront doesn't sign any origin requests. This value turns off origin access control for all origins in all distributions that use this origin access control.
            - ``no-override`` – If the viewer request doesn't contain the ``Authorization`` header, then CloudFront signs the origin request. If the viewer request contains the ``Authorization`` header, then CloudFront doesn't sign the origin request and instead passes along the ``Authorization`` header from the viewer request. *WARNING: To pass along the ``Authorization`` header from the viewer request, you *must* add the ``Authorization`` header to a `cache policy <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/controlling-the-cache-key.html>`_ for all cache behaviors that use origins associated with this origin access control.*

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig-signingbehavior
            '''
            result = self._values.get("signing_behavior")
            assert result is not None, "Required property 'signing_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def signing_protocol(self) -> builtins.str:
            '''The signing protocol of the origin access control, which determines how CloudFront signs (authenticates) requests.

            The only valid value is ``sigv4`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig-signingprotocol
            '''
            result = self._values.get("signing_protocol")
            assert result is not None, "Required property 'signing_protocol' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def description(self) -> typing.Optional[builtins.str]:
            '''A description of the origin access control.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originaccesscontrol-originaccesscontrolconfig.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig-description
            '''
            result = self._values.get("description")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginAccessControlConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginAccessControlProps",
    jsii_struct_bases=[],
    name_mapping={"origin_access_control_config": "originAccessControlConfig"},
)
class CfnOriginAccessControlProps:
    def __init__(
        self,
        *,
        origin_access_control_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginAccessControl.OriginAccessControlConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnOriginAccessControl``.

        :param origin_access_control_config: The origin access control.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originaccesscontrol.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_origin_access_control_props = cloudfront.CfnOriginAccessControlProps(
                origin_access_control_config=cloudfront.CfnOriginAccessControl.OriginAccessControlConfigProperty(
                    name="name",
                    origin_access_control_origin_type="originAccessControlOriginType",
                    signing_behavior="signingBehavior",
                    signing_protocol="signingProtocol",
            
                    # the properties below are optional
                    description="description"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b1fbc2954cdd2961f2225e1ee8c307ccf5186155cc0113debc58c59ad715aa9)
            check_type(argname="argument origin_access_control_config", value=origin_access_control_config, expected_type=type_hints["origin_access_control_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "origin_access_control_config": origin_access_control_config,
        }

    @builtins.property
    def origin_access_control_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnOriginAccessControl.OriginAccessControlConfigProperty]:
        '''The origin access control.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originaccesscontrol.html#cfn-cloudfront-originaccesscontrol-originaccesscontrolconfig
        '''
        result = self._values.get("origin_access_control_config")
        assert result is not None, "Required property 'origin_access_control_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnOriginAccessControl.OriginAccessControlConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnOriginAccessControlProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnOriginRequestPolicy(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicy",
):
    '''An origin request policy.

    When it's attached to a cache behavior, the origin request policy determines the values that CloudFront includes in requests that it sends to the origin. Each request that CloudFront sends to the origin includes the following:

    - The request body and the URL path (without the domain name) from the viewer request.
    - The headers that CloudFront automatically includes in every origin request, including ``Host`` , ``User-Agent`` , and ``X-Amz-Cf-Id`` .
    - All HTTP headers, cookies, and URL query strings that are specified in the cache policy or the origin request policy. These can include items from the viewer request and, in the case of headers, additional ones that are added by CloudFront.

    CloudFront sends a request when it can't find an object in its cache that matches the request. If you want to send values to the origin and also include them in the cache key, use ``CachePolicy`` .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originrequestpolicy.html
    :cloudformationResource: AWS::CloudFront::OriginRequestPolicy
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_origin_request_policy = cloudfront.CfnOriginRequestPolicy(self, "MyCfnOriginRequestPolicy",
            origin_request_policy_config=cloudfront.CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty(
                cookies_config=cloudfront.CfnOriginRequestPolicy.CookiesConfigProperty(
                    cookie_behavior="cookieBehavior",
        
                    # the properties below are optional
                    cookies=["cookies"]
                ),
                headers_config=cloudfront.CfnOriginRequestPolicy.HeadersConfigProperty(
                    header_behavior="headerBehavior",
        
                    # the properties below are optional
                    headers=["headers"]
                ),
                name="name",
                query_strings_config=cloudfront.CfnOriginRequestPolicy.QueryStringsConfigProperty(
                    query_string_behavior="queryStringBehavior",
        
                    # the properties below are optional
                    query_strings=["queryStrings"]
                ),
        
                # the properties below are optional
                comment="comment"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        origin_request_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param origin_request_policy_config: The origin request policy configuration.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__871d96ff224e7800447b82036cafd3ac5d0f4648e4030dbdae394618d6ed3a14)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnOriginRequestPolicyProps(
            origin_request_policy_config=origin_request_policy_config
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__17a470a01a640b399abf4d951ca5ea2146c8bc5036fc78a0c198f47c6a0bfba4)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__adca9bb24d1f287e0c732fd2df9f03b98fac699c939f9780dcf75ddb176fb7d2)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The unique identifier for the origin request policy.

        For example: ``befd7079-9bbc-4ebf-8ade-498a3694176c`` .

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrLastModifiedTime")
    def attr_last_modified_time(self) -> builtins.str:
        '''The date and time when the origin request policy was last modified.

        :cloudformationAttribute: LastModifiedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="originRequestPolicyConfig")
    def origin_request_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty"]:
        '''The origin request policy configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty"], jsii.get(self, "originRequestPolicyConfig"))

    @origin_request_policy_config.setter
    def origin_request_policy_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__708e0c2a481cb4e4b68fc467580d318614020b97e17eaa433b6804731ced5237)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "originRequestPolicyConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicy.CookiesConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"cookie_behavior": "cookieBehavior", "cookies": "cookies"},
    )
    class CookiesConfigProperty:
        def __init__(
            self,
            *,
            cookie_behavior: builtins.str,
            cookies: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.

            :param cookie_behavior: Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:. - ``none`` – No cookies in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any cookies that are listed in a ``CachePolicy`` *are* included in origin requests. - ``whitelist`` – Only the cookies in viewer requests that are listed in the ``CookieNames`` type are included in requests that CloudFront sends to the origin. - ``all`` – All cookies in viewer requests are included in requests that CloudFront sends to the origin. - ``allExcept`` – All cookies in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``CookieNames`` type, which are not included.
            :param cookies: Contains a list of cookie names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-cookiesconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cookies_config_property = cloudfront.CfnOriginRequestPolicy.CookiesConfigProperty(
                    cookie_behavior="cookieBehavior",
                
                    # the properties below are optional
                    cookies=["cookies"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__6a47926a5ee3ea9da47695059c974e765d83ca1bddf1093f834026bd1127590a)
                check_type(argname="argument cookie_behavior", value=cookie_behavior, expected_type=type_hints["cookie_behavior"])
                check_type(argname="argument cookies", value=cookies, expected_type=type_hints["cookies"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "cookie_behavior": cookie_behavior,
            }
            if cookies is not None:
                self._values["cookies"] = cookies

        @builtins.property
        def cookie_behavior(self) -> builtins.str:
            '''Determines whether cookies in viewer requests are included in requests that CloudFront sends to the origin. Valid values are:.

            - ``none`` – No cookies in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any cookies that are listed in a ``CachePolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the cookies in viewer requests that are listed in the ``CookieNames`` type are included in requests that CloudFront sends to the origin.
            - ``all`` – All cookies in viewer requests are included in requests that CloudFront sends to the origin.
            - ``allExcept`` – All cookies in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``CookieNames`` type, which are not included.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-cookiesconfig.html#cfn-cloudfront-originrequestpolicy-cookiesconfig-cookiebehavior
            '''
            result = self._values.get("cookie_behavior")
            assert result is not None, "Required property 'cookie_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def cookies(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of cookie names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-cookiesconfig.html#cfn-cloudfront-originrequestpolicy-cookiesconfig-cookies
            '''
            result = self._values.get("cookies")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CookiesConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicy.HeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"header_behavior": "headerBehavior", "headers": "headers"},
    )
    class HeadersConfigProperty:
        def __init__(
            self,
            *,
            header_behavior: builtins.str,
            headers: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any HTTP headers (and if so, which headers) are included in requests that CloudFront sends to the origin.

            :param header_behavior: Determines whether any HTTP headers are included in requests that CloudFront sends to the origin. Valid values are:. - ``none`` – No HTTP headers in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any headers that are listed in a ``CachePolicy`` *are* included in origin requests. - ``whitelist`` – Only the HTTP headers that are listed in the ``Headers`` type are included in requests that CloudFront sends to the origin. - ``allViewer`` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin. - ``allViewerAndWhitelistCloudFront`` – All HTTP headers in viewer requests and the additional CloudFront headers that are listed in the ``Headers`` type are included in requests that CloudFront sends to the origin. The additional headers are added by CloudFront. - ``allExcept`` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``Headers`` type, which are not included.
            :param headers: Contains a list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-headersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                headers_config_property = cloudfront.CfnOriginRequestPolicy.HeadersConfigProperty(
                    header_behavior="headerBehavior",
                
                    # the properties below are optional
                    headers=["headers"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__90a333fc7f9bca79e47989a1bdea615205e7877a721603c7f09b019303991fe1)
                check_type(argname="argument header_behavior", value=header_behavior, expected_type=type_hints["header_behavior"])
                check_type(argname="argument headers", value=headers, expected_type=type_hints["headers"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header_behavior": header_behavior,
            }
            if headers is not None:
                self._values["headers"] = headers

        @builtins.property
        def header_behavior(self) -> builtins.str:
            '''Determines whether any HTTP headers are included in requests that CloudFront sends to the origin. Valid values are:.

            - ``none`` – No HTTP headers in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any headers that are listed in a ``CachePolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the HTTP headers that are listed in the ``Headers`` type are included in requests that CloudFront sends to the origin.
            - ``allViewer`` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin.
            - ``allViewerAndWhitelistCloudFront`` – All HTTP headers in viewer requests and the additional CloudFront headers that are listed in the ``Headers`` type are included in requests that CloudFront sends to the origin. The additional headers are added by CloudFront.
            - ``allExcept`` – All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``Headers`` type, which are not included.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-headersconfig.html#cfn-cloudfront-originrequestpolicy-headersconfig-headerbehavior
            '''
            result = self._values.get("header_behavior")
            assert result is not None, "Required property 'header_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def headers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-headersconfig.html#cfn-cloudfront-originrequestpolicy-headersconfig-headers
            '''
            result = self._values.get("headers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "HeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "cookies_config": "cookiesConfig",
            "headers_config": "headersConfig",
            "name": "name",
            "query_strings_config": "queryStringsConfig",
            "comment": "comment",
        },
    )
    class OriginRequestPolicyConfigProperty:
        def __init__(
            self,
            *,
            cookies_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnOriginRequestPolicy.CookiesConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            headers_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnOriginRequestPolicy.HeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            name: builtins.str,
            query_strings_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnOriginRequestPolicy.QueryStringsConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            comment: typing.Optional[builtins.str] = None,
        ) -> None:
            '''An origin request policy configuration.

            This configuration determines the values that CloudFront includes in requests that it sends to the origin. Each request that CloudFront sends to the origin includes the following:

            - The request body and the URL path (without the domain name) from the viewer request.
            - The headers that CloudFront automatically includes in every origin request, including ``Host`` , ``User-Agent`` , and ``X-Amz-Cf-Id`` .
            - All HTTP headers, cookies, and URL query strings that are specified in the cache policy or the origin request policy. These can include items from the viewer request and, in the case of headers, additional ones that are added by CloudFront.

            CloudFront sends a request when it can't find an object in its cache that matches the request. If you want to send values to the origin and also include them in the cache key, use ``CachePolicy`` .

            :param cookies_config: The cookies from viewer requests to include in origin requests.
            :param headers_config: The HTTP headers to include in origin requests. These can include headers from viewer requests and additional headers added by CloudFront.
            :param name: A unique name to identify the origin request policy.
            :param query_strings_config: The URL query strings from viewer requests to include in origin requests.
            :param comment: A comment to describe the origin request policy. The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                origin_request_policy_config_property = cloudfront.CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty(
                    cookies_config=cloudfront.CfnOriginRequestPolicy.CookiesConfigProperty(
                        cookie_behavior="cookieBehavior",
                
                        # the properties below are optional
                        cookies=["cookies"]
                    ),
                    headers_config=cloudfront.CfnOriginRequestPolicy.HeadersConfigProperty(
                        header_behavior="headerBehavior",
                
                        # the properties below are optional
                        headers=["headers"]
                    ),
                    name="name",
                    query_strings_config=cloudfront.CfnOriginRequestPolicy.QueryStringsConfigProperty(
                        query_string_behavior="queryStringBehavior",
                
                        # the properties below are optional
                        query_strings=["queryStrings"]
                    ),
                
                    # the properties below are optional
                    comment="comment"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__7ba27550e98e403814785efd5215b6924c905fcd213901b3c80e06412bc851e4)
                check_type(argname="argument cookies_config", value=cookies_config, expected_type=type_hints["cookies_config"])
                check_type(argname="argument headers_config", value=headers_config, expected_type=type_hints["headers_config"])
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument query_strings_config", value=query_strings_config, expected_type=type_hints["query_strings_config"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "cookies_config": cookies_config,
                "headers_config": headers_config,
                "name": name,
                "query_strings_config": query_strings_config,
            }
            if comment is not None:
                self._values["comment"] = comment

        @builtins.property
        def cookies_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.CookiesConfigProperty"]:
            '''The cookies from viewer requests to include in origin requests.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig-cookiesconfig
            '''
            result = self._values.get("cookies_config")
            assert result is not None, "Required property 'cookies_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.CookiesConfigProperty"], result)

        @builtins.property
        def headers_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.HeadersConfigProperty"]:
            '''The HTTP headers to include in origin requests.

            These can include headers from viewer requests and additional headers added by CloudFront.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig-headersconfig
            '''
            result = self._values.get("headers_config")
            assert result is not None, "Required property 'headers_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.HeadersConfigProperty"], result)

        @builtins.property
        def name(self) -> builtins.str:
            '''A unique name to identify the origin request policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def query_strings_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.QueryStringsConfigProperty"]:
            '''The URL query strings from viewer requests to include in origin requests.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig-querystringsconfig
            '''
            result = self._values.get("query_strings_config")
            assert result is not None, "Required property 'query_strings_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnOriginRequestPolicy.QueryStringsConfigProperty"], result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the origin request policy.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-originrequestpolicyconfig.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "OriginRequestPolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicy.QueryStringsConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "query_string_behavior": "queryStringBehavior",
            "query_strings": "queryStrings",
        },
    )
    class QueryStringsConfigProperty:
        def __init__(
            self,
            *,
            query_string_behavior: builtins.str,
            query_strings: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''An object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in requests that CloudFront sends to the origin.

            :param query_string_behavior: Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin. Valid values are: - ``none`` – No query strings in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any query strings that are listed in a ``CachePolicy`` *are* included in origin requests. - ``whitelist`` – Only the query strings in viewer requests that are listed in the ``QueryStringNames`` type are included in requests that CloudFront sends to the origin. - ``all`` – All query strings in viewer requests are included in requests that CloudFront sends to the origin. - ``allExcept`` – All query strings in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``QueryStringNames`` type, which are not included.
            :param query_strings: Contains a list of query string names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-querystringsconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                query_strings_config_property = cloudfront.CfnOriginRequestPolicy.QueryStringsConfigProperty(
                    query_string_behavior="queryStringBehavior",
                
                    # the properties below are optional
                    query_strings=["queryStrings"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__5bb1e5d3e926a4d875db1d85b4638271e50fe135a8b15196fcf07944de291749)
                check_type(argname="argument query_string_behavior", value=query_string_behavior, expected_type=type_hints["query_string_behavior"])
                check_type(argname="argument query_strings", value=query_strings, expected_type=type_hints["query_strings"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "query_string_behavior": query_string_behavior,
            }
            if query_strings is not None:
                self._values["query_strings"] = query_strings

        @builtins.property
        def query_string_behavior(self) -> builtins.str:
            '''Determines whether any URL query strings in viewer requests are included in requests that CloudFront sends to the origin.

            Valid values are:

            - ``none`` – No query strings in viewer requests are included in requests that CloudFront sends to the origin. Even when this field is set to ``none`` , any query strings that are listed in a ``CachePolicy`` *are* included in origin requests.
            - ``whitelist`` – Only the query strings in viewer requests that are listed in the ``QueryStringNames`` type are included in requests that CloudFront sends to the origin.
            - ``all`` – All query strings in viewer requests are included in requests that CloudFront sends to the origin.
            - ``allExcept`` – All query strings in viewer requests are included in requests that CloudFront sends to the origin, **except** for those listed in the ``QueryStringNames`` type, which are not included.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-querystringsconfig.html#cfn-cloudfront-originrequestpolicy-querystringsconfig-querystringbehavior
            '''
            result = self._values.get("query_string_behavior")
            assert result is not None, "Required property 'query_string_behavior' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def query_strings(self) -> typing.Optional[typing.List[builtins.str]]:
            '''Contains a list of query string names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-originrequestpolicy-querystringsconfig.html#cfn-cloudfront-originrequestpolicy-querystringsconfig-querystrings
            '''
            result = self._values.get("query_strings")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "QueryStringsConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnOriginRequestPolicyProps",
    jsii_struct_bases=[],
    name_mapping={"origin_request_policy_config": "originRequestPolicyConfig"},
)
class CfnOriginRequestPolicyProps:
    def __init__(
        self,
        *,
        origin_request_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnOriginRequestPolicy``.

        :param origin_request_policy_config: The origin request policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originrequestpolicy.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_origin_request_policy_props = cloudfront.CfnOriginRequestPolicyProps(
                origin_request_policy_config=cloudfront.CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty(
                    cookies_config=cloudfront.CfnOriginRequestPolicy.CookiesConfigProperty(
                        cookie_behavior="cookieBehavior",
            
                        # the properties below are optional
                        cookies=["cookies"]
                    ),
                    headers_config=cloudfront.CfnOriginRequestPolicy.HeadersConfigProperty(
                        header_behavior="headerBehavior",
            
                        # the properties below are optional
                        headers=["headers"]
                    ),
                    name="name",
                    query_strings_config=cloudfront.CfnOriginRequestPolicy.QueryStringsConfigProperty(
                        query_string_behavior="queryStringBehavior",
            
                        # the properties below are optional
                        query_strings=["queryStrings"]
                    ),
            
                    # the properties below are optional
                    comment="comment"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa3e30be794fd122ac4b5c2f0e08c1d05c03023005916178d5d5c14e56db6f8d)
            check_type(argname="argument origin_request_policy_config", value=origin_request_policy_config, expected_type=type_hints["origin_request_policy_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "origin_request_policy_config": origin_request_policy_config,
        }

    @builtins.property
    def origin_request_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty]:
        '''The origin request policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-originrequestpolicy.html#cfn-cloudfront-originrequestpolicy-originrequestpolicyconfig
        '''
        result = self._values.get("origin_request_policy_config")
        assert result is not None, "Required property 'origin_request_policy_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnOriginRequestPolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnPublicKey(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnPublicKey",
):
    '''A public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-publickey.html
    :cloudformationResource: AWS::CloudFront::PublicKey
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_public_key = cloudfront.CfnPublicKey(self, "MyCfnPublicKey",
            public_key_config=cloudfront.CfnPublicKey.PublicKeyConfigProperty(
                caller_reference="callerReference",
                encoded_key="encodedKey",
                name="name",
        
                # the properties below are optional
                comment="comment"
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        public_key_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnPublicKey.PublicKeyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param public_key_config: Configuration information about a public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b1958332a898112d6a8103bbe8e7c119db53593ff5ad9f5859b51e1f1ad03558)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnPublicKeyProps(public_key_config=public_key_config)

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ab6df19428bbab908ddb2fa2f24965c865f8fbae43d39872e7bcaf980a5b5bb)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a03978cdc81f50281b256ef6525ad4c16b429dfa85a205ffdb9ba9a36e5f6312)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrCreatedTime")
    def attr_created_time(self) -> builtins.str:
        '''The date and time when the public key was uploaded.

        :cloudformationAttribute: CreatedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrCreatedTime"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The identifier of the public key.

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="publicKeyConfig")
    def public_key_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnPublicKey.PublicKeyConfigProperty"]:
        '''Configuration information about a public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnPublicKey.PublicKeyConfigProperty"], jsii.get(self, "publicKeyConfig"))

    @public_key_config.setter
    def public_key_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnPublicKey.PublicKeyConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58d675c3580a784a3be69561798d55507bf948f7a586b6ccaa1aca861f3e22dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "publicKeyConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnPublicKey.PublicKeyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "caller_reference": "callerReference",
            "encoded_key": "encodedKey",
            "name": "name",
            "comment": "comment",
        },
    )
    class PublicKeyConfigProperty:
        def __init__(
            self,
            *,
            caller_reference: builtins.str,
            encoded_key: builtins.str,
            name: builtins.str,
            comment: typing.Optional[builtins.str] = None,
        ) -> None:
            '''Configuration information about a public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .

            :param caller_reference: A string included in the request to help make sure that the request can't be replayed.
            :param encoded_key: The public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .
            :param name: A name to help identify the public key.
            :param comment: A comment to describe the public key. The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-publickey-publickeyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                public_key_config_property = cloudfront.CfnPublicKey.PublicKeyConfigProperty(
                    caller_reference="callerReference",
                    encoded_key="encodedKey",
                    name="name",
                
                    # the properties below are optional
                    comment="comment"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__2dbeb78225dce9b06a3668904d42ef0b88ff28373e78d80bc61dbc709b419ea3)
                check_type(argname="argument caller_reference", value=caller_reference, expected_type=type_hints["caller_reference"])
                check_type(argname="argument encoded_key", value=encoded_key, expected_type=type_hints["encoded_key"])
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "caller_reference": caller_reference,
                "encoded_key": encoded_key,
                "name": name,
            }
            if comment is not None:
                self._values["comment"] = comment

        @builtins.property
        def caller_reference(self) -> builtins.str:
            '''A string included in the request to help make sure that the request can't be replayed.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-publickey-publickeyconfig.html#cfn-cloudfront-publickey-publickeyconfig-callerreference
            '''
            result = self._values.get("caller_reference")
            assert result is not None, "Required property 'caller_reference' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def encoded_key(self) -> builtins.str:
            '''The public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-publickey-publickeyconfig.html#cfn-cloudfront-publickey-publickeyconfig-encodedkey
            '''
            result = self._values.get("encoded_key")
            assert result is not None, "Required property 'encoded_key' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def name(self) -> builtins.str:
            '''A name to help identify the public key.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-publickey-publickeyconfig.html#cfn-cloudfront-publickey-publickeyconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the public key.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-publickey-publickeyconfig.html#cfn-cloudfront-publickey-publickeyconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "PublicKeyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnPublicKeyProps",
    jsii_struct_bases=[],
    name_mapping={"public_key_config": "publicKeyConfig"},
)
class CfnPublicKeyProps:
    def __init__(
        self,
        *,
        public_key_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPublicKey.PublicKeyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnPublicKey``.

        :param public_key_config: Configuration information about a public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-publickey.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_public_key_props = cloudfront.CfnPublicKeyProps(
                public_key_config=cloudfront.CfnPublicKey.PublicKeyConfigProperty(
                    caller_reference="callerReference",
                    encoded_key="encodedKey",
                    name="name",
            
                    # the properties below are optional
                    comment="comment"
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f050d447a5019231355893cf57fb776121327d4b2a8364dc046c71f73dc854a8)
            check_type(argname="argument public_key_config", value=public_key_config, expected_type=type_hints["public_key_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "public_key_config": public_key_config,
        }

    @builtins.property
    def public_key_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnPublicKey.PublicKeyConfigProperty]:
        '''Configuration information about a public key that you can use with `signed URLs and signed cookies <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ , or with `field-level encryption <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html>`_ .

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-publickey.html#cfn-cloudfront-publickey-publickeyconfig
        '''
        result = self._values.get("public_key_config")
        assert result is not None, "Required property 'public_key_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnPublicKey.PublicKeyConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnPublicKeyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnRealtimeLogConfig(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnRealtimeLogConfig",
):
    '''A real-time log configuration.

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html
    :cloudformationResource: AWS::CloudFront::RealtimeLogConfig
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_realtime_log_config = cloudfront.CfnRealtimeLogConfig(self, "MyCfnRealtimeLogConfig",
            end_points=[cloudfront.CfnRealtimeLogConfig.EndPointProperty(
                kinesis_stream_config=cloudfront.CfnRealtimeLogConfig.KinesisStreamConfigProperty(
                    role_arn="roleArn",
                    stream_arn="streamArn"
                ),
                stream_type="streamType"
            )],
            fields=["fields"],
            name="name",
            sampling_rate=123
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        end_points: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnRealtimeLogConfig.EndPointProperty", typing.Dict[builtins.str, typing.Any]]]]],
        fields: typing.Sequence[builtins.str],
        name: builtins.str,
        sampling_rate: jsii.Number,
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param end_points: Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
        :param fields: A list of fields that are included in each real-time log record. In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream. For more information about fields, see `Real-time log configuration fields <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields>`_ in the *Amazon CloudFront Developer Guide* .
        :param name: The unique name of this real-time log configuration.
        :param sampling_rate: The sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8600367ceeead504a7a5648f122da082bbe25466b2e32f26804dfa35f266326e)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnRealtimeLogConfigProps(
            end_points=end_points,
            fields=fields,
            name=name,
            sampling_rate=sampling_rate,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__af536cba20e954d3a14c778a5a00d1b1f0d499f83ceac3925c1957502198e6c5)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2609d67a254fddd137efba5e37254cdbd77efd1e74de5c15dd5403048de7c96)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrArn")
    def attr_arn(self) -> builtins.str:
        '''The Amazon Resource Name (ARN) of the real-time log configuration.

        For example: ``arn:aws:cloudfront::111122223333:realtime-log-config/ExampleNameForRealtimeLogConfig`` .

        :cloudformationAttribute: Arn
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrArn"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="endPoints")
    def end_points(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRealtimeLogConfig.EndPointProperty"]]]:
        '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRealtimeLogConfig.EndPointProperty"]]], jsii.get(self, "endPoints"))

    @end_points.setter
    def end_points(
        self,
        value: typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnRealtimeLogConfig.EndPointProperty"]]],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a399b0f2984cadefbe5ab1596b0a4763a8f456c302dc65036725f1ad9a543e5b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "endPoints", value)

    @builtins.property
    @jsii.member(jsii_name="fields")
    def fields(self) -> typing.List[builtins.str]:
        '''A list of fields that are included in each real-time log record.'''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "fields"))

    @fields.setter
    def fields(self, value: typing.List[builtins.str]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f4acb3fc802e66b33d46f5f1737506960b7058ccd04caba1ad1db22c81983a4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "fields", value)

    @builtins.property
    @jsii.member(jsii_name="name")
    def name(self) -> builtins.str:
        '''The unique name of this real-time log configuration.'''
        return typing.cast(builtins.str, jsii.get(self, "name"))

    @name.setter
    def name(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4611dc2e52a8827da74b1cab9e79ef1a4b59423fda9e0b7a1f949d411f767a55)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "name", value)

    @builtins.property
    @jsii.member(jsii_name="samplingRate")
    def sampling_rate(self) -> jsii.Number:
        '''The sampling rate for this real-time log configuration.'''
        return typing.cast(jsii.Number, jsii.get(self, "samplingRate"))

    @sampling_rate.setter
    def sampling_rate(self, value: jsii.Number) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fae7e2f43229ce281266cc0e965c660b0c47348bdab2a464e668be589b0b8256)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "samplingRate", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnRealtimeLogConfig.EndPointProperty",
        jsii_struct_bases=[],
        name_mapping={
            "kinesis_stream_config": "kinesisStreamConfig",
            "stream_type": "streamType",
        },
    )
    class EndPointProperty:
        def __init__(
            self,
            *,
            kinesis_stream_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnRealtimeLogConfig.KinesisStreamConfigProperty", typing.Dict[builtins.str, typing.Any]]],
            stream_type: builtins.str,
        ) -> None:
            '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data in a real-time log configuration.

            :param kinesis_stream_config: Contains information about the Amazon Kinesis data stream where you are sending real-time log data.
            :param stream_type: The type of data stream where you are sending real-time log data. The only valid value is ``Kinesis`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-endpoint.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                end_point_property = cloudfront.CfnRealtimeLogConfig.EndPointProperty(
                    kinesis_stream_config=cloudfront.CfnRealtimeLogConfig.KinesisStreamConfigProperty(
                        role_arn="roleArn",
                        stream_arn="streamArn"
                    ),
                    stream_type="streamType"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__ce5fe06d411d184ca37ecebb5346fe111d87f2365b393be8adb6cd407fa42cb7)
                check_type(argname="argument kinesis_stream_config", value=kinesis_stream_config, expected_type=type_hints["kinesis_stream_config"])
                check_type(argname="argument stream_type", value=stream_type, expected_type=type_hints["stream_type"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "kinesis_stream_config": kinesis_stream_config,
                "stream_type": stream_type,
            }

        @builtins.property
        def kinesis_stream_config(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnRealtimeLogConfig.KinesisStreamConfigProperty"]:
            '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-endpoint.html#cfn-cloudfront-realtimelogconfig-endpoint-kinesisstreamconfig
            '''
            result = self._values.get("kinesis_stream_config")
            assert result is not None, "Required property 'kinesis_stream_config' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnRealtimeLogConfig.KinesisStreamConfigProperty"], result)

        @builtins.property
        def stream_type(self) -> builtins.str:
            '''The type of data stream where you are sending real-time log data.

            The only valid value is ``Kinesis`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-endpoint.html#cfn-cloudfront-realtimelogconfig-endpoint-streamtype
            '''
            result = self._values.get("stream_type")
            assert result is not None, "Required property 'stream_type' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "EndPointProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnRealtimeLogConfig.KinesisStreamConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"role_arn": "roleArn", "stream_arn": "streamArn"},
    )
    class KinesisStreamConfigProperty:
        def __init__(self, *, role_arn: builtins.str, stream_arn: builtins.str) -> None:
            '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data.

            :param role_arn: The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that CloudFront can use to send real-time log data to your Kinesis data stream. For more information the IAM role, see `Real-time log configuration IAM role <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role>`_ in the *Amazon CloudFront Developer Guide* .
            :param stream_arn: The Amazon Resource Name (ARN) of the Kinesis data stream where you are sending real-time log data.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-kinesisstreamconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                kinesis_stream_config_property = cloudfront.CfnRealtimeLogConfig.KinesisStreamConfigProperty(
                    role_arn="roleArn",
                    stream_arn="streamArn"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__fef9031ebca9c7cf81e35b997de2b35a3077ec1073566ec4a4555f7b072e696f)
                check_type(argname="argument role_arn", value=role_arn, expected_type=type_hints["role_arn"])
                check_type(argname="argument stream_arn", value=stream_arn, expected_type=type_hints["stream_arn"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "role_arn": role_arn,
                "stream_arn": stream_arn,
            }

        @builtins.property
        def role_arn(self) -> builtins.str:
            '''The Amazon Resource Name (ARN) of an AWS Identity and Access Management (IAM) role that CloudFront can use to send real-time log data to your Kinesis data stream.

            For more information the IAM role, see `Real-time log configuration IAM role <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-kinesisstreamconfig.html#cfn-cloudfront-realtimelogconfig-kinesisstreamconfig-rolearn
            '''
            result = self._values.get("role_arn")
            assert result is not None, "Required property 'role_arn' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def stream_arn(self) -> builtins.str:
            '''The Amazon Resource Name (ARN) of the Kinesis data stream where you are sending real-time log data.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-realtimelogconfig-kinesisstreamconfig.html#cfn-cloudfront-realtimelogconfig-kinesisstreamconfig-streamarn
            '''
            result = self._values.get("stream_arn")
            assert result is not None, "Required property 'stream_arn' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "KinesisStreamConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnRealtimeLogConfigProps",
    jsii_struct_bases=[],
    name_mapping={
        "end_points": "endPoints",
        "fields": "fields",
        "name": "name",
        "sampling_rate": "samplingRate",
    },
)
class CfnRealtimeLogConfigProps:
    def __init__(
        self,
        *,
        end_points: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRealtimeLogConfig.EndPointProperty, typing.Dict[builtins.str, typing.Any]]]]],
        fields: typing.Sequence[builtins.str],
        name: builtins.str,
        sampling_rate: jsii.Number,
    ) -> None:
        '''Properties for defining a ``CfnRealtimeLogConfig``.

        :param end_points: Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
        :param fields: A list of fields that are included in each real-time log record. In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream. For more information about fields, see `Real-time log configuration fields <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields>`_ in the *Amazon CloudFront Developer Guide* .
        :param name: The unique name of this real-time log configuration.
        :param sampling_rate: The sampling rate for this real-time log configuration. The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_realtime_log_config_props = cloudfront.CfnRealtimeLogConfigProps(
                end_points=[cloudfront.CfnRealtimeLogConfig.EndPointProperty(
                    kinesis_stream_config=cloudfront.CfnRealtimeLogConfig.KinesisStreamConfigProperty(
                        role_arn="roleArn",
                        stream_arn="streamArn"
                    ),
                    stream_type="streamType"
                )],
                fields=["fields"],
                name="name",
                sampling_rate=123
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87355c4f65a5747cdf3935a3350fc53ac6c9b6571d8397f85c1c8247bf479959)
            check_type(argname="argument end_points", value=end_points, expected_type=type_hints["end_points"])
            check_type(argname="argument fields", value=fields, expected_type=type_hints["fields"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument sampling_rate", value=sampling_rate, expected_type=type_hints["sampling_rate"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "end_points": end_points,
            "fields": fields,
            "name": name,
            "sampling_rate": sampling_rate,
        }

    @builtins.property
    def end_points(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRealtimeLogConfig.EndPointProperty]]]:
        '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html#cfn-cloudfront-realtimelogconfig-endpoints
        '''
        result = self._values.get("end_points")
        assert result is not None, "Required property 'end_points' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRealtimeLogConfig.EndPointProperty]]], result)

    @builtins.property
    def fields(self) -> typing.List[builtins.str]:
        '''A list of fields that are included in each real-time log record.

        In an API response, the fields are provided in the same order in which they are sent to the Amazon Kinesis data stream.

        For more information about fields, see `Real-time log configuration fields <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields>`_ in the *Amazon CloudFront Developer Guide* .

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html#cfn-cloudfront-realtimelogconfig-fields
        '''
        result = self._values.get("fields")
        assert result is not None, "Required property 'fields' is missing"
        return typing.cast(typing.List[builtins.str], result)

    @builtins.property
    def name(self) -> builtins.str:
        '''The unique name of this real-time log configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html#cfn-cloudfront-realtimelogconfig-name
        '''
        result = self._values.get("name")
        assert result is not None, "Required property 'name' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def sampling_rate(self) -> jsii.Number:
        '''The sampling rate for this real-time log configuration.

        The sampling rate determines the percentage of viewer requests that are represented in the real-time log data. The sampling rate is an integer between 1 and 100, inclusive.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-realtimelogconfig.html#cfn-cloudfront-realtimelogconfig-samplingrate
        '''
        result = self._values.get("sampling_rate")
        assert result is not None, "Required property 'sampling_rate' is missing"
        return typing.cast(jsii.Number, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnRealtimeLogConfigProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556)
class CfnResponseHeadersPolicy(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy",
):
    '''A response headers policy.

    A response headers policy contains information about a set of HTTP response headers.

    After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution. When it's attached to a cache behavior, the response headers policy affects the HTTP headers that CloudFront includes in HTTP responses to requests that match the cache behavior. CloudFront adds or removes response headers according to the configuration of the response headers policy.

    For more information, see `Adding or removing HTTP headers in CloudFront responses <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/modifying-response-headers.html>`_ in the *Amazon CloudFront Developer Guide* .

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-responseheaderspolicy.html
    :cloudformationResource: AWS::CloudFront::ResponseHeadersPolicy
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_response_headers_policy = cloudfront.CfnResponseHeadersPolicy(self, "MyCfnResponseHeadersPolicy",
            response_headers_policy_config=cloudfront.CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty(
                name="name",
        
                # the properties below are optional
                comment="comment",
                cors_config=cloudfront.CfnResponseHeadersPolicy.CorsConfigProperty(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty(
                        items=["items"]
                    ),
                    access_control_allow_methods=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty(
                        items=["items"]
                    ),
                    access_control_allow_origins=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty(
                        items=["items"]
                    ),
                    origin_override=False,
        
                    # the properties below are optional
                    access_control_expose_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty(
                        items=["items"]
                    ),
                    access_control_max_age_sec=123
                ),
                custom_headers_config=cloudfront.CfnResponseHeadersPolicy.CustomHeadersConfigProperty(
                    items=[cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty(
                        header="header",
                        override=False,
                        value="value"
                    )]
                ),
                remove_headers_config=cloudfront.CfnResponseHeadersPolicy.RemoveHeadersConfigProperty(
                    items=[cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty(
                        header="header"
                    )]
                ),
                security_headers_config=cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty(
                    content_security_policy=cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty(
                        content_security_policy="contentSecurityPolicy",
                        override=False
                    ),
                    content_type_options=cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty(
                        override=False
                    ),
                    frame_options=cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty(
                        frame_option="frameOption",
                        override=False
                    ),
                    referrer_policy=cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty(
                        override=False,
                        referrer_policy="referrerPolicy"
                    ),
                    strict_transport_security=cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty(
                        access_control_max_age_sec=123,
                        override=False,
        
                        # the properties below are optional
                        include_subdomains=False,
                        preload=False
                    ),
                    xss_protection=cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty(
                        override=False,
                        protection=False,
        
                        # the properties below are optional
                        mode_block=False,
                        report_uri="reportUri"
                    )
                ),
                server_timing_headers_config=cloudfront.CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty(
                    enabled=False,
        
                    # the properties below are optional
                    sampling_rate=123
                )
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        response_headers_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty", typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param response_headers_policy_config: A response headers policy configuration.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2887da28e2f7d008cf9b91797497a167a286e4f5b55f3a746aa7c2c40ed1c0b6)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnResponseHeadersPolicyProps(
            response_headers_policy_config=response_headers_policy_config
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__419de318daa622efd8b07d03f54fdf81f2e3b54e20726f56489ea749aa977c1b)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63d973f921eab7f9fc08c9930e3542c71384381836f9fdfc3544abaf75c1ce3a)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''The unique identifier for the response headers policy.

        For example: ``57f99797-3b20-4e1b-a728-27972a74082a`` .

        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="attrLastModifiedTime")
    def attr_last_modified_time(self) -> builtins.str:
        '''The date and time when the response headers policy was last modified.

        :cloudformationAttribute: LastModifiedTime
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrLastModifiedTime"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="responseHeadersPolicyConfig")
    def response_headers_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty"]:
        '''A response headers policy configuration.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty"], jsii.get(self, "responseHeadersPolicyConfig"))

    @response_headers_policy_config.setter
    def response_headers_policy_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9664ad8baf2a412170daf27d190c8b070be288076aab09583c9dbfb1818b4229)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "responseHeadersPolicyConfig", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class AccessControlAllowHeadersProperty:
        def __init__(self, *, items: typing.Sequence[builtins.str]) -> None:
            '''A list of HTTP header names that CloudFront includes as values for the ``Access-Control-Allow-Headers`` HTTP response header.

            For more information about the ``Access-Control-Allow-Headers`` HTTP response header, see `Access-Control-Allow-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers>`_ in the MDN Web Docs.

            :param items: The list of HTTP header names. You can specify ``*`` to allow all headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolallowheaders.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                access_control_allow_headers_property = cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty(
                    items=["items"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__773e5afcb00aff98780d3b24461b811a3ca2d3d3f1ea0374b5ba92d55be95212)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(self) -> typing.List[builtins.str]:
            '''The list of HTTP header names.

            You can specify ``*`` to allow all headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolallowheaders.html#cfn-cloudfront-responseheaderspolicy-accesscontrolallowheaders-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.List[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "AccessControlAllowHeadersProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class AccessControlAllowMethodsProperty:
        def __init__(self, *, items: typing.Sequence[builtins.str]) -> None:
            '''A list of HTTP methods that CloudFront includes as values for the ``Access-Control-Allow-Methods`` HTTP response header.

            For more information about the ``Access-Control-Allow-Methods`` HTTP response header, see `Access-Control-Allow-Methods <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods>`_ in the MDN Web Docs.

            :param items: The list of HTTP methods. Valid values are:. - ``GET`` - ``DELETE`` - ``HEAD`` - ``OPTIONS`` - ``PATCH`` - ``POST`` - ``PUT`` - ``ALL`` ``ALL`` is a special value that includes all of the listed HTTP methods.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolallowmethods.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                access_control_allow_methods_property = cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty(
                    items=["items"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__9e9eb9049251ab2f72740cb4b094dc8f2052945de7b62fbabaab3ed147999315)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(self) -> typing.List[builtins.str]:
            '''The list of HTTP methods. Valid values are:.

            - ``GET``
            - ``DELETE``
            - ``HEAD``
            - ``OPTIONS``
            - ``PATCH``
            - ``POST``
            - ``PUT``
            - ``ALL``

            ``ALL`` is a special value that includes all of the listed HTTP methods.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolallowmethods.html#cfn-cloudfront-responseheaderspolicy-accesscontrolallowmethods-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.List[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "AccessControlAllowMethodsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class AccessControlAllowOriginsProperty:
        def __init__(self, *, items: typing.Sequence[builtins.str]) -> None:
            '''A list of origins (domain names) that CloudFront can use as the value for the ``Access-Control-Allow-Origin`` HTTP response header.

            For more information about the ``Access-Control-Allow-Origin`` HTTP response header, see `Access-Control-Allow-Origin <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin>`_ in the MDN Web Docs.

            :param items: The list of origins (domain names). You can specify ``*`` to allow all origins.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolalloworigins.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                access_control_allow_origins_property = cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty(
                    items=["items"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__6870436c7a83f82baddf1b8993ea77062e833262e7ad9b274479252b61afa2ae)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(self) -> typing.List[builtins.str]:
            '''The list of origins (domain names).

            You can specify ``*`` to allow all origins.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolalloworigins.html#cfn-cloudfront-responseheaderspolicy-accesscontrolalloworigins-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.List[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "AccessControlAllowOriginsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class AccessControlExposeHeadersProperty:
        def __init__(self, *, items: typing.Sequence[builtins.str]) -> None:
            '''A list of HTTP headers that CloudFront includes as values for the ``Access-Control-Expose-Headers`` HTTP response header.

            For more information about the ``Access-Control-Expose-Headers`` HTTP response header, see `Access-Control-Expose-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers>`_ in the MDN Web Docs.

            :param items: The list of HTTP headers. You can specify ``*`` to expose all headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolexposeheaders.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                access_control_expose_headers_property = cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty(
                    items=["items"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__a093c9baeae42c526ce5d0b5f26c2323072f572ebf50651839ad0d56a4846ed4)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(self) -> typing.List[builtins.str]:
            '''The list of HTTP headers.

            You can specify ``*`` to expose all headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-accesscontrolexposeheaders.html#cfn-cloudfront-responseheaderspolicy-accesscontrolexposeheaders-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.List[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "AccessControlExposeHeadersProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty",
        jsii_struct_bases=[],
        name_mapping={
            "content_security_policy": "contentSecurityPolicy",
            "override": "override",
        },
    )
    class ContentSecurityPolicyProperty:
        def __init__(
            self,
            *,
            content_security_policy: builtins.str,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
        ) -> None:
            '''The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.

            For more information about the ``Content-Security-Policy`` HTTP response header, see `Content-Security-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy>`_ in the MDN Web Docs.

            :param content_security_policy: The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.
            :param override: A Boolean that determines whether CloudFront overrides the ``Content-Security-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-contentsecuritypolicy.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                content_security_policy_property = cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty(
                    content_security_policy="contentSecurityPolicy",
                    override=False
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__d4d3e987763161c0746b782403d40ea0c2ff123f7ae5dff00da0defccbdc83cf)
                check_type(argname="argument content_security_policy", value=content_security_policy, expected_type=type_hints["content_security_policy"])
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "content_security_policy": content_security_policy,
                "override": override,
            }

        @builtins.property
        def content_security_policy(self) -> builtins.str:
            '''The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-contentsecuritypolicy.html#cfn-cloudfront-responseheaderspolicy-contentsecuritypolicy-contentsecuritypolicy
            '''
            result = self._values.get("content_security_policy")
            assert result is not None, "Required property 'content_security_policy' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``Content-Security-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-contentsecuritypolicy.html#cfn-cloudfront-responseheaderspolicy-contentsecuritypolicy-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ContentSecurityPolicyProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty",
        jsii_struct_bases=[],
        name_mapping={"override": "override"},
    )
    class ContentTypeOptionsProperty:
        def __init__(
            self,
            *,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
        ) -> None:
            '''Determines whether CloudFront includes the ``X-Content-Type-Options`` HTTP response header with its value set to ``nosniff`` .

            For more information about the ``X-Content-Type-Options`` HTTP response header, see `X-Content-Type-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options>`_ in the MDN Web Docs.

            :param override: A Boolean that determines whether CloudFront overrides the ``X-Content-Type-Options`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-contenttypeoptions.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                content_type_options_property = cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty(
                    override=False
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__d77b463fb3cd8f602aca9b082752b8d07f4cf22b87bcdffcfaf82f5a3dd3d21e)
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "override": override,
            }

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``X-Content-Type-Options`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-contenttypeoptions.html#cfn-cloudfront-responseheaderspolicy-contenttypeoptions-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ContentTypeOptionsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.CorsConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "access_control_allow_credentials": "accessControlAllowCredentials",
            "access_control_allow_headers": "accessControlAllowHeaders",
            "access_control_allow_methods": "accessControlAllowMethods",
            "access_control_allow_origins": "accessControlAllowOrigins",
            "origin_override": "originOverride",
            "access_control_expose_headers": "accessControlExposeHeaders",
            "access_control_max_age_sec": "accessControlMaxAgeSec",
        },
    )
    class CorsConfigProperty:
        def __init__(
            self,
            *,
            access_control_allow_credentials: typing.Union[builtins.bool, _IResolvable_da3f097b],
            access_control_allow_headers: typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty", typing.Dict[builtins.str, typing.Any]]],
            access_control_allow_methods: typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty", typing.Dict[builtins.str, typing.Any]]],
            access_control_allow_origins: typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty", typing.Dict[builtins.str, typing.Any]]],
            origin_override: typing.Union[builtins.bool, _IResolvable_da3f097b],
            access_control_expose_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            access_control_max_age_sec: typing.Optional[jsii.Number] = None,
        ) -> None:
            '''A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

            CloudFront adds these headers to HTTP responses that it sends for CORS requests that match a cache behavior associated with this response headers policy.

            For more information about CORS, see `Cross-Origin Resource Sharing (CORS) <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS>`_ in the MDN Web Docs.

            :param access_control_allow_credentials: A Boolean that CloudFront uses as the value for the ``Access-Control-Allow-Credentials`` HTTP response header. For more information about the ``Access-Control-Allow-Credentials`` HTTP response header, see `Access-Control-Allow-Credentials <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials>`_ in the MDN Web Docs.
            :param access_control_allow_headers: A list of HTTP header names that CloudFront includes as values for the ``Access-Control-Allow-Headers`` HTTP response header. For more information about the ``Access-Control-Allow-Headers`` HTTP response header, see `Access-Control-Allow-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers>`_ in the MDN Web Docs.
            :param access_control_allow_methods: A list of HTTP methods that CloudFront includes as values for the ``Access-Control-Allow-Methods`` HTTP response header. For more information about the ``Access-Control-Allow-Methods`` HTTP response header, see `Access-Control-Allow-Methods <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods>`_ in the MDN Web Docs.
            :param access_control_allow_origins: A list of origins (domain names) that CloudFront can use as the value for the ``Access-Control-Allow-Origin`` HTTP response header. For more information about the ``Access-Control-Allow-Origin`` HTTP response header, see `Access-Control-Allow-Origin <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin>`_ in the MDN Web Docs.
            :param origin_override: A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
            :param access_control_expose_headers: A list of HTTP headers that CloudFront includes as values for the ``Access-Control-Expose-Headers`` HTTP response header. For more information about the ``Access-Control-Expose-Headers`` HTTP response header, see `Access-Control-Expose-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers>`_ in the MDN Web Docs.
            :param access_control_max_age_sec: A number that CloudFront uses as the value for the ``Access-Control-Max-Age`` HTTP response header. For more information about the ``Access-Control-Max-Age`` HTTP response header, see `Access-Control-Max-Age <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                cors_config_property = cloudfront.CfnResponseHeadersPolicy.CorsConfigProperty(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty(
                        items=["items"]
                    ),
                    access_control_allow_methods=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty(
                        items=["items"]
                    ),
                    access_control_allow_origins=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty(
                        items=["items"]
                    ),
                    origin_override=False,
                
                    # the properties below are optional
                    access_control_expose_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty(
                        items=["items"]
                    ),
                    access_control_max_age_sec=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__4d24abc4864d269da012deb3b8467c06fe4383437c6d52eb9608e91d90c5663a)
                check_type(argname="argument access_control_allow_credentials", value=access_control_allow_credentials, expected_type=type_hints["access_control_allow_credentials"])
                check_type(argname="argument access_control_allow_headers", value=access_control_allow_headers, expected_type=type_hints["access_control_allow_headers"])
                check_type(argname="argument access_control_allow_methods", value=access_control_allow_methods, expected_type=type_hints["access_control_allow_methods"])
                check_type(argname="argument access_control_allow_origins", value=access_control_allow_origins, expected_type=type_hints["access_control_allow_origins"])
                check_type(argname="argument origin_override", value=origin_override, expected_type=type_hints["origin_override"])
                check_type(argname="argument access_control_expose_headers", value=access_control_expose_headers, expected_type=type_hints["access_control_expose_headers"])
                check_type(argname="argument access_control_max_age_sec", value=access_control_max_age_sec, expected_type=type_hints["access_control_max_age_sec"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "access_control_allow_credentials": access_control_allow_credentials,
                "access_control_allow_headers": access_control_allow_headers,
                "access_control_allow_methods": access_control_allow_methods,
                "access_control_allow_origins": access_control_allow_origins,
                "origin_override": origin_override,
            }
            if access_control_expose_headers is not None:
                self._values["access_control_expose_headers"] = access_control_expose_headers
            if access_control_max_age_sec is not None:
                self._values["access_control_max_age_sec"] = access_control_max_age_sec

        @builtins.property
        def access_control_allow_credentials(
            self,
        ) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that CloudFront uses as the value for the ``Access-Control-Allow-Credentials`` HTTP response header.

            For more information about the ``Access-Control-Allow-Credentials`` HTTP response header, see `Access-Control-Allow-Credentials <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolallowcredentials
            '''
            result = self._values.get("access_control_allow_credentials")
            assert result is not None, "Required property 'access_control_allow_credentials' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def access_control_allow_headers(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty"]:
            '''A list of HTTP header names that CloudFront includes as values for the ``Access-Control-Allow-Headers`` HTTP response header.

            For more information about the ``Access-Control-Allow-Headers`` HTTP response header, see `Access-Control-Allow-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolallowheaders
            '''
            result = self._values.get("access_control_allow_headers")
            assert result is not None, "Required property 'access_control_allow_headers' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty"], result)

        @builtins.property
        def access_control_allow_methods(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty"]:
            '''A list of HTTP methods that CloudFront includes as values for the ``Access-Control-Allow-Methods`` HTTP response header.

            For more information about the ``Access-Control-Allow-Methods`` HTTP response header, see `Access-Control-Allow-Methods <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolallowmethods
            '''
            result = self._values.get("access_control_allow_methods")
            assert result is not None, "Required property 'access_control_allow_methods' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty"], result)

        @builtins.property
        def access_control_allow_origins(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty"]:
            '''A list of origins (domain names) that CloudFront can use as the value for the ``Access-Control-Allow-Origin`` HTTP response header.

            For more information about the ``Access-Control-Allow-Origin`` HTTP response header, see `Access-Control-Allow-Origin <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolalloworigins
            '''
            result = self._values.get("access_control_allow_origins")
            assert result is not None, "Required property 'access_control_allow_origins' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty"], result)

        @builtins.property
        def origin_override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-originoverride
            '''
            result = self._values.get("origin_override")
            assert result is not None, "Required property 'origin_override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def access_control_expose_headers(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty"]]:
            '''A list of HTTP headers that CloudFront includes as values for the ``Access-Control-Expose-Headers`` HTTP response header.

            For more information about the ``Access-Control-Expose-Headers`` HTTP response header, see `Access-Control-Expose-Headers <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolexposeheaders
            '''
            result = self._values.get("access_control_expose_headers")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty"]], result)

        @builtins.property
        def access_control_max_age_sec(self) -> typing.Optional[jsii.Number]:
            '''A number that CloudFront uses as the value for the ``Access-Control-Max-Age`` HTTP response header.

            For more information about the ``Access-Control-Max-Age`` HTTP response header, see `Access-Control-Max-Age <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-corsconfig.html#cfn-cloudfront-responseheaderspolicy-corsconfig-accesscontrolmaxagesec
            '''
            result = self._values.get("access_control_max_age_sec")
            return typing.cast(typing.Optional[jsii.Number], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CorsConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty",
        jsii_struct_bases=[],
        name_mapping={"header": "header", "override": "override", "value": "value"},
    )
    class CustomHeaderProperty:
        def __init__(
            self,
            *,
            header: builtins.str,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
            value: builtins.str,
        ) -> None:
            '''An HTTP response header name and its value.

            CloudFront includes this header in HTTP responses that it sends for requests that match a cache behavior that's associated with this response headers policy.

            :param header: The HTTP response header name.
            :param override: A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.
            :param value: The value for the HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheader.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                custom_header_property = cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty(
                    header="header",
                    override=False,
                    value="value"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__107330832c6d40d72f1dacd4d00b0baf26409d71a15dcf3e4ffebd1100e2b2d2)
                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
                check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header": header,
                "override": override,
                "value": value,
            }

        @builtins.property
        def header(self) -> builtins.str:
            '''The HTTP response header name.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheader.html#cfn-cloudfront-responseheaderspolicy-customheader-header
            '''
            result = self._values.get("header")
            assert result is not None, "Required property 'header' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheader.html#cfn-cloudfront-responseheaderspolicy-customheader-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def value(self) -> builtins.str:
            '''The value for the HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheader.html#cfn-cloudfront-responseheaderspolicy-customheader-value
            '''
            result = self._values.get("value")
            assert result is not None, "Required property 'value' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CustomHeaderProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.CustomHeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class CustomHeadersConfigProperty:
        def __init__(
            self,
            *,
            items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.CustomHeaderProperty", typing.Dict[builtins.str, typing.Any]]]]],
        ) -> None:
            '''A list of HTTP response header names and their values.

            CloudFront includes these headers in HTTP responses that it sends for requests that match a cache behavior that's associated with this response headers policy.

            :param items: The list of HTTP response headers and their values.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheadersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                custom_headers_config_property = cloudfront.CfnResponseHeadersPolicy.CustomHeadersConfigProperty(
                    items=[cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty(
                        header="header",
                        override=False,
                        value="value"
                    )]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__91ab0561b82f54c5ddb97c204523f77b107792a7b0910bc0341d00aedc2157c0)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CustomHeaderProperty"]]]:
            '''The list of HTTP response headers and their values.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-customheadersconfig.html#cfn-cloudfront-responseheaderspolicy-customheadersconfig-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CustomHeaderProperty"]]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "CustomHeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty",
        jsii_struct_bases=[],
        name_mapping={"frame_option": "frameOption", "override": "override"},
    )
    class FrameOptionsProperty:
        def __init__(
            self,
            *,
            frame_option: builtins.str,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
        ) -> None:
            '''Determines whether CloudFront includes the ``X-Frame-Options`` HTTP response header and the header's value.

            For more information about the ``X-Frame-Options`` HTTP response header, see `X-Frame-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options>`_ in the MDN Web Docs.

            :param frame_option: The value of the ``X-Frame-Options`` HTTP response header. Valid values are ``DENY`` and ``SAMEORIGIN`` . For more information about these values, see `X-Frame-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options>`_ in the MDN Web Docs.
            :param override: A Boolean that determines whether CloudFront overrides the ``X-Frame-Options`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-frameoptions.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                frame_options_property = cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty(
                    frame_option="frameOption",
                    override=False
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__5a680a281a082f31d5ee32556902ef482795469006054440265fd3bdefc49d0c)
                check_type(argname="argument frame_option", value=frame_option, expected_type=type_hints["frame_option"])
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "frame_option": frame_option,
                "override": override,
            }

        @builtins.property
        def frame_option(self) -> builtins.str:
            '''The value of the ``X-Frame-Options`` HTTP response header. Valid values are ``DENY`` and ``SAMEORIGIN`` .

            For more information about these values, see `X-Frame-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-frameoptions.html#cfn-cloudfront-responseheaderspolicy-frameoptions-frameoption
            '''
            result = self._values.get("frame_option")
            assert result is not None, "Required property 'frame_option' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``X-Frame-Options`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-frameoptions.html#cfn-cloudfront-responseheaderspolicy-frameoptions-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "FrameOptionsProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty",
        jsii_struct_bases=[],
        name_mapping={"override": "override", "referrer_policy": "referrerPolicy"},
    )
    class ReferrerPolicyProperty:
        def __init__(
            self,
            *,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
            referrer_policy: builtins.str,
        ) -> None:
            '''Determines whether CloudFront includes the ``Referrer-Policy`` HTTP response header and the header's value.

            For more information about the ``Referrer-Policy`` HTTP response header, see `Referrer-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy>`_ in the MDN Web Docs.

            :param override: A Boolean that determines whether CloudFront overrides the ``Referrer-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.
            :param referrer_policy: The value of the ``Referrer-Policy`` HTTP response header. Valid values are:. - ``no-referrer`` - ``no-referrer-when-downgrade`` - ``origin`` - ``origin-when-cross-origin`` - ``same-origin`` - ``strict-origin`` - ``strict-origin-when-cross-origin`` - ``unsafe-url`` For more information about these values, see `Referrer-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-referrerpolicy.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                referrer_policy_property = cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty(
                    override=False,
                    referrer_policy="referrerPolicy"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__01ff74d1cc6df3364aff2a82c1644eb87b8e4f4bad151996dbda308134972f74)
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
                check_type(argname="argument referrer_policy", value=referrer_policy, expected_type=type_hints["referrer_policy"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "override": override,
                "referrer_policy": referrer_policy,
            }

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``Referrer-Policy`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-referrerpolicy.html#cfn-cloudfront-responseheaderspolicy-referrerpolicy-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def referrer_policy(self) -> builtins.str:
            '''The value of the ``Referrer-Policy`` HTTP response header. Valid values are:.

            - ``no-referrer``
            - ``no-referrer-when-downgrade``
            - ``origin``
            - ``origin-when-cross-origin``
            - ``same-origin``
            - ``strict-origin``
            - ``strict-origin-when-cross-origin``
            - ``unsafe-url``

            For more information about these values, see `Referrer-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-referrerpolicy.html#cfn-cloudfront-responseheaderspolicy-referrerpolicy-referrerpolicy
            '''
            result = self._values.get("referrer_policy")
            assert result is not None, "Required property 'referrer_policy' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ReferrerPolicyProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty",
        jsii_struct_bases=[],
        name_mapping={"header": "header"},
    )
    class RemoveHeaderProperty:
        def __init__(self, *, header: builtins.str) -> None:
            '''The name of an HTTP header that CloudFront removes from HTTP responses to requests that match the cache behavior that this response headers policy is attached to.

            :param header: The HTTP header name.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-removeheader.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                remove_header_property = cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty(
                    header="header"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__5bf434f98e57f1ac6a1720a0347de831b65bf3c0a4b3680d8a9633e4c356d939)
                check_type(argname="argument header", value=header, expected_type=type_hints["header"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "header": header,
            }

        @builtins.property
        def header(self) -> builtins.str:
            '''The HTTP header name.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-removeheader.html#cfn-cloudfront-responseheaderspolicy-removeheader-header
            '''
            result = self._values.get("header")
            assert result is not None, "Required property 'header' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "RemoveHeaderProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.RemoveHeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"items": "items"},
    )
    class RemoveHeadersConfigProperty:
        def __init__(
            self,
            *,
            items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.RemoveHeaderProperty", typing.Dict[builtins.str, typing.Any]]]]],
        ) -> None:
            '''A list of HTTP header names that CloudFront removes from HTTP responses to requests that match the cache behavior that this response headers policy is attached to.

            :param items: The list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-removeheadersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                remove_headers_config_property = cloudfront.CfnResponseHeadersPolicy.RemoveHeadersConfigProperty(
                    items=[cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty(
                        header="header"
                    )]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__02662651d1c045bbf4485a4b77e8d96e2947dd266570ea70b852d1d5ba676571)
                check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "items": items,
            }

        @builtins.property
        def items(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.RemoveHeaderProperty"]]]:
            '''The list of HTTP header names.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-removeheadersconfig.html#cfn-cloudfront-responseheaderspolicy-removeheadersconfig-items
            '''
            result = self._values.get("items")
            assert result is not None, "Required property 'items' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.RemoveHeaderProperty"]]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "RemoveHeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "name": "name",
            "comment": "comment",
            "cors_config": "corsConfig",
            "custom_headers_config": "customHeadersConfig",
            "remove_headers_config": "removeHeadersConfig",
            "security_headers_config": "securityHeadersConfig",
            "server_timing_headers_config": "serverTimingHeadersConfig",
        },
    )
    class ResponseHeadersPolicyConfigProperty:
        def __init__(
            self,
            *,
            name: builtins.str,
            comment: typing.Optional[builtins.str] = None,
            cors_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.CorsConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            custom_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.CustomHeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            remove_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.RemoveHeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            security_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.SecurityHeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            server_timing_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''A response headers policy configuration.

            A response headers policy configuration contains metadata about the response headers policy, and configurations for sets of HTTP response headers.

            :param name: A name to identify the response headers policy. The name must be unique for response headers policies in this AWS account .
            :param comment: A comment to describe the response headers policy. The comment cannot be longer than 128 characters.
            :param cors_config: A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).
            :param custom_headers_config: A configuration for a set of custom HTTP response headers.
            :param remove_headers_config: A configuration for a set of HTTP headers to remove from the HTTP response.
            :param security_headers_config: A configuration for a set of security-related HTTP response headers.
            :param server_timing_headers_config: A configuration for enabling the ``Server-Timing`` header in HTTP responses sent from CloudFront.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                response_headers_policy_config_property = cloudfront.CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty(
                    name="name",
                
                    # the properties below are optional
                    comment="comment",
                    cors_config=cloudfront.CfnResponseHeadersPolicy.CorsConfigProperty(
                        access_control_allow_credentials=False,
                        access_control_allow_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty(
                            items=["items"]
                        ),
                        access_control_allow_methods=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty(
                            items=["items"]
                        ),
                        access_control_allow_origins=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty(
                            items=["items"]
                        ),
                        origin_override=False,
                
                        # the properties below are optional
                        access_control_expose_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty(
                            items=["items"]
                        ),
                        access_control_max_age_sec=123
                    ),
                    custom_headers_config=cloudfront.CfnResponseHeadersPolicy.CustomHeadersConfigProperty(
                        items=[cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty(
                            header="header",
                            override=False,
                            value="value"
                        )]
                    ),
                    remove_headers_config=cloudfront.CfnResponseHeadersPolicy.RemoveHeadersConfigProperty(
                        items=[cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty(
                            header="header"
                        )]
                    ),
                    security_headers_config=cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty(
                        content_security_policy=cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty(
                            content_security_policy="contentSecurityPolicy",
                            override=False
                        ),
                        content_type_options=cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty(
                            override=False
                        ),
                        frame_options=cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty(
                            frame_option="frameOption",
                            override=False
                        ),
                        referrer_policy=cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty(
                            override=False,
                            referrer_policy="referrerPolicy"
                        ),
                        strict_transport_security=cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty(
                            access_control_max_age_sec=123,
                            override=False,
                
                            # the properties below are optional
                            include_subdomains=False,
                            preload=False
                        ),
                        xss_protection=cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty(
                            override=False,
                            protection=False,
                
                            # the properties below are optional
                            mode_block=False,
                            report_uri="reportUri"
                        )
                    ),
                    server_timing_headers_config=cloudfront.CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty(
                        enabled=False,
                
                        # the properties below are optional
                        sampling_rate=123
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__9d75721553556d33ddbdbec6773a260748b117e2a3cfd6d0e5386d014560171a)
                check_type(argname="argument name", value=name, expected_type=type_hints["name"])
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
                check_type(argname="argument cors_config", value=cors_config, expected_type=type_hints["cors_config"])
                check_type(argname="argument custom_headers_config", value=custom_headers_config, expected_type=type_hints["custom_headers_config"])
                check_type(argname="argument remove_headers_config", value=remove_headers_config, expected_type=type_hints["remove_headers_config"])
                check_type(argname="argument security_headers_config", value=security_headers_config, expected_type=type_hints["security_headers_config"])
                check_type(argname="argument server_timing_headers_config", value=server_timing_headers_config, expected_type=type_hints["server_timing_headers_config"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "name": name,
            }
            if comment is not None:
                self._values["comment"] = comment
            if cors_config is not None:
                self._values["cors_config"] = cors_config
            if custom_headers_config is not None:
                self._values["custom_headers_config"] = custom_headers_config
            if remove_headers_config is not None:
                self._values["remove_headers_config"] = remove_headers_config
            if security_headers_config is not None:
                self._values["security_headers_config"] = security_headers_config
            if server_timing_headers_config is not None:
                self._values["server_timing_headers_config"] = server_timing_headers_config

        @builtins.property
        def name(self) -> builtins.str:
            '''A name to identify the response headers policy.

            The name must be unique for response headers policies in this AWS account .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-name
            '''
            result = self._values.get("name")
            assert result is not None, "Required property 'name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def comment(self) -> typing.Optional[builtins.str]:
            '''A comment to describe the response headers policy.

            The comment cannot be longer than 128 characters.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-comment
            '''
            result = self._values.get("comment")
            return typing.cast(typing.Optional[builtins.str], result)

        @builtins.property
        def cors_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CorsConfigProperty"]]:
            '''A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-corsconfig
            '''
            result = self._values.get("cors_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CorsConfigProperty"]], result)

        @builtins.property
        def custom_headers_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CustomHeadersConfigProperty"]]:
            '''A configuration for a set of custom HTTP response headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-customheadersconfig
            '''
            result = self._values.get("custom_headers_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.CustomHeadersConfigProperty"]], result)

        @builtins.property
        def remove_headers_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.RemoveHeadersConfigProperty"]]:
            '''A configuration for a set of HTTP headers to remove from the HTTP response.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-removeheadersconfig
            '''
            result = self._values.get("remove_headers_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.RemoveHeadersConfigProperty"]], result)

        @builtins.property
        def security_headers_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.SecurityHeadersConfigProperty"]]:
            '''A configuration for a set of security-related HTTP response headers.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-securityheadersconfig
            '''
            result = self._values.get("security_headers_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.SecurityHeadersConfigProperty"]], result)

        @builtins.property
        def server_timing_headers_config(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty"]]:
            '''A configuration for enabling the ``Server-Timing`` header in HTTP responses sent from CloudFront.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-responseheaderspolicyconfig.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig-servertimingheadersconfig
            '''
            result = self._values.get("server_timing_headers_config")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ResponseHeadersPolicyConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "content_security_policy": "contentSecurityPolicy",
            "content_type_options": "contentTypeOptions",
            "frame_options": "frameOptions",
            "referrer_policy": "referrerPolicy",
            "strict_transport_security": "strictTransportSecurity",
            "xss_protection": "xssProtection",
        },
    )
    class SecurityHeadersConfigProperty:
        def __init__(
            self,
            *,
            content_security_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.ContentSecurityPolicyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            content_type_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.ContentTypeOptionsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            frame_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.FrameOptionsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            referrer_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.ReferrerPolicyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            strict_transport_security: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.StrictTransportSecurityProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            xss_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnResponseHeadersPolicy.XSSProtectionProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
        ) -> None:
            '''A configuration for a set of security-related HTTP response headers.

            CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior associated with this response headers policy.

            :param content_security_policy: The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header. For more information about the ``Content-Security-Policy`` HTTP response header, see `Content-Security-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy>`_ in the MDN Web Docs.
            :param content_type_options: Determines whether CloudFront includes the ``X-Content-Type-Options`` HTTP response header with its value set to ``nosniff`` . For more information about the ``X-Content-Type-Options`` HTTP response header, see `X-Content-Type-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options>`_ in the MDN Web Docs.
            :param frame_options: Determines whether CloudFront includes the ``X-Frame-Options`` HTTP response header and the header's value. For more information about the ``X-Frame-Options`` HTTP response header, see `X-Frame-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options>`_ in the MDN Web Docs.
            :param referrer_policy: Determines whether CloudFront includes the ``Referrer-Policy`` HTTP response header and the header's value. For more information about the ``Referrer-Policy`` HTTP response header, see `Referrer-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy>`_ in the MDN Web Docs.
            :param strict_transport_security: Determines whether CloudFront includes the ``Strict-Transport-Security`` HTTP response header and the header's value. For more information about the ``Strict-Transport-Security`` HTTP response header, see `Security headers <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-response-headers-policies.html#understanding-response-headers-policies-security>`_ in the *Amazon CloudFront Developer Guide* and `Strict-Transport-Security <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security>`_ in the MDN Web Docs.
            :param xss_protection: Determines whether CloudFront includes the ``X-XSS-Protection`` HTTP response header and the header's value. For more information about the ``X-XSS-Protection`` HTTP response header, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                security_headers_config_property = cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty(
                    content_security_policy=cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty(
                        content_security_policy="contentSecurityPolicy",
                        override=False
                    ),
                    content_type_options=cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty(
                        override=False
                    ),
                    frame_options=cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty(
                        frame_option="frameOption",
                        override=False
                    ),
                    referrer_policy=cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty(
                        override=False,
                        referrer_policy="referrerPolicy"
                    ),
                    strict_transport_security=cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty(
                        access_control_max_age_sec=123,
                        override=False,
                
                        # the properties below are optional
                        include_subdomains=False,
                        preload=False
                    ),
                    xss_protection=cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty(
                        override=False,
                        protection=False,
                
                        # the properties below are optional
                        mode_block=False,
                        report_uri="reportUri"
                    )
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__42c151ba3f332af87420a4d861cd73e704b4d71c655a609155037328eab185ff)
                check_type(argname="argument content_security_policy", value=content_security_policy, expected_type=type_hints["content_security_policy"])
                check_type(argname="argument content_type_options", value=content_type_options, expected_type=type_hints["content_type_options"])
                check_type(argname="argument frame_options", value=frame_options, expected_type=type_hints["frame_options"])
                check_type(argname="argument referrer_policy", value=referrer_policy, expected_type=type_hints["referrer_policy"])
                check_type(argname="argument strict_transport_security", value=strict_transport_security, expected_type=type_hints["strict_transport_security"])
                check_type(argname="argument xss_protection", value=xss_protection, expected_type=type_hints["xss_protection"])
            self._values: typing.Dict[builtins.str, typing.Any] = {}
            if content_security_policy is not None:
                self._values["content_security_policy"] = content_security_policy
            if content_type_options is not None:
                self._values["content_type_options"] = content_type_options
            if frame_options is not None:
                self._values["frame_options"] = frame_options
            if referrer_policy is not None:
                self._values["referrer_policy"] = referrer_policy
            if strict_transport_security is not None:
                self._values["strict_transport_security"] = strict_transport_security
            if xss_protection is not None:
                self._values["xss_protection"] = xss_protection

        @builtins.property
        def content_security_policy(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ContentSecurityPolicyProperty"]]:
            '''The policy directives and their values that CloudFront includes as values for the ``Content-Security-Policy`` HTTP response header.

            For more information about the ``Content-Security-Policy`` HTTP response header, see `Content-Security-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-contentsecuritypolicy
            '''
            result = self._values.get("content_security_policy")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ContentSecurityPolicyProperty"]], result)

        @builtins.property
        def content_type_options(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ContentTypeOptionsProperty"]]:
            '''Determines whether CloudFront includes the ``X-Content-Type-Options`` HTTP response header with its value set to ``nosniff`` .

            For more information about the ``X-Content-Type-Options`` HTTP response header, see `X-Content-Type-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-contenttypeoptions
            '''
            result = self._values.get("content_type_options")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ContentTypeOptionsProperty"]], result)

        @builtins.property
        def frame_options(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.FrameOptionsProperty"]]:
            '''Determines whether CloudFront includes the ``X-Frame-Options`` HTTP response header and the header's value.

            For more information about the ``X-Frame-Options`` HTTP response header, see `X-Frame-Options <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-frameoptions
            '''
            result = self._values.get("frame_options")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.FrameOptionsProperty"]], result)

        @builtins.property
        def referrer_policy(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ReferrerPolicyProperty"]]:
            '''Determines whether CloudFront includes the ``Referrer-Policy`` HTTP response header and the header's value.

            For more information about the ``Referrer-Policy`` HTTP response header, see `Referrer-Policy <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-referrerpolicy
            '''
            result = self._values.get("referrer_policy")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.ReferrerPolicyProperty"]], result)

        @builtins.property
        def strict_transport_security(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.StrictTransportSecurityProperty"]]:
            '''Determines whether CloudFront includes the ``Strict-Transport-Security`` HTTP response header and the header's value.

            For more information about the ``Strict-Transport-Security`` HTTP response header, see `Security headers <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/understanding-response-headers-policies.html#understanding-response-headers-policies-security>`_ in the *Amazon CloudFront Developer Guide* and `Strict-Transport-Security <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-stricttransportsecurity
            '''
            result = self._values.get("strict_transport_security")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.StrictTransportSecurityProperty"]], result)

        @builtins.property
        def xss_protection(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.XSSProtectionProperty"]]:
            '''Determines whether CloudFront includes the ``X-XSS-Protection`` HTTP response header and the header's value.

            For more information about the ``X-XSS-Protection`` HTTP response header, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-securityheadersconfig.html#cfn-cloudfront-responseheaderspolicy-securityheadersconfig-xssprotection
            '''
            result = self._values.get("xss_protection")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnResponseHeadersPolicy.XSSProtectionProperty"]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "SecurityHeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty",
        jsii_struct_bases=[],
        name_mapping={"enabled": "enabled", "sampling_rate": "samplingRate"},
    )
    class ServerTimingHeadersConfigProperty:
        def __init__(
            self,
            *,
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            sampling_rate: typing.Optional[jsii.Number] = None,
        ) -> None:
            '''A configuration for enabling the ``Server-Timing`` header in HTTP responses sent from CloudFront.

            :param enabled: A Boolean that determines whether CloudFront adds the ``Server-Timing`` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
            :param sampling_rate: A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the ``Server-Timing`` header to. When you set the sampling rate to 100, CloudFront adds the ``Server-Timing`` header to the HTTP response for every request that matches the cache behavior that this response headers policy is attached to. When you set it to 50, CloudFront adds the header to 50% of the responses for requests that match the cache behavior. You can set the sampling rate to any number 0–100 with up to four decimal places.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-servertimingheadersconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                server_timing_headers_config_property = cloudfront.CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty(
                    enabled=False,
                
                    # the properties below are optional
                    sampling_rate=123
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__7287f7cb87a31b9049dab2c1b40c35e5b8f06f0faf1827f8a2351ebaaaed4d45)
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument sampling_rate", value=sampling_rate, expected_type=type_hints["sampling_rate"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "enabled": enabled,
            }
            if sampling_rate is not None:
                self._values["sampling_rate"] = sampling_rate

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront adds the ``Server-Timing`` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-servertimingheadersconfig.html#cfn-cloudfront-responseheaderspolicy-servertimingheadersconfig-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def sampling_rate(self) -> typing.Optional[jsii.Number]:
            '''A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the ``Server-Timing`` header to.

            When you set the sampling rate to 100, CloudFront adds the ``Server-Timing`` header to the HTTP response for every request that matches the cache behavior that this response headers policy is attached to. When you set it to 50, CloudFront adds the header to 50% of the responses for requests that match the cache behavior. You can set the sampling rate to any number 0–100 with up to four decimal places.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-servertimingheadersconfig.html#cfn-cloudfront-responseheaderspolicy-servertimingheadersconfig-samplingrate
            '''
            result = self._values.get("sampling_rate")
            return typing.cast(typing.Optional[jsii.Number], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "ServerTimingHeadersConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty",
        jsii_struct_bases=[],
        name_mapping={
            "access_control_max_age_sec": "accessControlMaxAgeSec",
            "override": "override",
            "include_subdomains": "includeSubdomains",
            "preload": "preload",
        },
    )
    class StrictTransportSecurityProperty:
        def __init__(
            self,
            *,
            access_control_max_age_sec: jsii.Number,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
            include_subdomains: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            preload: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
        ) -> None:
            '''Determines whether CloudFront includes the ``Strict-Transport-Security`` HTTP response header and the header's value.

            For more information about the ``Strict-Transport-Security`` HTTP response header, see `Strict-Transport-Security <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security>`_ in the MDN Web Docs.

            :param access_control_max_age_sec: A number that CloudFront uses as the value for the ``max-age`` directive in the ``Strict-Transport-Security`` HTTP response header.
            :param override: A Boolean that determines whether CloudFront overrides the ``Strict-Transport-Security`` HTTP response header received from the origin with the one specified in this response headers policy.
            :param include_subdomains: A Boolean that determines whether CloudFront includes the ``includeSubDomains`` directive in the ``Strict-Transport-Security`` HTTP response header.
            :param preload: A Boolean that determines whether CloudFront includes the ``preload`` directive in the ``Strict-Transport-Security`` HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-stricttransportsecurity.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                strict_transport_security_property = cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty(
                    access_control_max_age_sec=123,
                    override=False,
                
                    # the properties below are optional
                    include_subdomains=False,
                    preload=False
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__ed70aa7da28104db0f7ad239afaa8d904abf3cd909e05cc36724ddb717abff80)
                check_type(argname="argument access_control_max_age_sec", value=access_control_max_age_sec, expected_type=type_hints["access_control_max_age_sec"])
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
                check_type(argname="argument include_subdomains", value=include_subdomains, expected_type=type_hints["include_subdomains"])
                check_type(argname="argument preload", value=preload, expected_type=type_hints["preload"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "access_control_max_age_sec": access_control_max_age_sec,
                "override": override,
            }
            if include_subdomains is not None:
                self._values["include_subdomains"] = include_subdomains
            if preload is not None:
                self._values["preload"] = preload

        @builtins.property
        def access_control_max_age_sec(self) -> jsii.Number:
            '''A number that CloudFront uses as the value for the ``max-age`` directive in the ``Strict-Transport-Security`` HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-stricttransportsecurity.html#cfn-cloudfront-responseheaderspolicy-stricttransportsecurity-accesscontrolmaxagesec
            '''
            result = self._values.get("access_control_max_age_sec")
            assert result is not None, "Required property 'access_control_max_age_sec' is missing"
            return typing.cast(jsii.Number, result)

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``Strict-Transport-Security`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-stricttransportsecurity.html#cfn-cloudfront-responseheaderspolicy-stricttransportsecurity-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def include_subdomains(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A Boolean that determines whether CloudFront includes the ``includeSubDomains`` directive in the ``Strict-Transport-Security`` HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-stricttransportsecurity.html#cfn-cloudfront-responseheaderspolicy-stricttransportsecurity-includesubdomains
            '''
            result = self._values.get("include_subdomains")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def preload(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A Boolean that determines whether CloudFront includes the ``preload`` directive in the ``Strict-Transport-Security`` HTTP response header.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-stricttransportsecurity.html#cfn-cloudfront-responseheaderspolicy-stricttransportsecurity-preload
            '''
            result = self._values.get("preload")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "StrictTransportSecurityProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty",
        jsii_struct_bases=[],
        name_mapping={
            "override": "override",
            "protection": "protection",
            "mode_block": "modeBlock",
            "report_uri": "reportUri",
        },
    )
    class XSSProtectionProperty:
        def __init__(
            self,
            *,
            override: typing.Union[builtins.bool, _IResolvable_da3f097b],
            protection: typing.Union[builtins.bool, _IResolvable_da3f097b],
            mode_block: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
            report_uri: typing.Optional[builtins.str] = None,
        ) -> None:
            '''Determines whether CloudFront includes the ``X-XSS-Protection`` HTTP response header and the header's value.

            For more information about the ``X-XSS-Protection`` HTTP response header, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :param override: A Boolean that determines whether CloudFront overrides the ``X-XSS-Protection`` HTTP response header received from the origin with the one specified in this response headers policy.
            :param protection: A Boolean that determines the value of the ``X-XSS-Protection`` HTTP response header. When this setting is ``true`` , the value of the ``X-XSS-Protection`` header is ``1`` . When this setting is ``false`` , the value of the ``X-XSS-Protection`` header is ``0`` . For more information about these settings, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.
            :param mode_block: A Boolean that determines whether CloudFront includes the ``mode=block`` directive in the ``X-XSS-Protection`` header. For more information about this directive, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.
            :param report_uri: A reporting URI, which CloudFront uses as the value of the ``report`` directive in the ``X-XSS-Protection`` header. You cannot specify a ``ReportUri`` when ``ModeBlock`` is ``true`` . For more information about using a reporting URL, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-xssprotection.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                x_sSProtection_property = cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty(
                    override=False,
                    protection=False,
                
                    # the properties below are optional
                    mode_block=False,
                    report_uri="reportUri"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__5cb6b2605fdf9baf4f99e2d19193e93d8c1596ba58cc1248db85347b49a33b46)
                check_type(argname="argument override", value=override, expected_type=type_hints["override"])
                check_type(argname="argument protection", value=protection, expected_type=type_hints["protection"])
                check_type(argname="argument mode_block", value=mode_block, expected_type=type_hints["mode_block"])
                check_type(argname="argument report_uri", value=report_uri, expected_type=type_hints["report_uri"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "override": override,
                "protection": protection,
            }
            if mode_block is not None:
                self._values["mode_block"] = mode_block
            if report_uri is not None:
                self._values["report_uri"] = report_uri

        @builtins.property
        def override(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines whether CloudFront overrides the ``X-XSS-Protection`` HTTP response header received from the origin with the one specified in this response headers policy.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-xssprotection.html#cfn-cloudfront-responseheaderspolicy-xssprotection-override
            '''
            result = self._values.get("override")
            assert result is not None, "Required property 'override' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def protection(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''A Boolean that determines the value of the ``X-XSS-Protection`` HTTP response header.

            When this setting is ``true`` , the value of the ``X-XSS-Protection`` header is ``1`` . When this setting is ``false`` , the value of the ``X-XSS-Protection`` header is ``0`` .

            For more information about these settings, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-xssprotection.html#cfn-cloudfront-responseheaderspolicy-xssprotection-protection
            '''
            result = self._values.get("protection")
            assert result is not None, "Required property 'protection' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def mode_block(
            self,
        ) -> typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]]:
            '''A Boolean that determines whether CloudFront includes the ``mode=block`` directive in the ``X-XSS-Protection`` header.

            For more information about this directive, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-xssprotection.html#cfn-cloudfront-responseheaderspolicy-xssprotection-modeblock
            '''
            result = self._values.get("mode_block")
            return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)

        @builtins.property
        def report_uri(self) -> typing.Optional[builtins.str]:
            '''A reporting URI, which CloudFront uses as the value of the ``report`` directive in the ``X-XSS-Protection`` header.

            You cannot specify a ``ReportUri`` when ``ModeBlock`` is ``true`` .

            For more information about using a reporting URL, see `X-XSS-Protection <https://docs.aws.amazon.com/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection>`_ in the MDN Web Docs.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-responseheaderspolicy-xssprotection.html#cfn-cloudfront-responseheaderspolicy-xssprotection-reporturi
            '''
            result = self._values.get("report_uri")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "XSSProtectionProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnResponseHeadersPolicyProps",
    jsii_struct_bases=[],
    name_mapping={"response_headers_policy_config": "responseHeadersPolicyConfig"},
)
class CfnResponseHeadersPolicyProps:
    def __init__(
        self,
        *,
        response_headers_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Properties for defining a ``CfnResponseHeadersPolicy``.

        :param response_headers_policy_config: A response headers policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-responseheaderspolicy.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_response_headers_policy_props = cloudfront.CfnResponseHeadersPolicyProps(
                response_headers_policy_config=cloudfront.CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty(
                    name="name",
            
                    # the properties below are optional
                    comment="comment",
                    cors_config=cloudfront.CfnResponseHeadersPolicy.CorsConfigProperty(
                        access_control_allow_credentials=False,
                        access_control_allow_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty(
                            items=["items"]
                        ),
                        access_control_allow_methods=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty(
                            items=["items"]
                        ),
                        access_control_allow_origins=cloudfront.CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty(
                            items=["items"]
                        ),
                        origin_override=False,
            
                        # the properties below are optional
                        access_control_expose_headers=cloudfront.CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty(
                            items=["items"]
                        ),
                        access_control_max_age_sec=123
                    ),
                    custom_headers_config=cloudfront.CfnResponseHeadersPolicy.CustomHeadersConfigProperty(
                        items=[cloudfront.CfnResponseHeadersPolicy.CustomHeaderProperty(
                            header="header",
                            override=False,
                            value="value"
                        )]
                    ),
                    remove_headers_config=cloudfront.CfnResponseHeadersPolicy.RemoveHeadersConfigProperty(
                        items=[cloudfront.CfnResponseHeadersPolicy.RemoveHeaderProperty(
                            header="header"
                        )]
                    ),
                    security_headers_config=cloudfront.CfnResponseHeadersPolicy.SecurityHeadersConfigProperty(
                        content_security_policy=cloudfront.CfnResponseHeadersPolicy.ContentSecurityPolicyProperty(
                            content_security_policy="contentSecurityPolicy",
                            override=False
                        ),
                        content_type_options=cloudfront.CfnResponseHeadersPolicy.ContentTypeOptionsProperty(
                            override=False
                        ),
                        frame_options=cloudfront.CfnResponseHeadersPolicy.FrameOptionsProperty(
                            frame_option="frameOption",
                            override=False
                        ),
                        referrer_policy=cloudfront.CfnResponseHeadersPolicy.ReferrerPolicyProperty(
                            override=False,
                            referrer_policy="referrerPolicy"
                        ),
                        strict_transport_security=cloudfront.CfnResponseHeadersPolicy.StrictTransportSecurityProperty(
                            access_control_max_age_sec=123,
                            override=False,
            
                            # the properties below are optional
                            include_subdomains=False,
                            preload=False
                        ),
                        xss_protection=cloudfront.CfnResponseHeadersPolicy.XSSProtectionProperty(
                            override=False,
                            protection=False,
            
                            # the properties below are optional
                            mode_block=False,
                            report_uri="reportUri"
                        )
                    ),
                    server_timing_headers_config=cloudfront.CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty(
                        enabled=False,
            
                        # the properties below are optional
                        sampling_rate=123
                    )
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f8511083ec6665a44270c5e9c28a72f850eee19740fa9ddf72640068ce2a2cb)
            check_type(argname="argument response_headers_policy_config", value=response_headers_policy_config, expected_type=type_hints["response_headers_policy_config"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "response_headers_policy_config": response_headers_policy_config,
        }

    @builtins.property
    def response_headers_policy_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty]:
        '''A response headers policy configuration.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-responseheaderspolicy.html#cfn-cloudfront-responseheaderspolicy-responseheaderspolicyconfig
        '''
        result = self._values.get("response_headers_policy_config")
        assert result is not None, "Required property 'response_headers_policy_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnResponseHeadersPolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(_IInspectable_c2943556, _ITaggable_36806126)
class CfnStreamingDistribution(
    _CfnResource_9df397a6,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistribution",
):
    '''This resource is deprecated.

    Amazon CloudFront is deprecating real-time messaging protocol (RTMP) distributions on December 31, 2020. For more information, `read the announcement <https://docs.aws.amazon.com/ann.jspa?annID=7356>`_ on the Amazon CloudFront discussion forum.

    :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-streamingdistribution.html
    :cloudformationResource: AWS::CloudFront::StreamingDistribution
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        cfn_streaming_distribution = cloudfront.CfnStreamingDistribution(self, "MyCfnStreamingDistribution",
            streaming_distribution_config=cloudfront.CfnStreamingDistribution.StreamingDistributionConfigProperty(
                comment="comment",
                enabled=False,
                s3_origin=cloudfront.CfnStreamingDistribution.S3OriginProperty(
                    domain_name="domainName",
                    origin_access_identity="originAccessIdentity"
                ),
                trusted_signers=cloudfront.CfnStreamingDistribution.TrustedSignersProperty(
                    enabled=False,
        
                    # the properties below are optional
                    aws_account_numbers=["awsAccountNumbers"]
                ),
        
                # the properties below are optional
                aliases=["aliases"],
                logging=cloudfront.CfnStreamingDistribution.LoggingProperty(
                    bucket="bucket",
                    enabled=False,
                    prefix="prefix"
                ),
                price_class="priceClass"
            ),
        
            # the properties below are optional
            tags=[CfnTag(
                key="key",
                value="value"
            )]
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        streaming_distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union["CfnStreamingDistribution.StreamingDistributionConfigProperty", typing.Dict[builtins.str, typing.Any]]],
        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''
        :param scope: Scope in which this resource is defined.
        :param id: Construct identifier for this resource (unique in its scope).
        :param streaming_distribution_config: The current configuration information for the RTMP distribution.
        :param tags: A complex type that contains zero or more ``Tag`` elements.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__17ca08764f2b6977e10df04a284bfbc1dbaa0d6bbc803a829470cc3b9d6af3e5)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CfnStreamingDistributionProps(
            streaming_distribution_config=streaming_distribution_config, tags=tags
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="inspect")
    def inspect(self, inspector: _TreeInspector_488e0dd5) -> None:
        '''Examines the CloudFormation resource and discloses attributes.

        :param inspector: tree inspector to collect and process attributes.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ac1854f5f193377cda6bb81ca0d6ba242bd208bc7a9cf98c91ebe2ce4c52ed6)
            check_type(argname="argument inspector", value=inspector, expected_type=type_hints["inspector"])
        return typing.cast(None, jsii.invoke(self, "inspect", [inspector]))

    @jsii.member(jsii_name="renderProperties")
    def _render_properties(
        self,
        props: typing.Mapping[builtins.str, typing.Any],
    ) -> typing.Mapping[builtins.str, typing.Any]:
        '''
        :param props: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__819e188a059835947d7598f592d6c32e47d6dd56947e197d47b14f4b0011cfe2)
            check_type(argname="argument props", value=props, expected_type=type_hints["props"])
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.invoke(self, "renderProperties", [props]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CFN_RESOURCE_TYPE_NAME")
    def CFN_RESOURCE_TYPE_NAME(cls) -> builtins.str:
        '''The CloudFormation resource type name for this resource class.'''
        return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))

    @builtins.property
    @jsii.member(jsii_name="attrDomainName")
    def attr_domain_name(self) -> builtins.str:
        '''The domain name of the resource, such as ``d111111abcdef8.cloudfront.net`` .

        :cloudformationAttribute: DomainName
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrDomainName"))

    @builtins.property
    @jsii.member(jsii_name="attrId")
    def attr_id(self) -> builtins.str:
        '''
        :cloudformationAttribute: Id
        '''
        return typing.cast(builtins.str, jsii.get(self, "attrId"))

    @builtins.property
    @jsii.member(jsii_name="cfnProperties")
    def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
        return typing.cast(typing.Mapping[builtins.str, typing.Any], jsii.get(self, "cfnProperties"))

    @builtins.property
    @jsii.member(jsii_name="tags")
    def tags(self) -> _TagManager_0a598cb3:
        '''Tag Manager which manages the tags for this resource.'''
        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "tags"))

    @builtins.property
    @jsii.member(jsii_name="streamingDistributionConfig")
    def streaming_distribution_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.StreamingDistributionConfigProperty"]:
        '''The current configuration information for the RTMP distribution.'''
        return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.StreamingDistributionConfigProperty"], jsii.get(self, "streamingDistributionConfig"))

    @streaming_distribution_config.setter
    def streaming_distribution_config(
        self,
        value: typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.StreamingDistributionConfigProperty"],
    ) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc8a8d78e195f1bab99bca7ea58d3b6a029844997b8e6940d737f147d8dcc6d2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "streamingDistributionConfig", value)

    @builtins.property
    @jsii.member(jsii_name="tagsRaw")
    def tags_raw(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
        '''A complex type that contains zero or more ``Tag`` elements.'''
        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "tagsRaw"))

    @tags_raw.setter
    def tags_raw(self, value: typing.Optional[typing.List[_CfnTag_f6864754]]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a91a3a4fec8e270215622a8e9c4af00c6cfb4cfbe6700e58871b60ab722463f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "tagsRaw", value)

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistribution.LoggingProperty",
        jsii_struct_bases=[],
        name_mapping={"bucket": "bucket", "enabled": "enabled", "prefix": "prefix"},
    )
    class LoggingProperty:
        def __init__(
            self,
            *,
            bucket: builtins.str,
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            prefix: builtins.str,
        ) -> None:
            '''A complex type that controls whether access logs are written for the streaming distribution.

            :param bucket: The Amazon S3 bucket to store the access logs in, for example, ``myawslogbucket.s3.amazonaws.com`` .
            :param enabled: Specifies whether you want CloudFront to save access logs to an Amazon S3 bucket. If you don't want to enable logging when you create a streaming distribution or if you want to disable logging for an existing streaming distribution, specify ``false`` for ``Enabled`` , and specify ``empty Bucket`` and ``Prefix`` elements. If you specify ``false`` for ``Enabled`` but you specify values for ``Bucket`` and ``Prefix`` , the values are automatically deleted.
            :param prefix: An optional string that you want CloudFront to prefix to the access log filenames for this streaming distribution, for example, ``myprefix/`` . If you want to enable logging, but you don't want to specify a prefix, you still must include an empty ``Prefix`` element in the ``Logging`` element.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-logging.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                logging_property = cloudfront.CfnStreamingDistribution.LoggingProperty(
                    bucket="bucket",
                    enabled=False,
                    prefix="prefix"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__795127bdb4c64be24c3c21c115b84685ac7559387940a97c90aba108bcd5a4e2)
                check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument prefix", value=prefix, expected_type=type_hints["prefix"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "bucket": bucket,
                "enabled": enabled,
                "prefix": prefix,
            }

        @builtins.property
        def bucket(self) -> builtins.str:
            '''The Amazon S3 bucket to store the access logs in, for example, ``myawslogbucket.s3.amazonaws.com`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-logging.html#cfn-cloudfront-streamingdistribution-logging-bucket
            '''
            result = self._values.get("bucket")
            assert result is not None, "Required property 'bucket' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''Specifies whether you want CloudFront to save access logs to an Amazon S3 bucket.

            If you don't want to enable logging when you create a streaming distribution or if you want to disable logging for an existing streaming distribution, specify ``false`` for ``Enabled`` , and specify ``empty Bucket`` and ``Prefix`` elements. If you specify ``false`` for ``Enabled`` but you specify values for ``Bucket`` and ``Prefix`` , the values are automatically deleted.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-logging.html#cfn-cloudfront-streamingdistribution-logging-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def prefix(self) -> builtins.str:
            '''An optional string that you want CloudFront to prefix to the access log filenames for this streaming distribution, for example, ``myprefix/`` .

            If you want to enable logging, but you don't want to specify a prefix, you still must include an empty ``Prefix`` element in the ``Logging`` element.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-logging.html#cfn-cloudfront-streamingdistribution-logging-prefix
            '''
            result = self._values.get("prefix")
            assert result is not None, "Required property 'prefix' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "LoggingProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistribution.S3OriginProperty",
        jsii_struct_bases=[],
        name_mapping={
            "domain_name": "domainName",
            "origin_access_identity": "originAccessIdentity",
        },
    )
    class S3OriginProperty:
        def __init__(
            self,
            *,
            domain_name: builtins.str,
            origin_access_identity: builtins.str,
        ) -> None:
            '''A complex type that contains information about the Amazon S3 bucket from which you want CloudFront to get your media files for distribution.

            :param domain_name: The DNS name of the Amazon S3 origin.
            :param origin_access_identity: The CloudFront origin access identity to associate with the distribution. Use an origin access identity to configure the distribution so that end users can only access objects in an Amazon S3 bucket through CloudFront. If you want end users to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element. To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element. To replace the origin access identity, update the distribution configuration and specify the new origin access identity. For more information, see `Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-s3origin.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                s3_origin_property = cloudfront.CfnStreamingDistribution.S3OriginProperty(
                    domain_name="domainName",
                    origin_access_identity="originAccessIdentity"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__9ff1dcf0acb5b66c663decda982b7a72c0adc51ed56e979cac91b64f10de923c)
                check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
                check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "domain_name": domain_name,
                "origin_access_identity": origin_access_identity,
            }

        @builtins.property
        def domain_name(self) -> builtins.str:
            '''The DNS name of the Amazon S3 origin.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-s3origin.html#cfn-cloudfront-streamingdistribution-s3origin-domainname
            '''
            result = self._values.get("domain_name")
            assert result is not None, "Required property 'domain_name' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def origin_access_identity(self) -> builtins.str:
            '''The CloudFront origin access identity to associate with the distribution.

            Use an origin access identity to configure the distribution so that end users can only access objects in an Amazon S3 bucket through CloudFront.

            If you want end users to be able to access objects using either the CloudFront URL or the Amazon S3 URL, specify an empty ``OriginAccessIdentity`` element.

            To delete the origin access identity from an existing distribution, update the distribution configuration and include an empty ``OriginAccessIdentity`` element.

            To replace the origin access identity, update the distribution configuration and specify the new origin access identity.

            For more information, see `Using an Origin Access Identity to Restrict Access to Your Amazon S3 Content <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-s3origin.html#cfn-cloudfront-streamingdistribution-s3origin-originaccessidentity
            '''
            result = self._values.get("origin_access_identity")
            assert result is not None, "Required property 'origin_access_identity' is missing"
            return typing.cast(builtins.str, result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "S3OriginProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistribution.StreamingDistributionConfigProperty",
        jsii_struct_bases=[],
        name_mapping={
            "comment": "comment",
            "enabled": "enabled",
            "s3_origin": "s3Origin",
            "trusted_signers": "trustedSigners",
            "aliases": "aliases",
            "logging": "logging",
            "price_class": "priceClass",
        },
    )
    class StreamingDistributionConfigProperty:
        def __init__(
            self,
            *,
            comment: builtins.str,
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            s3_origin: typing.Union[_IResolvable_da3f097b, typing.Union["CfnStreamingDistribution.S3OriginProperty", typing.Dict[builtins.str, typing.Any]]],
            trusted_signers: typing.Union[_IResolvable_da3f097b, typing.Union["CfnStreamingDistribution.TrustedSignersProperty", typing.Dict[builtins.str, typing.Any]]],
            aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
            logging: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnStreamingDistribution.LoggingProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
            price_class: typing.Optional[builtins.str] = None,
        ) -> None:
            '''The RTMP distribution's configuration information.

            :param comment: Any comments you want to include about the streaming distribution.
            :param enabled: Whether the streaming distribution is enabled to accept user requests for content.
            :param s3_origin: A complex type that contains information about the Amazon S3 bucket from which you want CloudFront to get your media files for distribution.
            :param trusted_signers: A complex type that specifies any AWS accounts that you want to permit to create signed URLs for private content. If you want the distribution to use signed URLs, include this element; if you want the distribution to use public URLs, remove this element. For more information, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .
            :param aliases: A complex type that contains information about CNAMEs (alternate domain names), if any, for this streaming distribution.
            :param logging: A complex type that controls whether access logs are written for the streaming distribution.
            :param price_class: A complex type that contains information about price class for this streaming distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                streaming_distribution_config_property = cloudfront.CfnStreamingDistribution.StreamingDistributionConfigProperty(
                    comment="comment",
                    enabled=False,
                    s3_origin=cloudfront.CfnStreamingDistribution.S3OriginProperty(
                        domain_name="domainName",
                        origin_access_identity="originAccessIdentity"
                    ),
                    trusted_signers=cloudfront.CfnStreamingDistribution.TrustedSignersProperty(
                        enabled=False,
                
                        # the properties below are optional
                        aws_account_numbers=["awsAccountNumbers"]
                    ),
                
                    # the properties below are optional
                    aliases=["aliases"],
                    logging=cloudfront.CfnStreamingDistribution.LoggingProperty(
                        bucket="bucket",
                        enabled=False,
                        prefix="prefix"
                    ),
                    price_class="priceClass"
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__f50c61c21b5e047b7581d74bb0c2bfc94029fc8749c581d945be8555eb4b1a5c)
                check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument s3_origin", value=s3_origin, expected_type=type_hints["s3_origin"])
                check_type(argname="argument trusted_signers", value=trusted_signers, expected_type=type_hints["trusted_signers"])
                check_type(argname="argument aliases", value=aliases, expected_type=type_hints["aliases"])
                check_type(argname="argument logging", value=logging, expected_type=type_hints["logging"])
                check_type(argname="argument price_class", value=price_class, expected_type=type_hints["price_class"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "comment": comment,
                "enabled": enabled,
                "s3_origin": s3_origin,
                "trusted_signers": trusted_signers,
            }
            if aliases is not None:
                self._values["aliases"] = aliases
            if logging is not None:
                self._values["logging"] = logging
            if price_class is not None:
                self._values["price_class"] = price_class

        @builtins.property
        def comment(self) -> builtins.str:
            '''Any comments you want to include about the streaming distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-comment
            '''
            result = self._values.get("comment")
            assert result is not None, "Required property 'comment' is missing"
            return typing.cast(builtins.str, result)

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''Whether the streaming distribution is enabled to accept user requests for content.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def s3_origin(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.S3OriginProperty"]:
            '''A complex type that contains information about the Amazon S3 bucket from which you want CloudFront to get your media files for distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-s3origin
            '''
            result = self._values.get("s3_origin")
            assert result is not None, "Required property 's3_origin' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.S3OriginProperty"], result)

        @builtins.property
        def trusted_signers(
            self,
        ) -> typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.TrustedSignersProperty"]:
            '''A complex type that specifies any AWS accounts that you want to permit to create signed URLs for private content.

            If you want the distribution to use signed URLs, include this element; if you want the distribution to use public URLs, remove this element. For more information, see `Serving Private Content through CloudFront <https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/PrivateContent.html>`_ in the *Amazon CloudFront Developer Guide* .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-trustedsigners
            '''
            result = self._values.get("trusted_signers")
            assert result is not None, "Required property 'trusted_signers' is missing"
            return typing.cast(typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.TrustedSignersProperty"], result)

        @builtins.property
        def aliases(self) -> typing.Optional[typing.List[builtins.str]]:
            '''A complex type that contains information about CNAMEs (alternate domain names), if any, for this streaming distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-aliases
            '''
            result = self._values.get("aliases")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        @builtins.property
        def logging(
            self,
        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.LoggingProperty"]]:
            '''A complex type that controls whether access logs are written for the streaming distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-logging
            '''
            result = self._values.get("logging")
            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnStreamingDistribution.LoggingProperty"]], result)

        @builtins.property
        def price_class(self) -> typing.Optional[builtins.str]:
            '''A complex type that contains information about price class for this streaming distribution.

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-streamingdistributionconfig.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig-priceclass
            '''
            result = self._values.get("price_class")
            return typing.cast(typing.Optional[builtins.str], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "StreamingDistributionConfigProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )

    @jsii.data_type(
        jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistribution.TrustedSignersProperty",
        jsii_struct_bases=[],
        name_mapping={
            "enabled": "enabled",
            "aws_account_numbers": "awsAccountNumbers",
        },
    )
    class TrustedSignersProperty:
        def __init__(
            self,
            *,
            enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
            aws_account_numbers: typing.Optional[typing.Sequence[builtins.str]] = None,
        ) -> None:
            '''A list of AWS accounts whose public keys CloudFront can use to verify the signatures of signed URLs and signed cookies.

            :param enabled: This field is ``true`` if any of the AWS accounts in the list are configured as trusted signers. If not, this field is ``false`` .
            :param aws_account_numbers: An AWS account number that contains active CloudFront key pairs that CloudFront can use to verify the signatures of signed URLs and signed cookies. If the AWS account that owns the key pairs is the same account that owns the CloudFront distribution, the value of this field is ``self`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-trustedsigners.html
            :exampleMetadata: fixture=_generated

            Example::

                # The code below shows an example of how to instantiate this type.
                # The values are placeholders you should change.
                from aws_cdk import aws_cloudfront as cloudfront
                
                trusted_signers_property = cloudfront.CfnStreamingDistribution.TrustedSignersProperty(
                    enabled=False,
                
                    # the properties below are optional
                    aws_account_numbers=["awsAccountNumbers"]
                )
            '''
            if __debug__:
                type_hints = typing.get_type_hints(_typecheckingstub__49f382fbeca6f3ca4b73ecf7372c7a177aa462053b1953cff5b08a7fe5d5f174)
                check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
                check_type(argname="argument aws_account_numbers", value=aws_account_numbers, expected_type=type_hints["aws_account_numbers"])
            self._values: typing.Dict[builtins.str, typing.Any] = {
                "enabled": enabled,
            }
            if aws_account_numbers is not None:
                self._values["aws_account_numbers"] = aws_account_numbers

        @builtins.property
        def enabled(self) -> typing.Union[builtins.bool, _IResolvable_da3f097b]:
            '''This field is ``true`` if any of the AWS accounts in the list are configured as trusted signers.

            If not, this field is ``false`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-trustedsigners.html#cfn-cloudfront-streamingdistribution-trustedsigners-enabled
            '''
            result = self._values.get("enabled")
            assert result is not None, "Required property 'enabled' is missing"
            return typing.cast(typing.Union[builtins.bool, _IResolvable_da3f097b], result)

        @builtins.property
        def aws_account_numbers(self) -> typing.Optional[typing.List[builtins.str]]:
            '''An AWS account number that contains active CloudFront key pairs that CloudFront can use to verify the signatures of signed URLs and signed cookies.

            If the AWS account that owns the key pairs is the same account that owns the CloudFront distribution, the value of this field is ``self`` .

            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-streamingdistribution-trustedsigners.html#cfn-cloudfront-streamingdistribution-trustedsigners-awsaccountnumbers
            '''
            result = self._values.get("aws_account_numbers")
            return typing.cast(typing.Optional[typing.List[builtins.str]], result)

        def __eq__(self, rhs: typing.Any) -> builtins.bool:
            return isinstance(rhs, self.__class__) and rhs._values == self._values

        def __ne__(self, rhs: typing.Any) -> builtins.bool:
            return not (rhs == self)

        def __repr__(self) -> str:
            return "TrustedSignersProperty(%s)" % ", ".join(
                k + "=" + repr(v) for k, v in self._values.items()
            )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CfnStreamingDistributionProps",
    jsii_struct_bases=[],
    name_mapping={
        "streaming_distribution_config": "streamingDistributionConfig",
        "tags": "tags",
    },
)
class CfnStreamingDistributionProps:
    def __init__(
        self,
        *,
        streaming_distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.StreamingDistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
        tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
    ) -> None:
        '''Properties for defining a ``CfnStreamingDistribution``.

        :param streaming_distribution_config: The current configuration information for the RTMP distribution.
        :param tags: A complex type that contains zero or more ``Tag`` elements.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-streamingdistribution.html
        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cfn_streaming_distribution_props = cloudfront.CfnStreamingDistributionProps(
                streaming_distribution_config=cloudfront.CfnStreamingDistribution.StreamingDistributionConfigProperty(
                    comment="comment",
                    enabled=False,
                    s3_origin=cloudfront.CfnStreamingDistribution.S3OriginProperty(
                        domain_name="domainName",
                        origin_access_identity="originAccessIdentity"
                    ),
                    trusted_signers=cloudfront.CfnStreamingDistribution.TrustedSignersProperty(
                        enabled=False,
            
                        # the properties below are optional
                        aws_account_numbers=["awsAccountNumbers"]
                    ),
            
                    # the properties below are optional
                    aliases=["aliases"],
                    logging=cloudfront.CfnStreamingDistribution.LoggingProperty(
                        bucket="bucket",
                        enabled=False,
                        prefix="prefix"
                    ),
                    price_class="priceClass"
                ),
            
                # the properties below are optional
                tags=[CfnTag(
                    key="key",
                    value="value"
                )]
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb98a63a577b61baa6128a211026a41a13348dc9752d07118d9db5c63108ad97)
            check_type(argname="argument streaming_distribution_config", value=streaming_distribution_config, expected_type=type_hints["streaming_distribution_config"])
            check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "streaming_distribution_config": streaming_distribution_config,
        }
        if tags is not None:
            self._values["tags"] = tags

    @builtins.property
    def streaming_distribution_config(
        self,
    ) -> typing.Union[_IResolvable_da3f097b, CfnStreamingDistribution.StreamingDistributionConfigProperty]:
        '''The current configuration information for the RTMP distribution.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-streamingdistribution.html#cfn-cloudfront-streamingdistribution-streamingdistributionconfig
        '''
        result = self._values.get("streaming_distribution_config")
        assert result is not None, "Required property 'streaming_distribution_config' is missing"
        return typing.cast(typing.Union[_IResolvable_da3f097b, CfnStreamingDistribution.StreamingDistributionConfigProperty], result)

    @builtins.property
    def tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
        '''A complex type that contains zero or more ``Tag`` elements.

        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-streamingdistribution.html#cfn-cloudfront-streamingdistribution-tags
        '''
        result = self._values.get("tags")
        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CfnStreamingDistributionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.CloudFrontAllowedCachedMethods")
class CloudFrontAllowedCachedMethods(enum.Enum):
    '''Enums for the methods CloudFront can cache.'''

    GET_HEAD = "GET_HEAD"
    GET_HEAD_OPTIONS = "GET_HEAD_OPTIONS"


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.CloudFrontAllowedMethods")
class CloudFrontAllowedMethods(enum.Enum):
    '''An enum for the supported methods to a CloudFront distribution.'''

    GET_HEAD = "GET_HEAD"
    GET_HEAD_OPTIONS = "GET_HEAD_OPTIONS"
    ALL = "ALL"


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CloudFrontWebDistributionAttributes",
    jsii_struct_bases=[],
    name_mapping={"distribution_id": "distributionId", "domain_name": "domainName"},
)
class CloudFrontWebDistributionAttributes:
    def __init__(
        self,
        *,
        distribution_id: builtins.str,
        domain_name: builtins.str,
    ) -> None:
        '''Attributes used to import a Distribution.

        :param distribution_id: The distribution ID for this distribution.
        :param domain_name: The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            cloud_front_web_distribution_attributes = cloudfront.CloudFrontWebDistributionAttributes(
                distribution_id="distributionId",
                domain_name="domainName"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4066bd6a3cdef7b839e125a6133e4a1d52cc939d9ec9dd0288d2750b135e9452)
            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "distribution_id": distribution_id,
            "domain_name": domain_name,
        }

    @builtins.property
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.

        :attribute: true
        '''
        result = self._values.get("distribution_id")
        assert result is not None, "Required property 'distribution_id' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def domain_name(self) -> builtins.str:
        '''The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :attribute: true
        '''
        result = self._values.get("domain_name")
        assert result is not None, "Required property 'domain_name' is missing"
        return typing.cast(builtins.str, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CloudFrontWebDistributionAttributes(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CloudFrontWebDistributionProps",
    jsii_struct_bases=[],
    name_mapping={
        "origin_configs": "originConfigs",
        "comment": "comment",
        "default_root_object": "defaultRootObject",
        "enabled": "enabled",
        "enable_ip_v6": "enableIpV6",
        "error_configurations": "errorConfigurations",
        "geo_restriction": "geoRestriction",
        "http_version": "httpVersion",
        "logging_config": "loggingConfig",
        "price_class": "priceClass",
        "viewer_certificate": "viewerCertificate",
        "viewer_protocol_policy": "viewerProtocolPolicy",
        "web_acl_id": "webACLId",
    },
)
class CloudFrontWebDistributionProps:
    def __init__(
        self,
        *,
        origin_configs: typing.Sequence[typing.Union["SourceConfiguration", typing.Dict[builtins.str, typing.Any]]],
        comment: typing.Optional[builtins.str] = None,
        default_root_object: typing.Optional[builtins.str] = None,
        enabled: typing.Optional[builtins.bool] = None,
        enable_ip_v6: typing.Optional[builtins.bool] = None,
        error_configurations: typing.Optional[typing.Sequence[typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
        geo_restriction: typing.Optional["GeoRestriction"] = None,
        http_version: typing.Optional["HttpVersion"] = None,
        logging_config: typing.Optional[typing.Union["LoggingConfiguration", typing.Dict[builtins.str, typing.Any]]] = None,
        price_class: typing.Optional["PriceClass"] = None,
        viewer_certificate: typing.Optional["ViewerCertificate"] = None,
        viewer_protocol_policy: typing.Optional["ViewerProtocolPolicy"] = None,
        web_acl_id: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param origin_configs: The origin configurations for this distribution. Behaviors are a part of the origin.
        :param comment: A comment for this distribution in the CloudFront console. Default: - No comment is added to distribution.
        :param default_root_object: The default object to serve. Default: - "index.html" is served.
        :param enabled: Enable or disable the distribution. Default: true
        :param enable_ip_v6: If your distribution should have IPv6 enabled. Default: true
        :param error_configurations: How CloudFront should handle requests that are not successful (eg PageNotFound). By default, CloudFront does not replace HTTP status codes in the 4xx and 5xx range with custom error messages. CloudFront does not cache HTTP status codes. Default: - No custom error configuration.
        :param geo_restriction: Controls the countries in which your content is distributed. Default: No geo restriction
        :param http_version: The max supported HTTP Versions. Default: HttpVersion.HTTP2
        :param logging_config: Optional - if we should enable logging. You can pass an empty object ({}) to have us auto create a bucket for logging. Omission of this property indicates no logging is to be enabled. Default: - no logging is enabled by default.
        :param price_class: The price class for the distribution (this impacts how many locations CloudFront uses for your distribution, and billing). Default: PriceClass.PRICE_CLASS_100 the cheapest option for CloudFront is picked by default.
        :param viewer_certificate: Specifies whether you want viewers to use HTTP or HTTPS to request your objects, whether you're using an alternate domain name with HTTPS, and if so, if you're using AWS Certificate Manager (ACM) or a third-party certificate authority. Default: ViewerCertificate.fromCloudFrontDefaultCertificate()
        :param viewer_protocol_policy: The default viewer policy for incoming clients. Default: RedirectToHTTPs
        :param web_acl_id: Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution. To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``. Default: - No AWS Web Application Firewall web access control list (web ACL).

        :exampleMetadata: infused

        Example::

            # source_bucket: s3.Bucket
            
            viewer_certificate = cloudfront.ViewerCertificate.from_iam_certificate("MYIAMROLEIDENTIFIER",
                aliases=["MYALIAS"]
            )
            
            cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
                origin_configs=[cloudfront.SourceConfiguration(
                    s3_origin_source=cloudfront.S3OriginConfig(
                        s3_bucket_source=source_bucket
                    ),
                    behaviors=[cloudfront.Behavior(is_default_behavior=True)]
                )
                ],
                viewer_certificate=viewer_certificate
            )
        '''
        if isinstance(logging_config, dict):
            logging_config = LoggingConfiguration(**logging_config)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e1461b88a00922880847706a707c6c0dac98194e09fb0d242ce56edf1df5a57)
            check_type(argname="argument origin_configs", value=origin_configs, expected_type=type_hints["origin_configs"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument default_root_object", value=default_root_object, expected_type=type_hints["default_root_object"])
            check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
            check_type(argname="argument enable_ip_v6", value=enable_ip_v6, expected_type=type_hints["enable_ip_v6"])
            check_type(argname="argument error_configurations", value=error_configurations, expected_type=type_hints["error_configurations"])
            check_type(argname="argument geo_restriction", value=geo_restriction, expected_type=type_hints["geo_restriction"])
            check_type(argname="argument http_version", value=http_version, expected_type=type_hints["http_version"])
            check_type(argname="argument logging_config", value=logging_config, expected_type=type_hints["logging_config"])
            check_type(argname="argument price_class", value=price_class, expected_type=type_hints["price_class"])
            check_type(argname="argument viewer_certificate", value=viewer_certificate, expected_type=type_hints["viewer_certificate"])
            check_type(argname="argument viewer_protocol_policy", value=viewer_protocol_policy, expected_type=type_hints["viewer_protocol_policy"])
            check_type(argname="argument web_acl_id", value=web_acl_id, expected_type=type_hints["web_acl_id"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "origin_configs": origin_configs,
        }
        if comment is not None:
            self._values["comment"] = comment
        if default_root_object is not None:
            self._values["default_root_object"] = default_root_object
        if enabled is not None:
            self._values["enabled"] = enabled
        if enable_ip_v6 is not None:
            self._values["enable_ip_v6"] = enable_ip_v6
        if error_configurations is not None:
            self._values["error_configurations"] = error_configurations
        if geo_restriction is not None:
            self._values["geo_restriction"] = geo_restriction
        if http_version is not None:
            self._values["http_version"] = http_version
        if logging_config is not None:
            self._values["logging_config"] = logging_config
        if price_class is not None:
            self._values["price_class"] = price_class
        if viewer_certificate is not None:
            self._values["viewer_certificate"] = viewer_certificate
        if viewer_protocol_policy is not None:
            self._values["viewer_protocol_policy"] = viewer_protocol_policy
        if web_acl_id is not None:
            self._values["web_acl_id"] = web_acl_id

    @builtins.property
    def origin_configs(self) -> typing.List["SourceConfiguration"]:
        '''The origin configurations for this distribution.

        Behaviors are a part of the origin.
        '''
        result = self._values.get("origin_configs")
        assert result is not None, "Required property 'origin_configs' is missing"
        return typing.cast(typing.List["SourceConfiguration"], result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment for this distribution in the CloudFront console.

        :default: - No comment is added to distribution.
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def default_root_object(self) -> typing.Optional[builtins.str]:
        '''The default object to serve.

        :default: - "index.html" is served.
        '''
        result = self._values.get("default_root_object")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def enabled(self) -> typing.Optional[builtins.bool]:
        '''Enable or disable the distribution.

        :default: true
        '''
        result = self._values.get("enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def enable_ip_v6(self) -> typing.Optional[builtins.bool]:
        '''If your distribution should have IPv6 enabled.

        :default: true
        '''
        result = self._values.get("enable_ip_v6")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def error_configurations(
        self,
    ) -> typing.Optional[typing.List[CfnDistribution.CustomErrorResponseProperty]]:
        '''How CloudFront should handle requests that are not successful (eg PageNotFound).

        By default, CloudFront does not replace HTTP status codes in the 4xx and 5xx range
        with custom error messages. CloudFront does not cache HTTP status codes.

        :default: - No custom error configuration.
        '''
        result = self._values.get("error_configurations")
        return typing.cast(typing.Optional[typing.List[CfnDistribution.CustomErrorResponseProperty]], result)

    @builtins.property
    def geo_restriction(self) -> typing.Optional["GeoRestriction"]:
        '''Controls the countries in which your content is distributed.

        :default: No geo restriction
        '''
        result = self._values.get("geo_restriction")
        return typing.cast(typing.Optional["GeoRestriction"], result)

    @builtins.property
    def http_version(self) -> typing.Optional["HttpVersion"]:
        '''The max supported HTTP Versions.

        :default: HttpVersion.HTTP2
        '''
        result = self._values.get("http_version")
        return typing.cast(typing.Optional["HttpVersion"], result)

    @builtins.property
    def logging_config(self) -> typing.Optional["LoggingConfiguration"]:
        '''Optional - if we should enable logging.

        You can pass an empty object ({}) to have us auto create a bucket for logging.
        Omission of this property indicates no logging is to be enabled.

        :default: - no logging is enabled by default.
        '''
        result = self._values.get("logging_config")
        return typing.cast(typing.Optional["LoggingConfiguration"], result)

    @builtins.property
    def price_class(self) -> typing.Optional["PriceClass"]:
        '''The price class for the distribution (this impacts how many locations CloudFront uses for your distribution, and billing).

        :default: PriceClass.PRICE_CLASS_100 the cheapest option for CloudFront is picked by default.
        '''
        result = self._values.get("price_class")
        return typing.cast(typing.Optional["PriceClass"], result)

    @builtins.property
    def viewer_certificate(self) -> typing.Optional["ViewerCertificate"]:
        '''Specifies whether you want viewers to use HTTP or HTTPS to request your objects, whether you're using an alternate domain name with HTTPS, and if so, if you're using AWS Certificate Manager (ACM) or a third-party certificate authority.

        :default: ViewerCertificate.fromCloudFrontDefaultCertificate()

        :see: https://aws.amazon.com/premiumsupport/knowledge-center/custom-ssl-certificate-cloudfront/
        '''
        result = self._values.get("viewer_certificate")
        return typing.cast(typing.Optional["ViewerCertificate"], result)

    @builtins.property
    def viewer_protocol_policy(self) -> typing.Optional["ViewerProtocolPolicy"]:
        '''The default viewer policy for incoming clients.

        :default: RedirectToHTTPs
        '''
        result = self._values.get("viewer_protocol_policy")
        return typing.cast(typing.Optional["ViewerProtocolPolicy"], result)

    @builtins.property
    def web_acl_id(self) -> typing.Optional[builtins.str]:
        '''Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.

        To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
        ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``.

        To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``.

        :default: - No AWS Web Application Firewall web access control list (web ACL).

        :see: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html#API_CreateDistribution_RequestParameters.
        '''
        result = self._values.get("web_acl_id")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CloudFrontWebDistributionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.CustomOriginConfig",
    jsii_struct_bases=[],
    name_mapping={
        "domain_name": "domainName",
        "allowed_origin_ssl_versions": "allowedOriginSSLVersions",
        "http_port": "httpPort",
        "https_port": "httpsPort",
        "origin_headers": "originHeaders",
        "origin_keepalive_timeout": "originKeepaliveTimeout",
        "origin_path": "originPath",
        "origin_protocol_policy": "originProtocolPolicy",
        "origin_read_timeout": "originReadTimeout",
        "origin_shield_region": "originShieldRegion",
    },
)
class CustomOriginConfig:
    def __init__(
        self,
        *,
        domain_name: builtins.str,
        allowed_origin_ssl_versions: typing.Optional[typing.Sequence["OriginSslPolicy"]] = None,
        http_port: typing.Optional[jsii.Number] = None,
        https_port: typing.Optional[jsii.Number] = None,
        origin_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        origin_keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
        origin_path: typing.Optional[builtins.str] = None,
        origin_protocol_policy: typing.Optional["OriginProtocolPolicy"] = None,
        origin_read_timeout: typing.Optional[_Duration_4839e8c3] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
    ) -> None:
        '''A custom origin configuration.

        :param domain_name: The domain name of the custom origin. Should not include the path - that should be in the parent SourceConfiguration
        :param allowed_origin_ssl_versions: The SSL versions to use when interacting with the origin. Default: OriginSslPolicy.TLS_V1_2
        :param http_port: The origin HTTP port. Default: 80
        :param https_port: The origin HTTPS port. Default: 443
        :param origin_headers: Any additional headers to pass to the origin. Default: - No additional headers are passed.
        :param origin_keepalive_timeout: The keep alive timeout when making calls in seconds. Default: Duration.seconds(5)
        :param origin_path: The relative path to the origin root to use for sources. Default: /
        :param origin_protocol_policy: The protocol (http or https) policy to use when interacting with the origin. Default: OriginProtocolPolicy.HttpsOnly
        :param origin_read_timeout: The read timeout when calling the origin in seconds. Default: Duration.seconds(30)
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled

        :exampleMetadata: infused

        Example::

            # source_bucket: s3.Bucket
            # oai: cloudfront.OriginAccessIdentity
            
            
            cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
                origin_configs=[cloudfront.SourceConfiguration(
                    s3_origin_source=cloudfront.S3OriginConfig(
                        s3_bucket_source=source_bucket,
                        origin_access_identity=oai
                    ),
                    behaviors=[cloudfront.Behavior(is_default_behavior=True)]
                ), cloudfront.SourceConfiguration(
                    custom_origin_source=cloudfront.CustomOriginConfig(
                        domain_name="MYALIAS"
                    ),
                    behaviors=[cloudfront.Behavior(path_pattern="/somewhere")]
                )
                ]
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92ab974e2c359370c8dd8404a1254b379ed25c751976bee86e79d73ab441d0dc)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument allowed_origin_ssl_versions", value=allowed_origin_ssl_versions, expected_type=type_hints["allowed_origin_ssl_versions"])
            check_type(argname="argument http_port", value=http_port, expected_type=type_hints["http_port"])
            check_type(argname="argument https_port", value=https_port, expected_type=type_hints["https_port"])
            check_type(argname="argument origin_headers", value=origin_headers, expected_type=type_hints["origin_headers"])
            check_type(argname="argument origin_keepalive_timeout", value=origin_keepalive_timeout, expected_type=type_hints["origin_keepalive_timeout"])
            check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
            check_type(argname="argument origin_protocol_policy", value=origin_protocol_policy, expected_type=type_hints["origin_protocol_policy"])
            check_type(argname="argument origin_read_timeout", value=origin_read_timeout, expected_type=type_hints["origin_read_timeout"])
            check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "domain_name": domain_name,
        }
        if allowed_origin_ssl_versions is not None:
            self._values["allowed_origin_ssl_versions"] = allowed_origin_ssl_versions
        if http_port is not None:
            self._values["http_port"] = http_port
        if https_port is not None:
            self._values["https_port"] = https_port
        if origin_headers is not None:
            self._values["origin_headers"] = origin_headers
        if origin_keepalive_timeout is not None:
            self._values["origin_keepalive_timeout"] = origin_keepalive_timeout
        if origin_path is not None:
            self._values["origin_path"] = origin_path
        if origin_protocol_policy is not None:
            self._values["origin_protocol_policy"] = origin_protocol_policy
        if origin_read_timeout is not None:
            self._values["origin_read_timeout"] = origin_read_timeout
        if origin_shield_region is not None:
            self._values["origin_shield_region"] = origin_shield_region

    @builtins.property
    def domain_name(self) -> builtins.str:
        '''The domain name of the custom origin.

        Should not include the path - that should be in the parent SourceConfiguration
        '''
        result = self._values.get("domain_name")
        assert result is not None, "Required property 'domain_name' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def allowed_origin_ssl_versions(
        self,
    ) -> typing.Optional[typing.List["OriginSslPolicy"]]:
        '''The SSL versions to use when interacting with the origin.

        :default: OriginSslPolicy.TLS_V1_2
        '''
        result = self._values.get("allowed_origin_ssl_versions")
        return typing.cast(typing.Optional[typing.List["OriginSslPolicy"]], result)

    @builtins.property
    def http_port(self) -> typing.Optional[jsii.Number]:
        '''The origin HTTP port.

        :default: 80
        '''
        result = self._values.get("http_port")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def https_port(self) -> typing.Optional[jsii.Number]:
        '''The origin HTTPS port.

        :default: 443
        '''
        result = self._values.get("https_port")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def origin_headers(
        self,
    ) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
        '''Any additional headers to pass to the origin.

        :default: - No additional headers are passed.
        '''
        result = self._values.get("origin_headers")
        return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)

    @builtins.property
    def origin_keepalive_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The keep alive timeout when making calls in seconds.

        :default: Duration.seconds(5)
        '''
        result = self._values.get("origin_keepalive_timeout")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def origin_path(self) -> typing.Optional[builtins.str]:
        '''The relative path to the origin root to use for sources.

        :default: /
        '''
        result = self._values.get("origin_path")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def origin_protocol_policy(self) -> typing.Optional["OriginProtocolPolicy"]:
        '''The protocol (http or https) policy to use when interacting with the origin.

        :default: OriginProtocolPolicy.HttpsOnly
        '''
        result = self._values.get("origin_protocol_policy")
        return typing.cast(typing.Optional["OriginProtocolPolicy"], result)

    @builtins.property
    def origin_read_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The read timeout when calling the origin in seconds.

        :default: Duration.seconds(30)
        '''
        result = self._values.get("origin_read_timeout")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def origin_shield_region(self) -> typing.Optional[builtins.str]:
        '''When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

        :default: - origin shield not enabled
        '''
        result = self._values.get("origin_shield_region")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "CustomOriginConfig(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.DistributionAttributes",
    jsii_struct_bases=[],
    name_mapping={"distribution_id": "distributionId", "domain_name": "domainName"},
)
class DistributionAttributes:
    def __init__(
        self,
        *,
        distribution_id: builtins.str,
        domain_name: builtins.str,
    ) -> None:
        '''Attributes used to import a Distribution.

        :param distribution_id: The distribution ID for this distribution.
        :param domain_name: The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :exampleMetadata: infused

        Example::

            # Using a reference to an imported Distribution
            distribution = cloudfront.Distribution.from_distribution_attributes(self, "ImportedDist",
                domain_name="d111111abcdef8.cloudfront.net",
                distribution_id="012345ABCDEF"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bdb1dabb4ef81db5426cfd2e6a993db830c4e51f34b7dd369e6f07cd681d4f09)
            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "distribution_id": distribution_id,
            "domain_name": domain_name,
        }

    @builtins.property
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.

        :attribute: true
        '''
        result = self._values.get("distribution_id")
        assert result is not None, "Required property 'distribution_id' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def domain_name(self) -> builtins.str:
        '''The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :attribute: true
        '''
        result = self._values.get("domain_name")
        assert result is not None, "Required property 'domain_name' is missing"
        return typing.cast(builtins.str, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "DistributionAttributes(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.DistributionProps",
    jsii_struct_bases=[],
    name_mapping={
        "default_behavior": "defaultBehavior",
        "additional_behaviors": "additionalBehaviors",
        "certificate": "certificate",
        "comment": "comment",
        "default_root_object": "defaultRootObject",
        "domain_names": "domainNames",
        "enabled": "enabled",
        "enable_ipv6": "enableIpv6",
        "enable_logging": "enableLogging",
        "error_responses": "errorResponses",
        "geo_restriction": "geoRestriction",
        "http_version": "httpVersion",
        "log_bucket": "logBucket",
        "log_file_prefix": "logFilePrefix",
        "log_includes_cookies": "logIncludesCookies",
        "minimum_protocol_version": "minimumProtocolVersion",
        "price_class": "priceClass",
        "publish_additional_metrics": "publishAdditionalMetrics",
        "ssl_support_method": "sslSupportMethod",
        "web_acl_id": "webAclId",
    },
)
class DistributionProps:
    def __init__(
        self,
        *,
        default_behavior: typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]],
        additional_behaviors: typing.Optional[typing.Mapping[builtins.str, typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]]]] = None,
        certificate: typing.Optional[_ICertificate_c194c70b] = None,
        comment: typing.Optional[builtins.str] = None,
        default_root_object: typing.Optional[builtins.str] = None,
        domain_names: typing.Optional[typing.Sequence[builtins.str]] = None,
        enabled: typing.Optional[builtins.bool] = None,
        enable_ipv6: typing.Optional[builtins.bool] = None,
        enable_logging: typing.Optional[builtins.bool] = None,
        error_responses: typing.Optional[typing.Sequence[typing.Union["ErrorResponse", typing.Dict[builtins.str, typing.Any]]]] = None,
        geo_restriction: typing.Optional["GeoRestriction"] = None,
        http_version: typing.Optional["HttpVersion"] = None,
        log_bucket: typing.Optional[_IBucket_42e086fd] = None,
        log_file_prefix: typing.Optional[builtins.str] = None,
        log_includes_cookies: typing.Optional[builtins.bool] = None,
        minimum_protocol_version: typing.Optional["SecurityPolicyProtocol"] = None,
        price_class: typing.Optional["PriceClass"] = None,
        publish_additional_metrics: typing.Optional[builtins.bool] = None,
        ssl_support_method: typing.Optional["SSLMethod"] = None,
        web_acl_id: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties for a Distribution.

        :param default_behavior: The default behavior for the distribution.
        :param additional_behaviors: Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to. Default: - no additional behaviors are added.
        :param certificate: A certificate to associate with the distribution. The certificate must be located in N. Virginia (us-east-1). Default: - the CloudFront wildcard certificate (*.cloudfront.net) will be used.
        :param comment: Any comments you want to include about the distribution. Default: - no comment
        :param default_root_object: The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/). Default: - no default root object
        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you must add (at least one of) the domain names of the certificate to this list. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
        :param enabled: Enable or disable the distribution. Default: true
        :param enable_ipv6: Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address. If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution. Default: true
        :param enable_logging: Enable access logging for the distribution. Default: - false, unless ``logBucket`` is specified.
        :param error_responses: How CloudFront should handle requests that are not successful (e.g., PageNotFound). Default: - No custom error responses.
        :param geo_restriction: Controls the countries in which your content is distributed. Default: - No geographic restrictions
        :param http_version: Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront. For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI). Default: HttpVersion.HTTP2
        :param log_bucket: The Amazon S3 bucket to store the access logs in. Make sure to set ``objectOwnership`` to ``s3.ObjectOwnership.OBJECT_WRITER`` in your custom bucket. Default: - A bucket is created if ``enableLogging`` is true
        :param log_file_prefix: An optional string that you want CloudFront to prefix to the access log filenames for this distribution. Default: - no prefix
        :param log_includes_cookies: Specifies whether you want CloudFront to include cookies in access logs. Default: false
        :param minimum_protocol_version: The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify. Default: - SecurityPolicyProtocol.TLS_V1_2_2021 if the '@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021' feature flag is set; otherwise, SecurityPolicyProtocol.TLS_V1_2_2019.
        :param price_class: The price class that corresponds with the maximum price that you want to pay for CloudFront service. If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations. If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class. Default: PriceClass.PRICE_CLASS_ALL
        :param publish_additional_metrics: Whether to enable additional CloudWatch metrics. Default: false
        :param ssl_support_method: The SSL method CloudFront will use for your distribution. Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate. CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support. If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP). See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/ Default: SSLMethod.SNI
        :param web_acl_id: Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution. To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``. Default: - No AWS Web Application Firewall web access control list (web ACL).

        :exampleMetadata: infused

        Example::

            # Adding an existing Lambda@Edge function created in a different stack
            # to a CloudFront distribution.
            # s3_bucket: s3.Bucket
            
            function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")
            
            cloudfront.Distribution(self, "distro",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.S3Origin(s3_bucket),
                    edge_lambdas=[cloudfront.EdgeLambda(
                        function_version=function_version,
                        event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
                    )
                    ]
                )
            )
        '''
        if isinstance(default_behavior, dict):
            default_behavior = BehaviorOptions(**default_behavior)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c72abdcdfdddafd2ae88355978fb7eb563a14866cc02f8396484e058a9202ea2)
            check_type(argname="argument default_behavior", value=default_behavior, expected_type=type_hints["default_behavior"])
            check_type(argname="argument additional_behaviors", value=additional_behaviors, expected_type=type_hints["additional_behaviors"])
            check_type(argname="argument certificate", value=certificate, expected_type=type_hints["certificate"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument default_root_object", value=default_root_object, expected_type=type_hints["default_root_object"])
            check_type(argname="argument domain_names", value=domain_names, expected_type=type_hints["domain_names"])
            check_type(argname="argument enabled", value=enabled, expected_type=type_hints["enabled"])
            check_type(argname="argument enable_ipv6", value=enable_ipv6, expected_type=type_hints["enable_ipv6"])
            check_type(argname="argument enable_logging", value=enable_logging, expected_type=type_hints["enable_logging"])
            check_type(argname="argument error_responses", value=error_responses, expected_type=type_hints["error_responses"])
            check_type(argname="argument geo_restriction", value=geo_restriction, expected_type=type_hints["geo_restriction"])
            check_type(argname="argument http_version", value=http_version, expected_type=type_hints["http_version"])
            check_type(argname="argument log_bucket", value=log_bucket, expected_type=type_hints["log_bucket"])
            check_type(argname="argument log_file_prefix", value=log_file_prefix, expected_type=type_hints["log_file_prefix"])
            check_type(argname="argument log_includes_cookies", value=log_includes_cookies, expected_type=type_hints["log_includes_cookies"])
            check_type(argname="argument minimum_protocol_version", value=minimum_protocol_version, expected_type=type_hints["minimum_protocol_version"])
            check_type(argname="argument price_class", value=price_class, expected_type=type_hints["price_class"])
            check_type(argname="argument publish_additional_metrics", value=publish_additional_metrics, expected_type=type_hints["publish_additional_metrics"])
            check_type(argname="argument ssl_support_method", value=ssl_support_method, expected_type=type_hints["ssl_support_method"])
            check_type(argname="argument web_acl_id", value=web_acl_id, expected_type=type_hints["web_acl_id"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "default_behavior": default_behavior,
        }
        if additional_behaviors is not None:
            self._values["additional_behaviors"] = additional_behaviors
        if certificate is not None:
            self._values["certificate"] = certificate
        if comment is not None:
            self._values["comment"] = comment
        if default_root_object is not None:
            self._values["default_root_object"] = default_root_object
        if domain_names is not None:
            self._values["domain_names"] = domain_names
        if enabled is not None:
            self._values["enabled"] = enabled
        if enable_ipv6 is not None:
            self._values["enable_ipv6"] = enable_ipv6
        if enable_logging is not None:
            self._values["enable_logging"] = enable_logging
        if error_responses is not None:
            self._values["error_responses"] = error_responses
        if geo_restriction is not None:
            self._values["geo_restriction"] = geo_restriction
        if http_version is not None:
            self._values["http_version"] = http_version
        if log_bucket is not None:
            self._values["log_bucket"] = log_bucket
        if log_file_prefix is not None:
            self._values["log_file_prefix"] = log_file_prefix
        if log_includes_cookies is not None:
            self._values["log_includes_cookies"] = log_includes_cookies
        if minimum_protocol_version is not None:
            self._values["minimum_protocol_version"] = minimum_protocol_version
        if price_class is not None:
            self._values["price_class"] = price_class
        if publish_additional_metrics is not None:
            self._values["publish_additional_metrics"] = publish_additional_metrics
        if ssl_support_method is not None:
            self._values["ssl_support_method"] = ssl_support_method
        if web_acl_id is not None:
            self._values["web_acl_id"] = web_acl_id

    @builtins.property
    def default_behavior(self) -> BehaviorOptions:
        '''The default behavior for the distribution.'''
        result = self._values.get("default_behavior")
        assert result is not None, "Required property 'default_behavior' is missing"
        return typing.cast(BehaviorOptions, result)

    @builtins.property
    def additional_behaviors(
        self,
    ) -> typing.Optional[typing.Mapping[builtins.str, BehaviorOptions]]:
        '''Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to.

        :default: - no additional behaviors are added.
        '''
        result = self._values.get("additional_behaviors")
        return typing.cast(typing.Optional[typing.Mapping[builtins.str, BehaviorOptions]], result)

    @builtins.property
    def certificate(self) -> typing.Optional[_ICertificate_c194c70b]:
        '''A certificate to associate with the distribution.

        The certificate must be located in N. Virginia (us-east-1).

        :default: - the CloudFront wildcard certificate (*.cloudfront.net) will be used.
        '''
        result = self._values.get("certificate")
        return typing.cast(typing.Optional[_ICertificate_c194c70b], result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''Any comments you want to include about the distribution.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def default_root_object(self) -> typing.Optional[builtins.str]:
        '''The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/).

        :default: - no default root object
        '''
        result = self._values.get("default_root_object")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def domain_names(self) -> typing.Optional[typing.List[builtins.str]]:
        '''Alternative domain names for this distribution.

        If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name,
        you can add an alternate domain name to your distribution. If you attach a certificate to the distribution,
        you must add (at least one of) the domain names of the certificate to this list.

        :default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
        '''
        result = self._values.get("domain_names")
        return typing.cast(typing.Optional[typing.List[builtins.str]], result)

    @builtins.property
    def enabled(self) -> typing.Optional[builtins.bool]:
        '''Enable or disable the distribution.

        :default: true
        '''
        result = self._values.get("enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def enable_ipv6(self) -> typing.Optional[builtins.bool]:
        '''Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address.

        If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses.
        This allows viewers to submit a second request, for an IPv4 address for your distribution.

        :default: true
        '''
        result = self._values.get("enable_ipv6")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def enable_logging(self) -> typing.Optional[builtins.bool]:
        '''Enable access logging for the distribution.

        :default: - false, unless ``logBucket`` is specified.
        '''
        result = self._values.get("enable_logging")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def error_responses(self) -> typing.Optional[typing.List["ErrorResponse"]]:
        '''How CloudFront should handle requests that are not successful (e.g., PageNotFound).

        :default: - No custom error responses.
        '''
        result = self._values.get("error_responses")
        return typing.cast(typing.Optional[typing.List["ErrorResponse"]], result)

    @builtins.property
    def geo_restriction(self) -> typing.Optional["GeoRestriction"]:
        '''Controls the countries in which your content is distributed.

        :default: - No geographic restrictions
        '''
        result = self._values.get("geo_restriction")
        return typing.cast(typing.Optional["GeoRestriction"], result)

    @builtins.property
    def http_version(self) -> typing.Optional["HttpVersion"]:
        '''Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront.

        For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI).

        :default: HttpVersion.HTTP2
        '''
        result = self._values.get("http_version")
        return typing.cast(typing.Optional["HttpVersion"], result)

    @builtins.property
    def log_bucket(self) -> typing.Optional[_IBucket_42e086fd]:
        '''The Amazon S3 bucket to store the access logs in.

        Make sure to set ``objectOwnership`` to ``s3.ObjectOwnership.OBJECT_WRITER`` in your custom bucket.

        :default: - A bucket is created if ``enableLogging`` is true
        '''
        result = self._values.get("log_bucket")
        return typing.cast(typing.Optional[_IBucket_42e086fd], result)

    @builtins.property
    def log_file_prefix(self) -> typing.Optional[builtins.str]:
        '''An optional string that you want CloudFront to prefix to the access log filenames for this distribution.

        :default: - no prefix
        '''
        result = self._values.get("log_file_prefix")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def log_includes_cookies(self) -> typing.Optional[builtins.bool]:
        '''Specifies whether you want CloudFront to include cookies in access logs.

        :default: false
        '''
        result = self._values.get("log_includes_cookies")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def minimum_protocol_version(self) -> typing.Optional["SecurityPolicyProtocol"]:
        '''The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

        CloudFront serves your objects only to browsers or devices that support at
        least the SSL version that you specify.

        :default: - SecurityPolicyProtocol.TLS_V1_2_2021 if the '@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021' feature flag is set; otherwise, SecurityPolicyProtocol.TLS_V1_2_2019.
        '''
        result = self._values.get("minimum_protocol_version")
        return typing.cast(typing.Optional["SecurityPolicyProtocol"], result)

    @builtins.property
    def price_class(self) -> typing.Optional["PriceClass"]:
        '''The price class that corresponds with the maximum price that you want to pay for CloudFront service.

        If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations.
        If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location
        that has the lowest latency among the edge locations in your price class.

        :default: PriceClass.PRICE_CLASS_ALL
        '''
        result = self._values.get("price_class")
        return typing.cast(typing.Optional["PriceClass"], result)

    @builtins.property
    def publish_additional_metrics(self) -> typing.Optional[builtins.bool]:
        '''Whether to enable additional CloudWatch metrics.

        :default: false

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/viewing-cloudfront-metrics.html
        '''
        result = self._values.get("publish_additional_metrics")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def ssl_support_method(self) -> typing.Optional["SSLMethod"]:
        '''The SSL method CloudFront will use for your distribution.

        Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates
        which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present
        multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites
        (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

        CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.

        If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for
        using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).

        See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/

        :default: SSLMethod.SNI
        '''
        result = self._values.get("ssl_support_method")
        return typing.cast(typing.Optional["SSLMethod"], result)

    @builtins.property
    def web_acl_id(self) -> typing.Optional[builtins.str]:
        '''Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution.

        To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example
        ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``.
        To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``.

        :default: - No AWS Web Application Firewall web access control list (web ACL).

        :see: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html#API_CreateDistribution_RequestParameters.
        '''
        result = self._values.get("web_acl_id")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "DistributionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.EdgeLambda",
    jsii_struct_bases=[],
    name_mapping={
        "event_type": "eventType",
        "function_version": "functionVersion",
        "include_body": "includeBody",
    },
)
class EdgeLambda:
    def __init__(
        self,
        *,
        event_type: "LambdaEdgeEventType",
        function_version: _IVersion_faf7234e,
        include_body: typing.Optional[builtins.bool] = None,
    ) -> None:
        '''Represents a Lambda function version and event type when using Lambda@Edge.

        The type of the ``AddBehaviorOptions.edgeLambdas`` property.

        :param event_type: The type of event in response to which should the function be invoked.
        :param function_version: The version of the Lambda function that will be invoked. **Note**: it's not possible to use the '$LATEST' function version for Lambda@Edge!
        :param include_body: Allows a Lambda function to have read access to the body content. Only valid for "request" event types (``ORIGIN_REQUEST`` or ``VIEWER_REQUEST``). See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html Default: false

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            from aws_cdk import aws_lambda as lambda_
            
            # version: lambda.Version
            
            edge_lambda = cloudfront.EdgeLambda(
                event_type=cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                function_version=version,
            
                # the properties below are optional
                include_body=False
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__781a001f914aef1215b9a46bb776fc1b219e3114ade7e4b83077fa900881c60a)
            check_type(argname="argument event_type", value=event_type, expected_type=type_hints["event_type"])
            check_type(argname="argument function_version", value=function_version, expected_type=type_hints["function_version"])
            check_type(argname="argument include_body", value=include_body, expected_type=type_hints["include_body"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "event_type": event_type,
            "function_version": function_version,
        }
        if include_body is not None:
            self._values["include_body"] = include_body

    @builtins.property
    def event_type(self) -> "LambdaEdgeEventType":
        '''The type of event in response to which should the function be invoked.'''
        result = self._values.get("event_type")
        assert result is not None, "Required property 'event_type' is missing"
        return typing.cast("LambdaEdgeEventType", result)

    @builtins.property
    def function_version(self) -> _IVersion_faf7234e:
        '''The version of the Lambda function that will be invoked.

        **Note**: it's not possible to use the '$LATEST' function version for Lambda@Edge!
        '''
        result = self._values.get("function_version")
        assert result is not None, "Required property 'function_version' is missing"
        return typing.cast(_IVersion_faf7234e, result)

    @builtins.property
    def include_body(self) -> typing.Optional[builtins.bool]:
        '''Allows a Lambda function to have read access to the body content.

        Only valid for "request" event types (``ORIGIN_REQUEST`` or ``VIEWER_REQUEST``).
        See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html

        :default: false
        '''
        result = self._values.get("include_body")
        return typing.cast(typing.Optional[builtins.bool], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "EdgeLambda(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class Endpoint(
    metaclass=jsii.JSIIAbstractClass,
    jsii_type="aws-cdk-lib.aws_cloudfront.Endpoint",
):
    '''Represents the endpoints available for targetting within a realtime log config resource.

    :exampleMetadata: infused

    Example::

        # Adding realtime logs config to a Cloudfront Distribution on default behavior.
        import aws_cdk.aws_kinesis as kinesis
        
        # stream: kinesis.Stream
        
        
        real_time_config = cloudfront.RealtimeLogConfig(self, "realtimeLog",
            end_points=[
                cloudfront.Endpoint.from_kinesis_stream(stream)
            ],
            fields=["timestamp", "c-ip", "time-to-first-byte", "sc-status"
            ],
            realtime_log_config_name="my-delivery-stream",
            sampling_rate=100
        )
        
        cloudfront.Distribution(self, "myCdn",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.HttpOrigin("www.example.com"),
                realtime_log_config=real_time_config
            )
        )
    '''

    @jsii.member(jsii_name="fromKinesisStream")
    @builtins.classmethod
    def from_kinesis_stream(
        cls,
        stream: _IStream_4e2457d2,
        role: typing.Optional[_IRole_235f5d8e] = None,
    ) -> "Endpoint":
        '''Configure a Kinesis Stream Endpoint for Realtime Log Config.

        :param stream: -
        :param role: -

        :default: - a role will be created and used across your endpoints
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2988248094ccacba36276af35085c12ac3fac82279e37dccef9388ae4196ca6d)
            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
            check_type(argname="argument role", value=role, expected_type=type_hints["role"])
        return typing.cast("Endpoint", jsii.sinvoke(cls, "fromKinesisStream", [stream, role]))


class _EndpointProxy(Endpoint):
    pass

# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
typing.cast(typing.Any, Endpoint).__jsii_proxy_class__ = lambda : _EndpointProxy


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ErrorResponse",
    jsii_struct_bases=[],
    name_mapping={
        "http_status": "httpStatus",
        "response_http_status": "responseHttpStatus",
        "response_page_path": "responsePagePath",
        "ttl": "ttl",
    },
)
class ErrorResponse:
    def __init__(
        self,
        *,
        http_status: jsii.Number,
        response_http_status: typing.Optional[jsii.Number] = None,
        response_page_path: typing.Optional[builtins.str] = None,
        ttl: typing.Optional[_Duration_4839e8c3] = None,
    ) -> None:
        '''Options for configuring custom error responses.

        :param http_status: The HTTP status code for which you want to specify a custom error page and/or a caching duration.
        :param response_http_status: The HTTP status code that you want CloudFront to return to the viewer along with the custom error page. If you specify a value for ``responseHttpStatus``, you must also specify a value for ``responsePagePath``. Default: - the error code will be returned as the response code.
        :param response_page_path: The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the ``httpStatus``, for example, /4xx-errors/403-forbidden.html. Default: - the default CloudFront response is shown.
        :param ttl: The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in ErrorCode. Default: - the default caching TTL behavior applies

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            import aws_cdk as cdk
            from aws_cdk import aws_cloudfront as cloudfront
            
            error_response = cloudfront.ErrorResponse(
                http_status=123,
            
                # the properties below are optional
                response_http_status=123,
                response_page_path="responsePagePath",
                ttl=cdk.Duration.minutes(30)
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bee8b946e8aa5bcc2706c6314a79df3c9e4b0ba79127bd0c37d6a3805a6b5bf)
            check_type(argname="argument http_status", value=http_status, expected_type=type_hints["http_status"])
            check_type(argname="argument response_http_status", value=response_http_status, expected_type=type_hints["response_http_status"])
            check_type(argname="argument response_page_path", value=response_page_path, expected_type=type_hints["response_page_path"])
            check_type(argname="argument ttl", value=ttl, expected_type=type_hints["ttl"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "http_status": http_status,
        }
        if response_http_status is not None:
            self._values["response_http_status"] = response_http_status
        if response_page_path is not None:
            self._values["response_page_path"] = response_page_path
        if ttl is not None:
            self._values["ttl"] = ttl

    @builtins.property
    def http_status(self) -> jsii.Number:
        '''The HTTP status code for which you want to specify a custom error page and/or a caching duration.'''
        result = self._values.get("http_status")
        assert result is not None, "Required property 'http_status' is missing"
        return typing.cast(jsii.Number, result)

    @builtins.property
    def response_http_status(self) -> typing.Optional[jsii.Number]:
        '''The HTTP status code that you want CloudFront to return to the viewer along with the custom error page.

        If you specify a value for ``responseHttpStatus``, you must also specify a value for ``responsePagePath``.

        :default: - the error code will be returned as the response code.
        '''
        result = self._values.get("response_http_status")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def response_page_path(self) -> typing.Optional[builtins.str]:
        '''The path to the custom error page that you want CloudFront to return to a viewer when your origin returns the ``httpStatus``, for example, /4xx-errors/403-forbidden.html.

        :default: - the default CloudFront response is shown.
        '''
        result = self._values.get("response_page_path")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def ttl(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The minimum amount of time, in seconds, that you want CloudFront to cache the HTTP status code specified in ErrorCode.

        :default: - the default caching TTL behavior applies
        '''
        result = self._values.get("ttl")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ErrorResponse(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.FailoverStatusCode")
class FailoverStatusCode(enum.Enum):
    '''HTTP status code to failover to second origin.

    :exampleMetadata: infused

    Example::

        # Configuring origin fallback options for the CloudFrontWebDistribution
        cloudfront.CloudFrontWebDistribution(self, "ADistribution",
            origin_configs=[cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=s3.Bucket.from_bucket_name(self, "aBucket", "myoriginbucket"),
                    origin_path="/",
                    origin_headers={
                        "myHeader": "42"
                    },
                    origin_shield_region="us-west-2"
                ),
                failover_s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=s3.Bucket.from_bucket_name(self, "aBucketFallback", "myoriginbucketfallback"),
                    origin_path="/somewhere",
                    origin_headers={
                        "myHeader2": "21"
                    },
                    origin_shield_region="us-east-1"
                ),
                failover_criteria_status_codes=[cloudfront.FailoverStatusCode.INTERNAL_SERVER_ERROR],
                behaviors=[cloudfront.Behavior(
                    is_default_behavior=True
                )
                ]
            )
            ]
        )
    '''

    FORBIDDEN = "FORBIDDEN"
    '''Forbidden (403).'''
    NOT_FOUND = "NOT_FOUND"
    '''Not found (404).'''
    INTERNAL_SERVER_ERROR = "INTERNAL_SERVER_ERROR"
    '''Internal Server Error (500).'''
    BAD_GATEWAY = "BAD_GATEWAY"
    '''Bad Gateway (502).'''
    SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE"
    '''Service Unavailable (503).'''
    GATEWAY_TIMEOUT = "GATEWAY_TIMEOUT"
    '''Gateway Timeout (504).'''


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.FileCodeOptions",
    jsii_struct_bases=[],
    name_mapping={"file_path": "filePath"},
)
class FileCodeOptions:
    def __init__(self, *, file_path: builtins.str) -> None:
        '''Options when reading the function's code from an external file.

        :param file_path: The path of the file to read the code from.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            file_code_options = cloudfront.FileCodeOptions(
                file_path="filePath"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9cdc828d846bfe9d79c6fc8bef720d356a6be7ab3e05f715737d57083f285a8)
            check_type(argname="argument file_path", value=file_path, expected_type=type_hints["file_path"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "file_path": file_path,
        }

    @builtins.property
    def file_path(self) -> builtins.str:
        '''The path of the file to read the code from.'''
        result = self._values.get("file_path")
        assert result is not None, "Required property 'file_path' is missing"
        return typing.cast(builtins.str, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "FileCodeOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.FunctionAssociation",
    jsii_struct_bases=[],
    name_mapping={"event_type": "eventType", "function": "function"},
)
class FunctionAssociation:
    def __init__(
        self,
        *,
        event_type: "FunctionEventType",
        function: "IFunction",
    ) -> None:
        '''Represents a CloudFront function and event type when using CF Functions.

        The type of the ``AddBehaviorOptions.functionAssociations`` property.

        :param event_type: The type of event which should invoke the function.
        :param function: The CloudFront function that will be invoked.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            # function_: cloudfront.Function
            
            function_association = cloudfront.FunctionAssociation(
                event_type=cloudfront.FunctionEventType.VIEWER_REQUEST,
                function=function_
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0785f3d1d4dbd54d8a987edcb6c2627d77e3a568a16ce08ab0cd3ad2a96e39ff)
            check_type(argname="argument event_type", value=event_type, expected_type=type_hints["event_type"])
            check_type(argname="argument function", value=function, expected_type=type_hints["function"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "event_type": event_type,
            "function": function,
        }

    @builtins.property
    def event_type(self) -> "FunctionEventType":
        '''The type of event which should invoke the function.'''
        result = self._values.get("event_type")
        assert result is not None, "Required property 'event_type' is missing"
        return typing.cast("FunctionEventType", result)

    @builtins.property
    def function(self) -> "IFunction":
        '''The CloudFront function that will be invoked.'''
        result = self._values.get("function")
        assert result is not None, "Required property 'function' is missing"
        return typing.cast("IFunction", result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "FunctionAssociation(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.FunctionAttributes",
    jsii_struct_bases=[],
    name_mapping={
        "function_arn": "functionArn",
        "function_name": "functionName",
        "function_runtime": "functionRuntime",
    },
)
class FunctionAttributes:
    def __init__(
        self,
        *,
        function_arn: builtins.str,
        function_name: builtins.str,
        function_runtime: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Attributes of an existing CloudFront Function to import it.

        :param function_arn: The ARN of the function.
        :param function_name: The name of the function.
        :param function_runtime: The Runtime of the function. Default: FunctionRuntime.JS_1_0

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            function_attributes = cloudfront.FunctionAttributes(
                function_arn="functionArn",
                function_name="functionName",
            
                # the properties below are optional
                function_runtime="functionRuntime"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__903bbff401b8a2560d333137b7ac614ba7cdaa77d8d3034c4d8a9e13de5b1b01)
            check_type(argname="argument function_arn", value=function_arn, expected_type=type_hints["function_arn"])
            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
            check_type(argname="argument function_runtime", value=function_runtime, expected_type=type_hints["function_runtime"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "function_arn": function_arn,
            "function_name": function_name,
        }
        if function_runtime is not None:
            self._values["function_runtime"] = function_runtime

    @builtins.property
    def function_arn(self) -> builtins.str:
        '''The ARN of the function.'''
        result = self._values.get("function_arn")
        assert result is not None, "Required property 'function_arn' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def function_name(self) -> builtins.str:
        '''The name of the function.'''
        result = self._values.get("function_name")
        assert result is not None, "Required property 'function_name' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def function_runtime(self) -> typing.Optional[builtins.str]:
        '''The Runtime of the function.

        :default: FunctionRuntime.JS_1_0
        '''
        result = self._values.get("function_runtime")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "FunctionAttributes(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class FunctionCode(
    metaclass=jsii.JSIIAbstractClass,
    jsii_type="aws-cdk-lib.aws_cloudfront.FunctionCode",
):
    '''Represents the function's source code.

    :exampleMetadata: infused

    Example::

        # s3_bucket: s3.Bucket
        # Add a cloudfront Function to a Distribution
        cf_function = cloudfront.Function(self, "Function",
            code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
            runtime=cloudfront.FunctionRuntime.JS_2_0
        )
        cloudfront.Distribution(self, "distro",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(s3_bucket),
                function_associations=[cloudfront.FunctionAssociation(
                    function=cf_function,
                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
                )]
            )
        )
    '''

    def __init__(self) -> None:
        jsii.create(self.__class__, self, [])

    @jsii.member(jsii_name="fromFile")
    @builtins.classmethod
    def from_file(cls, *, file_path: builtins.str) -> "FunctionCode":
        '''Code from external file for function.

        :param file_path: The path of the file to read the code from.

        :return: code object with contents from file.
        '''
        options = FileCodeOptions(file_path=file_path)

        return typing.cast("FunctionCode", jsii.sinvoke(cls, "fromFile", [options]))

    @jsii.member(jsii_name="fromInline")
    @builtins.classmethod
    def from_inline(cls, code: builtins.str) -> "FunctionCode":
        '''Inline code for function.

        :param code: The actual function code.

        :return: code object with inline code.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e3494c015ce98060d9db266d49711978f619c5ef5558a3e89c5b5c6a5c3753f)
            check_type(argname="argument code", value=code, expected_type=type_hints["code"])
        return typing.cast("FunctionCode", jsii.sinvoke(cls, "fromInline", [code]))

    @jsii.member(jsii_name="render")
    @abc.abstractmethod
    def render(self) -> builtins.str:
        '''renders the function code.'''
        ...


class _FunctionCodeProxy(FunctionCode):
    @jsii.member(jsii_name="render")
    def render(self) -> builtins.str:
        '''renders the function code.'''
        return typing.cast(builtins.str, jsii.invoke(self, "render", []))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
typing.cast(typing.Any, FunctionCode).__jsii_proxy_class__ = lambda : _FunctionCodeProxy


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.FunctionEventType")
class FunctionEventType(enum.Enum):
    '''The type of events that a CloudFront function can be invoked in response to.

    :exampleMetadata: infused

    Example::

        # s3_bucket: s3.Bucket
        # Add a cloudfront Function to a Distribution
        cf_function = cloudfront.Function(self, "Function",
            code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
            runtime=cloudfront.FunctionRuntime.JS_2_0
        )
        cloudfront.Distribution(self, "distro",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(s3_bucket),
                function_associations=[cloudfront.FunctionAssociation(
                    function=cf_function,
                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
                )]
            )
        )
    '''

    VIEWER_REQUEST = "VIEWER_REQUEST"
    '''The viewer-request specifies the incoming request.'''
    VIEWER_RESPONSE = "VIEWER_RESPONSE"
    '''The viewer-response specifies the outgoing response.'''


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.FunctionProps",
    jsii_struct_bases=[],
    name_mapping={
        "code": "code",
        "comment": "comment",
        "function_name": "functionName",
        "key_value_store": "keyValueStore",
        "runtime": "runtime",
    },
)
class FunctionProps:
    def __init__(
        self,
        *,
        code: FunctionCode,
        comment: typing.Optional[builtins.str] = None,
        function_name: typing.Optional[builtins.str] = None,
        key_value_store: typing.Optional["IKeyValueStore"] = None,
        runtime: typing.Optional["FunctionRuntime"] = None,
    ) -> None:
        '''Properties for creating a CloudFront Function.

        :param code: The source code of the function.
        :param comment: A comment to describe the function. Default: - same as ``functionName``
        :param function_name: A name to identify the function. Default: - generated from the ``id``
        :param key_value_store: The Key Value Store to associate with this function. In order to associate a Key Value Store, the ``runtime`` must be ``cloudfront-js-2.0`` or newer. Default: - no key value store is associated
        :param runtime: The runtime environment for the function. Default: FunctionRuntime.JS_1_0 (unless ``keyValueStore`` is specified, then ``FunctionRuntime.JS_2_0``)

        :exampleMetadata: infused

        Example::

            # s3_bucket: s3.Bucket
            # Add a cloudfront Function to a Distribution
            cf_function = cloudfront.Function(self, "Function",
                code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
                runtime=cloudfront.FunctionRuntime.JS_2_0
            )
            cloudfront.Distribution(self, "distro",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.S3Origin(s3_bucket),
                    function_associations=[cloudfront.FunctionAssociation(
                        function=cf_function,
                        event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
                    )]
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8243b62a44e046850892a519da42366ef0e5b346474e3be3ebcb455dd6aa04df)
            check_type(argname="argument code", value=code, expected_type=type_hints["code"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
            check_type(argname="argument key_value_store", value=key_value_store, expected_type=type_hints["key_value_store"])
            check_type(argname="argument runtime", value=runtime, expected_type=type_hints["runtime"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "code": code,
        }
        if comment is not None:
            self._values["comment"] = comment
        if function_name is not None:
            self._values["function_name"] = function_name
        if key_value_store is not None:
            self._values["key_value_store"] = key_value_store
        if runtime is not None:
            self._values["runtime"] = runtime

    @builtins.property
    def code(self) -> FunctionCode:
        '''The source code of the function.'''
        result = self._values.get("code")
        assert result is not None, "Required property 'code' is missing"
        return typing.cast(FunctionCode, result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the function.

        :default: - same as ``functionName``
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def function_name(self) -> typing.Optional[builtins.str]:
        '''A name to identify the function.

        :default: - generated from the ``id``
        '''
        result = self._values.get("function_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def key_value_store(self) -> typing.Optional["IKeyValueStore"]:
        '''The Key Value Store to associate with this function.

        In order to associate a Key Value Store, the ``runtime`` must be
        ``cloudfront-js-2.0`` or newer.

        :default: - no key value store is associated
        '''
        result = self._values.get("key_value_store")
        return typing.cast(typing.Optional["IKeyValueStore"], result)

    @builtins.property
    def runtime(self) -> typing.Optional["FunctionRuntime"]:
        '''The runtime environment for the function.

        :default: FunctionRuntime.JS_1_0 (unless ``keyValueStore`` is specified, then ``FunctionRuntime.JS_2_0``)
        '''
        result = self._values.get("runtime")
        return typing.cast(typing.Optional["FunctionRuntime"], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "FunctionProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class FunctionRuntime(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.FunctionRuntime",
):
    '''The function's runtime environment version.

    :exampleMetadata: infused

    Example::

        # s3_bucket: s3.Bucket
        # Add a cloudfront Function to a Distribution
        cf_function = cloudfront.Function(self, "Function",
            code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
            runtime=cloudfront.FunctionRuntime.JS_2_0
        )
        cloudfront.Distribution(self, "distro",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(s3_bucket),
                function_associations=[cloudfront.FunctionAssociation(
                    function=cf_function,
                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
                )]
            )
        )
    '''

    @jsii.member(jsii_name="custom")
    @builtins.classmethod
    def custom(cls, runtime_string: builtins.str) -> "FunctionRuntime":
        '''A custom runtime string.

        Gives full control over the runtime string fragment.

        :param runtime_string: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__631c8d0b51cac2d9ffcbfad4bfbcc5e76ea97cde669fb05e21ba361b851513db)
            check_type(argname="argument runtime_string", value=runtime_string, expected_type=type_hints["runtime_string"])
        return typing.cast("FunctionRuntime", jsii.sinvoke(cls, "custom", [runtime_string]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="JS_1_0")
    def JS_1_0(cls) -> "FunctionRuntime":
        '''cloudfront-js-1.0.'''
        return typing.cast("FunctionRuntime", jsii.sget(cls, "JS_1_0"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="JS_2_0")
    def JS_2_0(cls) -> "FunctionRuntime":
        '''cloudfront-js-2.0.'''
        return typing.cast("FunctionRuntime", jsii.sget(cls, "JS_2_0"))

    @builtins.property
    @jsii.member(jsii_name="value")
    def value(self) -> builtins.str:
        return typing.cast(builtins.str, jsii.get(self, "value"))


class GeoRestriction(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.GeoRestriction",
):
    '''Controls the countries in which content is distributed.

    :exampleMetadata: infused

    Example::

        # Adding restrictions to a Cloudfront Web Distribution.
        # source_bucket: s3.Bucket
        
        cloudfront.CloudFrontWebDistribution(self, "MyDistribution",
            origin_configs=[cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=source_bucket
                ),
                behaviors=[cloudfront.Behavior(is_default_behavior=True)]
            )
            ],
            geo_restriction=cloudfront.GeoRestriction.allowlist("US", "GB")
        )
    '''

    @jsii.member(jsii_name="allowlist")
    @builtins.classmethod
    def allowlist(cls, *locations: builtins.str) -> "GeoRestriction":
        '''Allow specific countries which you want CloudFront to distribute your content.

        :param locations: Two-letter, uppercase country code for a country that you want to allow. Include one element for each country. See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a13eb93043db156a3265f56351965e4b4e9937ab6e803df3499b6885645f2bb6)
            check_type(argname="argument locations", value=locations, expected_type=typing.Tuple[type_hints["locations"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("GeoRestriction", jsii.sinvoke(cls, "allowlist", [*locations]))

    @jsii.member(jsii_name="denylist")
    @builtins.classmethod
    def denylist(cls, *locations: builtins.str) -> "GeoRestriction":
        '''Deny specific countries which you don't want CloudFront to distribute your content.

        :param locations: Two-letter, uppercase country code for a country that you want to deny. Include one element for each country. See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24b31469b40ea0166f23931bcce346a12c7bb33e828af041a41fc188ec32a008)
            check_type(argname="argument locations", value=locations, expected_type=typing.Tuple[type_hints["locations"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("GeoRestriction", jsii.sinvoke(cls, "denylist", [*locations]))

    @builtins.property
    @jsii.member(jsii_name="locations")
    def locations(self) -> typing.List[builtins.str]:
        '''Two-letter, uppercase country code for a country that you want to allow/deny.

        Include one element for each country.
        See ISO 3166-1-alpha-2 code on the *International Organization for Standardization* website
        '''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "locations"))

    @builtins.property
    @jsii.member(jsii_name="restrictionType")
    def restriction_type(self) -> builtins.str:
        '''Specifies the restriction type to impose.'''
        return typing.cast(builtins.str, jsii.get(self, "restrictionType"))


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.HeadersFrameOption")
class HeadersFrameOption(enum.Enum):
    '''Enum representing possible values of the X-Frame-Options HTTP response header.

    :exampleMetadata: infused

    Example::

        # Using an existing managed response headers policy
        # bucket_origin: origins.S3Origin
        
        cloudfront.Distribution(self, "myDistManagedPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
            )
        )
        
        # Creating a custom response headers policy -- all parameters optional
        my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
            response_headers_policy_name="MyPolicy",
            comment="A default policy",
            cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                access_control_allow_credentials=False,
                access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_allow_methods=["GET", "POST"],
                access_control_allow_origins=["*"],
                access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_max_age=Duration.seconds(600),
                origin_override=True
            ),
            custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                ]
            ),
            security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
            ),
            remove_headers=["Server"],
            server_timing_sampling_rate=50
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=my_response_headers_policy
            )
        )
    '''

    DENY = "DENY"
    '''The page can only be displayed in a frame on the same origin as the page itself.'''
    SAMEORIGIN = "SAMEORIGIN"
    '''The page can only be displayed in a frame on the specified origin.'''


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.HeadersReferrerPolicy")
class HeadersReferrerPolicy(enum.Enum):
    '''Enum representing possible values of the Referrer-Policy HTTP response header.

    :exampleMetadata: infused

    Example::

        # Using an existing managed response headers policy
        # bucket_origin: origins.S3Origin
        
        cloudfront.Distribution(self, "myDistManagedPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
            )
        )
        
        # Creating a custom response headers policy -- all parameters optional
        my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
            response_headers_policy_name="MyPolicy",
            comment="A default policy",
            cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                access_control_allow_credentials=False,
                access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_allow_methods=["GET", "POST"],
                access_control_allow_origins=["*"],
                access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_max_age=Duration.seconds(600),
                origin_override=True
            ),
            custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                ]
            ),
            security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
            ),
            remove_headers=["Server"],
            server_timing_sampling_rate=50
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=my_response_headers_policy
            )
        )
    '''

    NO_REFERRER = "NO_REFERRER"
    '''The referrer policy is not set.'''
    NO_REFERRER_WHEN_DOWNGRADE = "NO_REFERRER_WHEN_DOWNGRADE"
    '''The referrer policy is no-referrer-when-downgrade.'''
    ORIGIN = "ORIGIN"
    '''The referrer policy is origin.'''
    ORIGIN_WHEN_CROSS_ORIGIN = "ORIGIN_WHEN_CROSS_ORIGIN"
    '''The referrer policy is origin-when-cross-origin.'''
    SAME_ORIGIN = "SAME_ORIGIN"
    '''The referrer policy is same-origin.'''
    STRICT_ORIGIN = "STRICT_ORIGIN"
    '''The referrer policy is strict-origin.'''
    STRICT_ORIGIN_WHEN_CROSS_ORIGIN = "STRICT_ORIGIN_WHEN_CROSS_ORIGIN"
    '''The referrer policy is strict-origin-when-cross-origin.'''
    UNSAFE_URL = "UNSAFE_URL"
    '''The referrer policy is unsafe-url.'''


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.HttpVersion")
class HttpVersion(enum.Enum):
    '''Maximum HTTP version to support.

    :exampleMetadata: infused

    Example::

        # Configure a distribution to use HTTP/2 and HTTP/3
        cloudfront.Distribution(self, "myDist",
            default_behavior=cloudfront.BehaviorOptions(origin=origins.HttpOrigin("www.example.com")),
            http_version=cloudfront.HttpVersion.HTTP2_AND_3
        )
    '''

    HTTP1_1 = "HTTP1_1"
    '''HTTP 1.1.'''
    HTTP2 = "HTTP2"
    '''HTTP 2.'''
    HTTP2_AND_3 = "HTTP2_AND_3"
    '''HTTP 2 and HTTP 3.'''
    HTTP3 = "HTTP3"
    '''HTTP 3.'''


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.ICachePolicy")
class ICachePolicy(typing_extensions.Protocol):
    '''Represents a Cache Policy.'''

    @builtins.property
    @jsii.member(jsii_name="cachePolicyId")
    def cache_policy_id(self) -> builtins.str:
        '''The ID of the cache policy.

        :attribute: true
        '''
        ...


class _ICachePolicyProxy:
    '''Represents a Cache Policy.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.ICachePolicy"

    @builtins.property
    @jsii.member(jsii_name="cachePolicyId")
    def cache_policy_id(self) -> builtins.str:
        '''The ID of the cache policy.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "cachePolicyId"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, ICachePolicy).__jsii_proxy_class__ = lambda : _ICachePolicyProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IDistribution")
class IDistribution(_IResource_c80c4260, typing_extensions.Protocol):
    '''Interface for CloudFront distributions.'''

    @builtins.property
    @jsii.member(jsii_name="distributionDomainName")
    def distribution_domain_name(self) -> builtins.str:
        '''The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :attribute: true
        '''
        ...

    @builtins.property
    @jsii.member(jsii_name="distributionId")
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.

        :attribute: true
        '''
        ...

    @jsii.member(jsii_name="grant")
    def grant(
        self,
        identity: _IGrantable_71c4f5de,
        *actions: builtins.str,
    ) -> _Grant_a7ae64f8:
        '''Adds an IAM policy statement associated with this distribution to an IAM principal's policy.

        :param identity: The principal.
        :param actions: The set of actions to allow (i.e. "cloudfront:ListInvalidations").
        '''
        ...

    @jsii.member(jsii_name="grantCreateInvalidation")
    def grant_create_invalidation(
        self,
        identity: _IGrantable_71c4f5de,
    ) -> _Grant_a7ae64f8:
        '''Grant to create invalidations for this bucket to an IAM principal (Role/Group/User).

        :param identity: The principal.
        '''
        ...


class _IDistributionProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''Interface for CloudFront distributions.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IDistribution"

    @builtins.property
    @jsii.member(jsii_name="distributionDomainName")
    def distribution_domain_name(self) -> builtins.str:
        '''The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "distributionDomainName"))

    @builtins.property
    @jsii.member(jsii_name="distributionId")
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "distributionId"))

    @jsii.member(jsii_name="grant")
    def grant(
        self,
        identity: _IGrantable_71c4f5de,
        *actions: builtins.str,
    ) -> _Grant_a7ae64f8:
        '''Adds an IAM policy statement associated with this distribution to an IAM principal's policy.

        :param identity: The principal.
        :param actions: The set of actions to allow (i.e. "cloudfront:ListInvalidations").
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1f094d764e7044bda61b03a856a844a6c04d7a3a8c3074282ec5cf861c8fe4b)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
            check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [identity, *actions]))

    @jsii.member(jsii_name="grantCreateInvalidation")
    def grant_create_invalidation(
        self,
        identity: _IGrantable_71c4f5de,
    ) -> _Grant_a7ae64f8:
        '''Grant to create invalidations for this bucket to an IAM principal (Role/Group/User).

        :param identity: The principal.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0da834b81f05c7b03da27ef7cb73b4a87abd54c9f5430cc3f6f2866079c82b8)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantCreateInvalidation", [identity]))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IDistribution).__jsii_proxy_class__ = lambda : _IDistributionProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IFunction")
class IFunction(_IResource_c80c4260, typing_extensions.Protocol):
    '''Represents a CloudFront Function.'''

    @builtins.property
    @jsii.member(jsii_name="functionArn")
    def function_arn(self) -> builtins.str:
        '''The ARN of the function.

        :attribute: true
        '''
        ...

    @builtins.property
    @jsii.member(jsii_name="functionName")
    def function_name(self) -> builtins.str:
        '''The name of the function.

        :attribute: true
        '''
        ...


class _IFunctionProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''Represents a CloudFront Function.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IFunction"

    @builtins.property
    @jsii.member(jsii_name="functionArn")
    def function_arn(self) -> builtins.str:
        '''The ARN of the function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionArn"))

    @builtins.property
    @jsii.member(jsii_name="functionName")
    def function_name(self) -> builtins.str:
        '''The name of the function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionName"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IFunction).__jsii_proxy_class__ = lambda : _IFunctionProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IKeyGroup")
class IKeyGroup(_IResource_c80c4260, typing_extensions.Protocol):
    '''Represents a Key Group.'''

    @builtins.property
    @jsii.member(jsii_name="keyGroupId")
    def key_group_id(self) -> builtins.str:
        '''The ID of the key group.

        :attribute: true
        '''
        ...


class _IKeyGroupProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''Represents a Key Group.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IKeyGroup"

    @builtins.property
    @jsii.member(jsii_name="keyGroupId")
    def key_group_id(self) -> builtins.str:
        '''The ID of the key group.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "keyGroupId"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IKeyGroup).__jsii_proxy_class__ = lambda : _IKeyGroupProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IKeyValueStore")
class IKeyValueStore(_IResource_c80c4260, typing_extensions.Protocol):
    '''A CloudFront Key Value Store.'''

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreArn")
    def key_value_store_arn(self) -> builtins.str:
        '''The ARN of the Key Value Store.

        :attribute: true
        '''
        ...

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreId")
    def key_value_store_id(self) -> builtins.str:
        '''The Unique ID of the Key Value Store.

        :attribute: true
        '''
        ...

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreStatus")
    def key_value_store_status(self) -> builtins.str:
        '''The status of the Key Value Store.

        :attribute: true
        '''
        ...


class _IKeyValueStoreProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''A CloudFront Key Value Store.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IKeyValueStore"

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreArn")
    def key_value_store_arn(self) -> builtins.str:
        '''The ARN of the Key Value Store.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreArn"))

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreId")
    def key_value_store_id(self) -> builtins.str:
        '''The Unique ID of the Key Value Store.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreId"))

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreStatus")
    def key_value_store_status(self) -> builtins.str:
        '''The status of the Key Value Store.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreStatus"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IKeyValueStore).__jsii_proxy_class__ = lambda : _IKeyValueStoreProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IOrigin")
class IOrigin(typing_extensions.Protocol):
    '''Represents the concept of a CloudFront Origin.

    You provide one or more origins when creating a Distribution.
    '''

    @jsii.member(jsii_name="bind")
    def bind(
        self,
        scope: _constructs_77d1e7e8.Construct,
        *,
        origin_id: builtins.str,
    ) -> "OriginBindConfig":
        '''The method called when a given Origin is added (for the first time) to a Distribution.

        :param scope: -
        :param origin_id: The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.
        '''
        ...


class _IOriginProxy:
    '''Represents the concept of a CloudFront Origin.

    You provide one or more origins when creating a Distribution.
    '''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IOrigin"

    @jsii.member(jsii_name="bind")
    def bind(
        self,
        scope: _constructs_77d1e7e8.Construct,
        *,
        origin_id: builtins.str,
    ) -> "OriginBindConfig":
        '''The method called when a given Origin is added (for the first time) to a Distribution.

        :param scope: -
        :param origin_id: The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88031486a507fddae1a9cd6ed970521f2a57d7953a1e564c2c5d97b8591065f2)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
        options = OriginBindOptions(origin_id=origin_id)

        return typing.cast("OriginBindConfig", jsii.invoke(self, "bind", [scope, options]))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IOrigin).__jsii_proxy_class__ = lambda : _IOriginProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IOriginAccessIdentity")
class IOriginAccessIdentity(
    _IResource_c80c4260,
    _IGrantable_71c4f5de,
    typing_extensions.Protocol,
):
    '''Interface for CloudFront OriginAccessIdentity.'''

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityId")
    def origin_access_identity_id(self) -> builtins.str:
        '''The Origin Access Identity Id (physical id) This was called originAccessIdentityName before.'''
        ...

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityName")
    def origin_access_identity_name(self) -> builtins.str:
        '''(deprecated) The Origin Access Identity Id (physical id) It is misnamed and superseded by the correctly named originAccessIdentityId.

        :deprecated: use originAccessIdentityId instead

        :stability: deprecated
        '''
        ...


class _IOriginAccessIdentityProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
    jsii.proxy_for(_IGrantable_71c4f5de), # type: ignore[misc]
):
    '''Interface for CloudFront OriginAccessIdentity.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IOriginAccessIdentity"

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityId")
    def origin_access_identity_id(self) -> builtins.str:
        '''The Origin Access Identity Id (physical id) This was called originAccessIdentityName before.'''
        return typing.cast(builtins.str, jsii.get(self, "originAccessIdentityId"))

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityName")
    def origin_access_identity_name(self) -> builtins.str:
        '''(deprecated) The Origin Access Identity Id (physical id) It is misnamed and superseded by the correctly named originAccessIdentityId.

        :deprecated: use originAccessIdentityId instead

        :stability: deprecated
        '''
        return typing.cast(builtins.str, jsii.get(self, "originAccessIdentityName"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IOriginAccessIdentity).__jsii_proxy_class__ = lambda : _IOriginAccessIdentityProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IOriginRequestPolicy")
class IOriginRequestPolicy(typing_extensions.Protocol):
    '''Represents a Origin Request Policy.'''

    @builtins.property
    @jsii.member(jsii_name="originRequestPolicyId")
    def origin_request_policy_id(self) -> builtins.str:
        '''The ID of the origin request policy.

        :attribute: true
        '''
        ...


class _IOriginRequestPolicyProxy:
    '''Represents a Origin Request Policy.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IOriginRequestPolicy"

    @builtins.property
    @jsii.member(jsii_name="originRequestPolicyId")
    def origin_request_policy_id(self) -> builtins.str:
        '''The ID of the origin request policy.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "originRequestPolicyId"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IOriginRequestPolicy).__jsii_proxy_class__ = lambda : _IOriginRequestPolicyProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IPublicKey")
class IPublicKey(_IResource_c80c4260, typing_extensions.Protocol):
    '''Represents a Public Key.'''

    @builtins.property
    @jsii.member(jsii_name="publicKeyId")
    def public_key_id(self) -> builtins.str:
        '''The ID of the key group.

        :attribute: true
        '''
        ...


class _IPublicKeyProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''Represents a Public Key.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IPublicKey"

    @builtins.property
    @jsii.member(jsii_name="publicKeyId")
    def public_key_id(self) -> builtins.str:
        '''The ID of the key group.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "publicKeyId"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IPublicKey).__jsii_proxy_class__ = lambda : _IPublicKeyProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IRealtimeLogConfig")
class IRealtimeLogConfig(_IResource_c80c4260, typing_extensions.Protocol):
    '''Represents Realtime Log Configuration.'''

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigArn")
    def realtime_log_config_arn(self) -> builtins.str:
        '''The arn of the realtime log config.

        :attribute: true
        '''
        ...

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigName")
    def realtime_log_config_name(self) -> builtins.str:
        '''The name of the realtime log config.

        :attribute: true
        '''
        ...


class _IRealtimeLogConfigProxy(
    jsii.proxy_for(_IResource_c80c4260), # type: ignore[misc]
):
    '''Represents Realtime Log Configuration.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IRealtimeLogConfig"

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigArn")
    def realtime_log_config_arn(self) -> builtins.str:
        '''The arn of the realtime log config.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "realtimeLogConfigArn"))

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigName")
    def realtime_log_config_name(self) -> builtins.str:
        '''The name of the realtime log config.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "realtimeLogConfigName"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IRealtimeLogConfig).__jsii_proxy_class__ = lambda : _IRealtimeLogConfigProxy


@jsii.interface(jsii_type="aws-cdk-lib.aws_cloudfront.IResponseHeadersPolicy")
class IResponseHeadersPolicy(typing_extensions.Protocol):
    '''Represents a response headers policy.'''

    @builtins.property
    @jsii.member(jsii_name="responseHeadersPolicyId")
    def response_headers_policy_id(self) -> builtins.str:
        '''The ID of the response headers policy.

        :attribute: true
        '''
        ...


class _IResponseHeadersPolicyProxy:
    '''Represents a response headers policy.'''

    __jsii_type__: typing.ClassVar[str] = "aws-cdk-lib.aws_cloudfront.IResponseHeadersPolicy"

    @builtins.property
    @jsii.member(jsii_name="responseHeadersPolicyId")
    def response_headers_policy_id(self) -> builtins.str:
        '''The ID of the response headers policy.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "responseHeadersPolicyId"))

# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
typing.cast(typing.Any, IResponseHeadersPolicy).__jsii_proxy_class__ = lambda : _IResponseHeadersPolicyProxy


class ImportSource(
    metaclass=jsii.JSIIAbstractClass,
    jsii_type="aws-cdk-lib.aws_cloudfront.ImportSource",
):
    '''The data to be imported to the key value store.

    :exampleMetadata: infused

    Example::

        store = cloudfront.KeyValueStore(self, "KeyValueStore",
            key_value_store_name="KeyValueStore",
            source=cloudfront.ImportSource.from_asset("path-to-data.json")
        )
    '''

    def __init__(self) -> None:
        jsii.create(self.__class__, self, [])

    @jsii.member(jsii_name="fromAsset")
    @builtins.classmethod
    def from_asset(
        cls,
        path: builtins.str,
        *,
        deploy_time: typing.Optional[builtins.bool] = None,
        readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
        asset_hash: typing.Optional[builtins.str] = None,
        asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
        bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
        exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
        follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
        ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
    ) -> "ImportSource":
        '''An import source that exists as a local file.

        :param path: the path to the local file.
        :param deploy_time: Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false
        :param readers: A list of principals that should be able to read this asset from S3. You can use ``asset.grantRead(principal)`` to grant read permissions later. Default: - No principals that can read file asset.
        :param asset_hash: Specify a custom hash for this asset. If ``assetHashType`` is set it must be set to ``AssetHashType.CUSTOM``. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on ``assetHashType``
        :param asset_hash_type: Specifies the type of hash to calculate for this asset. If ``assetHash`` is configured, this option must be ``undefined`` or ``AssetHashType.CUSTOM``. Default: - the default is ``AssetHashType.SOURCE``, but if ``assetHash`` is explicitly specified this value defaults to ``AssetHashType.CUSTOM``.
        :param bundling: Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at ``/asset-input``. The Docker container is responsible for putting content at ``/asset-output``. The content at ``/asset-output`` will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise
        :param exclude: File paths matching the patterns will be excluded. See ``ignoreMode`` to set the matching behavior. Has no effect on Assets bundled using the ``bundling`` property. Default: - nothing is excluded
        :param follow_symlinks: A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER
        :param ignore_mode: The ignore behavior to use for ``exclude`` patterns. Default: IgnoreMode.GLOB
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f5d4750ca4d7703f815ca46be8b91e46ea0b813f42846026dff63e00f3b01302)
            check_type(argname="argument path", value=path, expected_type=type_hints["path"])
        options = _AssetOptions_2aa69621(
            deploy_time=deploy_time,
            readers=readers,
            asset_hash=asset_hash,
            asset_hash_type=asset_hash_type,
            bundling=bundling,
            exclude=exclude,
            follow_symlinks=follow_symlinks,
            ignore_mode=ignore_mode,
        )

        return typing.cast("ImportSource", jsii.sinvoke(cls, "fromAsset", [path, options]))

    @jsii.member(jsii_name="fromBucket")
    @builtins.classmethod
    def from_bucket(
        cls,
        bucket: _IBucket_42e086fd,
        key: builtins.str,
    ) -> "ImportSource":
        '''An import source that exists as an object in an S3 bucket.

        :param bucket: the S3 bucket that contains the data.
        :param key: the key within the S3 bucket that contains the data.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__199a9d2f509e6bf2ce32ccd58ce284ca48a05841123773473504a43c39588730)
            check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
        return typing.cast("ImportSource", jsii.sinvoke(cls, "fromBucket", [bucket, key]))


class _ImportSourceProxy(ImportSource):
    pass

# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
typing.cast(typing.Any, ImportSource).__jsii_proxy_class__ = lambda : _ImportSourceProxy


@jsii.implements(IKeyGroup)
class KeyGroup(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.KeyGroup",
):
    '''A Key Group configuration.

    :resource: AWS::CloudFront::KeyGroup
    :exampleMetadata: infused

    Example::

        # Validating signed URLs or signed cookies with Trusted Key Groups
        
        # public key in PEM format
        # public_key: str
        
        pub_key = cloudfront.PublicKey(self, "MyPubKey",
            encoded_key=public_key
        )
        
        key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
            items=[pub_key
            ]
        )
        
        cloudfront.Distribution(self, "Dist",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.HttpOrigin("www.example.com"),
                trusted_key_groups=[key_group
                ]
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        items: typing.Sequence[IPublicKey],
        comment: typing.Optional[builtins.str] = None,
        key_group_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param items: A list of public keys to add to the key group.
        :param comment: A comment to describe the key group. Default: - no comment
        :param key_group_name: A name to identify the key group. Default: - generated from the ``id``
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c6747d6cf01bdf872790a9315f48bb3e3363e1c57d3a822e5cf812d017c9661)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = KeyGroupProps(
            items=items, comment=comment, key_group_name=key_group_name
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromKeyGroupId")
    @builtins.classmethod
    def from_key_group_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        key_group_id: builtins.str,
    ) -> IKeyGroup:
        '''Imports a Key Group from its id.

        :param scope: -
        :param id: -
        :param key_group_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c19fe95da8aeeeb87e31eba40445bb529c1563db47685e07fffcd44bb41b095)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument key_group_id", value=key_group_id, expected_type=type_hints["key_group_id"])
        return typing.cast(IKeyGroup, jsii.sinvoke(cls, "fromKeyGroupId", [scope, id, key_group_id]))

    @builtins.property
    @jsii.member(jsii_name="keyGroupId")
    def key_group_id(self) -> builtins.str:
        '''The ID of the key group.'''
        return typing.cast(builtins.str, jsii.get(self, "keyGroupId"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.KeyGroupProps",
    jsii_struct_bases=[],
    name_mapping={
        "items": "items",
        "comment": "comment",
        "key_group_name": "keyGroupName",
    },
)
class KeyGroupProps:
    def __init__(
        self,
        *,
        items: typing.Sequence[IPublicKey],
        comment: typing.Optional[builtins.str] = None,
        key_group_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties for creating a Public Key.

        :param items: A list of public keys to add to the key group.
        :param comment: A comment to describe the key group. Default: - no comment
        :param key_group_name: A name to identify the key group. Default: - generated from the ``id``

        :exampleMetadata: infused

        Example::

            # Validating signed URLs or signed cookies with Trusted Key Groups
            
            # public key in PEM format
            # public_key: str
            
            pub_key = cloudfront.PublicKey(self, "MyPubKey",
                encoded_key=public_key
            )
            
            key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
                items=[pub_key
                ]
            )
            
            cloudfront.Distribution(self, "Dist",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.HttpOrigin("www.example.com"),
                    trusted_key_groups=[key_group
                    ]
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c42362898414602d0064aac5432fc41cadd378821fd0d3ec155f7a75af3f1e4)
            check_type(argname="argument items", value=items, expected_type=type_hints["items"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument key_group_name", value=key_group_name, expected_type=type_hints["key_group_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "items": items,
        }
        if comment is not None:
            self._values["comment"] = comment
        if key_group_name is not None:
            self._values["key_group_name"] = key_group_name

    @builtins.property
    def items(self) -> typing.List[IPublicKey]:
        '''A list of public keys to add to the key group.'''
        result = self._values.get("items")
        assert result is not None, "Required property 'items' is missing"
        return typing.cast(typing.List[IPublicKey], result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the key group.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def key_group_name(self) -> typing.Optional[builtins.str]:
        '''A name to identify the key group.

        :default: - generated from the ``id``
        '''
        result = self._values.get("key_group_name")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "KeyGroupProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(IKeyValueStore)
class KeyValueStore(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.KeyValueStore",
):
    '''A CloudFront Key Value Store.

    :resource: AWS::CloudFront::KeyValueStore
    :exampleMetadata: infused

    Example::

        store = cloudfront.KeyValueStore(self, "KeyValueStore",
            key_value_store_name="KeyValueStore",
            source=cloudfront.ImportSource.from_asset("path-to-data.json")
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        comment: typing.Optional[builtins.str] = None,
        key_value_store_name: typing.Optional[builtins.str] = None,
        source: typing.Optional[ImportSource] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param comment: A comment for the Key Value Store. Default: No comment will be specified
        :param key_value_store_name: The unique name of the Key Value Store. Default: A generated name
        :param source: The import source for the Key Value Store. This will populate the initial items in the Key Value Store. The source data must be in a valid JSON format. Default: No data will be imported to the store
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbcb7711d84a000f571b2303bf96f7a4319741a396d620e3f2c749be479fdde1)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = KeyValueStoreProps(
            comment=comment, key_value_store_name=key_value_store_name, source=source
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromKeyValueStoreArn")
    @builtins.classmethod
    def from_key_value_store_arn(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        key_value_store_arn: builtins.str,
    ) -> IKeyValueStore:
        '''Import a Key Value Store using its ARN.

        :param scope: -
        :param id: -
        :param key_value_store_arn: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6286cfc55d9b5b70d728248f5d869f6b99814bbec3d61416b9ff28849cdca011)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument key_value_store_arn", value=key_value_store_arn, expected_type=type_hints["key_value_store_arn"])
        return typing.cast(IKeyValueStore, jsii.sinvoke(cls, "fromKeyValueStoreArn", [scope, id, key_value_store_arn]))

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreArn")
    def key_value_store_arn(self) -> builtins.str:
        '''The ARN of the Key Value Store.'''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreArn"))

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreId")
    def key_value_store_id(self) -> builtins.str:
        '''The Unique ID of the Key Value Store.'''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreId"))

    @builtins.property
    @jsii.member(jsii_name="keyValueStoreStatus")
    def key_value_store_status(self) -> builtins.str:
        '''The status of the Key Value Store.'''
        return typing.cast(builtins.str, jsii.get(self, "keyValueStoreStatus"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.KeyValueStoreProps",
    jsii_struct_bases=[],
    name_mapping={
        "comment": "comment",
        "key_value_store_name": "keyValueStoreName",
        "source": "source",
    },
)
class KeyValueStoreProps:
    def __init__(
        self,
        *,
        comment: typing.Optional[builtins.str] = None,
        key_value_store_name: typing.Optional[builtins.str] = None,
        source: typing.Optional[ImportSource] = None,
    ) -> None:
        '''The properties to create a Key Value Store.

        :param comment: A comment for the Key Value Store. Default: No comment will be specified
        :param key_value_store_name: The unique name of the Key Value Store. Default: A generated name
        :param source: The import source for the Key Value Store. This will populate the initial items in the Key Value Store. The source data must be in a valid JSON format. Default: No data will be imported to the store

        :exampleMetadata: infused

        Example::

            store = cloudfront.KeyValueStore(self, "KeyValueStore",
                key_value_store_name="KeyValueStore",
                source=cloudfront.ImportSource.from_asset("path-to-data.json")
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0885cf023551545b14a4696bf116b851a0c7733cc2987782ba95a29b134a062e)
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument key_value_store_name", value=key_value_store_name, expected_type=type_hints["key_value_store_name"])
            check_type(argname="argument source", value=source, expected_type=type_hints["source"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if comment is not None:
            self._values["comment"] = comment
        if key_value_store_name is not None:
            self._values["key_value_store_name"] = key_value_store_name
        if source is not None:
            self._values["source"] = source

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment for the Key Value Store.

        :default: No comment will be specified
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def key_value_store_name(self) -> typing.Optional[builtins.str]:
        '''The unique name of the Key Value Store.

        :default: A generated name
        '''
        result = self._values.get("key_value_store_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def source(self) -> typing.Optional[ImportSource]:
        '''The import source for the Key Value Store.

        This will populate the initial items in the Key Value Store. The
        source data must be in a valid JSON format.

        :default: No data will be imported to the store
        '''
        result = self._values.get("source")
        return typing.cast(typing.Optional[ImportSource], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "KeyValueStoreProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.LambdaEdgeEventType")
class LambdaEdgeEventType(enum.Enum):
    '''The type of events that a Lambda@Edge function can be invoked in response to.

    :exampleMetadata: infused

    Example::

        # my_bucket: s3.Bucket
        # A Lambda@Edge function added to default behavior of a Distribution
        # and triggered on every request
        my_func = cloudfront.experimental.EdgeFunction(self, "MyFunction",
            runtime=lambda_.Runtime.NODEJS_LATEST,
            handler="index.handler",
            code=lambda_.Code.from_asset(path.join(__dirname, "lambda-handler"))
        )
        cloudfront.Distribution(self, "myDist",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(my_bucket),
                edge_lambdas=[cloudfront.EdgeLambda(
                    function_version=my_func.current_version,
                    event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
                )
                ]
            )
        )
    '''

    ORIGIN_REQUEST = "ORIGIN_REQUEST"
    '''The origin-request specifies the request to the origin location (e.g. S3).'''
    ORIGIN_RESPONSE = "ORIGIN_RESPONSE"
    '''The origin-response specifies the response from the origin location (e.g. S3).'''
    VIEWER_REQUEST = "VIEWER_REQUEST"
    '''The viewer-request specifies the incoming request.'''
    VIEWER_RESPONSE = "VIEWER_RESPONSE"
    '''The viewer-response specifies the outgoing response.'''


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.LambdaFunctionAssociation",
    jsii_struct_bases=[],
    name_mapping={
        "event_type": "eventType",
        "lambda_function": "lambdaFunction",
        "include_body": "includeBody",
    },
)
class LambdaFunctionAssociation:
    def __init__(
        self,
        *,
        event_type: LambdaEdgeEventType,
        lambda_function: _IVersion_faf7234e,
        include_body: typing.Optional[builtins.bool] = None,
    ) -> None:
        '''
        :param event_type: The lambda event type defines at which event the lambda is called during the request lifecycle.
        :param lambda_function: A version of the lambda to associate.
        :param include_body: Allows a Lambda function to have read access to the body content. Only valid for "request" event types (``ORIGIN_REQUEST`` or ``VIEWER_REQUEST``). See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html Default: false

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            from aws_cdk import aws_lambda as lambda_
            
            # version: lambda.Version
            
            lambda_function_association = cloudfront.LambdaFunctionAssociation(
                event_type=cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                lambda_function=version,
            
                # the properties below are optional
                include_body=False
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1cc70f1ca9c8fff5a72f34c1e001c9ece45f76199d1574048a6ec3fa44fbba48)
            check_type(argname="argument event_type", value=event_type, expected_type=type_hints["event_type"])
            check_type(argname="argument lambda_function", value=lambda_function, expected_type=type_hints["lambda_function"])
            check_type(argname="argument include_body", value=include_body, expected_type=type_hints["include_body"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "event_type": event_type,
            "lambda_function": lambda_function,
        }
        if include_body is not None:
            self._values["include_body"] = include_body

    @builtins.property
    def event_type(self) -> LambdaEdgeEventType:
        '''The lambda event type defines at which event the lambda is called during the request lifecycle.'''
        result = self._values.get("event_type")
        assert result is not None, "Required property 'event_type' is missing"
        return typing.cast(LambdaEdgeEventType, result)

    @builtins.property
    def lambda_function(self) -> _IVersion_faf7234e:
        '''A version of the lambda to associate.'''
        result = self._values.get("lambda_function")
        assert result is not None, "Required property 'lambda_function' is missing"
        return typing.cast(_IVersion_faf7234e, result)

    @builtins.property
    def include_body(self) -> typing.Optional[builtins.bool]:
        '''Allows a Lambda function to have read access to the body content.

        Only valid for "request" event types (``ORIGIN_REQUEST`` or ``VIEWER_REQUEST``).
        See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-include-body-access.html

        :default: false
        '''
        result = self._values.get("include_body")
        return typing.cast(typing.Optional[builtins.bool], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "LambdaFunctionAssociation(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.LoggingConfiguration",
    jsii_struct_bases=[],
    name_mapping={
        "bucket": "bucket",
        "include_cookies": "includeCookies",
        "prefix": "prefix",
    },
)
class LoggingConfiguration:
    def __init__(
        self,
        *,
        bucket: typing.Optional[_IBucket_42e086fd] = None,
        include_cookies: typing.Optional[builtins.bool] = None,
        prefix: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Logging configuration for incoming requests.

        :param bucket: Bucket to log requests to. Default: - A logging bucket is automatically created.
        :param include_cookies: Whether to include the cookies in the logs. Default: false
        :param prefix: Where in the bucket to store logs. Default: - No prefix.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            from aws_cdk import aws_s3 as s3
            
            # bucket: s3.Bucket
            
            logging_configuration = cloudfront.LoggingConfiguration(
                bucket=bucket,
                include_cookies=False,
                prefix="prefix"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1c495121d3f25343764da863019d723da4b7d05ac74ed07b91c30326bd60f42)
            check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
            check_type(argname="argument include_cookies", value=include_cookies, expected_type=type_hints["include_cookies"])
            check_type(argname="argument prefix", value=prefix, expected_type=type_hints["prefix"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if bucket is not None:
            self._values["bucket"] = bucket
        if include_cookies is not None:
            self._values["include_cookies"] = include_cookies
        if prefix is not None:
            self._values["prefix"] = prefix

    @builtins.property
    def bucket(self) -> typing.Optional[_IBucket_42e086fd]:
        '''Bucket to log requests to.

        :default: - A logging bucket is automatically created.
        '''
        result = self._values.get("bucket")
        return typing.cast(typing.Optional[_IBucket_42e086fd], result)

    @builtins.property
    def include_cookies(self) -> typing.Optional[builtins.bool]:
        '''Whether to include the cookies in the logs.

        :default: false
        '''
        result = self._values.get("include_cookies")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def prefix(self) -> typing.Optional[builtins.str]:
        '''Where in the bucket to store logs.

        :default: - No prefix.
        '''
        result = self._values.get("prefix")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "LoggingConfiguration(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(IOriginAccessIdentity)
class OriginAccessIdentity(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginAccessIdentity",
):
    '''An origin access identity is a special CloudFront user that you can associate with Amazon S3 origins, so that you can secure all or just some of your Amazon S3 content.

    :resource: AWS::CloudFront::CloudFrontOriginAccessIdentity
    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        
        origin_access_identity = cloudfront.OriginAccessIdentity(self, "MyOriginAccessIdentity",
            comment="comment"
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        comment: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param comment: Any comments you want to include about the origin access identity. Default: "Allows CloudFront to reach the bucket"
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff86c7c3a54c3012c2e56787024ba13254594b3c0ca9aa271798797fe668270a)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = OriginAccessIdentityProps(comment=comment)

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromOriginAccessIdentityId")
    @builtins.classmethod
    def from_origin_access_identity_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        origin_access_identity_id: builtins.str,
    ) -> IOriginAccessIdentity:
        '''Creates a OriginAccessIdentity by providing the OriginAccessIdentityId.

        :param scope: -
        :param id: -
        :param origin_access_identity_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5200c02dd4e6219704c4ac062b08ed6c07d13da76e4d84b30c0470218177ea67)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument origin_access_identity_id", value=origin_access_identity_id, expected_type=type_hints["origin_access_identity_id"])
        return typing.cast(IOriginAccessIdentity, jsii.sinvoke(cls, "fromOriginAccessIdentityId", [scope, id, origin_access_identity_id]))

    @jsii.member(jsii_name="fromOriginAccessIdentityName")
    @builtins.classmethod
    def from_origin_access_identity_name(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        origin_access_identity_name: builtins.str,
    ) -> IOriginAccessIdentity:
        '''(deprecated) Creates a OriginAccessIdentity by providing the OriginAccessIdentityId.

        It is misnamed and superseded by the correctly named fromOriginAccessIdentityId.

        :param scope: -
        :param id: -
        :param origin_access_identity_name: -

        :deprecated: use ``fromOriginAccessIdentityId``

        :stability: deprecated
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__252615cd4075890e9b97e25f95b99e87b2e94a66cad966f32c9fd7a78d5c37e8)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument origin_access_identity_name", value=origin_access_identity_name, expected_type=type_hints["origin_access_identity_name"])
        return typing.cast(IOriginAccessIdentity, jsii.sinvoke(cls, "fromOriginAccessIdentityName", [scope, id, origin_access_identity_name]))

    @jsii.member(jsii_name="arn")
    def _arn(self) -> builtins.str:
        '''The ARN to include in S3 bucket policy to allow CloudFront access.'''
        return typing.cast(builtins.str, jsii.invoke(self, "arn", []))

    @builtins.property
    @jsii.member(jsii_name="cloudFrontOriginAccessIdentityS3CanonicalUserId")
    def cloud_front_origin_access_identity_s3_canonical_user_id(self) -> builtins.str:
        '''The Amazon S3 canonical user ID for the origin access identity, used when giving the origin access identity read permission to an object in Amazon S3.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "cloudFrontOriginAccessIdentityS3CanonicalUserId"))

    @builtins.property
    @jsii.member(jsii_name="grantPrincipal")
    def grant_principal(self) -> _IPrincipal_539bb2fd:
        '''Derived principal value for bucket access.'''
        return typing.cast(_IPrincipal_539bb2fd, jsii.get(self, "grantPrincipal"))

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityId")
    def origin_access_identity_id(self) -> builtins.str:
        '''The Origin Access Identity Id (physical id) This was called originAccessIdentityName before.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "originAccessIdentityId"))

    @builtins.property
    @jsii.member(jsii_name="originAccessIdentityName")
    def origin_access_identity_name(self) -> builtins.str:
        '''(deprecated) The Origin Access Identity Id (physical id) It is misnamed and superseded by the correctly named originAccessIdentityId.

        :deprecated: use originAccessIdentityId instead

        :stability: deprecated
        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "originAccessIdentityName"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginAccessIdentityProps",
    jsii_struct_bases=[],
    name_mapping={"comment": "comment"},
)
class OriginAccessIdentityProps:
    def __init__(self, *, comment: typing.Optional[builtins.str] = None) -> None:
        '''Properties of CloudFront OriginAccessIdentity.

        :param comment: Any comments you want to include about the origin access identity. Default: "Allows CloudFront to reach the bucket"

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            origin_access_identity_props = cloudfront.OriginAccessIdentityProps(
                comment="comment"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__143f91820e990f7bf9dcb0392e6c177f508af6993b1798797c5ae5dcba9733a4)
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if comment is not None:
            self._values["comment"] = comment

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''Any comments you want to include about the origin access identity.

        :default: "Allows CloudFront to reach the bucket"
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginAccessIdentityProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(IOrigin)
class OriginBase(
    metaclass=jsii.JSIIAbstractClass,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginBase",
):
    '''Represents a distribution origin, that describes the Amazon S3 bucket, HTTP server (for example, a web server), Amazon MediaStore, or other server from which CloudFront gets your files.'''

    def __init__(
        self,
        domain_name: builtins.str,
        *,
        origin_path: typing.Optional[builtins.str] = None,
        connection_attempts: typing.Optional[jsii.Number] = None,
        connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
        custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        origin_id: typing.Optional[builtins.str] = None,
        origin_shield_enabled: typing.Optional[builtins.bool] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param domain_name: -
        :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'
        :param connection_attempts: The number of times that CloudFront attempts to connect to the origin; valid values are 1, 2, or 3 attempts. Default: 3
        :param connection_timeout: The number of seconds that CloudFront waits when trying to establish a connection to the origin. Valid values are 1-10 seconds, inclusive. Default: Duration.seconds(10)
        :param custom_headers: A list of HTTP header names and values that CloudFront adds to requests it sends to the origin. Default: {}
        :param origin_id: A unique identifier for the origin. This value must be unique within the distribution. Default: - an originid will be generated for you
        :param origin_shield_enabled: Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false. Default: - true
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b13f814bf47a5f3949ffc4b53034b4702a02836213167c9ba4c6a8d6e8f623e)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
        props = OriginProps(
            origin_path=origin_path,
            connection_attempts=connection_attempts,
            connection_timeout=connection_timeout,
            custom_headers=custom_headers,
            origin_id=origin_id,
            origin_shield_enabled=origin_shield_enabled,
            origin_shield_region=origin_shield_region,
        )

        jsii.create(self.__class__, self, [domain_name, props])

    @jsii.member(jsii_name="bind")
    def bind(
        self,
        _scope: _constructs_77d1e7e8.Construct,
        *,
        origin_id: builtins.str,
    ) -> "OriginBindConfig":
        '''Binds the origin to the associated Distribution.

        Can be used to grant permissions, create dependent resources, etc.

        :param _scope: -
        :param origin_id: The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8428dfc90e69bdd5363e69afd9c590a4ed2f1363b22242197295117dc5221878)
            check_type(argname="argument _scope", value=_scope, expected_type=type_hints["_scope"])
        options = OriginBindOptions(origin_id=origin_id)

        return typing.cast("OriginBindConfig", jsii.invoke(self, "bind", [_scope, options]))

    @jsii.member(jsii_name="renderCustomOriginConfig")
    def _render_custom_origin_config(
        self,
    ) -> typing.Optional[CfnDistribution.CustomOriginConfigProperty]:
        return typing.cast(typing.Optional[CfnDistribution.CustomOriginConfigProperty], jsii.invoke(self, "renderCustomOriginConfig", []))

    @jsii.member(jsii_name="renderS3OriginConfig")
    def _render_s3_origin_config(
        self,
    ) -> typing.Optional[CfnDistribution.S3OriginConfigProperty]:
        return typing.cast(typing.Optional[CfnDistribution.S3OriginConfigProperty], jsii.invoke(self, "renderS3OriginConfig", []))


class _OriginBaseProxy(OriginBase):
    pass

# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
typing.cast(typing.Any, OriginBase).__jsii_proxy_class__ = lambda : _OriginBaseProxy


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginBindConfig",
    jsii_struct_bases=[],
    name_mapping={
        "failover_config": "failoverConfig",
        "origin_property": "originProperty",
    },
)
class OriginBindConfig:
    def __init__(
        self,
        *,
        failover_config: typing.Optional[typing.Union["OriginFailoverConfig", typing.Dict[builtins.str, typing.Any]]] = None,
        origin_property: typing.Optional[typing.Union[CfnDistribution.OriginProperty, typing.Dict[builtins.str, typing.Any]]] = None,
    ) -> None:
        '''The struct returned from ``IOrigin.bind``.

        :param failover_config: The failover configuration for this Origin. Default: - nothing is returned
        :param origin_property: The CloudFormation OriginProperty configuration for this Origin. Default: - nothing is returned

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            # origin: cloudfront.IOrigin
            
            origin_bind_config = cloudfront.OriginBindConfig(
                failover_config=cloudfront.OriginFailoverConfig(
                    failover_origin=origin,
            
                    # the properties below are optional
                    status_codes=[123]
                ),
                origin_property=cloudfront.CfnDistribution.OriginProperty(
                    domain_name="domainName",
                    id="id",
            
                    # the properties below are optional
                    connection_attempts=123,
                    connection_timeout=123,
                    custom_origin_config=cloudfront.CfnDistribution.CustomOriginConfigProperty(
                        origin_protocol_policy="originProtocolPolicy",
            
                        # the properties below are optional
                        http_port=123,
                        https_port=123,
                        origin_keepalive_timeout=123,
                        origin_read_timeout=123,
                        origin_ssl_protocols=["originSslProtocols"]
                    ),
                    origin_access_control_id="originAccessControlId",
                    origin_custom_headers=[cloudfront.CfnDistribution.OriginCustomHeaderProperty(
                        header_name="headerName",
                        header_value="headerValue"
                    )],
                    origin_path="originPath",
                    origin_shield=cloudfront.CfnDistribution.OriginShieldProperty(
                        enabled=False,
                        origin_shield_region="originShieldRegion"
                    ),
                    s3_origin_config=cloudfront.CfnDistribution.S3OriginConfigProperty(
                        origin_access_identity="originAccessIdentity"
                    )
                )
            )
        '''
        if isinstance(failover_config, dict):
            failover_config = OriginFailoverConfig(**failover_config)
        if isinstance(origin_property, dict):
            origin_property = CfnDistribution.OriginProperty(**origin_property)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3e6a8992dd905a0c0d851cfed62aa0f881803068317a0b59eb84571249e84f1)
            check_type(argname="argument failover_config", value=failover_config, expected_type=type_hints["failover_config"])
            check_type(argname="argument origin_property", value=origin_property, expected_type=type_hints["origin_property"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if failover_config is not None:
            self._values["failover_config"] = failover_config
        if origin_property is not None:
            self._values["origin_property"] = origin_property

    @builtins.property
    def failover_config(self) -> typing.Optional["OriginFailoverConfig"]:
        '''The failover configuration for this Origin.

        :default: - nothing is returned
        '''
        result = self._values.get("failover_config")
        return typing.cast(typing.Optional["OriginFailoverConfig"], result)

    @builtins.property
    def origin_property(self) -> typing.Optional[CfnDistribution.OriginProperty]:
        '''The CloudFormation OriginProperty configuration for this Origin.

        :default: - nothing is returned
        '''
        result = self._values.get("origin_property")
        return typing.cast(typing.Optional[CfnDistribution.OriginProperty], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginBindConfig(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginBindOptions",
    jsii_struct_bases=[],
    name_mapping={"origin_id": "originId"},
)
class OriginBindOptions:
    def __init__(self, *, origin_id: builtins.str) -> None:
        '''Options passed to Origin.bind().

        :param origin_id: The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            origin_bind_options = cloudfront.OriginBindOptions(
                origin_id="originId"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0dbe700920dc77d0410da01e091c5caab2d3bb29313320e6057ed87275ccc649)
            check_type(argname="argument origin_id", value=origin_id, expected_type=type_hints["origin_id"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "origin_id": origin_id,
        }

    @builtins.property
    def origin_id(self) -> builtins.str:
        '''The identifier of this Origin, as assigned by the Distribution this Origin has been used added to.'''
        result = self._values.get("origin_id")
        assert result is not None, "Required property 'origin_id' is missing"
        return typing.cast(builtins.str, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginBindOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginFailoverConfig",
    jsii_struct_bases=[],
    name_mapping={"failover_origin": "failoverOrigin", "status_codes": "statusCodes"},
)
class OriginFailoverConfig:
    def __init__(
        self,
        *,
        failover_origin: IOrigin,
        status_codes: typing.Optional[typing.Sequence[jsii.Number]] = None,
    ) -> None:
        '''The failover configuration used for Origin Groups, returned in ``OriginBindConfig.failoverConfig``.

        :param failover_origin: The origin to use as the fallback origin.
        :param status_codes: The HTTP status codes of the response that trigger querying the failover Origin. Default: - 500, 502, 503 and 504

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            # origin: cloudfront.IOrigin
            
            origin_failover_config = cloudfront.OriginFailoverConfig(
                failover_origin=origin,
            
                # the properties below are optional
                status_codes=[123]
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38e0ba1250f1054d0ee50985aeec5f9f8030b5b28a88aa0fdda0f919636952bc)
            check_type(argname="argument failover_origin", value=failover_origin, expected_type=type_hints["failover_origin"])
            check_type(argname="argument status_codes", value=status_codes, expected_type=type_hints["status_codes"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "failover_origin": failover_origin,
        }
        if status_codes is not None:
            self._values["status_codes"] = status_codes

    @builtins.property
    def failover_origin(self) -> IOrigin:
        '''The origin to use as the fallback origin.'''
        result = self._values.get("failover_origin")
        assert result is not None, "Required property 'failover_origin' is missing"
        return typing.cast(IOrigin, result)

    @builtins.property
    def status_codes(self) -> typing.Optional[typing.List[jsii.Number]]:
        '''The HTTP status codes of the response that trigger querying the failover Origin.

        :default: - 500, 502, 503 and 504
        '''
        result = self._values.get("status_codes")
        return typing.cast(typing.Optional[typing.List[jsii.Number]], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginFailoverConfig(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginOptions",
    jsii_struct_bases=[],
    name_mapping={
        "connection_attempts": "connectionAttempts",
        "connection_timeout": "connectionTimeout",
        "custom_headers": "customHeaders",
        "origin_id": "originId",
        "origin_shield_enabled": "originShieldEnabled",
        "origin_shield_region": "originShieldRegion",
    },
)
class OriginOptions:
    def __init__(
        self,
        *,
        connection_attempts: typing.Optional[jsii.Number] = None,
        connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
        custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        origin_id: typing.Optional[builtins.str] = None,
        origin_shield_enabled: typing.Optional[builtins.bool] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Options to define an Origin.

        :param connection_attempts: The number of times that CloudFront attempts to connect to the origin; valid values are 1, 2, or 3 attempts. Default: 3
        :param connection_timeout: The number of seconds that CloudFront waits when trying to establish a connection to the origin. Valid values are 1-10 seconds, inclusive. Default: Duration.seconds(10)
        :param custom_headers: A list of HTTP header names and values that CloudFront adds to requests it sends to the origin. Default: {}
        :param origin_id: A unique identifier for the origin. This value must be unique within the distribution. Default: - an originid will be generated for you
        :param origin_shield_enabled: Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false. Default: - true
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            import aws_cdk as cdk
            from aws_cdk import aws_cloudfront as cloudfront
            
            origin_options = cloudfront.OriginOptions(
                connection_attempts=123,
                connection_timeout=cdk.Duration.minutes(30),
                custom_headers={
                    "custom_headers_key": "customHeaders"
                },
                origin_id="originId",
                origin_shield_enabled=False,
                origin_shield_region="originShieldRegion"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__554f93c57439378c8175676cc442eaea5c8ec961a156b1f26e60df9cd428fcc8)
            check_type(argname="argument connection_attempts", value=connection_attempts, expected_type=type_hints["connection_attempts"])
            check_type(argname="argument connection_timeout", value=connection_timeout, expected_type=type_hints["connection_timeout"])
            check_type(argname="argument custom_headers", value=custom_headers, expected_type=type_hints["custom_headers"])
            check_type(argname="argument origin_id", value=origin_id, expected_type=type_hints["origin_id"])
            check_type(argname="argument origin_shield_enabled", value=origin_shield_enabled, expected_type=type_hints["origin_shield_enabled"])
            check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if connection_attempts is not None:
            self._values["connection_attempts"] = connection_attempts
        if connection_timeout is not None:
            self._values["connection_timeout"] = connection_timeout
        if custom_headers is not None:
            self._values["custom_headers"] = custom_headers
        if origin_id is not None:
            self._values["origin_id"] = origin_id
        if origin_shield_enabled is not None:
            self._values["origin_shield_enabled"] = origin_shield_enabled
        if origin_shield_region is not None:
            self._values["origin_shield_region"] = origin_shield_region

    @builtins.property
    def connection_attempts(self) -> typing.Optional[jsii.Number]:
        '''The number of times that CloudFront attempts to connect to the origin;

        valid values are 1, 2, or 3 attempts.

        :default: 3
        '''
        result = self._values.get("connection_attempts")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def connection_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The number of seconds that CloudFront waits when trying to establish a connection to the origin.

        Valid values are 1-10 seconds, inclusive.

        :default: Duration.seconds(10)
        '''
        result = self._values.get("connection_timeout")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def custom_headers(
        self,
    ) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
        '''A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.

        :default: {}
        '''
        result = self._values.get("custom_headers")
        return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)

    @builtins.property
    def origin_id(self) -> typing.Optional[builtins.str]:
        '''A unique identifier for the origin.

        This value must be unique within the distribution.

        :default: - an originid will be generated for you
        '''
        result = self._values.get("origin_id")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def origin_shield_enabled(self) -> typing.Optional[builtins.bool]:
        '''Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false.

        :default: - true
        '''
        result = self._values.get("origin_shield_enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def origin_shield_region(self) -> typing.Optional[builtins.str]:
        '''When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

        :default: - origin shield not enabled

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
        '''
        result = self._values.get("origin_shield_region")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginProps",
    jsii_struct_bases=[OriginOptions],
    name_mapping={
        "connection_attempts": "connectionAttempts",
        "connection_timeout": "connectionTimeout",
        "custom_headers": "customHeaders",
        "origin_id": "originId",
        "origin_shield_enabled": "originShieldEnabled",
        "origin_shield_region": "originShieldRegion",
        "origin_path": "originPath",
    },
)
class OriginProps(OriginOptions):
    def __init__(
        self,
        *,
        connection_attempts: typing.Optional[jsii.Number] = None,
        connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
        custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        origin_id: typing.Optional[builtins.str] = None,
        origin_shield_enabled: typing.Optional[builtins.bool] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
        origin_path: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties to define an Origin.

        :param connection_attempts: The number of times that CloudFront attempts to connect to the origin; valid values are 1, 2, or 3 attempts. Default: 3
        :param connection_timeout: The number of seconds that CloudFront waits when trying to establish a connection to the origin. Valid values are 1-10 seconds, inclusive. Default: Duration.seconds(10)
        :param custom_headers: A list of HTTP header names and values that CloudFront adds to requests it sends to the origin. Default: {}
        :param origin_id: A unique identifier for the origin. This value must be unique within the distribution. Default: - an originid will be generated for you
        :param origin_shield_enabled: Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false. Default: - true
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled
        :param origin_path: An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin. Must begin, but not end, with '/' (e.g., '/production/images'). Default: '/'

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            import aws_cdk as cdk
            from aws_cdk import aws_cloudfront as cloudfront
            
            origin_props = cloudfront.OriginProps(
                connection_attempts=123,
                connection_timeout=cdk.Duration.minutes(30),
                custom_headers={
                    "custom_headers_key": "customHeaders"
                },
                origin_id="originId",
                origin_path="originPath",
                origin_shield_enabled=False,
                origin_shield_region="originShieldRegion"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1f5da480c426bb32e14bbbeb482146cc90bcd3678f902c46f0f2f73995b0ffa)
            check_type(argname="argument connection_attempts", value=connection_attempts, expected_type=type_hints["connection_attempts"])
            check_type(argname="argument connection_timeout", value=connection_timeout, expected_type=type_hints["connection_timeout"])
            check_type(argname="argument custom_headers", value=custom_headers, expected_type=type_hints["custom_headers"])
            check_type(argname="argument origin_id", value=origin_id, expected_type=type_hints["origin_id"])
            check_type(argname="argument origin_shield_enabled", value=origin_shield_enabled, expected_type=type_hints["origin_shield_enabled"])
            check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
            check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if connection_attempts is not None:
            self._values["connection_attempts"] = connection_attempts
        if connection_timeout is not None:
            self._values["connection_timeout"] = connection_timeout
        if custom_headers is not None:
            self._values["custom_headers"] = custom_headers
        if origin_id is not None:
            self._values["origin_id"] = origin_id
        if origin_shield_enabled is not None:
            self._values["origin_shield_enabled"] = origin_shield_enabled
        if origin_shield_region is not None:
            self._values["origin_shield_region"] = origin_shield_region
        if origin_path is not None:
            self._values["origin_path"] = origin_path

    @builtins.property
    def connection_attempts(self) -> typing.Optional[jsii.Number]:
        '''The number of times that CloudFront attempts to connect to the origin;

        valid values are 1, 2, or 3 attempts.

        :default: 3
        '''
        result = self._values.get("connection_attempts")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def connection_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The number of seconds that CloudFront waits when trying to establish a connection to the origin.

        Valid values are 1-10 seconds, inclusive.

        :default: Duration.seconds(10)
        '''
        result = self._values.get("connection_timeout")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def custom_headers(
        self,
    ) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
        '''A list of HTTP header names and values that CloudFront adds to requests it sends to the origin.

        :default: {}
        '''
        result = self._values.get("custom_headers")
        return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)

    @builtins.property
    def origin_id(self) -> typing.Optional[builtins.str]:
        '''A unique identifier for the origin.

        This value must be unique within the distribution.

        :default: - an originid will be generated for you
        '''
        result = self._values.get("origin_id")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def origin_shield_enabled(self) -> typing.Optional[builtins.bool]:
        '''Origin Shield is enabled by setting originShieldRegion to a valid region, after this to disable Origin Shield again you must set this flag to false.

        :default: - true
        '''
        result = self._values.get("origin_shield_enabled")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def origin_shield_region(self) -> typing.Optional[builtins.str]:
        '''When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

        :default: - origin shield not enabled

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
        '''
        result = self._values.get("origin_shield_region")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def origin_path(self) -> typing.Optional[builtins.str]:
        '''An optional path that CloudFront appends to the origin domain name when CloudFront requests content from the origin.

        Must begin, but not end, with '/' (e.g., '/production/images').

        :default: '/'
        '''
        result = self._values.get("origin_path")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.OriginProtocolPolicy")
class OriginProtocolPolicy(enum.Enum):
    '''Defines what protocols CloudFront will use to connect to an origin.

    :exampleMetadata: infused

    Example::

        import aws_cdk.aws_elasticloadbalancingv2 as elbv2
        
        # load_balancer: elbv2.ApplicationLoadBalancer
        
        origin = origins.LoadBalancerV2Origin(load_balancer,
            connection_attempts=3,
            connection_timeout=Duration.seconds(5),
            read_timeout=Duration.seconds(45),
            keepalive_timeout=Duration.seconds(45),
            protocol_policy=cloudfront.OriginProtocolPolicy.MATCH_VIEWER
        )
    '''

    HTTP_ONLY = "HTTP_ONLY"
    '''Connect on HTTP only.'''
    MATCH_VIEWER = "MATCH_VIEWER"
    '''Connect with the same protocol as the viewer.'''
    HTTPS_ONLY = "HTTPS_ONLY"
    '''Connect on HTTPS only.'''


class OriginRequestCookieBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginRequestCookieBehavior",
):
    '''Determines whether any cookies in viewer requests (and if so, which cookies) are included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom origin request policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_origin_request_policy = cloudfront.OriginRequestPolicy(self, "OriginRequestPolicy",
            origin_request_policy_name="MyPolicy",
            comment="A default policy",
            cookie_behavior=cloudfront.OriginRequestCookieBehavior.none(),
            header_behavior=cloudfront.OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"),
            query_string_behavior=cloudfront.OriginRequestQueryStringBehavior.allow_list("username")
        )
        
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                origin_request_policy=my_origin_request_policy
            )
        )
    '''

    @jsii.member(jsii_name="all")
    @builtins.classmethod
    def all(cls) -> "OriginRequestCookieBehavior":
        '''All cookies in viewer requests are included in requests that CloudFront sends to the origin.'''
        return typing.cast("OriginRequestCookieBehavior", jsii.sinvoke(cls, "all", []))

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(cls, *cookies: builtins.str) -> "OriginRequestCookieBehavior":
        '''Only the provided ``cookies`` are included in requests that CloudFront sends to the origin.

        :param cookies: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b8269be835f9da749d549383d8951224e3457a97f62046a53327e2f5c2cd49a)
            check_type(argname="argument cookies", value=cookies, expected_type=typing.Tuple[type_hints["cookies"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestCookieBehavior", jsii.sinvoke(cls, "allowList", [*cookies]))

    @jsii.member(jsii_name="denyList")
    @builtins.classmethod
    def deny_list(cls, *cookies: builtins.str) -> "OriginRequestCookieBehavior":
        '''All cookies except the provided ``cookies`` are included in requests that CloudFront sends to the origin.

        :param cookies: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__008183a3117dfcb2b8343daac09d7d25d4ab1c6ab65416bcab43b1207e05b8d9)
            check_type(argname="argument cookies", value=cookies, expected_type=typing.Tuple[type_hints["cookies"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestCookieBehavior", jsii.sinvoke(cls, "denyList", [*cookies]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "OriginRequestCookieBehavior":
        '''Cookies in viewer requests are not included in requests that CloudFront sends to the origin.

        Any cookies that are listed in a CachePolicy are still included in origin requests.
        '''
        return typing.cast("OriginRequestCookieBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''The behavior of cookies: allow all, none or an allow list.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="cookies")
    def cookies(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The cookies to allow, if the behavior is an allow list.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "cookies"))


class OriginRequestHeaderBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginRequestHeaderBehavior",
):
    '''Determines whether any HTTP headers (and if so, which headers) are included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom origin request policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_origin_request_policy = cloudfront.OriginRequestPolicy(self, "OriginRequestPolicy",
            origin_request_policy_name="MyPolicy",
            comment="A default policy",
            cookie_behavior=cloudfront.OriginRequestCookieBehavior.none(),
            header_behavior=cloudfront.OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"),
            query_string_behavior=cloudfront.OriginRequestQueryStringBehavior.allow_list("username")
        )
        
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                origin_request_policy=my_origin_request_policy
            )
        )
    '''

    @jsii.member(jsii_name="all")
    @builtins.classmethod
    def all(cls, *cloudfront_headers: builtins.str) -> "OriginRequestHeaderBehavior":
        '''All HTTP headers in viewer requests are included in requests that CloudFront sends to the origin.

        Additionally, any additional CloudFront headers provided are included; the additional headers are added by CloudFront.

        :param cloudfront_headers: -

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-cloudfront-headers.html
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__383fa7ac6f385ddef1c437636060592a64c46b8ecd239de2282032e4802d8152)
            check_type(argname="argument cloudfront_headers", value=cloudfront_headers, expected_type=typing.Tuple[type_hints["cloudfront_headers"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestHeaderBehavior", jsii.sinvoke(cls, "all", [*cloudfront_headers]))

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(cls, *headers: builtins.str) -> "OriginRequestHeaderBehavior":
        '''Listed headers are included in requests that CloudFront sends to the origin.

        :param headers: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0af46524a400348290f2dd406a74c3cfdfcd0b98f3d7c390ac3a1c5b20289b4b)
            check_type(argname="argument headers", value=headers, expected_type=typing.Tuple[type_hints["headers"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestHeaderBehavior", jsii.sinvoke(cls, "allowList", [*headers]))

    @jsii.member(jsii_name="denyList")
    @builtins.classmethod
    def deny_list(cls, *headers: builtins.str) -> "OriginRequestHeaderBehavior":
        '''All headers except the provided ``headers`` are included in requests that CloudFront sends to the origin.

        :param headers: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55c517b4712d259617472c7499bb2235cadb05a92ed299020d86e1bd9760c3a0)
            check_type(argname="argument headers", value=headers, expected_type=typing.Tuple[type_hints["headers"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestHeaderBehavior", jsii.sinvoke(cls, "denyList", [*headers]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "OriginRequestHeaderBehavior":
        '''HTTP headers are not included in requests that CloudFront sends to the origin.

        Any headers that are listed in a CachePolicy are still included in origin requests.
        '''
        return typing.cast("OriginRequestHeaderBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''The behavior of headers: allow all, none or an allow list.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="headers")
    def headers(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The headers for the allow list or the included CloudFront headers, if applicable.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "headers"))


@jsii.implements(IOriginRequestPolicy)
class OriginRequestPolicy(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginRequestPolicy",
):
    '''A Origin Request Policy configuration.

    :resource: AWS::CloudFront::OriginRequestPolicy
    :exampleMetadata: infused

    Example::

        # Using an existing origin request policy for a Distribution
        # bucket_origin: origins.S3Origin
        
        cloudfront.Distribution(self, "myDistManagedPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                origin_request_policy=cloudfront.OriginRequestPolicy.CORS_S3_ORIGIN
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        comment: typing.Optional[builtins.str] = None,
        cookie_behavior: typing.Optional[OriginRequestCookieBehavior] = None,
        header_behavior: typing.Optional[OriginRequestHeaderBehavior] = None,
        origin_request_policy_name: typing.Optional[builtins.str] = None,
        query_string_behavior: typing.Optional["OriginRequestQueryStringBehavior"] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param comment: A comment to describe the origin request policy. Default: - no comment
        :param cookie_behavior: The cookies from viewer requests to include in origin requests. Default: OriginRequestCookieBehavior.none()
        :param header_behavior: The HTTP headers to include in origin requests. These can include headers from viewer requests and additional headers added by CloudFront. Default: OriginRequestHeaderBehavior.none()
        :param origin_request_policy_name: A unique name to identify the origin request policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
        :param query_string_behavior: The URL query strings from viewer requests to include in origin requests. Default: OriginRequestQueryStringBehavior.none()
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e885e7a4a9115b26e667d3ce393d00a2544e4dd8e14aaebede3dc44cc5529950)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = OriginRequestPolicyProps(
            comment=comment,
            cookie_behavior=cookie_behavior,
            header_behavior=header_behavior,
            origin_request_policy_name=origin_request_policy_name,
            query_string_behavior=query_string_behavior,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromOriginRequestPolicyId")
    @builtins.classmethod
    def from_origin_request_policy_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        origin_request_policy_id: builtins.str,
    ) -> IOriginRequestPolicy:
        '''Imports a Origin Request Policy from its id.

        :param scope: -
        :param id: -
        :param origin_request_policy_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43549cc88635c871acbe8816f79b9a3ef446fc5c8ed521dbbc6da0ccd90054f5)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument origin_request_policy_id", value=origin_request_policy_id, expected_type=type_hints["origin_request_policy_id"])
        return typing.cast(IOriginRequestPolicy, jsii.sinvoke(cls, "fromOriginRequestPolicyId", [scope, id, origin_request_policy_id]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALL_VIEWER")
    def ALL_VIEWER(cls) -> IOriginRequestPolicy:
        '''This policy includes all values (query strings, headers, and cookies) in the viewer request.'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "ALL_VIEWER"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALL_VIEWER_AND_CLOUDFRONT_2022")
    def ALL_VIEWER_AND_CLOUDFRONT_2022(cls) -> IOriginRequestPolicy:
        '''This policy includes all values (headers, cookies, and query strings) in the viewer request, and all CloudFront headers that were released through June 2022 (CloudFront headers released after June 2022 are not included).'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "ALL_VIEWER_AND_CLOUDFRONT_2022"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ALL_VIEWER_EXCEPT_HOST_HEADER")
    def ALL_VIEWER_EXCEPT_HOST_HEADER(cls) -> IOriginRequestPolicy:
        '''This policy includes all values (query strings, and cookies) except the header in the viewer request.'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "ALL_VIEWER_EXCEPT_HOST_HEADER"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_CUSTOM_ORIGIN")
    def CORS_CUSTOM_ORIGIN(cls) -> IOriginRequestPolicy:
        '''This policy includes the header that enables cross-origin resource sharing (CORS) requests when the origin is a custom origin.'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "CORS_CUSTOM_ORIGIN"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_S3_ORIGIN")
    def CORS_S3_ORIGIN(cls) -> IOriginRequestPolicy:
        '''This policy includes the headers that enable cross-origin resource sharing (CORS) requests when the origin is an Amazon S3 bucket.'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "CORS_S3_ORIGIN"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ELEMENTAL_MEDIA_TAILOR")
    def ELEMENTAL_MEDIA_TAILOR(cls) -> IOriginRequestPolicy:
        '''This policy is designed for use with an origin that is an AWS Elemental MediaTailor endpoint.'''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "ELEMENTAL_MEDIA_TAILOR"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="USER_AGENT_REFERER_HEADERS")
    def USER_AGENT_REFERER_HEADERS(cls) -> IOriginRequestPolicy:
        '''This policy includes only the User-Agent and Referer headers.

        It doesn’t include any query strings or cookies.
        '''
        return typing.cast(IOriginRequestPolicy, jsii.sget(cls, "USER_AGENT_REFERER_HEADERS"))

    @builtins.property
    @jsii.member(jsii_name="originRequestPolicyId")
    def origin_request_policy_id(self) -> builtins.str:
        '''The ID of the origin request policy.'''
        return typing.cast(builtins.str, jsii.get(self, "originRequestPolicyId"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginRequestPolicyProps",
    jsii_struct_bases=[],
    name_mapping={
        "comment": "comment",
        "cookie_behavior": "cookieBehavior",
        "header_behavior": "headerBehavior",
        "origin_request_policy_name": "originRequestPolicyName",
        "query_string_behavior": "queryStringBehavior",
    },
)
class OriginRequestPolicyProps:
    def __init__(
        self,
        *,
        comment: typing.Optional[builtins.str] = None,
        cookie_behavior: typing.Optional[OriginRequestCookieBehavior] = None,
        header_behavior: typing.Optional[OriginRequestHeaderBehavior] = None,
        origin_request_policy_name: typing.Optional[builtins.str] = None,
        query_string_behavior: typing.Optional["OriginRequestQueryStringBehavior"] = None,
    ) -> None:
        '''Properties for creating a Origin Request Policy.

        :param comment: A comment to describe the origin request policy. Default: - no comment
        :param cookie_behavior: The cookies from viewer requests to include in origin requests. Default: OriginRequestCookieBehavior.none()
        :param header_behavior: The HTTP headers to include in origin requests. These can include headers from viewer requests and additional headers added by CloudFront. Default: OriginRequestHeaderBehavior.none()
        :param origin_request_policy_name: A unique name to identify the origin request policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
        :param query_string_behavior: The URL query strings from viewer requests to include in origin requests. Default: OriginRequestQueryStringBehavior.none()

        :exampleMetadata: infused

        Example::

            # Creating a custom origin request policy for a Distribution -- all parameters optional
            # bucket_origin: origins.S3Origin
            
            my_origin_request_policy = cloudfront.OriginRequestPolicy(self, "OriginRequestPolicy",
                origin_request_policy_name="MyPolicy",
                comment="A default policy",
                cookie_behavior=cloudfront.OriginRequestCookieBehavior.none(),
                header_behavior=cloudfront.OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"),
                query_string_behavior=cloudfront.OriginRequestQueryStringBehavior.allow_list("username")
            )
            
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    origin_request_policy=my_origin_request_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec4f66fbb29fda8f3270c9ee4c3640dc9a5ecda29289597df21d4e0b71e23b68)
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument cookie_behavior", value=cookie_behavior, expected_type=type_hints["cookie_behavior"])
            check_type(argname="argument header_behavior", value=header_behavior, expected_type=type_hints["header_behavior"])
            check_type(argname="argument origin_request_policy_name", value=origin_request_policy_name, expected_type=type_hints["origin_request_policy_name"])
            check_type(argname="argument query_string_behavior", value=query_string_behavior, expected_type=type_hints["query_string_behavior"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if comment is not None:
            self._values["comment"] = comment
        if cookie_behavior is not None:
            self._values["cookie_behavior"] = cookie_behavior
        if header_behavior is not None:
            self._values["header_behavior"] = header_behavior
        if origin_request_policy_name is not None:
            self._values["origin_request_policy_name"] = origin_request_policy_name
        if query_string_behavior is not None:
            self._values["query_string_behavior"] = query_string_behavior

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the origin request policy.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def cookie_behavior(self) -> typing.Optional[OriginRequestCookieBehavior]:
        '''The cookies from viewer requests to include in origin requests.

        :default: OriginRequestCookieBehavior.none()
        '''
        result = self._values.get("cookie_behavior")
        return typing.cast(typing.Optional[OriginRequestCookieBehavior], result)

    @builtins.property
    def header_behavior(self) -> typing.Optional[OriginRequestHeaderBehavior]:
        '''The HTTP headers to include in origin requests.

        These can include headers from viewer requests and additional headers added by CloudFront.

        :default: OriginRequestHeaderBehavior.none()
        '''
        result = self._values.get("header_behavior")
        return typing.cast(typing.Optional[OriginRequestHeaderBehavior], result)

    @builtins.property
    def origin_request_policy_name(self) -> typing.Optional[builtins.str]:
        '''A unique name to identify the origin request policy.

        The name must only include '-', '_', or alphanumeric characters.

        :default: - generated from the ``id``
        '''
        result = self._values.get("origin_request_policy_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def query_string_behavior(
        self,
    ) -> typing.Optional["OriginRequestQueryStringBehavior"]:
        '''The URL query strings from viewer requests to include in origin requests.

        :default: OriginRequestQueryStringBehavior.none()
        '''
        result = self._values.get("query_string_behavior")
        return typing.cast(typing.Optional["OriginRequestQueryStringBehavior"], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "OriginRequestPolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class OriginRequestQueryStringBehavior(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.OriginRequestQueryStringBehavior",
):
    '''Determines whether any URL query strings in viewer requests (and if so, which query strings) are included in requests that CloudFront sends to the origin.

    :exampleMetadata: infused

    Example::

        # Creating a custom origin request policy for a Distribution -- all parameters optional
        # bucket_origin: origins.S3Origin
        
        my_origin_request_policy = cloudfront.OriginRequestPolicy(self, "OriginRequestPolicy",
            origin_request_policy_name="MyPolicy",
            comment="A default policy",
            cookie_behavior=cloudfront.OriginRequestCookieBehavior.none(),
            header_behavior=cloudfront.OriginRequestHeaderBehavior.all("CloudFront-Is-Android-Viewer"),
            query_string_behavior=cloudfront.OriginRequestQueryStringBehavior.allow_list("username")
        )
        
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                origin_request_policy=my_origin_request_policy
            )
        )
    '''

    @jsii.member(jsii_name="all")
    @builtins.classmethod
    def all(cls) -> "OriginRequestQueryStringBehavior":
        '''All query strings in viewer requests are included in requests that CloudFront sends to the origin.'''
        return typing.cast("OriginRequestQueryStringBehavior", jsii.sinvoke(cls, "all", []))

    @jsii.member(jsii_name="allowList")
    @builtins.classmethod
    def allow_list(
        cls,
        *query_strings: builtins.str,
    ) -> "OriginRequestQueryStringBehavior":
        '''Only the provided ``queryStrings`` are included in requests that CloudFront sends to the origin.

        :param query_strings: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae451ad3ac09bf0211b7d5e644b3be2e95ca44931114c00853e0c41d4c9f6390)
            check_type(argname="argument query_strings", value=query_strings, expected_type=typing.Tuple[type_hints["query_strings"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestQueryStringBehavior", jsii.sinvoke(cls, "allowList", [*query_strings]))

    @jsii.member(jsii_name="denyList")
    @builtins.classmethod
    def deny_list(
        cls,
        *query_strings: builtins.str,
    ) -> "OriginRequestQueryStringBehavior":
        '''All query strings except the provided ``queryStrings`` are included in requests that CloudFront sends to the origin.

        :param query_strings: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcd8f6960f4da45cf3ffe6621991313b5539701d2536df92c50a213e97e2d673)
            check_type(argname="argument query_strings", value=query_strings, expected_type=typing.Tuple[type_hints["query_strings"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("OriginRequestQueryStringBehavior", jsii.sinvoke(cls, "denyList", [*query_strings]))

    @jsii.member(jsii_name="none")
    @builtins.classmethod
    def none(cls) -> "OriginRequestQueryStringBehavior":
        '''Query strings in viewer requests are not included in requests that CloudFront sends to the origin.

        Any query strings that are listed in a CachePolicy are still included in origin requests.
        '''
        return typing.cast("OriginRequestQueryStringBehavior", jsii.sinvoke(cls, "none", []))

    @builtins.property
    @jsii.member(jsii_name="behavior")
    def behavior(self) -> builtins.str:
        '''The behavior of query strings -- allow all, none, or only an allow list.'''
        return typing.cast(builtins.str, jsii.get(self, "behavior"))

    @builtins.property
    @jsii.member(jsii_name="queryStrings")
    def query_strings(self) -> typing.Optional[typing.List[builtins.str]]:
        '''The query strings to allow, if the behavior is an allow list.'''
        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "queryStrings"))


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.OriginSslPolicy")
class OriginSslPolicy(enum.Enum):
    SSL_V3 = "SSL_V3"
    TLS_V1 = "TLS_V1"
    TLS_V1_1 = "TLS_V1_1"
    TLS_V1_2 = "TLS_V1_2"


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.PriceClass")
class PriceClass(enum.Enum):
    '''The price class determines how many edge locations CloudFront will use for your distribution.

    See https://aws.amazon.com/cloudfront/pricing/ for full list of supported regions.
    '''

    PRICE_CLASS_100 = "PRICE_CLASS_100"
    '''USA, Canada, Europe, & Israel.'''
    PRICE_CLASS_200 = "PRICE_CLASS_200"
    '''PRICE_CLASS_100 + South Africa, Kenya, Middle East, Japan, Singapore, South Korea, Taiwan, Hong Kong, & Philippines.'''
    PRICE_CLASS_ALL = "PRICE_CLASS_ALL"
    '''All locations.'''


@jsii.implements(IPublicKey)
class PublicKey(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.PublicKey",
):
    '''A Public Key Configuration.

    :resource: AWS::CloudFront::PublicKey
    :exampleMetadata: infused

    Example::

        # Validating signed URLs or signed cookies with Trusted Key Groups
        
        # public key in PEM format
        # public_key: str
        
        pub_key = cloudfront.PublicKey(self, "MyPubKey",
            encoded_key=public_key
        )
        
        key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
            items=[pub_key
            ]
        )
        
        cloudfront.Distribution(self, "Dist",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.HttpOrigin("www.example.com"),
                trusted_key_groups=[key_group
                ]
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        encoded_key: builtins.str,
        comment: typing.Optional[builtins.str] = None,
        public_key_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param encoded_key: The public key that you can use with signed URLs and signed cookies, or with field-level encryption. The ``encodedKey`` parameter must include ``-----BEGIN PUBLIC KEY-----`` and ``-----END PUBLIC KEY-----`` lines.
        :param comment: A comment to describe the public key. Default: - no comment
        :param public_key_name: A name to identify the public key. Default: - generated from the ``id``
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e1d5b018505383d83a9bcf1d71da4d03e20b34d63a8072edc955897c86bd396)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = PublicKeyProps(
            encoded_key=encoded_key, comment=comment, public_key_name=public_key_name
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromPublicKeyId")
    @builtins.classmethod
    def from_public_key_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        public_key_id: builtins.str,
    ) -> IPublicKey:
        '''Imports a Public Key from its id.

        :param scope: -
        :param id: -
        :param public_key_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a372140d57e306c95e0eac7dc64ba363242f34dddada8274869ba6733360f7c3)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument public_key_id", value=public_key_id, expected_type=type_hints["public_key_id"])
        return typing.cast(IPublicKey, jsii.sinvoke(cls, "fromPublicKeyId", [scope, id, public_key_id]))

    @builtins.property
    @jsii.member(jsii_name="publicKeyId")
    def public_key_id(self) -> builtins.str:
        '''The ID of the key group.'''
        return typing.cast(builtins.str, jsii.get(self, "publicKeyId"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.PublicKeyProps",
    jsii_struct_bases=[],
    name_mapping={
        "encoded_key": "encodedKey",
        "comment": "comment",
        "public_key_name": "publicKeyName",
    },
)
class PublicKeyProps:
    def __init__(
        self,
        *,
        encoded_key: builtins.str,
        comment: typing.Optional[builtins.str] = None,
        public_key_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties for creating a Public Key.

        :param encoded_key: The public key that you can use with signed URLs and signed cookies, or with field-level encryption. The ``encodedKey`` parameter must include ``-----BEGIN PUBLIC KEY-----`` and ``-----END PUBLIC KEY-----`` lines.
        :param comment: A comment to describe the public key. Default: - no comment
        :param public_key_name: A name to identify the public key. Default: - generated from the ``id``

        :exampleMetadata: infused

        Example::

            # Validating signed URLs or signed cookies with Trusted Key Groups
            
            # public key in PEM format
            # public_key: str
            
            pub_key = cloudfront.PublicKey(self, "MyPubKey",
                encoded_key=public_key
            )
            
            key_group = cloudfront.KeyGroup(self, "MyKeyGroup",
                items=[pub_key
                ]
            )
            
            cloudfront.Distribution(self, "Dist",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.HttpOrigin("www.example.com"),
                    trusted_key_groups=[key_group
                    ]
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab6d6a7ffe806c347a4fbac3b890074d407fcf2dd19c1ca56da8ddc83cb3ad61)
            check_type(argname="argument encoded_key", value=encoded_key, expected_type=type_hints["encoded_key"])
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument public_key_name", value=public_key_name, expected_type=type_hints["public_key_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "encoded_key": encoded_key,
        }
        if comment is not None:
            self._values["comment"] = comment
        if public_key_name is not None:
            self._values["public_key_name"] = public_key_name

    @builtins.property
    def encoded_key(self) -> builtins.str:
        '''The public key that you can use with signed URLs and signed cookies, or with field-level encryption.

        The ``encodedKey`` parameter must include ``-----BEGIN PUBLIC KEY-----`` and ``-----END PUBLIC KEY-----`` lines.

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html
        '''
        result = self._values.get("encoded_key")
        assert result is not None, "Required property 'encoded_key' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the public key.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def public_key_name(self) -> typing.Optional[builtins.str]:
        '''A name to identify the public key.

        :default: - generated from the ``id``
        '''
        result = self._values.get("public_key_name")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "PublicKeyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(IRealtimeLogConfig)
class RealtimeLogConfig(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.RealtimeLogConfig",
):
    '''A Realtime Log Config configuration.

    :resource: AWS::CloudFront::RealtimeLogConfig
    :exampleMetadata: infused

    Example::

        # Adding realtime logs config to a Cloudfront Distribution on default behavior.
        import aws_cdk.aws_kinesis as kinesis
        
        # stream: kinesis.Stream
        
        
        real_time_config = cloudfront.RealtimeLogConfig(self, "realtimeLog",
            end_points=[
                cloudfront.Endpoint.from_kinesis_stream(stream)
            ],
            fields=["timestamp", "c-ip", "time-to-first-byte", "sc-status"
            ],
            realtime_log_config_name="my-delivery-stream",
            sampling_rate=100
        )
        
        cloudfront.Distribution(self, "myCdn",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.HttpOrigin("www.example.com"),
                realtime_log_config=real_time_config
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        end_points: typing.Sequence[Endpoint],
        fields: typing.Sequence[builtins.str],
        sampling_rate: jsii.Number,
        realtime_log_config_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param end_points: Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
        :param fields: A list of fields that are included in each real-time log record.
        :param sampling_rate: The sampling rate for this real-time log configuration.
        :param realtime_log_config_name: The unique name of this real-time log configuration. Default: - the unique construct ID
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b962b5c5a537a691dd467162db6671972caadd6e84b4764e913417754964503)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = RealtimeLogConfigProps(
            end_points=end_points,
            fields=fields,
            sampling_rate=sampling_rate,
            realtime_log_config_name=realtime_log_config_name,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigArn")
    def realtime_log_config_arn(self) -> builtins.str:
        '''The arn of the realtime log config.'''
        return typing.cast(builtins.str, jsii.get(self, "realtimeLogConfigArn"))

    @builtins.property
    @jsii.member(jsii_name="realtimeLogConfigName")
    def realtime_log_config_name(self) -> builtins.str:
        '''The name of the realtime log config.'''
        return typing.cast(builtins.str, jsii.get(self, "realtimeLogConfigName"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.RealtimeLogConfigProps",
    jsii_struct_bases=[],
    name_mapping={
        "end_points": "endPoints",
        "fields": "fields",
        "sampling_rate": "samplingRate",
        "realtime_log_config_name": "realtimeLogConfigName",
    },
)
class RealtimeLogConfigProps:
    def __init__(
        self,
        *,
        end_points: typing.Sequence[Endpoint],
        fields: typing.Sequence[builtins.str],
        sampling_rate: jsii.Number,
        realtime_log_config_name: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Properties for defining a RealtimeLogConfig resource.

        :param end_points: Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.
        :param fields: A list of fields that are included in each real-time log record.
        :param sampling_rate: The sampling rate for this real-time log configuration.
        :param realtime_log_config_name: The unique name of this real-time log configuration. Default: - the unique construct ID

        :exampleMetadata: infused

        Example::

            # Adding realtime logs config to a Cloudfront Distribution on default behavior.
            import aws_cdk.aws_kinesis as kinesis
            
            # stream: kinesis.Stream
            
            
            real_time_config = cloudfront.RealtimeLogConfig(self, "realtimeLog",
                end_points=[
                    cloudfront.Endpoint.from_kinesis_stream(stream)
                ],
                fields=["timestamp", "c-ip", "time-to-first-byte", "sc-status"
                ],
                realtime_log_config_name="my-delivery-stream",
                sampling_rate=100
            )
            
            cloudfront.Distribution(self, "myCdn",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=origins.HttpOrigin("www.example.com"),
                    realtime_log_config=real_time_config
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b859af3e83837e7af12d51c04e73c677e6547a840cf0007c8eb70ab1c6f3e5c8)
            check_type(argname="argument end_points", value=end_points, expected_type=type_hints["end_points"])
            check_type(argname="argument fields", value=fields, expected_type=type_hints["fields"])
            check_type(argname="argument sampling_rate", value=sampling_rate, expected_type=type_hints["sampling_rate"])
            check_type(argname="argument realtime_log_config_name", value=realtime_log_config_name, expected_type=type_hints["realtime_log_config_name"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "end_points": end_points,
            "fields": fields,
            "sampling_rate": sampling_rate,
        }
        if realtime_log_config_name is not None:
            self._values["realtime_log_config_name"] = realtime_log_config_name

    @builtins.property
    def end_points(self) -> typing.List[Endpoint]:
        '''Contains information about the Amazon Kinesis data stream where you are sending real-time log data for this real-time log configuration.'''
        result = self._values.get("end_points")
        assert result is not None, "Required property 'end_points' is missing"
        return typing.cast(typing.List[Endpoint], result)

    @builtins.property
    def fields(self) -> typing.List[builtins.str]:
        '''A list of fields that are included in each real-time log record.

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-fields
        '''
        result = self._values.get("fields")
        assert result is not None, "Required property 'fields' is missing"
        return typing.cast(typing.List[builtins.str], result)

    @builtins.property
    def sampling_rate(self) -> jsii.Number:
        '''The sampling rate for this real-time log configuration.'''
        result = self._values.get("sampling_rate")
        assert result is not None, "Required property 'sampling_rate' is missing"
        return typing.cast(jsii.Number, result)

    @builtins.property
    def realtime_log_config_name(self) -> typing.Optional[builtins.str]:
        '''The unique name of this real-time log configuration.

        :default: - the unique construct ID
        '''
        result = self._values.get("realtime_log_config_name")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "RealtimeLogConfigProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseCustomHeader",
    jsii_struct_bases=[],
    name_mapping={"header": "header", "override": "override", "value": "value"},
)
class ResponseCustomHeader:
    def __init__(
        self,
        *,
        header: builtins.str,
        override: builtins.bool,
        value: builtins.str,
    ) -> None:
        '''An HTTP response header name and its value.

        CloudFront includes this header in HTTP responses that it sends for requests that match a cache behavior that’s associated with this response headers policy.

        :param header: The HTTP response header name.
        :param override: A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.
        :param value: The value for the HTTP response header.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            from aws_cdk import aws_cloudfront as cloudfront
            
            response_custom_header = cloudfront.ResponseCustomHeader(
                header="header",
                override=False,
                value="value"
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f01a1d404d8a9d35e0fe277e7119cfd36cf5184ed0930085a67855baa85b7a91)
            check_type(argname="argument header", value=header, expected_type=type_hints["header"])
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "header": header,
            "override": override,
            "value": value,
        }

    @builtins.property
    def header(self) -> builtins.str:
        '''The HTTP response header name.'''
        result = self._values.get("header")
        assert result is not None, "Required property 'header' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides a response header with the same name received from the origin with the header specified here.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def value(self) -> builtins.str:
        '''The value for the HTTP response header.'''
        result = self._values.get("value")
        assert result is not None, "Required property 'value' is missing"
        return typing.cast(builtins.str, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseCustomHeader(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseCustomHeadersBehavior",
    jsii_struct_bases=[],
    name_mapping={"custom_headers": "customHeaders"},
)
class ResponseCustomHeadersBehavior:
    def __init__(
        self,
        *,
        custom_headers: typing.Sequence[typing.Union[ResponseCustomHeader, typing.Dict[builtins.str, typing.Any]]],
    ) -> None:
        '''Configuration for a set of HTTP response headers that are sent for requests that match a cache behavior that’s associated with this response headers policy.

        :param custom_headers: The list of HTTP response headers and their values.

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5f578d45a3fe9e583b5a9e8f6718db9250923e8cdfee2a4ab5acc14ec9050e9)
            check_type(argname="argument custom_headers", value=custom_headers, expected_type=type_hints["custom_headers"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "custom_headers": custom_headers,
        }

    @builtins.property
    def custom_headers(self) -> typing.List[ResponseCustomHeader]:
        '''The list of HTTP response headers and their values.'''
        result = self._values.get("custom_headers")
        assert result is not None, "Required property 'custom_headers' is missing"
        return typing.cast(typing.List[ResponseCustomHeader], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseCustomHeadersBehavior(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersContentSecurityPolicy",
    jsii_struct_bases=[],
    name_mapping={
        "content_security_policy": "contentSecurityPolicy",
        "override": "override",
    },
)
class ResponseHeadersContentSecurityPolicy:
    def __init__(
        self,
        *,
        content_security_policy: builtins.str,
        override: builtins.bool,
    ) -> None:
        '''The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.

        :param content_security_policy: The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.
        :param override: A Boolean that determines whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37103032f6e1589582f3aeddcec6e717b2d9eaeb0b89c98cd14f096380c0dd71)
            check_type(argname="argument content_security_policy", value=content_security_policy, expected_type=type_hints["content_security_policy"])
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "content_security_policy": content_security_policy,
            "override": override,
        }

    @builtins.property
    def content_security_policy(self) -> builtins.str:
        '''The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.'''
        result = self._values.get("content_security_policy")
        assert result is not None, "Required property 'content_security_policy' is missing"
        return typing.cast(builtins.str, result)

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the Content-Security-Policy HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersContentSecurityPolicy(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersContentTypeOptions",
    jsii_struct_bases=[],
    name_mapping={"override": "override"},
)
class ResponseHeadersContentTypeOptions:
    def __init__(self, *, override: builtins.bool) -> None:
        '''Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.

        :param override: A Boolean that determines whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd25d891e1639c1e6b6acd944b8462cdd1f9935eabd50612051ac11b640fab48)
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "override": override,
        }

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the X-Content-Type-Options HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersContentTypeOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersCorsBehavior",
    jsii_struct_bases=[],
    name_mapping={
        "access_control_allow_credentials": "accessControlAllowCredentials",
        "access_control_allow_headers": "accessControlAllowHeaders",
        "access_control_allow_methods": "accessControlAllowMethods",
        "access_control_allow_origins": "accessControlAllowOrigins",
        "origin_override": "originOverride",
        "access_control_expose_headers": "accessControlExposeHeaders",
        "access_control_max_age": "accessControlMaxAge",
    },
)
class ResponseHeadersCorsBehavior:
    def __init__(
        self,
        *,
        access_control_allow_credentials: builtins.bool,
        access_control_allow_headers: typing.Sequence[builtins.str],
        access_control_allow_methods: typing.Sequence[builtins.str],
        access_control_allow_origins: typing.Sequence[builtins.str],
        origin_override: builtins.bool,
        access_control_expose_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
        access_control_max_age: typing.Optional[_Duration_4839e8c3] = None,
    ) -> None:
        '''Configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

        CloudFront adds these headers to HTTP responses that it sends for CORS requests that match a cache behavior
        associated with this response headers policy.

        :param access_control_allow_credentials: A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.
        :param access_control_allow_headers: A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header. You can specify ``['*']`` to allow all headers.
        :param access_control_allow_methods: A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.
        :param access_control_allow_origins: A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header. You can specify ``['*']`` to allow all origins.
        :param origin_override: A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.
        :param access_control_expose_headers: A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header. You can specify ``['*']`` to expose all headers. Default: - no headers exposed
        :param access_control_max_age: A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header. Default: - no max age

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f4355d3e23f2ae161fa57983ee96962f26612012f7f6471bd872191d94c2877)
            check_type(argname="argument access_control_allow_credentials", value=access_control_allow_credentials, expected_type=type_hints["access_control_allow_credentials"])
            check_type(argname="argument access_control_allow_headers", value=access_control_allow_headers, expected_type=type_hints["access_control_allow_headers"])
            check_type(argname="argument access_control_allow_methods", value=access_control_allow_methods, expected_type=type_hints["access_control_allow_methods"])
            check_type(argname="argument access_control_allow_origins", value=access_control_allow_origins, expected_type=type_hints["access_control_allow_origins"])
            check_type(argname="argument origin_override", value=origin_override, expected_type=type_hints["origin_override"])
            check_type(argname="argument access_control_expose_headers", value=access_control_expose_headers, expected_type=type_hints["access_control_expose_headers"])
            check_type(argname="argument access_control_max_age", value=access_control_max_age, expected_type=type_hints["access_control_max_age"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "access_control_allow_credentials": access_control_allow_credentials,
            "access_control_allow_headers": access_control_allow_headers,
            "access_control_allow_methods": access_control_allow_methods,
            "access_control_allow_origins": access_control_allow_origins,
            "origin_override": origin_override,
        }
        if access_control_expose_headers is not None:
            self._values["access_control_expose_headers"] = access_control_expose_headers
        if access_control_max_age is not None:
            self._values["access_control_max_age"] = access_control_max_age

    @builtins.property
    def access_control_allow_credentials(self) -> builtins.bool:
        '''A Boolean that CloudFront uses as the value for the Access-Control-Allow-Credentials HTTP response header.'''
        result = self._values.get("access_control_allow_credentials")
        assert result is not None, "Required property 'access_control_allow_credentials' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def access_control_allow_headers(self) -> typing.List[builtins.str]:
        '''A list of HTTP header names that CloudFront includes as values for the Access-Control-Allow-Headers HTTP response header.

        You can specify ``['*']`` to allow all headers.
        '''
        result = self._values.get("access_control_allow_headers")
        assert result is not None, "Required property 'access_control_allow_headers' is missing"
        return typing.cast(typing.List[builtins.str], result)

    @builtins.property
    def access_control_allow_methods(self) -> typing.List[builtins.str]:
        '''A list of HTTP methods that CloudFront includes as values for the Access-Control-Allow-Methods HTTP response header.'''
        result = self._values.get("access_control_allow_methods")
        assert result is not None, "Required property 'access_control_allow_methods' is missing"
        return typing.cast(typing.List[builtins.str], result)

    @builtins.property
    def access_control_allow_origins(self) -> typing.List[builtins.str]:
        '''A list of origins (domain names) that CloudFront can use as the value for the Access-Control-Allow-Origin HTTP response header.

        You can specify ``['*']`` to allow all origins.
        '''
        result = self._values.get("access_control_allow_origins")
        assert result is not None, "Required property 'access_control_allow_origins' is missing"
        return typing.cast(typing.List[builtins.str], result)

    @builtins.property
    def origin_override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides HTTP response headers received from the origin with the ones specified in this response headers policy.'''
        result = self._values.get("origin_override")
        assert result is not None, "Required property 'origin_override' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def access_control_expose_headers(
        self,
    ) -> typing.Optional[typing.List[builtins.str]]:
        '''A list of HTTP headers that CloudFront includes as values for the Access-Control-Expose-Headers HTTP response header.

        You can specify ``['*']`` to expose all headers.

        :default: - no headers exposed
        '''
        result = self._values.get("access_control_expose_headers")
        return typing.cast(typing.Optional[typing.List[builtins.str]], result)

    @builtins.property
    def access_control_max_age(self) -> typing.Optional[_Duration_4839e8c3]:
        '''A number that CloudFront uses as the value for the Access-Control-Max-Age HTTP response header.

        :default: - no max age
        '''
        result = self._values.get("access_control_max_age")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersCorsBehavior(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersFrameOptions",
    jsii_struct_bases=[],
    name_mapping={"frame_option": "frameOption", "override": "override"},
)
class ResponseHeadersFrameOptions:
    def __init__(
        self,
        *,
        frame_option: HeadersFrameOption,
        override: builtins.bool,
    ) -> None:
        '''Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.

        :param frame_option: The value of the X-Frame-Options HTTP response header.
        :param override: A Boolean that determines whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83e225184728062d9c6c7e8fe86cceff0ee3e7086aaa9dc988904e6d36bee0b5)
            check_type(argname="argument frame_option", value=frame_option, expected_type=type_hints["frame_option"])
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "frame_option": frame_option,
            "override": override,
        }

    @builtins.property
    def frame_option(self) -> HeadersFrameOption:
        '''The value of the X-Frame-Options HTTP response header.'''
        result = self._values.get("frame_option")
        assert result is not None, "Required property 'frame_option' is missing"
        return typing.cast(HeadersFrameOption, result)

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the X-Frame-Options HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersFrameOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.implements(IResponseHeadersPolicy)
class ResponseHeadersPolicy(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersPolicy",
):
    '''A Response Headers Policy configuration.

    :resource: AWS::CloudFront::ResponseHeadersPolicy
    :exampleMetadata: infused

    Example::

        # Using an existing managed response headers policy
        # bucket_origin: origins.S3Origin
        
        cloudfront.Distribution(self, "myDistManagedPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
            )
        )
        
        # Creating a custom response headers policy -- all parameters optional
        my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
            response_headers_policy_name="MyPolicy",
            comment="A default policy",
            cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                access_control_allow_credentials=False,
                access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_allow_methods=["GET", "POST"],
                access_control_allow_origins=["*"],
                access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                access_control_max_age=Duration.seconds(600),
                origin_override=True
            ),
            custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                ]
            ),
            security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
            ),
            remove_headers=["Server"],
            server_timing_sampling_rate=50
        )
        cloudfront.Distribution(self, "myDistCustomPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                response_headers_policy=my_response_headers_policy
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        comment: typing.Optional[builtins.str] = None,
        cors_behavior: typing.Optional[typing.Union[ResponseHeadersCorsBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
        custom_headers_behavior: typing.Optional[typing.Union[ResponseCustomHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
        remove_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
        response_headers_policy_name: typing.Optional[builtins.str] = None,
        security_headers_behavior: typing.Optional[typing.Union["ResponseSecurityHeadersBehavior", typing.Dict[builtins.str, typing.Any]]] = None,
        server_timing_sampling_rate: typing.Optional[jsii.Number] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param comment: A comment to describe the response headers policy. Default: - no comment
        :param cors_behavior: A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS). Default: - no cors behavior
        :param custom_headers_behavior: A configuration for a set of custom HTTP response headers. Default: - no custom headers behavior
        :param remove_headers: A list of HTTP response headers that CloudFront removes from HTTP responses that it sends to viewers. Default: - no headers are removed
        :param response_headers_policy_name: A unique name to identify the response headers policy. Default: - generated from the ``id``
        :param security_headers_behavior: A configuration for a set of security-related HTTP response headers. Default: - no security headers behavior
        :param server_timing_sampling_rate: The percentage of responses that you want CloudFront to add the Server-Timing header to. Default: - no Server-Timing header is added to HTTP responses
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c65e59c990466ba6d4cec24189c57194f1b1e938661cabbf5af2857c7792a28)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = ResponseHeadersPolicyProps(
            comment=comment,
            cors_behavior=cors_behavior,
            custom_headers_behavior=custom_headers_behavior,
            remove_headers=remove_headers,
            response_headers_policy_name=response_headers_policy_name,
            security_headers_behavior=security_headers_behavior,
            server_timing_sampling_rate=server_timing_sampling_rate,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromResponseHeadersPolicyId")
    @builtins.classmethod
    def from_response_headers_policy_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        response_headers_policy_id: builtins.str,
    ) -> IResponseHeadersPolicy:
        '''Import an existing Response Headers Policy from its ID.

        :param scope: -
        :param id: -
        :param response_headers_policy_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f630acbadbe2836493eb85c732b26b45500ee90f2504a40128321ee2efab7603)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument response_headers_policy_id", value=response_headers_policy_id, expected_type=type_hints["response_headers_policy_id"])
        return typing.cast(IResponseHeadersPolicy, jsii.sinvoke(cls, "fromResponseHeadersPolicyId", [scope, id, response_headers_policy_id]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_ALLOW_ALL_ORIGINS")
    def CORS_ALLOW_ALL_ORIGINS(cls) -> IResponseHeadersPolicy:
        '''Use this managed policy to allow simple CORS requests from any origin.'''
        return typing.cast(IResponseHeadersPolicy, jsii.sget(cls, "CORS_ALLOW_ALL_ORIGINS"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_ALLOW_ALL_ORIGINS_AND_SECURITY_HEADERS")
    def CORS_ALLOW_ALL_ORIGINS_AND_SECURITY_HEADERS(cls) -> IResponseHeadersPolicy:
        '''Use this managed policy to allow simple CORS requests from any origin and add a set of security headers to all responses that CloudFront sends to viewers.'''
        return typing.cast(IResponseHeadersPolicy, jsii.sget(cls, "CORS_ALLOW_ALL_ORIGINS_AND_SECURITY_HEADERS"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT")
    def CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT(cls) -> IResponseHeadersPolicy:
        '''Use this managed policy to allow CORS requests from any origin, including preflight requests.'''
        return typing.cast(IResponseHeadersPolicy, jsii.sget(cls, "CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS")
    def CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS(
        cls,
    ) -> IResponseHeadersPolicy:
        '''Use this managed policy to allow CORS requests from any origin, including preflight requests, and add a set of security headers to all responses that CloudFront sends to viewers.'''
        return typing.cast(IResponseHeadersPolicy, jsii.sget(cls, "CORS_ALLOW_ALL_ORIGINS_WITH_PREFLIGHT_AND_SECURITY_HEADERS"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="SECURITY_HEADERS")
    def SECURITY_HEADERS(cls) -> IResponseHeadersPolicy:
        '''Use this managed policy to add a set of security headers to all responses that CloudFront sends to viewers.'''
        return typing.cast(IResponseHeadersPolicy, jsii.sget(cls, "SECURITY_HEADERS"))

    @builtins.property
    @jsii.member(jsii_name="responseHeadersPolicyId")
    def response_headers_policy_id(self) -> builtins.str:
        '''The ID of the response headers policy.'''
        return typing.cast(builtins.str, jsii.get(self, "responseHeadersPolicyId"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersPolicyProps",
    jsii_struct_bases=[],
    name_mapping={
        "comment": "comment",
        "cors_behavior": "corsBehavior",
        "custom_headers_behavior": "customHeadersBehavior",
        "remove_headers": "removeHeaders",
        "response_headers_policy_name": "responseHeadersPolicyName",
        "security_headers_behavior": "securityHeadersBehavior",
        "server_timing_sampling_rate": "serverTimingSamplingRate",
    },
)
class ResponseHeadersPolicyProps:
    def __init__(
        self,
        *,
        comment: typing.Optional[builtins.str] = None,
        cors_behavior: typing.Optional[typing.Union[ResponseHeadersCorsBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
        custom_headers_behavior: typing.Optional[typing.Union[ResponseCustomHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
        remove_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
        response_headers_policy_name: typing.Optional[builtins.str] = None,
        security_headers_behavior: typing.Optional[typing.Union["ResponseSecurityHeadersBehavior", typing.Dict[builtins.str, typing.Any]]] = None,
        server_timing_sampling_rate: typing.Optional[jsii.Number] = None,
    ) -> None:
        '''Properties for creating a Response Headers Policy.

        :param comment: A comment to describe the response headers policy. Default: - no comment
        :param cors_behavior: A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS). Default: - no cors behavior
        :param custom_headers_behavior: A configuration for a set of custom HTTP response headers. Default: - no custom headers behavior
        :param remove_headers: A list of HTTP response headers that CloudFront removes from HTTP responses that it sends to viewers. Default: - no headers are removed
        :param response_headers_policy_name: A unique name to identify the response headers policy. Default: - generated from the ``id``
        :param security_headers_behavior: A configuration for a set of security-related HTTP response headers. Default: - no security headers behavior
        :param server_timing_sampling_rate: The percentage of responses that you want CloudFront to add the Server-Timing header to. Default: - no Server-Timing header is added to HTTP responses

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if isinstance(cors_behavior, dict):
            cors_behavior = ResponseHeadersCorsBehavior(**cors_behavior)
        if isinstance(custom_headers_behavior, dict):
            custom_headers_behavior = ResponseCustomHeadersBehavior(**custom_headers_behavior)
        if isinstance(security_headers_behavior, dict):
            security_headers_behavior = ResponseSecurityHeadersBehavior(**security_headers_behavior)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48943f3f237f42c21c68643192917fbc6413eb95efd05d29e67aa66b75613c59)
            check_type(argname="argument comment", value=comment, expected_type=type_hints["comment"])
            check_type(argname="argument cors_behavior", value=cors_behavior, expected_type=type_hints["cors_behavior"])
            check_type(argname="argument custom_headers_behavior", value=custom_headers_behavior, expected_type=type_hints["custom_headers_behavior"])
            check_type(argname="argument remove_headers", value=remove_headers, expected_type=type_hints["remove_headers"])
            check_type(argname="argument response_headers_policy_name", value=response_headers_policy_name, expected_type=type_hints["response_headers_policy_name"])
            check_type(argname="argument security_headers_behavior", value=security_headers_behavior, expected_type=type_hints["security_headers_behavior"])
            check_type(argname="argument server_timing_sampling_rate", value=server_timing_sampling_rate, expected_type=type_hints["server_timing_sampling_rate"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if comment is not None:
            self._values["comment"] = comment
        if cors_behavior is not None:
            self._values["cors_behavior"] = cors_behavior
        if custom_headers_behavior is not None:
            self._values["custom_headers_behavior"] = custom_headers_behavior
        if remove_headers is not None:
            self._values["remove_headers"] = remove_headers
        if response_headers_policy_name is not None:
            self._values["response_headers_policy_name"] = response_headers_policy_name
        if security_headers_behavior is not None:
            self._values["security_headers_behavior"] = security_headers_behavior
        if server_timing_sampling_rate is not None:
            self._values["server_timing_sampling_rate"] = server_timing_sampling_rate

    @builtins.property
    def comment(self) -> typing.Optional[builtins.str]:
        '''A comment to describe the response headers policy.

        :default: - no comment
        '''
        result = self._values.get("comment")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def cors_behavior(self) -> typing.Optional[ResponseHeadersCorsBehavior]:
        '''A configuration for a set of HTTP response headers that are used for cross-origin resource sharing (CORS).

        :default: - no cors behavior
        '''
        result = self._values.get("cors_behavior")
        return typing.cast(typing.Optional[ResponseHeadersCorsBehavior], result)

    @builtins.property
    def custom_headers_behavior(self) -> typing.Optional[ResponseCustomHeadersBehavior]:
        '''A configuration for a set of custom HTTP response headers.

        :default: - no custom headers behavior
        '''
        result = self._values.get("custom_headers_behavior")
        return typing.cast(typing.Optional[ResponseCustomHeadersBehavior], result)

    @builtins.property
    def remove_headers(self) -> typing.Optional[typing.List[builtins.str]]:
        '''A list of HTTP response headers that CloudFront removes from HTTP responses that it sends to viewers.

        :default: - no headers are removed
        '''
        result = self._values.get("remove_headers")
        return typing.cast(typing.Optional[typing.List[builtins.str]], result)

    @builtins.property
    def response_headers_policy_name(self) -> typing.Optional[builtins.str]:
        '''A unique name to identify the response headers policy.

        :default: - generated from the ``id``
        '''
        result = self._values.get("response_headers_policy_name")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def security_headers_behavior(
        self,
    ) -> typing.Optional["ResponseSecurityHeadersBehavior"]:
        '''A configuration for a set of security-related HTTP response headers.

        :default: - no security headers behavior
        '''
        result = self._values.get("security_headers_behavior")
        return typing.cast(typing.Optional["ResponseSecurityHeadersBehavior"], result)

    @builtins.property
    def server_timing_sampling_rate(self) -> typing.Optional[jsii.Number]:
        '''The percentage of responses that you want CloudFront to add the Server-Timing header to.

        :default: - no Server-Timing header is added to HTTP responses
        '''
        result = self._values.get("server_timing_sampling_rate")
        return typing.cast(typing.Optional[jsii.Number], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersPolicyProps(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersReferrerPolicy",
    jsii_struct_bases=[],
    name_mapping={"override": "override", "referrer_policy": "referrerPolicy"},
)
class ResponseHeadersReferrerPolicy:
    def __init__(
        self,
        *,
        override: builtins.bool,
        referrer_policy: HeadersReferrerPolicy,
    ) -> None:
        '''Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.

        :param override: A Boolean that determines whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.
        :param referrer_policy: The value of the Referrer-Policy HTTP response header.

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__514cc47069ac611c2eda37493d652269b1b116a5ce59d515a9a8bfbcdd5eac3e)
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            check_type(argname="argument referrer_policy", value=referrer_policy, expected_type=type_hints["referrer_policy"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "override": override,
            "referrer_policy": referrer_policy,
        }

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the Referrer-Policy HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def referrer_policy(self) -> HeadersReferrerPolicy:
        '''The value of the Referrer-Policy HTTP response header.'''
        result = self._values.get("referrer_policy")
        assert result is not None, "Required property 'referrer_policy' is missing"
        return typing.cast(HeadersReferrerPolicy, result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersReferrerPolicy(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersStrictTransportSecurity",
    jsii_struct_bases=[],
    name_mapping={
        "access_control_max_age": "accessControlMaxAge",
        "override": "override",
        "include_subdomains": "includeSubdomains",
        "preload": "preload",
    },
)
class ResponseHeadersStrictTransportSecurity:
    def __init__(
        self,
        *,
        access_control_max_age: _Duration_4839e8c3,
        override: builtins.bool,
        include_subdomains: typing.Optional[builtins.bool] = None,
        preload: typing.Optional[builtins.bool] = None,
    ) -> None:
        '''Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.

        :param access_control_max_age: A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.
        :param override: A Boolean that determines whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.
        :param include_subdomains: A Boolean that determines whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header. Default: false
        :param preload: A Boolean that determines whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header. Default: false

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4e0940acf2339cf3a07ca9ffe31acdd52a17c3e42a2acb8b4ef0bc3cc040c9c)
            check_type(argname="argument access_control_max_age", value=access_control_max_age, expected_type=type_hints["access_control_max_age"])
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            check_type(argname="argument include_subdomains", value=include_subdomains, expected_type=type_hints["include_subdomains"])
            check_type(argname="argument preload", value=preload, expected_type=type_hints["preload"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "access_control_max_age": access_control_max_age,
            "override": override,
        }
        if include_subdomains is not None:
            self._values["include_subdomains"] = include_subdomains
        if preload is not None:
            self._values["preload"] = preload

    @builtins.property
    def access_control_max_age(self) -> _Duration_4839e8c3:
        '''A number that CloudFront uses as the value for the max-age directive in the Strict-Transport-Security HTTP response header.'''
        result = self._values.get("access_control_max_age")
        assert result is not None, "Required property 'access_control_max_age' is missing"
        return typing.cast(_Duration_4839e8c3, result)

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the Strict-Transport-Security HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def include_subdomains(self) -> typing.Optional[builtins.bool]:
        '''A Boolean that determines whether CloudFront includes the includeSubDomains directive in the Strict-Transport-Security HTTP response header.

        :default: false
        '''
        result = self._values.get("include_subdomains")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def preload(self) -> typing.Optional[builtins.bool]:
        '''A Boolean that determines whether CloudFront includes the preload directive in the Strict-Transport-Security HTTP response header.

        :default: false
        '''
        result = self._values.get("preload")
        return typing.cast(typing.Optional[builtins.bool], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersStrictTransportSecurity(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseHeadersXSSProtection",
    jsii_struct_bases=[],
    name_mapping={
        "override": "override",
        "protection": "protection",
        "mode_block": "modeBlock",
        "report_uri": "reportUri",
    },
)
class ResponseHeadersXSSProtection:
    def __init__(
        self,
        *,
        override: builtins.bool,
        protection: builtins.bool,
        mode_block: typing.Optional[builtins.bool] = None,
        report_uri: typing.Optional[builtins.str] = None,
    ) -> None:
        '''Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.

        :param override: A Boolean that determines whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.
        :param protection: A Boolean that determines the value of the X-XSS-Protection HTTP response header. When this setting is true, the value of the X-XSS-Protection header is 1. When this setting is false, the value of the X-XSS-Protection header is 0.
        :param mode_block: A Boolean that determines whether CloudFront includes the mode=block directive in the X-XSS-Protection header. Default: false
        :param report_uri: A reporting URI, which CloudFront uses as the value of the report directive in the X-XSS-Protection header. You cannot specify a ReportUri when ModeBlock is true. Default: - no report uri

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a62858b9d5373489e0c3429f2d59585f609b67bc76b59bf4f3a65ddd5742febc)
            check_type(argname="argument override", value=override, expected_type=type_hints["override"])
            check_type(argname="argument protection", value=protection, expected_type=type_hints["protection"])
            check_type(argname="argument mode_block", value=mode_block, expected_type=type_hints["mode_block"])
            check_type(argname="argument report_uri", value=report_uri, expected_type=type_hints["report_uri"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "override": override,
            "protection": protection,
        }
        if mode_block is not None:
            self._values["mode_block"] = mode_block
        if report_uri is not None:
            self._values["report_uri"] = report_uri

    @builtins.property
    def override(self) -> builtins.bool:
        '''A Boolean that determines whether CloudFront overrides the X-XSS-Protection HTTP response header received from the origin with the one specified in this response headers policy.'''
        result = self._values.get("override")
        assert result is not None, "Required property 'override' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def protection(self) -> builtins.bool:
        '''A Boolean that determines the value of the X-XSS-Protection HTTP response header.

        When this setting is true, the value of the X-XSS-Protection header is 1.
        When this setting is false, the value of the X-XSS-Protection header is 0.
        '''
        result = self._values.get("protection")
        assert result is not None, "Required property 'protection' is missing"
        return typing.cast(builtins.bool, result)

    @builtins.property
    def mode_block(self) -> typing.Optional[builtins.bool]:
        '''A Boolean that determines whether CloudFront includes the mode=block directive in the X-XSS-Protection header.

        :default: false
        '''
        result = self._values.get("mode_block")
        return typing.cast(typing.Optional[builtins.bool], result)

    @builtins.property
    def report_uri(self) -> typing.Optional[builtins.str]:
        '''A reporting URI, which CloudFront uses as the value of the report directive in the X-XSS-Protection header.

        You cannot specify a ReportUri when ModeBlock is true.

        :default: - no report uri
        '''
        result = self._values.get("report_uri")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseHeadersXSSProtection(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ResponseSecurityHeadersBehavior",
    jsii_struct_bases=[],
    name_mapping={
        "content_security_policy": "contentSecurityPolicy",
        "content_type_options": "contentTypeOptions",
        "frame_options": "frameOptions",
        "referrer_policy": "referrerPolicy",
        "strict_transport_security": "strictTransportSecurity",
        "xss_protection": "xssProtection",
    },
)
class ResponseSecurityHeadersBehavior:
    def __init__(
        self,
        *,
        content_security_policy: typing.Optional[typing.Union[ResponseHeadersContentSecurityPolicy, typing.Dict[builtins.str, typing.Any]]] = None,
        content_type_options: typing.Optional[typing.Union[ResponseHeadersContentTypeOptions, typing.Dict[builtins.str, typing.Any]]] = None,
        frame_options: typing.Optional[typing.Union[ResponseHeadersFrameOptions, typing.Dict[builtins.str, typing.Any]]] = None,
        referrer_policy: typing.Optional[typing.Union[ResponseHeadersReferrerPolicy, typing.Dict[builtins.str, typing.Any]]] = None,
        strict_transport_security: typing.Optional[typing.Union[ResponseHeadersStrictTransportSecurity, typing.Dict[builtins.str, typing.Any]]] = None,
        xss_protection: typing.Optional[typing.Union[ResponseHeadersXSSProtection, typing.Dict[builtins.str, typing.Any]]] = None,
    ) -> None:
        '''Configuration for a set of security-related HTTP response headers.

        CloudFront adds these headers to HTTP responses that it sends for requests that match a cache behavior
        associated with this response headers policy.

        :param content_security_policy: The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header. Default: - no content security policy
        :param content_type_options: Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff. Default: - no content type options
        :param frame_options: Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value. Default: - no frame options
        :param referrer_policy: Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value. Default: - no referrer policy
        :param strict_transport_security: Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value. Default: - no strict transport security
        :param xss_protection: Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value. Default: - no xss protection

        :exampleMetadata: infused

        Example::

            # Using an existing managed response headers policy
            # bucket_origin: origins.S3Origin
            
            cloudfront.Distribution(self, "myDistManagedPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=cloudfront.ResponseHeadersPolicy.CORS_ALLOW_ALL_ORIGINS
                )
            )
            
            # Creating a custom response headers policy -- all parameters optional
            my_response_headers_policy = cloudfront.ResponseHeadersPolicy(self, "ResponseHeadersPolicy",
                response_headers_policy_name="MyPolicy",
                comment="A default policy",
                cors_behavior=cloudfront.ResponseHeadersCorsBehavior(
                    access_control_allow_credentials=False,
                    access_control_allow_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_allow_methods=["GET", "POST"],
                    access_control_allow_origins=["*"],
                    access_control_expose_headers=["X-Custom-Header-1", "X-Custom-Header-2"],
                    access_control_max_age=Duration.seconds(600),
                    origin_override=True
                ),
                custom_headers_behavior=cloudfront.ResponseCustomHeadersBehavior(
                    custom_headers=[cloudfront.ResponseCustomHeader(header="X-Amz-Date", value="some-value", override=True), cloudfront.ResponseCustomHeader(header="X-Amz-Security-Token", value="some-value", override=False)
                    ]
                ),
                security_headers_behavior=cloudfront.ResponseSecurityHeadersBehavior(
                    content_security_policy=cloudfront.ResponseHeadersContentSecurityPolicy(content_security_policy="default-src https:;", override=True),
                    content_type_options=cloudfront.ResponseHeadersContentTypeOptions(override=True),
                    frame_options=cloudfront.ResponseHeadersFrameOptions(frame_option=cloudfront.HeadersFrameOption.DENY, override=True),
                    referrer_policy=cloudfront.ResponseHeadersReferrerPolicy(referrer_policy=cloudfront.HeadersReferrerPolicy.NO_REFERRER, override=True),
                    strict_transport_security=cloudfront.ResponseHeadersStrictTransportSecurity(access_control_max_age=Duration.seconds(600), include_subdomains=True, override=True),
                    xss_protection=cloudfront.ResponseHeadersXSSProtection(protection=True, mode_block=True, report_uri="https://example.com/csp-report", override=True)
                ),
                remove_headers=["Server"],
                server_timing_sampling_rate=50
            )
            cloudfront.Distribution(self, "myDistCustomPolicy",
                default_behavior=cloudfront.BehaviorOptions(
                    origin=bucket_origin,
                    response_headers_policy=my_response_headers_policy
                )
            )
        '''
        if isinstance(content_security_policy, dict):
            content_security_policy = ResponseHeadersContentSecurityPolicy(**content_security_policy)
        if isinstance(content_type_options, dict):
            content_type_options = ResponseHeadersContentTypeOptions(**content_type_options)
        if isinstance(frame_options, dict):
            frame_options = ResponseHeadersFrameOptions(**frame_options)
        if isinstance(referrer_policy, dict):
            referrer_policy = ResponseHeadersReferrerPolicy(**referrer_policy)
        if isinstance(strict_transport_security, dict):
            strict_transport_security = ResponseHeadersStrictTransportSecurity(**strict_transport_security)
        if isinstance(xss_protection, dict):
            xss_protection = ResponseHeadersXSSProtection(**xss_protection)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb11968ba35df78b776ef4a98fdb6f7be69c1246b510ef919ab61befd9939553)
            check_type(argname="argument content_security_policy", value=content_security_policy, expected_type=type_hints["content_security_policy"])
            check_type(argname="argument content_type_options", value=content_type_options, expected_type=type_hints["content_type_options"])
            check_type(argname="argument frame_options", value=frame_options, expected_type=type_hints["frame_options"])
            check_type(argname="argument referrer_policy", value=referrer_policy, expected_type=type_hints["referrer_policy"])
            check_type(argname="argument strict_transport_security", value=strict_transport_security, expected_type=type_hints["strict_transport_security"])
            check_type(argname="argument xss_protection", value=xss_protection, expected_type=type_hints["xss_protection"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if content_security_policy is not None:
            self._values["content_security_policy"] = content_security_policy
        if content_type_options is not None:
            self._values["content_type_options"] = content_type_options
        if frame_options is not None:
            self._values["frame_options"] = frame_options
        if referrer_policy is not None:
            self._values["referrer_policy"] = referrer_policy
        if strict_transport_security is not None:
            self._values["strict_transport_security"] = strict_transport_security
        if xss_protection is not None:
            self._values["xss_protection"] = xss_protection

    @builtins.property
    def content_security_policy(
        self,
    ) -> typing.Optional[ResponseHeadersContentSecurityPolicy]:
        '''The policy directives and their values that CloudFront includes as values for the Content-Security-Policy HTTP response header.

        :default: - no content security policy
        '''
        result = self._values.get("content_security_policy")
        return typing.cast(typing.Optional[ResponseHeadersContentSecurityPolicy], result)

    @builtins.property
    def content_type_options(
        self,
    ) -> typing.Optional[ResponseHeadersContentTypeOptions]:
        '''Determines whether CloudFront includes the X-Content-Type-Options HTTP response header with its value set to nosniff.

        :default: - no content type options
        '''
        result = self._values.get("content_type_options")
        return typing.cast(typing.Optional[ResponseHeadersContentTypeOptions], result)

    @builtins.property
    def frame_options(self) -> typing.Optional[ResponseHeadersFrameOptions]:
        '''Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header’s value.

        :default: - no frame options
        '''
        result = self._values.get("frame_options")
        return typing.cast(typing.Optional[ResponseHeadersFrameOptions], result)

    @builtins.property
    def referrer_policy(self) -> typing.Optional[ResponseHeadersReferrerPolicy]:
        '''Determines whether CloudFront includes the Referrer-Policy HTTP response header and the header’s value.

        :default: - no referrer policy
        '''
        result = self._values.get("referrer_policy")
        return typing.cast(typing.Optional[ResponseHeadersReferrerPolicy], result)

    @builtins.property
    def strict_transport_security(
        self,
    ) -> typing.Optional[ResponseHeadersStrictTransportSecurity]:
        '''Determines whether CloudFront includes the Strict-Transport-Security HTTP response header and the header’s value.

        :default: - no strict transport security
        '''
        result = self._values.get("strict_transport_security")
        return typing.cast(typing.Optional[ResponseHeadersStrictTransportSecurity], result)

    @builtins.property
    def xss_protection(self) -> typing.Optional[ResponseHeadersXSSProtection]:
        '''Determines whether CloudFront includes the X-XSS-Protection HTTP response header and the header’s value.

        :default: - no xss protection
        '''
        result = self._values.get("xss_protection")
        return typing.cast(typing.Optional[ResponseHeadersXSSProtection], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResponseSecurityHeadersBehavior(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class S3ImportSource(
    ImportSource,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.S3ImportSource",
):
    '''An import source from an S3 object.

    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        from aws_cdk import aws_cloudfront as cloudfront
        from aws_cdk import aws_s3 as s3
        
        # bucket: s3.Bucket
        
        s3_import_source = cloudfront.S3ImportSource(bucket, "key")
    '''

    def __init__(self, bucket: _IBucket_42e086fd, key: builtins.str) -> None:
        '''
        :param bucket: the S3 bucket that contains the data.
        :param key: the key within the S3 bucket that contains the data.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50b2e52880076ae956da5eb2d05fa8de1161eb1b2df762d8dafbf8e6bbfa4639)
            check_type(argname="argument bucket", value=bucket, expected_type=type_hints["bucket"])
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
        jsii.create(self.__class__, self, [bucket, key])

    @builtins.property
    @jsii.member(jsii_name="bucket")
    def bucket(self) -> _IBucket_42e086fd:
        '''the S3 bucket that contains the data.'''
        return typing.cast(_IBucket_42e086fd, jsii.get(self, "bucket"))

    @builtins.property
    @jsii.member(jsii_name="key")
    def key(self) -> builtins.str:
        '''the key within the S3 bucket that contains the data.'''
        return typing.cast(builtins.str, jsii.get(self, "key"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.S3OriginConfig",
    jsii_struct_bases=[],
    name_mapping={
        "s3_bucket_source": "s3BucketSource",
        "origin_access_identity": "originAccessIdentity",
        "origin_headers": "originHeaders",
        "origin_path": "originPath",
        "origin_shield_region": "originShieldRegion",
    },
)
class S3OriginConfig:
    def __init__(
        self,
        *,
        s3_bucket_source: _IBucket_42e086fd,
        origin_access_identity: typing.Optional[IOriginAccessIdentity] = None,
        origin_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        origin_path: typing.Optional[builtins.str] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
    ) -> None:
        '''S3 origin configuration for CloudFront.

        :param s3_bucket_source: The source bucket to serve content from.
        :param origin_access_identity: The optional Origin Access Identity of the origin identity cloudfront will use when calling your s3 bucket. Default: No Origin Access Identity which requires the S3 bucket to be public accessible
        :param origin_headers: Any additional headers to pass to the origin. Default: - No additional headers are passed.
        :param origin_path: The relative path to the origin root to use for sources. Default: /
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled

        :exampleMetadata: infused

        Example::

            # source_bucket: s3.Bucket
            
            viewer_certificate = cloudfront.ViewerCertificate.from_iam_certificate("MYIAMROLEIDENTIFIER",
                aliases=["MYALIAS"]
            )
            
            cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
                origin_configs=[cloudfront.SourceConfiguration(
                    s3_origin_source=cloudfront.S3OriginConfig(
                        s3_bucket_source=source_bucket
                    ),
                    behaviors=[cloudfront.Behavior(is_default_behavior=True)]
                )
                ],
                viewer_certificate=viewer_certificate
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e5837aa017bcf235e169321284a6cfe3cd3ac7b3c0baef0d9b68b55e8da518be)
            check_type(argname="argument s3_bucket_source", value=s3_bucket_source, expected_type=type_hints["s3_bucket_source"])
            check_type(argname="argument origin_access_identity", value=origin_access_identity, expected_type=type_hints["origin_access_identity"])
            check_type(argname="argument origin_headers", value=origin_headers, expected_type=type_hints["origin_headers"])
            check_type(argname="argument origin_path", value=origin_path, expected_type=type_hints["origin_path"])
            check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "s3_bucket_source": s3_bucket_source,
        }
        if origin_access_identity is not None:
            self._values["origin_access_identity"] = origin_access_identity
        if origin_headers is not None:
            self._values["origin_headers"] = origin_headers
        if origin_path is not None:
            self._values["origin_path"] = origin_path
        if origin_shield_region is not None:
            self._values["origin_shield_region"] = origin_shield_region

    @builtins.property
    def s3_bucket_source(self) -> _IBucket_42e086fd:
        '''The source bucket to serve content from.'''
        result = self._values.get("s3_bucket_source")
        assert result is not None, "Required property 's3_bucket_source' is missing"
        return typing.cast(_IBucket_42e086fd, result)

    @builtins.property
    def origin_access_identity(self) -> typing.Optional[IOriginAccessIdentity]:
        '''The optional Origin Access Identity of the origin identity cloudfront will use when calling your s3 bucket.

        :default: No Origin Access Identity which requires the S3 bucket to be public accessible
        '''
        result = self._values.get("origin_access_identity")
        return typing.cast(typing.Optional[IOriginAccessIdentity], result)

    @builtins.property
    def origin_headers(
        self,
    ) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
        '''Any additional headers to pass to the origin.

        :default: - No additional headers are passed.
        '''
        result = self._values.get("origin_headers")
        return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)

    @builtins.property
    def origin_path(self) -> typing.Optional[builtins.str]:
        '''The relative path to the origin root to use for sources.

        :default: /
        '''
        result = self._values.get("origin_path")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def origin_shield_region(self) -> typing.Optional[builtins.str]:
        '''When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

        :default: - origin shield not enabled
        '''
        result = self._values.get("origin_shield_region")
        return typing.cast(typing.Optional[builtins.str], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "S3OriginConfig(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.SSLMethod")
class SSLMethod(enum.Enum):
    '''The SSL method CloudFront will use for your distribution.

    Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates
    which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present
    multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites
    (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

    CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support.

    If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for
    using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP).

    See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/

    :exampleMetadata: lit=aws-cloudfront/test/example.iam-cert-alias.lit.ts infused

    Example::

        s3_bucket_source = s3.Bucket(self, "Bucket")
        
        distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
            origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
                behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
            )],
            viewer_certificate=cloudfront.ViewerCertificate.from_iam_certificate("certificateId",
                aliases=["example.com"],
                security_policy=cloudfront.SecurityPolicyProtocol.SSL_V3,  # default
                ssl_method=cloudfront.SSLMethod.SNI
            )
        )
    '''

    SNI = "SNI"
    VIP = "VIP"


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.SecurityPolicyProtocol")
class SecurityPolicyProtocol(enum.Enum):
    '''The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

    CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify.

    :exampleMetadata: lit=aws-cloudfront/test/example.iam-cert-alias.lit.ts infused

    Example::

        s3_bucket_source = s3.Bucket(self, "Bucket")
        
        distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
            origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
                behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
            )],
            viewer_certificate=cloudfront.ViewerCertificate.from_iam_certificate("certificateId",
                aliases=["example.com"],
                security_policy=cloudfront.SecurityPolicyProtocol.SSL_V3,  # default
                ssl_method=cloudfront.SSLMethod.SNI
            )
        )
    '''

    SSL_V3 = "SSL_V3"
    TLS_V1 = "TLS_V1"
    TLS_V1_2016 = "TLS_V1_2016"
    TLS_V1_1_2016 = "TLS_V1_1_2016"
    TLS_V1_2_2018 = "TLS_V1_2_2018"
    TLS_V1_2_2019 = "TLS_V1_2_2019"
    TLS_V1_2_2021 = "TLS_V1_2_2021"


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.SourceConfiguration",
    jsii_struct_bases=[],
    name_mapping={
        "behaviors": "behaviors",
        "connection_attempts": "connectionAttempts",
        "connection_timeout": "connectionTimeout",
        "custom_origin_source": "customOriginSource",
        "failover_criteria_status_codes": "failoverCriteriaStatusCodes",
        "failover_custom_origin_source": "failoverCustomOriginSource",
        "failover_s3_origin_source": "failoverS3OriginSource",
        "origin_shield_region": "originShieldRegion",
        "s3_origin_source": "s3OriginSource",
    },
)
class SourceConfiguration:
    def __init__(
        self,
        *,
        behaviors: typing.Sequence[typing.Union[Behavior, typing.Dict[builtins.str, typing.Any]]],
        connection_attempts: typing.Optional[jsii.Number] = None,
        connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
        custom_origin_source: typing.Optional[typing.Union[CustomOriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
        failover_criteria_status_codes: typing.Optional[typing.Sequence[FailoverStatusCode]] = None,
        failover_custom_origin_source: typing.Optional[typing.Union[CustomOriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
        failover_s3_origin_source: typing.Optional[typing.Union[S3OriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
        origin_shield_region: typing.Optional[builtins.str] = None,
        s3_origin_source: typing.Optional[typing.Union[S3OriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
    ) -> None:
        '''A source configuration is a wrapper for CloudFront origins and behaviors.

        An origin is what CloudFront will "be in front of" - that is, CloudFront will pull it's assets from an origin.

        If you're using s3 as a source - pass the ``s3Origin`` property, otherwise, pass the ``customOriginSource`` property.

        One or the other must be passed, and it is invalid to pass both in the same SourceConfiguration.

        :param behaviors: The behaviors associated with this source. At least one (default) behavior must be included.
        :param connection_attempts: The number of times that CloudFront attempts to connect to the origin. You can specify 1, 2, or 3 as the number of attempts. Default: 3
        :param connection_timeout: The number of seconds that CloudFront waits when trying to establish a connection to the origin. You can specify a number of seconds between 1 and 10 (inclusive). Default: cdk.Duration.seconds(10)
        :param custom_origin_source: A custom origin source - for all non-s3 sources.
        :param failover_criteria_status_codes: HTTP status code to failover to second origin. Default: [500, 502, 503, 504]
        :param failover_custom_origin_source: A custom origin source for failover in case the s3OriginSource returns invalid status code. Default: - no failover configuration
        :param failover_s3_origin_source: An s3 origin source for failover in case the s3OriginSource returns invalid status code. Default: - no failover configuration
        :param origin_shield_region: When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance. Default: - origin shield not enabled
        :param s3_origin_source: An s3 origin source - if you're using s3 for your assets.

        :exampleMetadata: fixture=_generated

        Example::

            # The code below shows an example of how to instantiate this type.
            # The values are placeholders you should change.
            import aws_cdk as cdk
            from aws_cdk import aws_cloudfront as cloudfront
            from aws_cdk import aws_lambda as lambda_
            from aws_cdk import aws_s3 as s3
            
            # bucket: s3.Bucket
            # function_: cloudfront.Function
            # key_group: cloudfront.KeyGroup
            # origin_access_identity: cloudfront.OriginAccessIdentity
            # version: lambda.Version
            
            source_configuration = cloudfront.SourceConfiguration(
                behaviors=[cloudfront.Behavior(
                    allowed_methods=cloudfront.CloudFrontAllowedMethods.GET_HEAD,
                    cached_methods=cloudfront.CloudFrontAllowedCachedMethods.GET_HEAD,
                    compress=False,
                    default_ttl=cdk.Duration.minutes(30),
                    forwarded_values=cloudfront.CfnDistribution.ForwardedValuesProperty(
                        query_string=False,
            
                        # the properties below are optional
                        cookies=cloudfront.CfnDistribution.CookiesProperty(
                            forward="forward",
            
                            # the properties below are optional
                            whitelisted_names=["whitelistedNames"]
                        ),
                        headers=["headers"],
                        query_string_cache_keys=["queryStringCacheKeys"]
                    ),
                    function_associations=[cloudfront.FunctionAssociation(
                        event_type=cloudfront.FunctionEventType.VIEWER_REQUEST,
                        function=function_
                    )],
                    is_default_behavior=False,
                    lambda_function_associations=[cloudfront.LambdaFunctionAssociation(
                        event_type=cloudfront.LambdaEdgeEventType.ORIGIN_REQUEST,
                        lambda_function=version,
            
                        # the properties below are optional
                        include_body=False
                    )],
                    max_ttl=cdk.Duration.minutes(30),
                    min_ttl=cdk.Duration.minutes(30),
                    path_pattern="pathPattern",
                    trusted_key_groups=[key_group],
                    trusted_signers=["trustedSigners"],
                    viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.HTTPS_ONLY
                )],
            
                # the properties below are optional
                connection_attempts=123,
                connection_timeout=cdk.Duration.minutes(30),
                custom_origin_source=cloudfront.CustomOriginConfig(
                    domain_name="domainName",
            
                    # the properties below are optional
                    allowed_origin_sSLVersions=[cloudfront.OriginSslPolicy.SSL_V3],
                    http_port=123,
                    https_port=123,
                    origin_headers={
                        "origin_headers_key": "originHeaders"
                    },
                    origin_keepalive_timeout=cdk.Duration.minutes(30),
                    origin_path="originPath",
                    origin_protocol_policy=cloudfront.OriginProtocolPolicy.HTTP_ONLY,
                    origin_read_timeout=cdk.Duration.minutes(30),
                    origin_shield_region="originShieldRegion"
                ),
                failover_criteria_status_codes=[cloudfront.FailoverStatusCode.FORBIDDEN],
                failover_custom_origin_source=cloudfront.CustomOriginConfig(
                    domain_name="domainName",
            
                    # the properties below are optional
                    allowed_origin_sSLVersions=[cloudfront.OriginSslPolicy.SSL_V3],
                    http_port=123,
                    https_port=123,
                    origin_headers={
                        "origin_headers_key": "originHeaders"
                    },
                    origin_keepalive_timeout=cdk.Duration.minutes(30),
                    origin_path="originPath",
                    origin_protocol_policy=cloudfront.OriginProtocolPolicy.HTTP_ONLY,
                    origin_read_timeout=cdk.Duration.minutes(30),
                    origin_shield_region="originShieldRegion"
                ),
                failover_s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=bucket,
            
                    # the properties below are optional
                    origin_access_identity=origin_access_identity,
                    origin_headers={
                        "origin_headers_key": "originHeaders"
                    },
                    origin_path="originPath",
                    origin_shield_region="originShieldRegion"
                ),
                origin_shield_region="originShieldRegion",
                s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=bucket,
            
                    # the properties below are optional
                    origin_access_identity=origin_access_identity,
                    origin_headers={
                        "origin_headers_key": "originHeaders"
                    },
                    origin_path="originPath",
                    origin_shield_region="originShieldRegion"
                )
            )
        '''
        if isinstance(custom_origin_source, dict):
            custom_origin_source = CustomOriginConfig(**custom_origin_source)
        if isinstance(failover_custom_origin_source, dict):
            failover_custom_origin_source = CustomOriginConfig(**failover_custom_origin_source)
        if isinstance(failover_s3_origin_source, dict):
            failover_s3_origin_source = S3OriginConfig(**failover_s3_origin_source)
        if isinstance(s3_origin_source, dict):
            s3_origin_source = S3OriginConfig(**s3_origin_source)
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ccea0761c172529885c07d5e167927d1ae78b92776ef8b892c36faadf6bb0dce)
            check_type(argname="argument behaviors", value=behaviors, expected_type=type_hints["behaviors"])
            check_type(argname="argument connection_attempts", value=connection_attempts, expected_type=type_hints["connection_attempts"])
            check_type(argname="argument connection_timeout", value=connection_timeout, expected_type=type_hints["connection_timeout"])
            check_type(argname="argument custom_origin_source", value=custom_origin_source, expected_type=type_hints["custom_origin_source"])
            check_type(argname="argument failover_criteria_status_codes", value=failover_criteria_status_codes, expected_type=type_hints["failover_criteria_status_codes"])
            check_type(argname="argument failover_custom_origin_source", value=failover_custom_origin_source, expected_type=type_hints["failover_custom_origin_source"])
            check_type(argname="argument failover_s3_origin_source", value=failover_s3_origin_source, expected_type=type_hints["failover_s3_origin_source"])
            check_type(argname="argument origin_shield_region", value=origin_shield_region, expected_type=type_hints["origin_shield_region"])
            check_type(argname="argument s3_origin_source", value=s3_origin_source, expected_type=type_hints["s3_origin_source"])
        self._values: typing.Dict[builtins.str, typing.Any] = {
            "behaviors": behaviors,
        }
        if connection_attempts is not None:
            self._values["connection_attempts"] = connection_attempts
        if connection_timeout is not None:
            self._values["connection_timeout"] = connection_timeout
        if custom_origin_source is not None:
            self._values["custom_origin_source"] = custom_origin_source
        if failover_criteria_status_codes is not None:
            self._values["failover_criteria_status_codes"] = failover_criteria_status_codes
        if failover_custom_origin_source is not None:
            self._values["failover_custom_origin_source"] = failover_custom_origin_source
        if failover_s3_origin_source is not None:
            self._values["failover_s3_origin_source"] = failover_s3_origin_source
        if origin_shield_region is not None:
            self._values["origin_shield_region"] = origin_shield_region
        if s3_origin_source is not None:
            self._values["s3_origin_source"] = s3_origin_source

    @builtins.property
    def behaviors(self) -> typing.List[Behavior]:
        '''The behaviors associated with this source.

        At least one (default) behavior must be included.
        '''
        result = self._values.get("behaviors")
        assert result is not None, "Required property 'behaviors' is missing"
        return typing.cast(typing.List[Behavior], result)

    @builtins.property
    def connection_attempts(self) -> typing.Optional[jsii.Number]:
        '''The number of times that CloudFront attempts to connect to the origin.

        You can specify 1, 2, or 3 as the number of attempts.

        :default: 3
        '''
        result = self._values.get("connection_attempts")
        return typing.cast(typing.Optional[jsii.Number], result)

    @builtins.property
    def connection_timeout(self) -> typing.Optional[_Duration_4839e8c3]:
        '''The number of seconds that CloudFront waits when trying to establish a connection to the origin.

        You can specify a number of seconds between 1 and 10 (inclusive).

        :default: cdk.Duration.seconds(10)
        '''
        result = self._values.get("connection_timeout")
        return typing.cast(typing.Optional[_Duration_4839e8c3], result)

    @builtins.property
    def custom_origin_source(self) -> typing.Optional[CustomOriginConfig]:
        '''A custom origin source - for all non-s3 sources.'''
        result = self._values.get("custom_origin_source")
        return typing.cast(typing.Optional[CustomOriginConfig], result)

    @builtins.property
    def failover_criteria_status_codes(
        self,
    ) -> typing.Optional[typing.List[FailoverStatusCode]]:
        '''HTTP status code to failover to second origin.

        :default: [500, 502, 503, 504]
        '''
        result = self._values.get("failover_criteria_status_codes")
        return typing.cast(typing.Optional[typing.List[FailoverStatusCode]], result)

    @builtins.property
    def failover_custom_origin_source(self) -> typing.Optional[CustomOriginConfig]:
        '''A custom origin source for failover in case the s3OriginSource returns invalid status code.

        :default: - no failover configuration
        '''
        result = self._values.get("failover_custom_origin_source")
        return typing.cast(typing.Optional[CustomOriginConfig], result)

    @builtins.property
    def failover_s3_origin_source(self) -> typing.Optional[S3OriginConfig]:
        '''An s3 origin source for failover in case the s3OriginSource returns invalid status code.

        :default: - no failover configuration
        '''
        result = self._values.get("failover_s3_origin_source")
        return typing.cast(typing.Optional[S3OriginConfig], result)

    @builtins.property
    def origin_shield_region(self) -> typing.Optional[builtins.str]:
        '''When you enable Origin Shield in the AWS Region that has the lowest latency to your origin, you can get better network performance.

        :default: - origin shield not enabled

        :see: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html
        '''
        result = self._values.get("origin_shield_region")
        return typing.cast(typing.Optional[builtins.str], result)

    @builtins.property
    def s3_origin_source(self) -> typing.Optional[S3OriginConfig]:
        '''An s3 origin source - if you're using s3 for your assets.'''
        result = self._values.get("s3_origin_source")
        return typing.cast(typing.Optional[S3OriginConfig], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "SourceConfiguration(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class ViewerCertificate(
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.ViewerCertificate",
):
    '''Viewer certificate configuration class.

    :exampleMetadata: lit=aws-cloudfront/test/example.iam-cert-alias.lit.ts infused

    Example::

        s3_bucket_source = s3.Bucket(self, "Bucket")
        
        distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
            origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
                behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
            )],
            viewer_certificate=cloudfront.ViewerCertificate.from_iam_certificate("certificateId",
                aliases=["example.com"],
                security_policy=cloudfront.SecurityPolicyProtocol.SSL_V3,  # default
                ssl_method=cloudfront.SSLMethod.SNI
            )
        )
    '''

    @jsii.member(jsii_name="fromAcmCertificate")
    @builtins.classmethod
    def from_acm_certificate(
        cls,
        certificate: _ICertificate_c194c70b,
        *,
        aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
        security_policy: typing.Optional[SecurityPolicyProtocol] = None,
        ssl_method: typing.Optional[SSLMethod] = None,
    ) -> "ViewerCertificate":
        '''Generate an AWS Certificate Manager (ACM) viewer certificate configuration.

        :param certificate: AWS Certificate Manager (ACM) certificate. Your certificate must be located in the us-east-1 (US East (N. Virginia)) region to be accessed by CloudFront
        :param aliases: Domain names on the certificate (both main domain name and Subject Alternative names).
        :param security_policy: The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify. Default: - SSLv3 if sslMethod VIP, TLSv1 if sslMethod SNI
        :param ssl_method: How CloudFront should serve HTTPS requests. See the notes on SSLMethod if you wish to use other SSL termination types. Default: SSLMethod.SNI
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__32c93e9d34723e934bcd1fe5aa6cff4345177cac1db5a7d27edb46ee71a3039b)
            check_type(argname="argument certificate", value=certificate, expected_type=type_hints["certificate"])
        options = ViewerCertificateOptions(
            aliases=aliases, security_policy=security_policy, ssl_method=ssl_method
        )

        return typing.cast("ViewerCertificate", jsii.sinvoke(cls, "fromAcmCertificate", [certificate, options]))

    @jsii.member(jsii_name="fromCloudFrontDefaultCertificate")
    @builtins.classmethod
    def from_cloud_front_default_certificate(
        cls,
        *aliases: builtins.str,
    ) -> "ViewerCertificate":
        '''Generate a viewer certificate configuration using the CloudFront default certificate (e.g. d111111abcdef8.cloudfront.net) and a ``SecurityPolicyProtocol.TLS_V1`` security policy.

        :param aliases: Alternative CNAME aliases You also must create a CNAME record with your DNS service to route queries.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7e3bfe50fa9fa1021510c74ea173b88833f4eab10b4f6b93e13ee0884dd899ba)
            check_type(argname="argument aliases", value=aliases, expected_type=typing.Tuple[type_hints["aliases"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("ViewerCertificate", jsii.sinvoke(cls, "fromCloudFrontDefaultCertificate", [*aliases]))

    @jsii.member(jsii_name="fromIamCertificate")
    @builtins.classmethod
    def from_iam_certificate(
        cls,
        iam_certificate_id: builtins.str,
        *,
        aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
        security_policy: typing.Optional[SecurityPolicyProtocol] = None,
        ssl_method: typing.Optional[SSLMethod] = None,
    ) -> "ViewerCertificate":
        '''Generate an IAM viewer certificate configuration.

        :param iam_certificate_id: Identifier of the IAM certificate.
        :param aliases: Domain names on the certificate (both main domain name and Subject Alternative names).
        :param security_policy: The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify. Default: - SSLv3 if sslMethod VIP, TLSv1 if sslMethod SNI
        :param ssl_method: How CloudFront should serve HTTPS requests. See the notes on SSLMethod if you wish to use other SSL termination types. Default: SSLMethod.SNI
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__506a4c849d10b2bf2933c109cc2881f1d2378b90a4e949b700ae00a7caced565)
            check_type(argname="argument iam_certificate_id", value=iam_certificate_id, expected_type=type_hints["iam_certificate_id"])
        options = ViewerCertificateOptions(
            aliases=aliases, security_policy=security_policy, ssl_method=ssl_method
        )

        return typing.cast("ViewerCertificate", jsii.sinvoke(cls, "fromIamCertificate", [iam_certificate_id, options]))

    @builtins.property
    @jsii.member(jsii_name="aliases")
    def aliases(self) -> typing.List[builtins.str]:
        return typing.cast(typing.List[builtins.str], jsii.get(self, "aliases"))

    @builtins.property
    @jsii.member(jsii_name="props")
    def props(self) -> CfnDistribution.ViewerCertificateProperty:
        return typing.cast(CfnDistribution.ViewerCertificateProperty, jsii.get(self, "props"))


@jsii.data_type(
    jsii_type="aws-cdk-lib.aws_cloudfront.ViewerCertificateOptions",
    jsii_struct_bases=[],
    name_mapping={
        "aliases": "aliases",
        "security_policy": "securityPolicy",
        "ssl_method": "sslMethod",
    },
)
class ViewerCertificateOptions:
    def __init__(
        self,
        *,
        aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
        security_policy: typing.Optional[SecurityPolicyProtocol] = None,
        ssl_method: typing.Optional[SSLMethod] = None,
    ) -> None:
        '''
        :param aliases: Domain names on the certificate (both main domain name and Subject Alternative names).
        :param security_policy: The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify. Default: - SSLv3 if sslMethod VIP, TLSv1 if sslMethod SNI
        :param ssl_method: How CloudFront should serve HTTPS requests. See the notes on SSLMethod if you wish to use other SSL termination types. Default: SSLMethod.SNI

        :exampleMetadata: lit=aws-cloudfront/test/example.iam-cert-alias.lit.ts infused

        Example::

            s3_bucket_source = s3.Bucket(self, "Bucket")
            
            distribution = cloudfront.CloudFrontWebDistribution(self, "AnAmazingWebsiteProbably",
                origin_configs=[cloudfront.aws_cloudfront.SourceConfiguration(
                    s3_origin_source=cloudfront.aws_cloudfront.S3OriginConfig(s3_bucket_source=s3_bucket_source),
                    behaviors=[cloudfront.aws_cloudfront.Behavior(is_default_behavior=True)]
                )],
                viewer_certificate=cloudfront.ViewerCertificate.from_iam_certificate("certificateId",
                    aliases=["example.com"],
                    security_policy=cloudfront.SecurityPolicyProtocol.SSL_V3,  # default
                    ssl_method=cloudfront.SSLMethod.SNI
                )
            )
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1fca8e67199164c4d795df93e2e45befd6c6e688025259d033408b16a7f663c)
            check_type(argname="argument aliases", value=aliases, expected_type=type_hints["aliases"])
            check_type(argname="argument security_policy", value=security_policy, expected_type=type_hints["security_policy"])
            check_type(argname="argument ssl_method", value=ssl_method, expected_type=type_hints["ssl_method"])
        self._values: typing.Dict[builtins.str, typing.Any] = {}
        if aliases is not None:
            self._values["aliases"] = aliases
        if security_policy is not None:
            self._values["security_policy"] = security_policy
        if ssl_method is not None:
            self._values["ssl_method"] = ssl_method

    @builtins.property
    def aliases(self) -> typing.Optional[typing.List[builtins.str]]:
        '''Domain names on the certificate (both main domain name and Subject Alternative names).'''
        result = self._values.get("aliases")
        return typing.cast(typing.Optional[typing.List[builtins.str]], result)

    @builtins.property
    def security_policy(self) -> typing.Optional[SecurityPolicyProtocol]:
        '''The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.

        CloudFront serves your objects only to browsers or devices that support at
        least the SSL version that you specify.

        :default: - SSLv3 if sslMethod VIP, TLSv1 if sslMethod SNI
        '''
        result = self._values.get("security_policy")
        return typing.cast(typing.Optional[SecurityPolicyProtocol], result)

    @builtins.property
    def ssl_method(self) -> typing.Optional[SSLMethod]:
        '''How CloudFront should serve HTTPS requests.

        See the notes on SSLMethod if you wish to use other SSL termination types.

        :default: SSLMethod.SNI

        :see: https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ViewerCertificate.html
        '''
        result = self._values.get("ssl_method")
        return typing.cast(typing.Optional[SSLMethod], result)

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ViewerCertificateOptions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="aws-cdk-lib.aws_cloudfront.ViewerProtocolPolicy")
class ViewerProtocolPolicy(enum.Enum):
    '''How HTTPs should be handled with your distribution.

    :exampleMetadata: infused

    Example::

        # Create a Distribution with configured HTTP methods and viewer protocol policy of the cache.
        # my_bucket: s3.Bucket
        
        my_web_distribution = cloudfront.Distribution(self, "myDist",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(my_bucket),
                allowed_methods=cloudfront.AllowedMethods.ALLOW_ALL,
                viewer_protocol_policy=cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS
            )
        )
    '''

    HTTPS_ONLY = "HTTPS_ONLY"
    '''HTTPS only.'''
    REDIRECT_TO_HTTPS = "REDIRECT_TO_HTTPS"
    '''Will redirect HTTP requests to HTTPS.'''
    ALLOW_ALL = "ALLOW_ALL"
    '''Both HTTP and HTTPS supported.'''


class AssetImportSource(
    ImportSource,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.AssetImportSource",
):
    '''An import source from a local file.

    :exampleMetadata: fixture=_generated

    Example::

        # The code below shows an example of how to instantiate this type.
        # The values are placeholders you should change.
        import aws_cdk as cdk
        from aws_cdk import aws_cloudfront as cloudfront
        from aws_cdk import aws_iam as iam
        
        # docker_image: cdk.DockerImage
        # grantable: iam.IGrantable
        # local_bundling: cdk.ILocalBundling
        
        asset_import_source = cloudfront.AssetImportSource("path",
            asset_hash="assetHash",
            asset_hash_type=cdk.AssetHashType.SOURCE,
            bundling=cdk.BundlingOptions(
                image=docker_image,
        
                # the properties below are optional
                bundling_file_access=cdk.BundlingFileAccess.VOLUME_COPY,
                command=["command"],
                entrypoint=["entrypoint"],
                environment={
                    "environment_key": "environment"
                },
                local=local_bundling,
                network="network",
                output_type=cdk.BundlingOutput.ARCHIVED,
                platform="platform",
                security_opt="securityOpt",
                user="user",
                volumes=[cdk.DockerVolume(
                    container_path="containerPath",
                    host_path="hostPath",
        
                    # the properties below are optional
                    consistency=cdk.DockerVolumeConsistency.CONSISTENT
                )],
                volumes_from=["volumesFrom"],
                working_directory="workingDirectory"
            ),
            deploy_time=False,
            exclude=["exclude"],
            follow_symlinks=cdk.SymlinkFollowMode.NEVER,
            ignore_mode=cdk.IgnoreMode.GLOB,
            readers=[grantable]
        )
    '''

    def __init__(
        self,
        path: builtins.str,
        *,
        deploy_time: typing.Optional[builtins.bool] = None,
        readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
        asset_hash: typing.Optional[builtins.str] = None,
        asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
        bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
        exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
        follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
        ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
    ) -> None:
        '''
        :param path: the path to the local file.
        :param deploy_time: Whether or not the asset needs to exist beyond deployment time; i.e. are copied over to a different location and not needed afterwards. Setting this property to true has an impact on the lifecycle of the asset, because we will assume that it is safe to delete after the CloudFormation deployment succeeds. For example, Lambda Function assets are copied over to Lambda during deployment. Therefore, it is not necessary to store the asset in S3, so we consider those deployTime assets. Default: false
        :param readers: A list of principals that should be able to read this asset from S3. You can use ``asset.grantRead(principal)`` to grant read permissions later. Default: - No principals that can read file asset.
        :param asset_hash: Specify a custom hash for this asset. If ``assetHashType`` is set it must be set to ``AssetHashType.CUSTOM``. For consistency, this custom hash will be SHA256 hashed and encoded as hex. The resulting hash will be the asset hash. NOTE: the hash is used in order to identify a specific revision of the asset, and used for optimizing and caching deployment activities related to this asset such as packaging, uploading to Amazon S3, etc. If you chose to customize the hash, you will need to make sure it is updated every time the asset changes, or otherwise it is possible that some deployments will not be invalidated. Default: - based on ``assetHashType``
        :param asset_hash_type: Specifies the type of hash to calculate for this asset. If ``assetHash`` is configured, this option must be ``undefined`` or ``AssetHashType.CUSTOM``. Default: - the default is ``AssetHashType.SOURCE``, but if ``assetHash`` is explicitly specified this value defaults to ``AssetHashType.CUSTOM``.
        :param bundling: Bundle the asset by executing a command in a Docker container or a custom bundling provider. The asset path will be mounted at ``/asset-input``. The Docker container is responsible for putting content at ``/asset-output``. The content at ``/asset-output`` will be zipped and used as the final asset. Default: - uploaded as-is to S3 if the asset is a regular file or a .zip file, archived into a .zip file and uploaded to S3 otherwise
        :param exclude: File paths matching the patterns will be excluded. See ``ignoreMode`` to set the matching behavior. Has no effect on Assets bundled using the ``bundling`` property. Default: - nothing is excluded
        :param follow_symlinks: A strategy for how to handle symlinks. Default: SymlinkFollowMode.NEVER
        :param ignore_mode: The ignore behavior to use for ``exclude`` patterns. Default: IgnoreMode.GLOB
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62441d3d3228ae5fb69aaca12e603944f07f9335dae80f70ce3b04e8e353f020)
            check_type(argname="argument path", value=path, expected_type=type_hints["path"])
        options = _AssetOptions_2aa69621(
            deploy_time=deploy_time,
            readers=readers,
            asset_hash=asset_hash,
            asset_hash_type=asset_hash_type,
            bundling=bundling,
            exclude=exclude,
            follow_symlinks=follow_symlinks,
            ignore_mode=ignore_mode,
        )

        jsii.create(self.__class__, self, [path, options])

    @builtins.property
    @jsii.member(jsii_name="path")
    def path(self) -> builtins.str:
        '''the path to the local file.'''
        return typing.cast(builtins.str, jsii.get(self, "path"))


@jsii.implements(ICachePolicy)
class CachePolicy(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CachePolicy",
):
    '''A Cache Policy configuration.

    :link: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/using-managed-cache-policies.html
    :resource: AWS::CloudFront::CachePolicy
    :exampleMetadata: infused

    Example::

        # Using an existing cache policy for a Distribution
        # bucket_origin: origins.S3Origin
        
        cloudfront.Distribution(self, "myDistManagedPolicy",
            default_behavior=cloudfront.BehaviorOptions(
                origin=bucket_origin,
                cache_policy=cloudfront.CachePolicy.CACHING_OPTIMIZED
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        cache_policy_name: typing.Optional[builtins.str] = None,
        comment: typing.Optional[builtins.str] = None,
        cookie_behavior: typing.Optional[CacheCookieBehavior] = None,
        default_ttl: typing.Optional[_Duration_4839e8c3] = None,
        enable_accept_encoding_brotli: typing.Optional[builtins.bool] = None,
        enable_accept_encoding_gzip: typing.Optional[builtins.bool] = None,
        header_behavior: typing.Optional[CacheHeaderBehavior] = None,
        max_ttl: typing.Optional[_Duration_4839e8c3] = None,
        min_ttl: typing.Optional[_Duration_4839e8c3] = None,
        query_string_behavior: typing.Optional[CacheQueryStringBehavior] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param cache_policy_name: A unique name to identify the cache policy. The name must only include '-', '_', or alphanumeric characters. Default: - generated from the ``id``
        :param comment: A comment to describe the cache policy. Default: - no comment
        :param cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheCookieBehavior.none()
        :param default_ttl: The default amount of time for objects to stay in the CloudFront cache. Only used when the origin does not send Cache-Control or Expires headers with the object. Default: - The greater of 1 day and ``minTtl``
        :param enable_accept_encoding_brotli: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'br'. Default: false
        :param enable_accept_encoding_gzip: Whether to normalize and include the ``Accept-Encoding`` header in the cache key when the ``Accept-Encoding`` header is 'gzip'. Default: false
        :param header_behavior: Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheHeaderBehavior.none()
        :param max_ttl: The maximum amount of time for objects to stay in the CloudFront cache. CloudFront uses this value only when the origin sends Cache-Control or Expires headers with the object. Default: - The greater of 1 year and ``defaultTtl``
        :param min_ttl: The minimum amount of time for objects to stay in the CloudFront cache. Default: Duration.seconds(0)
        :param query_string_behavior: Determines whether any query strings are included in the cache key and automatically included in requests that CloudFront sends to the origin. Default: CacheQueryStringBehavior.none()
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8a9474ce476b57ed85f97b060b559f6bc96bb0780255754efa416b3f31f18e5)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CachePolicyProps(
            cache_policy_name=cache_policy_name,
            comment=comment,
            cookie_behavior=cookie_behavior,
            default_ttl=default_ttl,
            enable_accept_encoding_brotli=enable_accept_encoding_brotli,
            enable_accept_encoding_gzip=enable_accept_encoding_gzip,
            header_behavior=header_behavior,
            max_ttl=max_ttl,
            min_ttl=min_ttl,
            query_string_behavior=query_string_behavior,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromCachePolicyId")
    @builtins.classmethod
    def from_cache_policy_id(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        cache_policy_id: builtins.str,
    ) -> ICachePolicy:
        '''Imports a Cache Policy from its id.

        :param scope: -
        :param id: -
        :param cache_policy_id: -
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__021efa4f6feaf855cba1b4a34877c6dbb10aec00527a213f7cebf59d57cfbd3c)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument cache_policy_id", value=cache_policy_id, expected_type=type_hints["cache_policy_id"])
        return typing.cast(ICachePolicy, jsii.sinvoke(cls, "fromCachePolicyId", [scope, id, cache_policy_id]))

    @jsii.python.classproperty
    @jsii.member(jsii_name="AMPLIFY")
    def AMPLIFY(cls) -> ICachePolicy:
        '''This policy is designed for use with an origin that is an AWS Amplify web app.'''
        return typing.cast(ICachePolicy, jsii.sget(cls, "AMPLIFY"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CACHING_DISABLED")
    def CACHING_DISABLED(cls) -> ICachePolicy:
        '''Disables caching.

        This policy is useful for dynamic content and for requests that are not cacheable.
        '''
        return typing.cast(ICachePolicy, jsii.sget(cls, "CACHING_DISABLED"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CACHING_OPTIMIZED")
    def CACHING_OPTIMIZED(cls) -> ICachePolicy:
        '''Optimize cache efficiency by minimizing the values that CloudFront includes in the cache key.

        Query strings and cookies are not included in the cache key, and only the normalized 'Accept-Encoding' header is included.
        '''
        return typing.cast(ICachePolicy, jsii.sget(cls, "CACHING_OPTIMIZED"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="CACHING_OPTIMIZED_FOR_UNCOMPRESSED_OBJECTS")
    def CACHING_OPTIMIZED_FOR_UNCOMPRESSED_OBJECTS(cls) -> ICachePolicy:
        '''Optimize cache efficiency by minimizing the values that CloudFront includes in the cache key.

        Query strings and cookies are not included in the cache key, and only the normalized 'Accept-Encoding' header is included.
        Disables cache compression.
        '''
        return typing.cast(ICachePolicy, jsii.sget(cls, "CACHING_OPTIMIZED_FOR_UNCOMPRESSED_OBJECTS"))

    @jsii.python.classproperty
    @jsii.member(jsii_name="ELEMENTAL_MEDIA_PACKAGE")
    def ELEMENTAL_MEDIA_PACKAGE(cls) -> ICachePolicy:
        '''Designed for use with an origin that is an AWS Elemental MediaPackage endpoint.'''
        return typing.cast(ICachePolicy, jsii.sget(cls, "ELEMENTAL_MEDIA_PACKAGE"))

    @builtins.property
    @jsii.member(jsii_name="cachePolicyId")
    def cache_policy_id(self) -> builtins.str:
        '''The ID of the cache policy.'''
        return typing.cast(builtins.str, jsii.get(self, "cachePolicyId"))


@jsii.implements(IDistribution)
class CloudFrontWebDistribution(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.CloudFrontWebDistribution",
):
    '''Amazon CloudFront is a global content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to your viewers with low latency and high transfer speeds.

    CloudFront fronts user provided content and caches it at edge locations across the world.

    Here's how you can use this construct::

       source_bucket = s3.Bucket(self, "Bucket")

       distribution = cloudfront.CloudFrontWebDistribution(self, "MyDistribution",
           origin_configs=[cloudfront.SourceConfiguration(
               s3_origin_source=cloudfront.S3OriginConfig(
                   s3_bucket_source=source_bucket
               ),
               behaviors=[cloudfront.Behavior(is_default_behavior=True)]
           )
           ]
       )

    This will create a CloudFront distribution that uses your S3Bucket as it's origin.

    You can customize the distribution using additional properties from the CloudFrontWebDistributionProps interface.

    :resource: AWS::CloudFront::Distribution
    :exampleMetadata: infused

    Example::

        # source_bucket: s3.Bucket
        
        viewer_certificate = cloudfront.ViewerCertificate.from_iam_certificate("MYIAMROLEIDENTIFIER",
            aliases=["MYALIAS"]
        )
        
        cloudfront.CloudFrontWebDistribution(self, "MyCfWebDistribution",
            origin_configs=[cloudfront.SourceConfiguration(
                s3_origin_source=cloudfront.S3OriginConfig(
                    s3_bucket_source=source_bucket
                ),
                behaviors=[cloudfront.Behavior(is_default_behavior=True)]
            )
            ],
            viewer_certificate=viewer_certificate
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        origin_configs: typing.Sequence[typing.Union[SourceConfiguration, typing.Dict[builtins.str, typing.Any]]],
        comment: typing.Optional[builtins.str] = None,
        default_root_object: typing.Optional[builtins.str] = None,
        enabled: typing.Optional[builtins.bool] = None,
        enable_ip_v6: typing.Optional[builtins.bool] = None,
        error_configurations: typing.Optional[typing.Sequence[typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
        geo_restriction: typing.Optional[GeoRestriction] = None,
        http_version: typing.Optional[HttpVersion] = None,
        logging_config: typing.Optional[typing.Union[LoggingConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
        price_class: typing.Optional[PriceClass] = None,
        viewer_certificate: typing.Optional[ViewerCertificate] = None,
        viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
        web_acl_id: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param origin_configs: The origin configurations for this distribution. Behaviors are a part of the origin.
        :param comment: A comment for this distribution in the CloudFront console. Default: - No comment is added to distribution.
        :param default_root_object: The default object to serve. Default: - "index.html" is served.
        :param enabled: Enable or disable the distribution. Default: true
        :param enable_ip_v6: If your distribution should have IPv6 enabled. Default: true
        :param error_configurations: How CloudFront should handle requests that are not successful (eg PageNotFound). By default, CloudFront does not replace HTTP status codes in the 4xx and 5xx range with custom error messages. CloudFront does not cache HTTP status codes. Default: - No custom error configuration.
        :param geo_restriction: Controls the countries in which your content is distributed. Default: No geo restriction
        :param http_version: The max supported HTTP Versions. Default: HttpVersion.HTTP2
        :param logging_config: Optional - if we should enable logging. You can pass an empty object ({}) to have us auto create a bucket for logging. Omission of this property indicates no logging is to be enabled. Default: - no logging is enabled by default.
        :param price_class: The price class for the distribution (this impacts how many locations CloudFront uses for your distribution, and billing). Default: PriceClass.PRICE_CLASS_100 the cheapest option for CloudFront is picked by default.
        :param viewer_certificate: Specifies whether you want viewers to use HTTP or HTTPS to request your objects, whether you're using an alternate domain name with HTTPS, and if so, if you're using AWS Certificate Manager (ACM) or a third-party certificate authority. Default: ViewerCertificate.fromCloudFrontDefaultCertificate()
        :param viewer_protocol_policy: The default viewer policy for incoming clients. Default: RedirectToHTTPs
        :param web_acl_id: Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution. To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``. Default: - No AWS Web Application Firewall web access control list (web ACL).
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10cf4b33f291ebea192f1ea6c37ed91936b858def6e1350c920f21db71902d54)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = CloudFrontWebDistributionProps(
            origin_configs=origin_configs,
            comment=comment,
            default_root_object=default_root_object,
            enabled=enabled,
            enable_ip_v6=enable_ip_v6,
            error_configurations=error_configurations,
            geo_restriction=geo_restriction,
            http_version=http_version,
            logging_config=logging_config,
            price_class=price_class,
            viewer_certificate=viewer_certificate,
            viewer_protocol_policy=viewer_protocol_policy,
            web_acl_id=web_acl_id,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromDistributionAttributes")
    @builtins.classmethod
    def from_distribution_attributes(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        distribution_id: builtins.str,
        domain_name: builtins.str,
    ) -> IDistribution:
        '''Creates a construct that represents an external (imported) distribution.

        :param scope: -
        :param id: -
        :param distribution_id: The distribution ID for this distribution.
        :param domain_name: The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea3b674a8185c8a9d03501ece5d860a4700034e19e03fc3a57d05fc8623fafc9)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        attrs = CloudFrontWebDistributionAttributes(
            distribution_id=distribution_id, domain_name=domain_name
        )

        return typing.cast(IDistribution, jsii.sinvoke(cls, "fromDistributionAttributes", [scope, id, attrs]))

    @jsii.member(jsii_name="grant")
    def grant(
        self,
        identity: _IGrantable_71c4f5de,
        *actions: builtins.str,
    ) -> _Grant_a7ae64f8:
        '''Adds an IAM policy statement associated with this distribution to an IAM principal's policy.

        :param identity: The principal.
        :param actions: The set of actions to allow (i.e. "cloudfront:ListInvalidations").
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbe540671a65a5420a5e19288df418399a2c78bc5c1c07de38b3f735b89a36ed)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
            check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [identity, *actions]))

    @jsii.member(jsii_name="grantCreateInvalidation")
    def grant_create_invalidation(
        self,
        identity: _IGrantable_71c4f5de,
    ) -> _Grant_a7ae64f8:
        '''Grant to create invalidations for this bucket to an IAM principal (Role/Group/User).

        :param identity: The principal.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e035551f14cb51c65a18baf4f340f3be55199133afe180ca2138a8a0e86e6f8)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantCreateInvalidation", [identity]))

    @builtins.property
    @jsii.member(jsii_name="distributionDomainName")
    def distribution_domain_name(self) -> builtins.str:
        '''The domain name created by CloudFront for this distribution.

        If you are using aliases for your distribution, this is the domainName your DNS records should point to.
        (In Route53, you could create an ALIAS record to this value, for example.)
        '''
        return typing.cast(builtins.str, jsii.get(self, "distributionDomainName"))

    @builtins.property
    @jsii.member(jsii_name="distributionId")
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.'''
        return typing.cast(builtins.str, jsii.get(self, "distributionId"))

    @builtins.property
    @jsii.member(jsii_name="loggingBucket")
    def logging_bucket(self) -> typing.Optional[_IBucket_42e086fd]:
        '''The logging bucket for this CloudFront distribution.

        If logging is not enabled for this distribution - this property will be undefined.
        '''
        return typing.cast(typing.Optional[_IBucket_42e086fd], jsii.get(self, "loggingBucket"))


@jsii.implements(IDistribution)
class Distribution(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.Distribution",
):
    '''A CloudFront distribution with associated origin(s) and caching behavior(s).

    :exampleMetadata: infused

    Example::

        # Adding an existing Lambda@Edge function created in a different stack
        # to a CloudFront distribution.
        # s3_bucket: s3.Bucket
        
        function_version = lambda_.Version.from_version_arn(self, "Version", "arn:aws:lambda:us-east-1:123456789012:function:functionName:1")
        
        cloudfront.Distribution(self, "distro",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(s3_bucket),
                edge_lambdas=[cloudfront.EdgeLambda(
                    function_version=function_version,
                    event_type=cloudfront.LambdaEdgeEventType.VIEWER_REQUEST
                )
                ]
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        default_behavior: typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]],
        additional_behaviors: typing.Optional[typing.Mapping[builtins.str, typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]]]] = None,
        certificate: typing.Optional[_ICertificate_c194c70b] = None,
        comment: typing.Optional[builtins.str] = None,
        default_root_object: typing.Optional[builtins.str] = None,
        domain_names: typing.Optional[typing.Sequence[builtins.str]] = None,
        enabled: typing.Optional[builtins.bool] = None,
        enable_ipv6: typing.Optional[builtins.bool] = None,
        enable_logging: typing.Optional[builtins.bool] = None,
        error_responses: typing.Optional[typing.Sequence[typing.Union[ErrorResponse, typing.Dict[builtins.str, typing.Any]]]] = None,
        geo_restriction: typing.Optional[GeoRestriction] = None,
        http_version: typing.Optional[HttpVersion] = None,
        log_bucket: typing.Optional[_IBucket_42e086fd] = None,
        log_file_prefix: typing.Optional[builtins.str] = None,
        log_includes_cookies: typing.Optional[builtins.bool] = None,
        minimum_protocol_version: typing.Optional[SecurityPolicyProtocol] = None,
        price_class: typing.Optional[PriceClass] = None,
        publish_additional_metrics: typing.Optional[builtins.bool] = None,
        ssl_support_method: typing.Optional[SSLMethod] = None,
        web_acl_id: typing.Optional[builtins.str] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param default_behavior: The default behavior for the distribution.
        :param additional_behaviors: Additional behaviors for the distribution, mapped by the pathPattern that specifies which requests to apply the behavior to. Default: - no additional behaviors are added.
        :param certificate: A certificate to associate with the distribution. The certificate must be located in N. Virginia (us-east-1). Default: - the CloudFront wildcard certificate (*.cloudfront.net) will be used.
        :param comment: Any comments you want to include about the distribution. Default: - no comment
        :param default_root_object: The object that you want CloudFront to request from your origin (for example, index.html) when a viewer requests the root URL for your distribution. If no default object is set, the request goes to the origin's root (e.g., example.com/). Default: - no default root object
        :param domain_names: Alternative domain names for this distribution. If you want to use your own domain name, such as www.example.com, instead of the cloudfront.net domain name, you can add an alternate domain name to your distribution. If you attach a certificate to the distribution, you must add (at least one of) the domain names of the certificate to this list. Default: - The distribution will only support the default generated name (e.g., d111111abcdef8.cloudfront.net)
        :param enabled: Enable or disable the distribution. Default: true
        :param enable_ipv6: Whether CloudFront will respond to IPv6 DNS requests with an IPv6 address. If you specify false, CloudFront responds to IPv6 DNS requests with the DNS response code NOERROR and with no IP addresses. This allows viewers to submit a second request, for an IPv4 address for your distribution. Default: true
        :param enable_logging: Enable access logging for the distribution. Default: - false, unless ``logBucket`` is specified.
        :param error_responses: How CloudFront should handle requests that are not successful (e.g., PageNotFound). Default: - No custom error responses.
        :param geo_restriction: Controls the countries in which your content is distributed. Default: - No geographic restrictions
        :param http_version: Specify the maximum HTTP version that you want viewers to use to communicate with CloudFront. For viewers and CloudFront to use HTTP/2, viewers must support TLS 1.2 or later, and must support server name identification (SNI). Default: HttpVersion.HTTP2
        :param log_bucket: The Amazon S3 bucket to store the access logs in. Make sure to set ``objectOwnership`` to ``s3.ObjectOwnership.OBJECT_WRITER`` in your custom bucket. Default: - A bucket is created if ``enableLogging`` is true
        :param log_file_prefix: An optional string that you want CloudFront to prefix to the access log filenames for this distribution. Default: - no prefix
        :param log_includes_cookies: Specifies whether you want CloudFront to include cookies in access logs. Default: false
        :param minimum_protocol_version: The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. CloudFront serves your objects only to browsers or devices that support at least the SSL version that you specify. Default: - SecurityPolicyProtocol.TLS_V1_2_2021 if the '@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021' feature flag is set; otherwise, SecurityPolicyProtocol.TLS_V1_2_2019.
        :param price_class: The price class that corresponds with the maximum price that you want to pay for CloudFront service. If you specify PriceClass_All, CloudFront responds to requests for your objects from all CloudFront edge locations. If you specify a price class other than PriceClass_All, CloudFront serves your objects from the CloudFront edge location that has the lowest latency among the edge locations in your price class. Default: PriceClass.PRICE_CLASS_ALL
        :param publish_additional_metrics: Whether to enable additional CloudWatch metrics. Default: false
        :param ssl_support_method: The SSL method CloudFront will use for your distribution. Server Name Indication (SNI) - is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate. CloudFront can use SNI to host multiple distributions on the same IP - which a large majority of clients will support. If your clients cannot support SNI however - CloudFront can use dedicated IPs for your distribution - but there is a prorated monthly charge for using this feature. By default, we use SNI - but you can optionally enable dedicated IPs (VIP). See the CloudFront SSL for more details about pricing : https://aws.amazon.com/cloudfront/custom-ssl-domains/ Default: SSLMethod.SNI
        :param web_acl_id: Unique identifier that specifies the AWS WAF web ACL to associate with this CloudFront distribution. To specify a web ACL created using the latest version of AWS WAF, use the ACL ARN, for example ``arn:aws:wafv2:us-east-1:123456789012:global/webacl/ExampleWebACL/473e64fd-f30b-4765-81a0-62ad96dd167a``. To specify a web ACL created using AWS WAF Classic, use the ACL ID, for example ``473e64fd-f30b-4765-81a0-62ad96dd167a``. Default: - No AWS Web Application Firewall web access control list (web ACL).
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7aacedff6241d454506db6fd614d1052310e1396435b71669cb481c9436bd003)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = DistributionProps(
            default_behavior=default_behavior,
            additional_behaviors=additional_behaviors,
            certificate=certificate,
            comment=comment,
            default_root_object=default_root_object,
            domain_names=domain_names,
            enabled=enabled,
            enable_ipv6=enable_ipv6,
            enable_logging=enable_logging,
            error_responses=error_responses,
            geo_restriction=geo_restriction,
            http_version=http_version,
            log_bucket=log_bucket,
            log_file_prefix=log_file_prefix,
            log_includes_cookies=log_includes_cookies,
            minimum_protocol_version=minimum_protocol_version,
            price_class=price_class,
            publish_additional_metrics=publish_additional_metrics,
            ssl_support_method=ssl_support_method,
            web_acl_id=web_acl_id,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromDistributionAttributes")
    @builtins.classmethod
    def from_distribution_attributes(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        distribution_id: builtins.str,
        domain_name: builtins.str,
    ) -> IDistribution:
        '''Creates a Distribution construct that represents an external (imported) distribution.

        :param scope: -
        :param id: -
        :param distribution_id: The distribution ID for this distribution.
        :param domain_name: The generated domain name of the Distribution, such as d111111abcdef8.cloudfront.net.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe98eb36f48aa8f0ac0f52c535bd54102eabaead0298d4caa98eb6e9700716c4)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        attrs = DistributionAttributes(
            distribution_id=distribution_id, domain_name=domain_name
        )

        return typing.cast(IDistribution, jsii.sinvoke(cls, "fromDistributionAttributes", [scope, id, attrs]))

    @jsii.member(jsii_name="addBehavior")
    def add_behavior(
        self,
        path_pattern: builtins.str,
        origin: IOrigin,
        *,
        allowed_methods: typing.Optional[AllowedMethods] = None,
        cached_methods: typing.Optional[CachedMethods] = None,
        cache_policy: typing.Optional[ICachePolicy] = None,
        compress: typing.Optional[builtins.bool] = None,
        edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
        function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
        origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
        realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
        response_headers_policy: typing.Optional[IResponseHeadersPolicy] = None,
        smooth_streaming: typing.Optional[builtins.bool] = None,
        trusted_key_groups: typing.Optional[typing.Sequence[IKeyGroup]] = None,
        viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
    ) -> None:
        '''Adds a new behavior to this distribution for the given pathPattern.

        :param path_pattern: the path pattern (e.g., 'images/*') that specifies which requests to apply the behavior to.
        :param origin: the origin to use for this behavior.
        :param allowed_methods: HTTP methods to allow for this behavior. Default: AllowedMethods.ALLOW_GET_HEAD
        :param cached_methods: HTTP methods to cache for this behavior. Default: CachedMethods.CACHE_GET_HEAD
        :param cache_policy: The cache policy for this behavior. The cache policy determines what values are included in the cache key, and the time-to-live (TTL) values for the cache. Default: CachePolicy.CACHING_OPTIMIZED
        :param compress: Whether you want CloudFront to automatically compress certain files for this cache behavior. See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/ServingCompressedFiles.html#compressed-content-cloudfront-file-types for file types CloudFront will compress. Default: true
        :param edge_lambdas: The Lambda@Edge functions to invoke before serving the contents. Default: - no Lambda functions will be invoked
        :param function_associations: The CloudFront functions to invoke before serving the contents. Default: - no functions will be invoked
        :param origin_request_policy: The origin request policy for this behavior. The origin request policy determines which values (e.g., headers, cookies) are included in requests that CloudFront sends to the origin. Default: - none
        :param realtime_log_config: The real-time log configuration to be attached to this cache behavior. Default: - none
        :param response_headers_policy: The response headers policy for this behavior. The response headers policy determines which headers are included in responses Default: - none
        :param smooth_streaming: Set this to true to indicate you want to distribute media files in the Microsoft Smooth Streaming format using this behavior. Default: false
        :param trusted_key_groups: A list of Key Groups that CloudFront can use to validate signed URLs or signed cookies. Default: - no KeyGroups are associated with cache behavior
        :param viewer_protocol_policy: The protocol that viewers can use to access the files controlled by this behavior. Default: ViewerProtocolPolicy.ALLOW_ALL
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f94c33f8f74d148b7c436f42a002e770c6ad95241e489b963596aea62818c051)
            check_type(argname="argument path_pattern", value=path_pattern, expected_type=type_hints["path_pattern"])
            check_type(argname="argument origin", value=origin, expected_type=type_hints["origin"])
        behavior_options = AddBehaviorOptions(
            allowed_methods=allowed_methods,
            cached_methods=cached_methods,
            cache_policy=cache_policy,
            compress=compress,
            edge_lambdas=edge_lambdas,
            function_associations=function_associations,
            origin_request_policy=origin_request_policy,
            realtime_log_config=realtime_log_config,
            response_headers_policy=response_headers_policy,
            smooth_streaming=smooth_streaming,
            trusted_key_groups=trusted_key_groups,
            viewer_protocol_policy=viewer_protocol_policy,
        )

        return typing.cast(None, jsii.invoke(self, "addBehavior", [path_pattern, origin, behavior_options]))

    @jsii.member(jsii_name="grant")
    def grant(
        self,
        identity: _IGrantable_71c4f5de,
        *actions: builtins.str,
    ) -> _Grant_a7ae64f8:
        '''Adds an IAM policy statement associated with this distribution to an IAM principal's policy.

        :param identity: The principal.
        :param actions: The set of actions to allow (i.e. "cloudfront:ListInvalidations").
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__570665aa807bcddef2b06088f934fc7c08e51ec76b12bb573dce40bcd558c053)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
            check_type(argname="argument actions", value=actions, expected_type=typing.Tuple[type_hints["actions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grant", [identity, *actions]))

    @jsii.member(jsii_name="grantCreateInvalidation")
    def grant_create_invalidation(
        self,
        identity: _IGrantable_71c4f5de,
    ) -> _Grant_a7ae64f8:
        '''Grant to create invalidations for this bucket to an IAM principal (Role/Group/User).

        :param identity: The principal.
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f120acf6052cd817f09b30ce4d40d0853e41ea258f27908bbd45136d4e56e891)
            check_type(argname="argument identity", value=identity, expected_type=type_hints["identity"])
        return typing.cast(_Grant_a7ae64f8, jsii.invoke(self, "grantCreateInvalidation", [identity]))

    @jsii.member(jsii_name="metric")
    def metric(
        self,
        metric_name: builtins.str,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Return the given named metric for this Distribution.

        :param metric_name: -
        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57d1cb583a433250ea9a7b0fd61eb68ee34cc5f8ab9ebc2c7b54d4a3f730247f)
            check_type(argname="argument metric_name", value=metric_name, expected_type=type_hints["metric_name"])
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric", [metric_name, props]))

    @jsii.member(jsii_name="metric401ErrorRate")
    def metric401_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 401.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric401ErrorRate", [props]))

    @jsii.member(jsii_name="metric403ErrorRate")
    def metric403_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 403.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric403ErrorRate", [props]))

    @jsii.member(jsii_name="metric404ErrorRate")
    def metric404_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 404.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric404ErrorRate", [props]))

    @jsii.member(jsii_name="metric4xxErrorRate")
    def metric4xx_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 4xx.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric4xxErrorRate", [props]))

    @jsii.member(jsii_name="metric502ErrorRate")
    def metric502_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 502.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric502ErrorRate", [props]))

    @jsii.member(jsii_name="metric503ErrorRate")
    def metric503_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 503.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric503ErrorRate", [props]))

    @jsii.member(jsii_name="metric504ErrorRate")
    def metric504_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 504.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric504ErrorRate", [props]))

    @jsii.member(jsii_name="metric5xxErrorRate")
    def metric5xx_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 5xx.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metric5xxErrorRate", [props]))

    @jsii.member(jsii_name="metricBytesDownloaded")
    def metric_bytes_downloaded(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the total number of bytes downloaded by viewers for GET, HEAD, and OPTIONS requests.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - sum over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricBytesDownloaded", [props]))

    @jsii.member(jsii_name="metricBytesUploaded")
    def metric_bytes_uploaded(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the total number of bytes that viewers uploaded to your origin with CloudFront, using POST and PUT requests.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - sum over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricBytesUploaded", [props]))

    @jsii.member(jsii_name="metricCacheHitRate")
    def metric_cache_hit_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all cacheable requests for which CloudFront served the content from its cache.

        HTTP POST and PUT requests, and errors, are not considered cacheable requests.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricCacheHitRate", [props]))

    @jsii.member(jsii_name="metricOriginLatency")
    def metric_origin_latency(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the total time spent from when CloudFront receives a request to when it starts providing a response to the network (not the viewer), for requests that are served from the origin, not the CloudFront cache.

        This is also known as first byte latency, or time-to-first-byte.

        To obtain this metric, you need to set ``publishAdditionalMetrics`` to ``true``.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricOriginLatency", [props]))

    @jsii.member(jsii_name="metricRequests")
    def metric_requests(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the total number of viewer requests received by CloudFront, for all HTTP methods and for both HTTP and HTTPS requests.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - sum over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricRequests", [props]))

    @jsii.member(jsii_name="metricTotalErrorRate")
    def metric_total_error_rate(
        self,
        *,
        account: typing.Optional[builtins.str] = None,
        color: typing.Optional[builtins.str] = None,
        dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
        label: typing.Optional[builtins.str] = None,
        period: typing.Optional[_Duration_4839e8c3] = None,
        region: typing.Optional[builtins.str] = None,
        statistic: typing.Optional[builtins.str] = None,
        unit: typing.Optional[_Unit_61bc6f70] = None,
    ) -> _Metric_e396a4dc:
        '''Metric for the percentage of all viewer requests for which the response's HTTP status code is 4xx or 5xx.

        :param account: Account which this metric comes from. Default: - Deployment account.
        :param color: The hex color code, prefixed with '#' (e.g. '#00ff00'), to use when this metric is rendered on a graph. The ``Color`` class has a set of standard colors that can be used here. Default: - Automatic color
        :param dimensions_map: Dimensions of the metric. Default: - No dimensions.
        :param label: Label for this metric when added to a Graph in a Dashboard. You can use `dynamic labels <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/graph-dynamic-labels.html>`_ to show summary information about the entire displayed time series in the legend. For example, if you use:: [max: ${MAX}] MyMetric As the metric label, the maximum value in the visible range will be shown next to the time series name in the graph's legend. Default: - No label
        :param period: The period over which the specified statistic is applied. Default: Duration.minutes(5)
        :param region: Region which this metric comes from. Default: - Deployment region.
        :param statistic: What function to use for aggregating. Use the ``aws_cloudwatch.Stats`` helper class to construct valid input strings. Can be one of the following: - "Minimum" | "min" - "Maximum" | "max" - "Average" | "avg" - "Sum" | "sum" - "SampleCount | "n" - "pNN.NN" - "tmNN.NN" | "tm(NN.NN%:NN.NN%)" - "iqm" - "wmNN.NN" | "wm(NN.NN%:NN.NN%)" - "tcNN.NN" | "tc(NN.NN%:NN.NN%)" - "tsNN.NN" | "ts(NN.NN%:NN.NN%)" Default: Average
        :param unit: Unit used to filter the metric stream. Only refer to datums emitted to the metric stream with the given unit and ignore all others. Only useful when datums are being emitted to the same metric stream under different units. The default is to use all matric datums in the stream, regardless of unit, which is recommended in nearly all cases. CloudWatch does not honor this property for graphs. Default: - All metric datums in the given metric stream

        :default: - average over 5 minutes
        '''
        props = _MetricOptions_1788b62f(
            account=account,
            color=color,
            dimensions_map=dimensions_map,
            label=label,
            period=period,
            region=region,
            statistic=statistic,
            unit=unit,
        )

        return typing.cast(_Metric_e396a4dc, jsii.invoke(self, "metricTotalErrorRate", [props]))

    @builtins.property
    @jsii.member(jsii_name="distributionDomainName")
    def distribution_domain_name(self) -> builtins.str:
        '''The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.'''
        return typing.cast(builtins.str, jsii.get(self, "distributionDomainName"))

    @builtins.property
    @jsii.member(jsii_name="distributionId")
    def distribution_id(self) -> builtins.str:
        '''The distribution ID for this distribution.'''
        return typing.cast(builtins.str, jsii.get(self, "distributionId"))

    @builtins.property
    @jsii.member(jsii_name="domainName")
    def domain_name(self) -> builtins.str:
        '''The domain name of the Distribution, such as d111111abcdef8.cloudfront.net.'''
        return typing.cast(builtins.str, jsii.get(self, "domainName"))


@jsii.implements(IFunction)
class Function(
    _Resource_45bc6135,
    metaclass=jsii.JSIIMeta,
    jsii_type="aws-cdk-lib.aws_cloudfront.Function",
):
    '''A CloudFront Function.

    :resource: AWS::CloudFront::Function
    :exampleMetadata: infused

    Example::

        # s3_bucket: s3.Bucket
        # Add a cloudfront Function to a Distribution
        cf_function = cloudfront.Function(self, "Function",
            code=cloudfront.FunctionCode.from_inline("function handler(event) { return event.request }"),
            runtime=cloudfront.FunctionRuntime.JS_2_0
        )
        cloudfront.Distribution(self, "distro",
            default_behavior=cloudfront.BehaviorOptions(
                origin=origins.S3Origin(s3_bucket),
                function_associations=[cloudfront.FunctionAssociation(
                    function=cf_function,
                    event_type=cloudfront.FunctionEventType.VIEWER_REQUEST
                )]
            )
        )
    '''

    def __init__(
        self,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        code: FunctionCode,
        comment: typing.Optional[builtins.str] = None,
        function_name: typing.Optional[builtins.str] = None,
        key_value_store: typing.Optional[IKeyValueStore] = None,
        runtime: typing.Optional[FunctionRuntime] = None,
    ) -> None:
        '''
        :param scope: -
        :param id: -
        :param code: The source code of the function.
        :param comment: A comment to describe the function. Default: - same as ``functionName``
        :param function_name: A name to identify the function. Default: - generated from the ``id``
        :param key_value_store: The Key Value Store to associate with this function. In order to associate a Key Value Store, the ``runtime`` must be ``cloudfront-js-2.0`` or newer. Default: - no key value store is associated
        :param runtime: The runtime environment for the function. Default: FunctionRuntime.JS_1_0 (unless ``keyValueStore`` is specified, then ``FunctionRuntime.JS_2_0``)
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__036fe4f21793a85724c37ca1ffc5912522571664ab980383ee3babc485339b2e)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        props = FunctionProps(
            code=code,
            comment=comment,
            function_name=function_name,
            key_value_store=key_value_store,
            runtime=runtime,
        )

        jsii.create(self.__class__, self, [scope, id, props])

    @jsii.member(jsii_name="fromFunctionAttributes")
    @builtins.classmethod
    def from_function_attributes(
        cls,
        scope: _constructs_77d1e7e8.Construct,
        id: builtins.str,
        *,
        function_arn: builtins.str,
        function_name: builtins.str,
        function_runtime: typing.Optional[builtins.str] = None,
    ) -> IFunction:
        '''Imports a function by its name and ARN.

        :param scope: -
        :param id: -
        :param function_arn: The ARN of the function.
        :param function_name: The name of the function.
        :param function_runtime: The Runtime of the function. Default: FunctionRuntime.JS_1_0
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5989cbf7079014eacde0ab3a45d42fc3fb56a2cf17ecfbacd7bc46da0a11701d)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
        attrs = FunctionAttributes(
            function_arn=function_arn,
            function_name=function_name,
            function_runtime=function_runtime,
        )

        return typing.cast(IFunction, jsii.sinvoke(cls, "fromFunctionAttributes", [scope, id, attrs]))

    @builtins.property
    @jsii.member(jsii_name="functionArn")
    def function_arn(self) -> builtins.str:
        '''the ARN of the CloudFront function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionArn"))

    @builtins.property
    @jsii.member(jsii_name="functionName")
    def function_name(self) -> builtins.str:
        '''the name of the CloudFront function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionName"))

    @builtins.property
    @jsii.member(jsii_name="functionRuntime")
    def function_runtime(self) -> builtins.str:
        '''the runtime of the CloudFront function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionRuntime"))

    @builtins.property
    @jsii.member(jsii_name="functionStage")
    def function_stage(self) -> builtins.str:
        '''the deployment stage of the CloudFront function.

        :attribute: true
        '''
        return typing.cast(builtins.str, jsii.get(self, "functionStage"))


__all__ = [
    "AddBehaviorOptions",
    "AllowedMethods",
    "AssetImportSource",
    "Behavior",
    "BehaviorOptions",
    "CacheCookieBehavior",
    "CacheHeaderBehavior",
    "CachePolicy",
    "CachePolicyProps",
    "CacheQueryStringBehavior",
    "CachedMethods",
    "CfnCachePolicy",
    "CfnCachePolicyProps",
    "CfnCloudFrontOriginAccessIdentity",
    "CfnCloudFrontOriginAccessIdentityProps",
    "CfnContinuousDeploymentPolicy",
    "CfnContinuousDeploymentPolicyProps",
    "CfnDistribution",
    "CfnDistributionProps",
    "CfnFunction",
    "CfnFunctionProps",
    "CfnKeyGroup",
    "CfnKeyGroupProps",
    "CfnKeyValueStore",
    "CfnKeyValueStoreProps",
    "CfnMonitoringSubscription",
    "CfnMonitoringSubscriptionProps",
    "CfnOriginAccessControl",
    "CfnOriginAccessControlProps",
    "CfnOriginRequestPolicy",
    "CfnOriginRequestPolicyProps",
    "CfnPublicKey",
    "CfnPublicKeyProps",
    "CfnRealtimeLogConfig",
    "CfnRealtimeLogConfigProps",
    "CfnResponseHeadersPolicy",
    "CfnResponseHeadersPolicyProps",
    "CfnStreamingDistribution",
    "CfnStreamingDistributionProps",
    "CloudFrontAllowedCachedMethods",
    "CloudFrontAllowedMethods",
    "CloudFrontWebDistribution",
    "CloudFrontWebDistributionAttributes",
    "CloudFrontWebDistributionProps",
    "CustomOriginConfig",
    "Distribution",
    "DistributionAttributes",
    "DistributionProps",
    "EdgeLambda",
    "Endpoint",
    "ErrorResponse",
    "FailoverStatusCode",
    "FileCodeOptions",
    "Function",
    "FunctionAssociation",
    "FunctionAttributes",
    "FunctionCode",
    "FunctionEventType",
    "FunctionProps",
    "FunctionRuntime",
    "GeoRestriction",
    "HeadersFrameOption",
    "HeadersReferrerPolicy",
    "HttpVersion",
    "ICachePolicy",
    "IDistribution",
    "IFunction",
    "IKeyGroup",
    "IKeyValueStore",
    "IOrigin",
    "IOriginAccessIdentity",
    "IOriginRequestPolicy",
    "IPublicKey",
    "IRealtimeLogConfig",
    "IResponseHeadersPolicy",
    "ImportSource",
    "KeyGroup",
    "KeyGroupProps",
    "KeyValueStore",
    "KeyValueStoreProps",
    "LambdaEdgeEventType",
    "LambdaFunctionAssociation",
    "LoggingConfiguration",
    "OriginAccessIdentity",
    "OriginAccessIdentityProps",
    "OriginBase",
    "OriginBindConfig",
    "OriginBindOptions",
    "OriginFailoverConfig",
    "OriginOptions",
    "OriginProps",
    "OriginProtocolPolicy",
    "OriginRequestCookieBehavior",
    "OriginRequestHeaderBehavior",
    "OriginRequestPolicy",
    "OriginRequestPolicyProps",
    "OriginRequestQueryStringBehavior",
    "OriginSslPolicy",
    "PriceClass",
    "PublicKey",
    "PublicKeyProps",
    "RealtimeLogConfig",
    "RealtimeLogConfigProps",
    "ResponseCustomHeader",
    "ResponseCustomHeadersBehavior",
    "ResponseHeadersContentSecurityPolicy",
    "ResponseHeadersContentTypeOptions",
    "ResponseHeadersCorsBehavior",
    "ResponseHeadersFrameOptions",
    "ResponseHeadersPolicy",
    "ResponseHeadersPolicyProps",
    "ResponseHeadersReferrerPolicy",
    "ResponseHeadersStrictTransportSecurity",
    "ResponseHeadersXSSProtection",
    "ResponseSecurityHeadersBehavior",
    "S3ImportSource",
    "S3OriginConfig",
    "SSLMethod",
    "SecurityPolicyProtocol",
    "SourceConfiguration",
    "ViewerCertificate",
    "ViewerCertificateOptions",
    "ViewerProtocolPolicy",
    "experimental",
]

publication.publish()

# Loading modules to ensure their types are registered with the jsii runtime library
from . import experimental

def _typecheckingstub__65772d6db92564a1181169ceb316d515431097e5d91750c338502393dc09f916(
    *,
    allowed_methods: typing.Optional[AllowedMethods] = None,
    cached_methods: typing.Optional[CachedMethods] = None,
    cache_policy: typing.Optional[ICachePolicy] = None,
    compress: typing.Optional[builtins.bool] = None,
    edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
    function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
    origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
    realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
    response_headers_policy: typing.Optional[IResponseHeadersPolicy] = None,
    smooth_streaming: typing.Optional[builtins.bool] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[IKeyGroup]] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9578dfe76ca23ed5579560a4735db540df319a1f3d27dbe31a05d73a3e0ede5(
    *,
    allowed_methods: typing.Optional[CloudFrontAllowedMethods] = None,
    cached_methods: typing.Optional[CloudFrontAllowedCachedMethods] = None,
    compress: typing.Optional[builtins.bool] = None,
    default_ttl: typing.Optional[_Duration_4839e8c3] = None,
    forwarded_values: typing.Optional[typing.Union[CfnDistribution.ForwardedValuesProperty, typing.Dict[builtins.str, typing.Any]]] = None,
    function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
    is_default_behavior: typing.Optional[builtins.bool] = None,
    lambda_function_associations: typing.Optional[typing.Sequence[typing.Union[LambdaFunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
    max_ttl: typing.Optional[_Duration_4839e8c3] = None,
    min_ttl: typing.Optional[_Duration_4839e8c3] = None,
    path_pattern: typing.Optional[builtins.str] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[IKeyGroup]] = None,
    trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4eb7e06f76f798ae0a32c303cbe5f500a4fd80b03804aa96894c0cddc6b6bdde(
    *,
    allowed_methods: typing.Optional[AllowedMethods] = None,
    cached_methods: typing.Optional[CachedMethods] = None,
    cache_policy: typing.Optional[ICachePolicy] = None,
    compress: typing.Optional[builtins.bool] = None,
    edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
    function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
    origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
    realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
    response_headers_policy: typing.Optional[IResponseHeadersPolicy] = None,
    smooth_streaming: typing.Optional[builtins.bool] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[IKeyGroup]] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
    origin: IOrigin,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8f0589a04e5898d704a7865117107d07b6fc07534515180daeb80b9ccadecd3(
    *cookies: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb45fad1f5139b6f0b21bc7c8049b9ba75512317a075cf007e71241e20ab594a(
    *cookies: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f6328e96e4626d927599ef0a823150c80dedc786fcecd52ead47872ab792f1d(
    *headers: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6711b48737c2878c00a53b355affefe0cd15881ebeb8815751d145b20c1ac29(
    *,
    cache_policy_name: typing.Optional[builtins.str] = None,
    comment: typing.Optional[builtins.str] = None,
    cookie_behavior: typing.Optional[CacheCookieBehavior] = None,
    default_ttl: typing.Optional[_Duration_4839e8c3] = None,
    enable_accept_encoding_brotli: typing.Optional[builtins.bool] = None,
    enable_accept_encoding_gzip: typing.Optional[builtins.bool] = None,
    header_behavior: typing.Optional[CacheHeaderBehavior] = None,
    max_ttl: typing.Optional[_Duration_4839e8c3] = None,
    min_ttl: typing.Optional[_Duration_4839e8c3] = None,
    query_string_behavior: typing.Optional[CacheQueryStringBehavior] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__094db6ae59f6747b36b05734a6b50105265c51b64c1ebda30cf790535b51d268(
    *query_strings: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a222c5119a62123645775df745b141b876338875bf9ef6e0b116ff55a45e82e3(
    *query_strings: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ecaedd7f16610a74896b909af6b8327237ba10f429c68ee400588f2df9ef521(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    cache_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.CachePolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8cc9977c97b3ea5f90c24bea4d8773b19f82c365e3c365d8958a74f5f2a1967(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f0cd76a4bde3d2792f5f48785eee4f3d7e310661d2ce134a5c0d4f2651ed7641(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__368f0f7bddba18df11229a8928c7cef7fa894a962c8f2f2c356a58aafc898f60(
    value: typing.Union[_IResolvable_da3f097b, CfnCachePolicy.CachePolicyConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec1b7b3968af5b89f6e59013aba51df728071d409ddc819a6ba52d2f73c7f35c(
    *,
    default_ttl: jsii.Number,
    max_ttl: jsii.Number,
    min_ttl: jsii.Number,
    name: builtins.str,
    parameters_in_cache_key_and_forwarded_to_origin: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.ParametersInCacheKeyAndForwardedToOriginProperty, typing.Dict[builtins.str, typing.Any]]],
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00472fa326e61dbdcc1f65b5f16211e3c809eeab0306a33f8944dbc2aa998e5f(
    *,
    cookie_behavior: builtins.str,
    cookies: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b80d639143aac5598d38694f54735db2be433f16d5f6c2c18e598933c520524d(
    *,
    header_behavior: builtins.str,
    headers: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4f66fadef22e9fe00758307d849db076998474f283ea1102c4ac6025e05103e(
    *,
    cookies_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.CookiesConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    enable_accept_encoding_gzip: typing.Union[builtins.bool, _IResolvable_da3f097b],
    headers_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.HeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    query_strings_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.QueryStringsConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    enable_accept_encoding_brotli: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7d5343f09690980c0041ef3359edc53a470f00af784ccbaf385999eb32b95b1(
    *,
    query_string_behavior: builtins.str,
    query_strings: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c50bde17577533380a433f5d5db423b4327130bc1c895dda7a73412879fd10c3(
    *,
    cache_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCachePolicy.CachePolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7e5746b5e9605c9b6058b245e37628d4de4a28a6ec81a063f83dcea2b8fc3e3(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    cloud_front_origin_access_identity_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__683eb561c6eda03fa343baf1dac94004449a9f5f958222dbcf3157aad3d2353a(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e16bd6a135e3ccb5946d8cee951e62c0ea1f7914d77fb803f6e8f45b4c813cd(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dbd0afebd21ffa009f133a600072844fc5616264b7a1829c3dea492b21c75315(
    value: typing.Union[_IResolvable_da3f097b, CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4999a9391c03ffa8a42c6617711deb35dfb94305e962c6704faa714a245dd9a(
    *,
    comment: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac17d18e4ddb1cb8a79015a96667059270fe5083273f938cf851deeb4c65e450(
    *,
    cloud_front_origin_access_identity_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnCloudFrontOriginAccessIdentity.CloudFrontOriginAccessIdentityConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b57269fe6faf53d2e30ff31a58c5711db8b8cc3b38dc9ac79efdb585dc8f324b(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95d0eeca39c0c26751595d2bbe6c1247ac12b7acdb2d7c9d28f5fb0eeacb7187(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__779f5842b62fc4504802401955475d45973a372c1d8293180cd8ce460b4e4823(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4581f42e1117e6de93836f594986c28a2378e8200e2f4a535cce028879382c9(
    value: typing.Union[_IResolvable_da3f097b, CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5bd1a74dffe3773a269b4a42a8f5fc37c7934b0931fd845b2923603086ea48cc(
    *,
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    staging_distribution_dns_names: typing.Sequence[builtins.str],
    single_header_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SingleHeaderPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    single_weight_policy_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SingleWeightPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    traffic_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.TrafficConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    type: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28b75d48272033dc185ab5e21f79a97315becd9c7999a921e0b955c636dc0311(
    *,
    idle_ttl: jsii.Number,
    maximum_ttl: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab2cd352992c9ba2b394cb9901d11c00f78ce00fd375f0cc51f4ae2401889435(
    *,
    header: builtins.str,
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cdc8f6ee6354e61b27155f9e23e4aa75f2a7ba61db0aefaa8b33d79f7772fe16(
    *,
    header: builtins.str,
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ba7d952d1015505a10d7999960852df19dab54d6b3113134cf9174ef1030b16(
    *,
    weight: jsii.Number,
    session_stickiness_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84e0588982dd4503df87db99f734b545b51a61216a04cbf8ae433c7e6041c065(
    *,
    weight: jsii.Number,
    session_stickiness_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SessionStickinessConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25e3b1d96d558cd97eeb1dde2cdbe1659675a2229aa5fd29c732485f764f4aa8(
    *,
    type: builtins.str,
    single_header_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SingleHeaderConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    single_weight_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.SingleWeightConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1d05eaadb3d9addfa31ffbe5c17411fc95adb41047f3e3765293c98277e66bd(
    *,
    continuous_deployment_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnContinuousDeploymentPolicy.ContinuousDeploymentPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81eda5f01ae8971b275cf76ed8b337277ad192ff5b49de8c33ebe25fd13da073(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40ba9750b9508c380e2724727094e58eb27b5c37b6b692cd0ef7c46535b474ea(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8bfc436bc745342bcff636516edf9ce81ca8e92694d3307ec6ab9bec0002f395(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e8ff8a9cdfd4490d2e3cfaa371fe6e07d1dd8cd413e3d3ac95e589565d9ed0c(
    value: typing.Union[_IResolvable_da3f097b, CfnDistribution.DistributionConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56e2d827e2f2ba5a0841aa9995f521ce75ad3be3fba3d8a6a555ca39d319d2f4(
    value: typing.Optional[typing.List[_CfnTag_f6864754]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40fab044003cdf2432d623590b2a89d0545d13047f180f029d22adc95cf31c5b(
    *,
    path_pattern: builtins.str,
    target_origin_id: builtins.str,
    viewer_protocol_policy: builtins.str,
    allowed_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
    cached_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
    cache_policy_id: typing.Optional[builtins.str] = None,
    compress: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    default_ttl: typing.Optional[jsii.Number] = None,
    field_level_encryption_id: typing.Optional[builtins.str] = None,
    forwarded_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.ForwardedValuesProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.FunctionAssociationProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    lambda_function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LambdaFunctionAssociationProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    max_ttl: typing.Optional[jsii.Number] = None,
    min_ttl: typing.Optional[jsii.Number] = None,
    origin_request_policy_id: typing.Optional[builtins.str] = None,
    realtime_log_config_arn: typing.Optional[builtins.str] = None,
    response_headers_policy_id: typing.Optional[builtins.str] = None,
    smooth_streaming: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[builtins.str]] = None,
    trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e44b3a9bc1a7e09b4dab8efd6baa05a8a81a531ccffdb2ea115b073bdbbb25e0(
    *,
    forward: builtins.str,
    whitelisted_names: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__165a54d7c992e96bdb527d46ec00363098905c57e6a02574f448cc32b8103dc8(
    *,
    error_code: jsii.Number,
    error_caching_min_ttl: typing.Optional[jsii.Number] = None,
    response_code: typing.Optional[jsii.Number] = None,
    response_page_path: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4818766b050bad18cc83a1490771aa31b5eaddfe75b97673cb8c97008d6067b6(
    *,
    origin_protocol_policy: builtins.str,
    http_port: typing.Optional[jsii.Number] = None,
    https_port: typing.Optional[jsii.Number] = None,
    origin_keepalive_timeout: typing.Optional[jsii.Number] = None,
    origin_read_timeout: typing.Optional[jsii.Number] = None,
    origin_ssl_protocols: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__acf9839d8791146628088e2f7ab6072f3232af301427572733ecdb1c51a7b94f(
    *,
    target_origin_id: builtins.str,
    viewer_protocol_policy: builtins.str,
    allowed_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
    cached_methods: typing.Optional[typing.Sequence[builtins.str]] = None,
    cache_policy_id: typing.Optional[builtins.str] = None,
    compress: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    default_ttl: typing.Optional[jsii.Number] = None,
    field_level_encryption_id: typing.Optional[builtins.str] = None,
    forwarded_values: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.ForwardedValuesProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.FunctionAssociationProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    lambda_function_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LambdaFunctionAssociationProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    max_ttl: typing.Optional[jsii.Number] = None,
    min_ttl: typing.Optional[jsii.Number] = None,
    origin_request_policy_id: typing.Optional[builtins.str] = None,
    realtime_log_config_arn: typing.Optional[builtins.str] = None,
    response_headers_policy_id: typing.Optional[builtins.str] = None,
    smooth_streaming: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[builtins.str]] = None,
    trusted_signers: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__924aa31797d5562075c15043a82632c8afbc217d476fdf805d7efea103da3360(
    *,
    default_cache_behavior: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DefaultCacheBehaviorProperty, typing.Dict[builtins.str, typing.Any]]],
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
    cache_behaviors: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CacheBehaviorProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    cnam_es: typing.Optional[typing.Sequence[builtins.str]] = None,
    comment: typing.Optional[builtins.str] = None,
    continuous_deployment_policy_id: typing.Optional[builtins.str] = None,
    custom_error_responses: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    custom_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LegacyCustomOriginProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    default_root_object: typing.Optional[builtins.str] = None,
    http_version: typing.Optional[builtins.str] = None,
    ipv6_enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    logging: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LoggingProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    origin_groups: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginGroupsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    origins: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    price_class: typing.Optional[builtins.str] = None,
    restrictions: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.RestrictionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    s3_origin: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.LegacyS3OriginProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    staging: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    viewer_certificate: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.ViewerCertificateProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    web_acl_id: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__829a3114025a8daee956dbcc0afa807f920ef6f096374b00826b1646ad863c3e(
    *,
    query_string: typing.Union[builtins.bool, _IResolvable_da3f097b],
    cookies: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CookiesProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    headers: typing.Optional[typing.Sequence[builtins.str]] = None,
    query_string_cache_keys: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9bbc3ed014a608917a180d2a9867ec9646bbd29af02fa61a3a829f7b27e15e81(
    *,
    event_type: typing.Optional[builtins.str] = None,
    function_arn: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95bd46ae407889173be5aed0249979fa29060c3f563d398aac36961967e9ce36(
    *,
    restriction_type: builtins.str,
    locations: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e6f5cc34036eacd4d5965f3264d177a65ea02e95ec0abf14ad79fd49e7743885(
    *,
    event_type: typing.Optional[builtins.str] = None,
    include_body: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    lambda_function_arn: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61d8581e13d95eb21648e21c4a5ac7785469e1c5145e441295fae6aaaa4023c4(
    *,
    dns_name: builtins.str,
    origin_protocol_policy: builtins.str,
    origin_ssl_protocols: typing.Sequence[builtins.str],
    http_port: typing.Optional[jsii.Number] = None,
    https_port: typing.Optional[jsii.Number] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e695ac5bc48e85bf9919e26bdb45e3de2d237ba2e8d90acd19414f7650ebf32c(
    *,
    dns_name: builtins.str,
    origin_access_identity: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a0c3d5ebfffb13f35ce0b0ca8f717738914598e4bca9e7b40ad11010a9c3b2c(
    *,
    bucket: builtins.str,
    include_cookies: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    prefix: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2cfa720a0d1d1c1fc7e085212905816d0c4e3cf518185fada3a39b9191cb0c0c(
    *,
    header_name: builtins.str,
    header_value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61dbb5bd2192479404eecdd9474c5bb62ba9671ee119d5f3f1b80dd80facd8a1(
    *,
    status_codes: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.StatusCodesProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__16bee92bcc24808d9dce56a72933a19326adcd53d49a178fd14a6e5ab68982e7(
    *,
    origin_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60f8ca14147351b458f575f380aa1c1cdcc066feae932cfccffead8ab29b0677(
    *,
    items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginGroupMemberProperty, typing.Dict[builtins.str, typing.Any]]]]],
    quantity: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd08423916d03eaf406b848a8b7d04e6dad1de842d0f03928145ff201c7ef387(
    *,
    failover_criteria: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginGroupFailoverCriteriaProperty, typing.Dict[builtins.str, typing.Any]]],
    id: builtins.str,
    members: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginGroupMembersProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ec6db0461baa77c3c5f4808e0fd24051c8b01a4b3b804d8c8e89cc3537cce65(
    *,
    quantity: jsii.Number,
    items: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginGroupProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb4237408749840dbecf9d9aed57975910052da22b994c7e13cc97c984a6e868(
    *,
    domain_name: builtins.str,
    id: builtins.str,
    connection_attempts: typing.Optional[jsii.Number] = None,
    connection_timeout: typing.Optional[jsii.Number] = None,
    custom_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.CustomOriginConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    origin_access_control_id: typing.Optional[builtins.str] = None,
    origin_custom_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginCustomHeaderProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
    origin_path: typing.Optional[builtins.str] = None,
    origin_shield: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.OriginShieldProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    s3_origin_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.S3OriginConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2a25e92d5905a4c19d3636ff8b631afa34a538497a13fa9d29e56ca404539e4(
    *,
    enabled: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4deb0a9215bd7c703383e0e2be801747efa09772f2b073423550aa9638220c0d(
    *,
    geo_restriction: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.GeoRestrictionProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d9ff629693eb9bcb66704ce461d05e62e0755b651cbbc7ead2b89151325cad7(
    *,
    origin_access_identity: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b8b62ce6bf1ec6151566719caf2d665f3f7fea596e402fba7354f19f781f23c(
    *,
    items: typing.Union[_IResolvable_da3f097b, typing.Sequence[jsii.Number]],
    quantity: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__511560286b35778c69f3d2a23120607f1ab2e58901f0c1ba7acd75a338eb699e(
    *,
    acm_certificate_arn: typing.Optional[builtins.str] = None,
    cloud_front_default_certificate: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    iam_certificate_id: typing.Optional[builtins.str] = None,
    minimum_protocol_version: typing.Optional[builtins.str] = None,
    ssl_support_method: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7553d47847912fd83a61da98a84c9c8cb5fdb95cf08048d70723db17c73053a(
    *,
    distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnDistribution.DistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7fd6686720dc42916d1486e9d86a083535cb418c14fb4746839d47b9f77562f0(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    function_code: builtins.str,
    function_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    name: builtins.str,
    auto_publish: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    function_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionMetadataProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__676078cdc388a90c2898708674577c94e68ab34efc8ba4848182b1bbcc55aa64(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be848cae7d7e602d35f1328d28b404d48c64e114b3652041c8e99479f97f7326(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97599332fb85693253c87028142c0596a8f097fc2e5e5c08def898b5d875a746(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e1085109b32e0c76599f999f799894997c5e13b7588671859ed027f4d0eceaf(
    value: typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49e27efb9a632d18d709cce44f4c9025bc32523c224dcb735351068e4a2f071f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__827ae5409caf9c9196670ea90d3ee72840fe49ac20cace1bd57d5f83fc2617cc(
    value: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe3c43f2af2adeb7b33e657cb565ba1627c04114bab013dcd445631d30026b9e(
    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnFunction.FunctionMetadataProperty]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e34db5cf326a0cd47f00dc35b60e1fbde4ec723cb88839d65178012682abd233(
    *,
    comment: builtins.str,
    runtime: builtins.str,
    key_value_store_associations: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.KeyValueStoreAssociationProperty, typing.Dict[builtins.str, typing.Any]]]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4371917f1ba460651436f0ac35c2459332e11b39c45862ccbe97c6bd6041aaed(
    *,
    function_arn: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7d3d29786c9dae5b37c513099f68b7af9dbc6d9fae4e0cbdcb48e77b4e6f592(
    *,
    key_value_store_arn: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8288752acdcd70ed40eb65e878d490645ed376ded173a5c2d02caa4e1e180024(
    *,
    function_code: builtins.str,
    function_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    name: builtins.str,
    auto_publish: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    function_metadata: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnFunction.FunctionMetadataProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f76122d8eb5a2e346f84a770990097cb3637adebdf9c4e339ad0d33ee6d2602c(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    key_group_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyGroup.KeyGroupConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4109b7a561956bf3aa5d6e3fcb68e6a1ee60d3d5519af53727e7a34f1cfebb26(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43ef7a43b54c4e399ff953d311d1306c5d84a03a0f390d5bfbf705dd507dbae0(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f5ed72b1e268631c85b0ecd81a9bcb5dda1c9af4f25021249f63cf35b6102f2a(
    value: typing.Union[_IResolvable_da3f097b, CfnKeyGroup.KeyGroupConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3df3a5f11f8060a5933f7e1b9bd07f224d639d93b3e4bbc56115c29e9e42201(
    *,
    items: typing.Sequence[builtins.str],
    name: builtins.str,
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e741b07b1138a784b11f2ea580eddc81dd7319624a4af9812aa5af954e6eecd(
    *,
    key_group_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyGroup.KeyGroupConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39a9c43a6e994ac270417da8b032b21384dbcc2f5eb680a69e9a420bb725c8a3(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    name: builtins.str,
    comment: typing.Optional[builtins.str] = None,
    import_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyValueStore.ImportSourceProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7cce3c0228e7ed2efc7ae086d760e1644b87da3af4e3ad96f5db8359c9d6a55(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57efaaf906bcd24d4e9a557ea42636dffa0cb26212a58d19d3ab685a531181c8(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31c81f83ed9c5a25440ffda441f09dcb33411d9684b0a3146646cb289054da0c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7ef3d5363a87ed84c6584e05c362a97bac2792589a6003e1851446b936205f8(
    value: typing.Optional[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bfd48a97d25e7b681206f3f821672b491cdb6e27eb4858257cc5f853e5674c56(
    value: typing.Optional[typing.Union[_IResolvable_da3f097b, CfnKeyValueStore.ImportSourceProperty]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c607ebfca7e05fb52f9d41898246334c1bd226fe4d739e9e3061836324174f88(
    *,
    source_arn: builtins.str,
    source_type: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46271f68955fd8497d5300c52e033d659758a0ba193251ef2f5c50bdda198fa2(
    *,
    name: builtins.str,
    comment: typing.Optional[builtins.str] = None,
    import_source: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnKeyValueStore.ImportSourceProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ced3ed079ed433587ef1975eb7679215d61c861fee5ee32066a1c0a3396cd698(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    distribution_id: builtins.str,
    monitoring_subscription: typing.Union[_IResolvable_da3f097b, typing.Union[CfnMonitoringSubscription.MonitoringSubscriptionProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f97fee287b7cc733d9e3d225cb221d2e6e85c8827eebd3a31754f7c8730e3f76(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6843f71d8a39e921ed9135a7df139720bb810abd43c3eb2d2fecda4798de72c4(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7800c3e8dc8908a3f056fdb42d3210ab64e0eab502963a833ad4c34e4f9fd397(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6a73e9da7bd64c6f8edfeda9db92c61f11177fd45e61323cc95783240a1f833(
    value: typing.Union[_IResolvable_da3f097b, CfnMonitoringSubscription.MonitoringSubscriptionProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b52c65657e5a9a1c856774b5fc17a8b4ae8f058973cb17f179c4bb277cac388(
    *,
    realtime_metrics_subscription_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnMonitoringSubscription.RealtimeMetricsSubscriptionConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3261c1424c358856cecb0c4a928988154b733f6cb60193809668157d473c98d(
    *,
    realtime_metrics_subscription_status: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__089c727048b6b3871663119f330661529675476b9932f9b82a2fc2053495a985(
    *,
    distribution_id: builtins.str,
    monitoring_subscription: typing.Union[_IResolvable_da3f097b, typing.Union[CfnMonitoringSubscription.MonitoringSubscriptionProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cede2a2577225484fb142173757735a061c8f8a7b77f7775c71aeb2558ef67b3(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    origin_access_control_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginAccessControl.OriginAccessControlConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__543dd4c22fad038021b080a1cf4dfdf0974d39f6434fef84a84800ed4ab06110(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__754e4ee68f0c6f44fd3ea6d6c2353cfb7720ea4c3ebc33bfd96ceb4402144bb2(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ce66d3b823fd9ddad2c2b62c7851eb33500f3dcb8168e58af67867c2f6aae9d(
    value: typing.Union[_IResolvable_da3f097b, CfnOriginAccessControl.OriginAccessControlConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe6bbad92b3305732dd85f773454e01a0834fcc91bbaf513be994c67698e5e3d(
    *,
    name: builtins.str,
    origin_access_control_origin_type: builtins.str,
    signing_behavior: builtins.str,
    signing_protocol: builtins.str,
    description: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b1fbc2954cdd2961f2225e1ee8c307ccf5186155cc0113debc58c59ad715aa9(
    *,
    origin_access_control_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginAccessControl.OriginAccessControlConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__871d96ff224e7800447b82036cafd3ac5d0f4648e4030dbdae394618d6ed3a14(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    origin_request_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__17a470a01a640b399abf4d951ca5ea2146c8bc5036fc78a0c198f47c6a0bfba4(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__adca9bb24d1f287e0c732fd2df9f03b98fac699c939f9780dcf75ddb176fb7d2(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__708e0c2a481cb4e4b68fc467580d318614020b97e17eaa433b6804731ced5237(
    value: typing.Union[_IResolvable_da3f097b, CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a47926a5ee3ea9da47695059c974e765d83ca1bddf1093f834026bd1127590a(
    *,
    cookie_behavior: builtins.str,
    cookies: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__90a333fc7f9bca79e47989a1bdea615205e7877a721603c7f09b019303991fe1(
    *,
    header_behavior: builtins.str,
    headers: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ba27550e98e403814785efd5215b6924c905fcd213901b3c80e06412bc851e4(
    *,
    cookies_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.CookiesConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    headers_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.HeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    name: builtins.str,
    query_strings_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.QueryStringsConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5bb1e5d3e926a4d875db1d85b4638271e50fe135a8b15196fcf07944de291749(
    *,
    query_string_behavior: builtins.str,
    query_strings: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa3e30be794fd122ac4b5c2f0e08c1d05c03023005916178d5d5c14e56db6f8d(
    *,
    origin_request_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnOriginRequestPolicy.OriginRequestPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b1958332a898112d6a8103bbe8e7c119db53593ff5ad9f5859b51e1f1ad03558(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    public_key_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPublicKey.PublicKeyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ab6df19428bbab908ddb2fa2f24965c865f8fbae43d39872e7bcaf980a5b5bb(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a03978cdc81f50281b256ef6525ad4c16b429dfa85a205ffdb9ba9a36e5f6312(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58d675c3580a784a3be69561798d55507bf948f7a586b6ccaa1aca861f3e22dd(
    value: typing.Union[_IResolvable_da3f097b, CfnPublicKey.PublicKeyConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2dbeb78225dce9b06a3668904d42ef0b88ff28373e78d80bc61dbc709b419ea3(
    *,
    caller_reference: builtins.str,
    encoded_key: builtins.str,
    name: builtins.str,
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f050d447a5019231355893cf57fb776121327d4b2a8364dc046c71f73dc854a8(
    *,
    public_key_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnPublicKey.PublicKeyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8600367ceeead504a7a5648f122da082bbe25466b2e32f26804dfa35f266326e(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    end_points: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRealtimeLogConfig.EndPointProperty, typing.Dict[builtins.str, typing.Any]]]]],
    fields: typing.Sequence[builtins.str],
    name: builtins.str,
    sampling_rate: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__af536cba20e954d3a14c778a5a00d1b1f0d499f83ceac3925c1957502198e6c5(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2609d67a254fddd137efba5e37254cdbd77efd1e74de5c15dd5403048de7c96(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a399b0f2984cadefbe5ab1596b0a4763a8f456c302dc65036725f1ad9a543e5b(
    value: typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnRealtimeLogConfig.EndPointProperty]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f4acb3fc802e66b33d46f5f1737506960b7058ccd04caba1ad1db22c81983a4(
    value: typing.List[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4611dc2e52a8827da74b1cab9e79ef1a4b59423fda9e0b7a1f949d411f767a55(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fae7e2f43229ce281266cc0e965c660b0c47348bdab2a464e668be589b0b8256(
    value: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce5fe06d411d184ca37ecebb5346fe111d87f2365b393be8adb6cd407fa42cb7(
    *,
    kinesis_stream_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnRealtimeLogConfig.KinesisStreamConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    stream_type: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fef9031ebca9c7cf81e35b997de2b35a3077ec1073566ec4a4555f7b072e696f(
    *,
    role_arn: builtins.str,
    stream_arn: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87355c4f65a5747cdf3935a3350fc53ac6c9b6571d8397f85c1c8247bf479959(
    *,
    end_points: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnRealtimeLogConfig.EndPointProperty, typing.Dict[builtins.str, typing.Any]]]]],
    fields: typing.Sequence[builtins.str],
    name: builtins.str,
    sampling_rate: jsii.Number,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2887da28e2f7d008cf9b91797497a167a286e4f5b55f3a746aa7c2c40ed1c0b6(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    response_headers_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__419de318daa622efd8b07d03f54fdf81f2e3b54e20726f56489ea749aa977c1b(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63d973f921eab7f9fc08c9930e3542c71384381836f9fdfc3544abaf75c1ce3a(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9664ad8baf2a412170daf27d190c8b070be288076aab09583c9dbfb1818b4229(
    value: typing.Union[_IResolvable_da3f097b, CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__773e5afcb00aff98780d3b24461b811a3ca2d3d3f1ea0374b5ba92d55be95212(
    *,
    items: typing.Sequence[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e9eb9049251ab2f72740cb4b094dc8f2052945de7b62fbabaab3ed147999315(
    *,
    items: typing.Sequence[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6870436c7a83f82baddf1b8993ea77062e833262e7ad9b274479252b61afa2ae(
    *,
    items: typing.Sequence[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a093c9baeae42c526ce5d0b5f26c2323072f572ebf50651839ad0d56a4846ed4(
    *,
    items: typing.Sequence[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4d3e987763161c0746b782403d40ea0c2ff123f7ae5dff00da0defccbdc83cf(
    *,
    content_security_policy: builtins.str,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d77b463fb3cd8f602aca9b082752b8d07f4cf22b87bcdffcfaf82f5a3dd3d21e(
    *,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d24abc4864d269da012deb3b8467c06fe4383437c6d52eb9608e91d90c5663a(
    *,
    access_control_allow_credentials: typing.Union[builtins.bool, _IResolvable_da3f097b],
    access_control_allow_headers: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.AccessControlAllowHeadersProperty, typing.Dict[builtins.str, typing.Any]]],
    access_control_allow_methods: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.AccessControlAllowMethodsProperty, typing.Dict[builtins.str, typing.Any]]],
    access_control_allow_origins: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.AccessControlAllowOriginsProperty, typing.Dict[builtins.str, typing.Any]]],
    origin_override: typing.Union[builtins.bool, _IResolvable_da3f097b],
    access_control_expose_headers: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.AccessControlExposeHeadersProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    access_control_max_age_sec: typing.Optional[jsii.Number] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__107330832c6d40d72f1dacd4d00b0baf26409d71a15dcf3e4ffebd1100e2b2d2(
    *,
    header: builtins.str,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91ab0561b82f54c5ddb97c204523f77b107792a7b0910bc0341d00aedc2157c0(
    *,
    items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.CustomHeaderProperty, typing.Dict[builtins.str, typing.Any]]]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a680a281a082f31d5ee32556902ef482795469006054440265fd3bdefc49d0c(
    *,
    frame_option: builtins.str,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01ff74d1cc6df3364aff2a82c1644eb87b8e4f4bad151996dbda308134972f74(
    *,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
    referrer_policy: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5bf434f98e57f1ac6a1720a0347de831b65bf3c0a4b3680d8a9633e4c356d939(
    *,
    header: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02662651d1c045bbf4485a4b77e8d96e2947dd266570ea70b852d1d5ba676571(
    *,
    items: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.RemoveHeaderProperty, typing.Dict[builtins.str, typing.Any]]]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9d75721553556d33ddbdbec6773a260748b117e2a3cfd6d0e5386d014560171a(
    *,
    name: builtins.str,
    comment: typing.Optional[builtins.str] = None,
    cors_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.CorsConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    custom_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.CustomHeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    remove_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.RemoveHeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    security_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.SecurityHeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    server_timing_headers_config: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ServerTimingHeadersConfigProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42c151ba3f332af87420a4d861cd73e704b4d71c655a609155037328eab185ff(
    *,
    content_security_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ContentSecurityPolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    content_type_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ContentTypeOptionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    frame_options: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.FrameOptionsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    referrer_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ReferrerPolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    strict_transport_security: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.StrictTransportSecurityProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    xss_protection: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.XSSProtectionProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7287f7cb87a31b9049dab2c1b40c35e5b8f06f0faf1827f8a2351ebaaaed4d45(
    *,
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    sampling_rate: typing.Optional[jsii.Number] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed70aa7da28104db0f7ad239afaa8d904abf3cd909e05cc36724ddb717abff80(
    *,
    access_control_max_age_sec: jsii.Number,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
    include_subdomains: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    preload: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5cb6b2605fdf9baf4f99e2d19193e93d8c1596ba58cc1248db85347b49a33b46(
    *,
    override: typing.Union[builtins.bool, _IResolvable_da3f097b],
    protection: typing.Union[builtins.bool, _IResolvable_da3f097b],
    mode_block: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
    report_uri: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f8511083ec6665a44270c5e9c28a72f850eee19740fa9ddf72640068ce2a2cb(
    *,
    response_headers_policy_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnResponseHeadersPolicy.ResponseHeadersPolicyConfigProperty, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__17ca08764f2b6977e10df04a284bfbc1dbaa0d6bbc803a829470cc3b9d6af3e5(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    streaming_distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.StreamingDistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ac1854f5f193377cda6bb81ca0d6ba242bd208bc7a9cf98c91ebe2ce4c52ed6(
    inspector: _TreeInspector_488e0dd5,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__819e188a059835947d7598f592d6c32e47d6dd56947e197d47b14f4b0011cfe2(
    props: typing.Mapping[builtins.str, typing.Any],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc8a8d78e195f1bab99bca7ea58d3b6a029844997b8e6940d737f147d8dcc6d2(
    value: typing.Union[_IResolvable_da3f097b, CfnStreamingDistribution.StreamingDistributionConfigProperty],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a91a3a4fec8e270215622a8e9c4af00c6cfb4cfbe6700e58871b60ab722463f(
    value: typing.Optional[typing.List[_CfnTag_f6864754]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__795127bdb4c64be24c3c21c115b84685ac7559387940a97c90aba108bcd5a4e2(
    *,
    bucket: builtins.str,
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    prefix: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ff1dcf0acb5b66c663decda982b7a72c0adc51ed56e979cac91b64f10de923c(
    *,
    domain_name: builtins.str,
    origin_access_identity: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f50c61c21b5e047b7581d74bb0c2bfc94029fc8749c581d945be8555eb4b1a5c(
    *,
    comment: builtins.str,
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    s3_origin: typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.S3OriginProperty, typing.Dict[builtins.str, typing.Any]]],
    trusted_signers: typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.TrustedSignersProperty, typing.Dict[builtins.str, typing.Any]]],
    aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
    logging: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.LoggingProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    price_class: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49f382fbeca6f3ca4b73ecf7372c7a177aa462053b1953cff5b08a7fe5d5f174(
    *,
    enabled: typing.Union[builtins.bool, _IResolvable_da3f097b],
    aws_account_numbers: typing.Optional[typing.Sequence[builtins.str]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb98a63a577b61baa6128a211026a41a13348dc9752d07118d9db5c63108ad97(
    *,
    streaming_distribution_config: typing.Union[_IResolvable_da3f097b, typing.Union[CfnStreamingDistribution.StreamingDistributionConfigProperty, typing.Dict[builtins.str, typing.Any]]],
    tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4066bd6a3cdef7b839e125a6133e4a1d52cc939d9ec9dd0288d2750b135e9452(
    *,
    distribution_id: builtins.str,
    domain_name: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e1461b88a00922880847706a707c6c0dac98194e09fb0d242ce56edf1df5a57(
    *,
    origin_configs: typing.Sequence[typing.Union[SourceConfiguration, typing.Dict[builtins.str, typing.Any]]],
    comment: typing.Optional[builtins.str] = None,
    default_root_object: typing.Optional[builtins.str] = None,
    enabled: typing.Optional[builtins.bool] = None,
    enable_ip_v6: typing.Optional[builtins.bool] = None,
    error_configurations: typing.Optional[typing.Sequence[typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    geo_restriction: typing.Optional[GeoRestriction] = None,
    http_version: typing.Optional[HttpVersion] = None,
    logging_config: typing.Optional[typing.Union[LoggingConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
    price_class: typing.Optional[PriceClass] = None,
    viewer_certificate: typing.Optional[ViewerCertificate] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
    web_acl_id: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92ab974e2c359370c8dd8404a1254b379ed25c751976bee86e79d73ab441d0dc(
    *,
    domain_name: builtins.str,
    allowed_origin_ssl_versions: typing.Optional[typing.Sequence[OriginSslPolicy]] = None,
    http_port: typing.Optional[jsii.Number] = None,
    https_port: typing.Optional[jsii.Number] = None,
    origin_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    origin_keepalive_timeout: typing.Optional[_Duration_4839e8c3] = None,
    origin_path: typing.Optional[builtins.str] = None,
    origin_protocol_policy: typing.Optional[OriginProtocolPolicy] = None,
    origin_read_timeout: typing.Optional[_Duration_4839e8c3] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bdb1dabb4ef81db5426cfd2e6a993db830c4e51f34b7dd369e6f07cd681d4f09(
    *,
    distribution_id: builtins.str,
    domain_name: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c72abdcdfdddafd2ae88355978fb7eb563a14866cc02f8396484e058a9202ea2(
    *,
    default_behavior: typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]],
    additional_behaviors: typing.Optional[typing.Mapping[builtins.str, typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]]]] = None,
    certificate: typing.Optional[_ICertificate_c194c70b] = None,
    comment: typing.Optional[builtins.str] = None,
    default_root_object: typing.Optional[builtins.str] = None,
    domain_names: typing.Optional[typing.Sequence[builtins.str]] = None,
    enabled: typing.Optional[builtins.bool] = None,
    enable_ipv6: typing.Optional[builtins.bool] = None,
    enable_logging: typing.Optional[builtins.bool] = None,
    error_responses: typing.Optional[typing.Sequence[typing.Union[ErrorResponse, typing.Dict[builtins.str, typing.Any]]]] = None,
    geo_restriction: typing.Optional[GeoRestriction] = None,
    http_version: typing.Optional[HttpVersion] = None,
    log_bucket: typing.Optional[_IBucket_42e086fd] = None,
    log_file_prefix: typing.Optional[builtins.str] = None,
    log_includes_cookies: typing.Optional[builtins.bool] = None,
    minimum_protocol_version: typing.Optional[SecurityPolicyProtocol] = None,
    price_class: typing.Optional[PriceClass] = None,
    publish_additional_metrics: typing.Optional[builtins.bool] = None,
    ssl_support_method: typing.Optional[SSLMethod] = None,
    web_acl_id: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__781a001f914aef1215b9a46bb776fc1b219e3114ade7e4b83077fa900881c60a(
    *,
    event_type: LambdaEdgeEventType,
    function_version: _IVersion_faf7234e,
    include_body: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2988248094ccacba36276af35085c12ac3fac82279e37dccef9388ae4196ca6d(
    stream: _IStream_4e2457d2,
    role: typing.Optional[_IRole_235f5d8e] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bee8b946e8aa5bcc2706c6314a79df3c9e4b0ba79127bd0c37d6a3805a6b5bf(
    *,
    http_status: jsii.Number,
    response_http_status: typing.Optional[jsii.Number] = None,
    response_page_path: typing.Optional[builtins.str] = None,
    ttl: typing.Optional[_Duration_4839e8c3] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9cdc828d846bfe9d79c6fc8bef720d356a6be7ab3e05f715737d57083f285a8(
    *,
    file_path: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0785f3d1d4dbd54d8a987edcb6c2627d77e3a568a16ce08ab0cd3ad2a96e39ff(
    *,
    event_type: FunctionEventType,
    function: IFunction,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__903bbff401b8a2560d333137b7ac614ba7cdaa77d8d3034c4d8a9e13de5b1b01(
    *,
    function_arn: builtins.str,
    function_name: builtins.str,
    function_runtime: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e3494c015ce98060d9db266d49711978f619c5ef5558a3e89c5b5c6a5c3753f(
    code: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8243b62a44e046850892a519da42366ef0e5b346474e3be3ebcb455dd6aa04df(
    *,
    code: FunctionCode,
    comment: typing.Optional[builtins.str] = None,
    function_name: typing.Optional[builtins.str] = None,
    key_value_store: typing.Optional[IKeyValueStore] = None,
    runtime: typing.Optional[FunctionRuntime] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__631c8d0b51cac2d9ffcbfad4bfbcc5e76ea97cde669fb05e21ba361b851513db(
    runtime_string: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a13eb93043db156a3265f56351965e4b4e9937ab6e803df3499b6885645f2bb6(
    *locations: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24b31469b40ea0166f23931bcce346a12c7bb33e828af041a41fc188ec32a008(
    *locations: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1f094d764e7044bda61b03a856a844a6c04d7a3a8c3074282ec5cf861c8fe4b(
    identity: _IGrantable_71c4f5de,
    *actions: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0da834b81f05c7b03da27ef7cb73b4a87abd54c9f5430cc3f6f2866079c82b8(
    identity: _IGrantable_71c4f5de,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88031486a507fddae1a9cd6ed970521f2a57d7953a1e564c2c5d97b8591065f2(
    scope: _constructs_77d1e7e8.Construct,
    *,
    origin_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f5d4750ca4d7703f815ca46be8b91e46ea0b813f42846026dff63e00f3b01302(
    path: builtins.str,
    *,
    deploy_time: typing.Optional[builtins.bool] = None,
    readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
    asset_hash: typing.Optional[builtins.str] = None,
    asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
    bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
    exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
    follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
    ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__199a9d2f509e6bf2ce32ccd58ce284ca48a05841123773473504a43c39588730(
    bucket: _IBucket_42e086fd,
    key: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c6747d6cf01bdf872790a9315f48bb3e3363e1c57d3a822e5cf812d017c9661(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    items: typing.Sequence[IPublicKey],
    comment: typing.Optional[builtins.str] = None,
    key_group_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c19fe95da8aeeeb87e31eba40445bb529c1563db47685e07fffcd44bb41b095(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    key_group_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c42362898414602d0064aac5432fc41cadd378821fd0d3ec155f7a75af3f1e4(
    *,
    items: typing.Sequence[IPublicKey],
    comment: typing.Optional[builtins.str] = None,
    key_group_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbcb7711d84a000f571b2303bf96f7a4319741a396d620e3f2c749be479fdde1(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    comment: typing.Optional[builtins.str] = None,
    key_value_store_name: typing.Optional[builtins.str] = None,
    source: typing.Optional[ImportSource] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6286cfc55d9b5b70d728248f5d869f6b99814bbec3d61416b9ff28849cdca011(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    key_value_store_arn: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0885cf023551545b14a4696bf116b851a0c7733cc2987782ba95a29b134a062e(
    *,
    comment: typing.Optional[builtins.str] = None,
    key_value_store_name: typing.Optional[builtins.str] = None,
    source: typing.Optional[ImportSource] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1cc70f1ca9c8fff5a72f34c1e001c9ece45f76199d1574048a6ec3fa44fbba48(
    *,
    event_type: LambdaEdgeEventType,
    lambda_function: _IVersion_faf7234e,
    include_body: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1c495121d3f25343764da863019d723da4b7d05ac74ed07b91c30326bd60f42(
    *,
    bucket: typing.Optional[_IBucket_42e086fd] = None,
    include_cookies: typing.Optional[builtins.bool] = None,
    prefix: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff86c7c3a54c3012c2e56787024ba13254594b3c0ca9aa271798797fe668270a(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5200c02dd4e6219704c4ac062b08ed6c07d13da76e4d84b30c0470218177ea67(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    origin_access_identity_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__252615cd4075890e9b97e25f95b99e87b2e94a66cad966f32c9fd7a78d5c37e8(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    origin_access_identity_name: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__143f91820e990f7bf9dcb0392e6c177f508af6993b1798797c5ae5dcba9733a4(
    *,
    comment: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b13f814bf47a5f3949ffc4b53034b4702a02836213167c9ba4c6a8d6e8f623e(
    domain_name: builtins.str,
    *,
    origin_path: typing.Optional[builtins.str] = None,
    connection_attempts: typing.Optional[jsii.Number] = None,
    connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
    custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    origin_id: typing.Optional[builtins.str] = None,
    origin_shield_enabled: typing.Optional[builtins.bool] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8428dfc90e69bdd5363e69afd9c590a4ed2f1363b22242197295117dc5221878(
    _scope: _constructs_77d1e7e8.Construct,
    *,
    origin_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3e6a8992dd905a0c0d851cfed62aa0f881803068317a0b59eb84571249e84f1(
    *,
    failover_config: typing.Optional[typing.Union[OriginFailoverConfig, typing.Dict[builtins.str, typing.Any]]] = None,
    origin_property: typing.Optional[typing.Union[CfnDistribution.OriginProperty, typing.Dict[builtins.str, typing.Any]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0dbe700920dc77d0410da01e091c5caab2d3bb29313320e6057ed87275ccc649(
    *,
    origin_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38e0ba1250f1054d0ee50985aeec5f9f8030b5b28a88aa0fdda0f919636952bc(
    *,
    failover_origin: IOrigin,
    status_codes: typing.Optional[typing.Sequence[jsii.Number]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__554f93c57439378c8175676cc442eaea5c8ec961a156b1f26e60df9cd428fcc8(
    *,
    connection_attempts: typing.Optional[jsii.Number] = None,
    connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
    custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    origin_id: typing.Optional[builtins.str] = None,
    origin_shield_enabled: typing.Optional[builtins.bool] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1f5da480c426bb32e14bbbeb482146cc90bcd3678f902c46f0f2f73995b0ffa(
    *,
    connection_attempts: typing.Optional[jsii.Number] = None,
    connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
    custom_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    origin_id: typing.Optional[builtins.str] = None,
    origin_shield_enabled: typing.Optional[builtins.bool] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
    origin_path: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b8269be835f9da749d549383d8951224e3457a97f62046a53327e2f5c2cd49a(
    *cookies: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__008183a3117dfcb2b8343daac09d7d25d4ab1c6ab65416bcab43b1207e05b8d9(
    *cookies: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__383fa7ac6f385ddef1c437636060592a64c46b8ecd239de2282032e4802d8152(
    *cloudfront_headers: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0af46524a400348290f2dd406a74c3cfdfcd0b98f3d7c390ac3a1c5b20289b4b(
    *headers: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55c517b4712d259617472c7499bb2235cadb05a92ed299020d86e1bd9760c3a0(
    *headers: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e885e7a4a9115b26e667d3ce393d00a2544e4dd8e14aaebede3dc44cc5529950(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    comment: typing.Optional[builtins.str] = None,
    cookie_behavior: typing.Optional[OriginRequestCookieBehavior] = None,
    header_behavior: typing.Optional[OriginRequestHeaderBehavior] = None,
    origin_request_policy_name: typing.Optional[builtins.str] = None,
    query_string_behavior: typing.Optional[OriginRequestQueryStringBehavior] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43549cc88635c871acbe8816f79b9a3ef446fc5c8ed521dbbc6da0ccd90054f5(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    origin_request_policy_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec4f66fbb29fda8f3270c9ee4c3640dc9a5ecda29289597df21d4e0b71e23b68(
    *,
    comment: typing.Optional[builtins.str] = None,
    cookie_behavior: typing.Optional[OriginRequestCookieBehavior] = None,
    header_behavior: typing.Optional[OriginRequestHeaderBehavior] = None,
    origin_request_policy_name: typing.Optional[builtins.str] = None,
    query_string_behavior: typing.Optional[OriginRequestQueryStringBehavior] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae451ad3ac09bf0211b7d5e644b3be2e95ca44931114c00853e0c41d4c9f6390(
    *query_strings: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcd8f6960f4da45cf3ffe6621991313b5539701d2536df92c50a213e97e2d673(
    *query_strings: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e1d5b018505383d83a9bcf1d71da4d03e20b34d63a8072edc955897c86bd396(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    encoded_key: builtins.str,
    comment: typing.Optional[builtins.str] = None,
    public_key_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a372140d57e306c95e0eac7dc64ba363242f34dddada8274869ba6733360f7c3(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    public_key_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab6d6a7ffe806c347a4fbac3b890074d407fcf2dd19c1ca56da8ddc83cb3ad61(
    *,
    encoded_key: builtins.str,
    comment: typing.Optional[builtins.str] = None,
    public_key_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b962b5c5a537a691dd467162db6671972caadd6e84b4764e913417754964503(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    end_points: typing.Sequence[Endpoint],
    fields: typing.Sequence[builtins.str],
    sampling_rate: jsii.Number,
    realtime_log_config_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b859af3e83837e7af12d51c04e73c677e6547a840cf0007c8eb70ab1c6f3e5c8(
    *,
    end_points: typing.Sequence[Endpoint],
    fields: typing.Sequence[builtins.str],
    sampling_rate: jsii.Number,
    realtime_log_config_name: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f01a1d404d8a9d35e0fe277e7119cfd36cf5184ed0930085a67855baa85b7a91(
    *,
    header: builtins.str,
    override: builtins.bool,
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5f578d45a3fe9e583b5a9e8f6718db9250923e8cdfee2a4ab5acc14ec9050e9(
    *,
    custom_headers: typing.Sequence[typing.Union[ResponseCustomHeader, typing.Dict[builtins.str, typing.Any]]],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37103032f6e1589582f3aeddcec6e717b2d9eaeb0b89c98cd14f096380c0dd71(
    *,
    content_security_policy: builtins.str,
    override: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd25d891e1639c1e6b6acd944b8462cdd1f9935eabd50612051ac11b640fab48(
    *,
    override: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f4355d3e23f2ae161fa57983ee96962f26612012f7f6471bd872191d94c2877(
    *,
    access_control_allow_credentials: builtins.bool,
    access_control_allow_headers: typing.Sequence[builtins.str],
    access_control_allow_methods: typing.Sequence[builtins.str],
    access_control_allow_origins: typing.Sequence[builtins.str],
    origin_override: builtins.bool,
    access_control_expose_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
    access_control_max_age: typing.Optional[_Duration_4839e8c3] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83e225184728062d9c6c7e8fe86cceff0ee3e7086aaa9dc988904e6d36bee0b5(
    *,
    frame_option: HeadersFrameOption,
    override: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c65e59c990466ba6d4cec24189c57194f1b1e938661cabbf5af2857c7792a28(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    comment: typing.Optional[builtins.str] = None,
    cors_behavior: typing.Optional[typing.Union[ResponseHeadersCorsBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    custom_headers_behavior: typing.Optional[typing.Union[ResponseCustomHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    remove_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
    response_headers_policy_name: typing.Optional[builtins.str] = None,
    security_headers_behavior: typing.Optional[typing.Union[ResponseSecurityHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    server_timing_sampling_rate: typing.Optional[jsii.Number] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f630acbadbe2836493eb85c732b26b45500ee90f2504a40128321ee2efab7603(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    response_headers_policy_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48943f3f237f42c21c68643192917fbc6413eb95efd05d29e67aa66b75613c59(
    *,
    comment: typing.Optional[builtins.str] = None,
    cors_behavior: typing.Optional[typing.Union[ResponseHeadersCorsBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    custom_headers_behavior: typing.Optional[typing.Union[ResponseCustomHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    remove_headers: typing.Optional[typing.Sequence[builtins.str]] = None,
    response_headers_policy_name: typing.Optional[builtins.str] = None,
    security_headers_behavior: typing.Optional[typing.Union[ResponseSecurityHeadersBehavior, typing.Dict[builtins.str, typing.Any]]] = None,
    server_timing_sampling_rate: typing.Optional[jsii.Number] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__514cc47069ac611c2eda37493d652269b1b116a5ce59d515a9a8bfbcdd5eac3e(
    *,
    override: builtins.bool,
    referrer_policy: HeadersReferrerPolicy,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4e0940acf2339cf3a07ca9ffe31acdd52a17c3e42a2acb8b4ef0bc3cc040c9c(
    *,
    access_control_max_age: _Duration_4839e8c3,
    override: builtins.bool,
    include_subdomains: typing.Optional[builtins.bool] = None,
    preload: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a62858b9d5373489e0c3429f2d59585f609b67bc76b59bf4f3a65ddd5742febc(
    *,
    override: builtins.bool,
    protection: builtins.bool,
    mode_block: typing.Optional[builtins.bool] = None,
    report_uri: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb11968ba35df78b776ef4a98fdb6f7be69c1246b510ef919ab61befd9939553(
    *,
    content_security_policy: typing.Optional[typing.Union[ResponseHeadersContentSecurityPolicy, typing.Dict[builtins.str, typing.Any]]] = None,
    content_type_options: typing.Optional[typing.Union[ResponseHeadersContentTypeOptions, typing.Dict[builtins.str, typing.Any]]] = None,
    frame_options: typing.Optional[typing.Union[ResponseHeadersFrameOptions, typing.Dict[builtins.str, typing.Any]]] = None,
    referrer_policy: typing.Optional[typing.Union[ResponseHeadersReferrerPolicy, typing.Dict[builtins.str, typing.Any]]] = None,
    strict_transport_security: typing.Optional[typing.Union[ResponseHeadersStrictTransportSecurity, typing.Dict[builtins.str, typing.Any]]] = None,
    xss_protection: typing.Optional[typing.Union[ResponseHeadersXSSProtection, typing.Dict[builtins.str, typing.Any]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50b2e52880076ae956da5eb2d05fa8de1161eb1b2df762d8dafbf8e6bbfa4639(
    bucket: _IBucket_42e086fd,
    key: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e5837aa017bcf235e169321284a6cfe3cd3ac7b3c0baef0d9b68b55e8da518be(
    *,
    s3_bucket_source: _IBucket_42e086fd,
    origin_access_identity: typing.Optional[IOriginAccessIdentity] = None,
    origin_headers: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    origin_path: typing.Optional[builtins.str] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ccea0761c172529885c07d5e167927d1ae78b92776ef8b892c36faadf6bb0dce(
    *,
    behaviors: typing.Sequence[typing.Union[Behavior, typing.Dict[builtins.str, typing.Any]]],
    connection_attempts: typing.Optional[jsii.Number] = None,
    connection_timeout: typing.Optional[_Duration_4839e8c3] = None,
    custom_origin_source: typing.Optional[typing.Union[CustomOriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
    failover_criteria_status_codes: typing.Optional[typing.Sequence[FailoverStatusCode]] = None,
    failover_custom_origin_source: typing.Optional[typing.Union[CustomOriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
    failover_s3_origin_source: typing.Optional[typing.Union[S3OriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
    origin_shield_region: typing.Optional[builtins.str] = None,
    s3_origin_source: typing.Optional[typing.Union[S3OriginConfig, typing.Dict[builtins.str, typing.Any]]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__32c93e9d34723e934bcd1fe5aa6cff4345177cac1db5a7d27edb46ee71a3039b(
    certificate: _ICertificate_c194c70b,
    *,
    aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
    security_policy: typing.Optional[SecurityPolicyProtocol] = None,
    ssl_method: typing.Optional[SSLMethod] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7e3bfe50fa9fa1021510c74ea173b88833f4eab10b4f6b93e13ee0884dd899ba(
    *aliases: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__506a4c849d10b2bf2933c109cc2881f1d2378b90a4e949b700ae00a7caced565(
    iam_certificate_id: builtins.str,
    *,
    aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
    security_policy: typing.Optional[SecurityPolicyProtocol] = None,
    ssl_method: typing.Optional[SSLMethod] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1fca8e67199164c4d795df93e2e45befd6c6e688025259d033408b16a7f663c(
    *,
    aliases: typing.Optional[typing.Sequence[builtins.str]] = None,
    security_policy: typing.Optional[SecurityPolicyProtocol] = None,
    ssl_method: typing.Optional[SSLMethod] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62441d3d3228ae5fb69aaca12e603944f07f9335dae80f70ce3b04e8e353f020(
    path: builtins.str,
    *,
    deploy_time: typing.Optional[builtins.bool] = None,
    readers: typing.Optional[typing.Sequence[_IGrantable_71c4f5de]] = None,
    asset_hash: typing.Optional[builtins.str] = None,
    asset_hash_type: typing.Optional[_AssetHashType_05b67f2d] = None,
    bundling: typing.Optional[typing.Union[_BundlingOptions_588cc936, typing.Dict[builtins.str, typing.Any]]] = None,
    exclude: typing.Optional[typing.Sequence[builtins.str]] = None,
    follow_symlinks: typing.Optional[_SymlinkFollowMode_047ec1f6] = None,
    ignore_mode: typing.Optional[_IgnoreMode_655a98e8] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8a9474ce476b57ed85f97b060b559f6bc96bb0780255754efa416b3f31f18e5(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    cache_policy_name: typing.Optional[builtins.str] = None,
    comment: typing.Optional[builtins.str] = None,
    cookie_behavior: typing.Optional[CacheCookieBehavior] = None,
    default_ttl: typing.Optional[_Duration_4839e8c3] = None,
    enable_accept_encoding_brotli: typing.Optional[builtins.bool] = None,
    enable_accept_encoding_gzip: typing.Optional[builtins.bool] = None,
    header_behavior: typing.Optional[CacheHeaderBehavior] = None,
    max_ttl: typing.Optional[_Duration_4839e8c3] = None,
    min_ttl: typing.Optional[_Duration_4839e8c3] = None,
    query_string_behavior: typing.Optional[CacheQueryStringBehavior] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__021efa4f6feaf855cba1b4a34877c6dbb10aec00527a213f7cebf59d57cfbd3c(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    cache_policy_id: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10cf4b33f291ebea192f1ea6c37ed91936b858def6e1350c920f21db71902d54(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    origin_configs: typing.Sequence[typing.Union[SourceConfiguration, typing.Dict[builtins.str, typing.Any]]],
    comment: typing.Optional[builtins.str] = None,
    default_root_object: typing.Optional[builtins.str] = None,
    enabled: typing.Optional[builtins.bool] = None,
    enable_ip_v6: typing.Optional[builtins.bool] = None,
    error_configurations: typing.Optional[typing.Sequence[typing.Union[CfnDistribution.CustomErrorResponseProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
    geo_restriction: typing.Optional[GeoRestriction] = None,
    http_version: typing.Optional[HttpVersion] = None,
    logging_config: typing.Optional[typing.Union[LoggingConfiguration, typing.Dict[builtins.str, typing.Any]]] = None,
    price_class: typing.Optional[PriceClass] = None,
    viewer_certificate: typing.Optional[ViewerCertificate] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
    web_acl_id: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea3b674a8185c8a9d03501ece5d860a4700034e19e03fc3a57d05fc8623fafc9(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    distribution_id: builtins.str,
    domain_name: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbe540671a65a5420a5e19288df418399a2c78bc5c1c07de38b3f735b89a36ed(
    identity: _IGrantable_71c4f5de,
    *actions: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e035551f14cb51c65a18baf4f340f3be55199133afe180ca2138a8a0e86e6f8(
    identity: _IGrantable_71c4f5de,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7aacedff6241d454506db6fd614d1052310e1396435b71669cb481c9436bd003(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    default_behavior: typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]],
    additional_behaviors: typing.Optional[typing.Mapping[builtins.str, typing.Union[BehaviorOptions, typing.Dict[builtins.str, typing.Any]]]] = None,
    certificate: typing.Optional[_ICertificate_c194c70b] = None,
    comment: typing.Optional[builtins.str] = None,
    default_root_object: typing.Optional[builtins.str] = None,
    domain_names: typing.Optional[typing.Sequence[builtins.str]] = None,
    enabled: typing.Optional[builtins.bool] = None,
    enable_ipv6: typing.Optional[builtins.bool] = None,
    enable_logging: typing.Optional[builtins.bool] = None,
    error_responses: typing.Optional[typing.Sequence[typing.Union[ErrorResponse, typing.Dict[builtins.str, typing.Any]]]] = None,
    geo_restriction: typing.Optional[GeoRestriction] = None,
    http_version: typing.Optional[HttpVersion] = None,
    log_bucket: typing.Optional[_IBucket_42e086fd] = None,
    log_file_prefix: typing.Optional[builtins.str] = None,
    log_includes_cookies: typing.Optional[builtins.bool] = None,
    minimum_protocol_version: typing.Optional[SecurityPolicyProtocol] = None,
    price_class: typing.Optional[PriceClass] = None,
    publish_additional_metrics: typing.Optional[builtins.bool] = None,
    ssl_support_method: typing.Optional[SSLMethod] = None,
    web_acl_id: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe98eb36f48aa8f0ac0f52c535bd54102eabaead0298d4caa98eb6e9700716c4(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    distribution_id: builtins.str,
    domain_name: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f94c33f8f74d148b7c436f42a002e770c6ad95241e489b963596aea62818c051(
    path_pattern: builtins.str,
    origin: IOrigin,
    *,
    allowed_methods: typing.Optional[AllowedMethods] = None,
    cached_methods: typing.Optional[CachedMethods] = None,
    cache_policy: typing.Optional[ICachePolicy] = None,
    compress: typing.Optional[builtins.bool] = None,
    edge_lambdas: typing.Optional[typing.Sequence[typing.Union[EdgeLambda, typing.Dict[builtins.str, typing.Any]]]] = None,
    function_associations: typing.Optional[typing.Sequence[typing.Union[FunctionAssociation, typing.Dict[builtins.str, typing.Any]]]] = None,
    origin_request_policy: typing.Optional[IOriginRequestPolicy] = None,
    realtime_log_config: typing.Optional[IRealtimeLogConfig] = None,
    response_headers_policy: typing.Optional[IResponseHeadersPolicy] = None,
    smooth_streaming: typing.Optional[builtins.bool] = None,
    trusted_key_groups: typing.Optional[typing.Sequence[IKeyGroup]] = None,
    viewer_protocol_policy: typing.Optional[ViewerProtocolPolicy] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__570665aa807bcddef2b06088f934fc7c08e51ec76b12bb573dce40bcd558c053(
    identity: _IGrantable_71c4f5de,
    *actions: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f120acf6052cd817f09b30ce4d40d0853e41ea258f27908bbd45136d4e56e891(
    identity: _IGrantable_71c4f5de,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57d1cb583a433250ea9a7b0fd61eb68ee34cc5f8ab9ebc2c7b54d4a3f730247f(
    metric_name: builtins.str,
    *,
    account: typing.Optional[builtins.str] = None,
    color: typing.Optional[builtins.str] = None,
    dimensions_map: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
    label: typing.Optional[builtins.str] = None,
    period: typing.Optional[_Duration_4839e8c3] = None,
    region: typing.Optional[builtins.str] = None,
    statistic: typing.Optional[builtins.str] = None,
    unit: typing.Optional[_Unit_61bc6f70] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__036fe4f21793a85724c37ca1ffc5912522571664ab980383ee3babc485339b2e(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    code: FunctionCode,
    comment: typing.Optional[builtins.str] = None,
    function_name: typing.Optional[builtins.str] = None,
    key_value_store: typing.Optional[IKeyValueStore] = None,
    runtime: typing.Optional[FunctionRuntime] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5989cbf7079014eacde0ab3a45d42fc3fb56a2cf17ecfbacd7bc46da0a11701d(
    scope: _constructs_77d1e7e8.Construct,
    id: builtins.str,
    *,
    function_arn: builtins.str,
    function_name: builtins.str,
    function_runtime: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass
