feat(cloudfront): mutual TLS #36245

badmintoncryer · 2025-11-30T01:20:44Z

Issue # (if applicable)

None

Reason for this change

AWS cloudfront now supports for mTLS authentication.
https://aws.amazon.com/jp/about-aws/whats-new/2025/11/amazon-cloudfront-mutual-tls-authentication/

Description of changes

L2 Construct Implementation
(distribution.ts)

Added MtlsMode enum with REQUIRED and OPTIONAL values
Added ViewerMtlsConfig interface with flat structure:
- mode: mTLS enforcement mode
- trustStore: Interface of the CloudFront TrustStore
- advertiseTrustStoreCaNames: Optional flag to advertise CA names during TLS handshake
- ignoreCertificateExpiry: Optional flag to accept expiredcertificates
Added viewerMtlsConfig property to DistributionProps

Add truststore L2 construct.

Describe any new or updated permissions being added

None

Description of how you validated changes

added both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…Distribution

...framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.assets/mtls-test-handler.ts

...4059581719d059fbdfc854912e8a27be60d7784f4bf89aae78071ca0219ecb40.assets/mtls-test-handler.js

...8fa19fb03891638e9070c4bee8ad539f11932b9cd7f884f6570b5622df2fc78c.assets/mtls-test-handler.js

badmintoncryer · 2025-11-30T05:49:31Z

It might be better to avoid using NodejsFunction in integ test.

mazyu36

Thanks for the contribution. Before reviewing, let me confirm the implementation direction.

mazyu36 · 2025-12-03T13:04:18Z

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.ts

+    });
+
+    // Create TrustStore using L1 construct (CfnTrustStore)
+    const trustStore = new cloudfront.CfnTrustStore(this, 'TrustStore', {


Is there any reason why the trust store is not implemented as an L2 construct?
I don't think creating L2 constructs is mandatory, so if you have a reason, please let me know.

Of course, I’m planning to implement it! My initial thought was to merge this PR first, then implement the L2 for truststore while deprecating truststoreId.

However, I’m starting to think it might not be ideal to implement an argument that will soon become obsolete. So it might be better to either implement the L2 first, or include it in this PR.

That said, including the L2 implementation might make this PR a bit too large. What are your thoughts on this?

Thank you.
In my opinion, if you are going to deprecate the property after implementing L2, it would be better to implement L2 from the beginning. I don't think the trust store itself will be a very complex construct.
If you're not going to deprecate it, I think the current policy is fine.

Sure! I'll add TruestStore L2 construct in this PR. Please wait for a while.

…ruct and simplify S3 bucket reference

… name length

…d update validation

aws-cdk-automation

(This review is outdated)

github-actions · 2025-12-05T13:53:48Z

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	52 ran	50 passed	0 skipped	2 failed

Test	Result
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.js.snapshot/integ-distribution-mtls.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure

View Security Guardian Results

github-actions · 2025-12-05T13:53:49Z

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	52 ran	50 passed	0 skipped	2 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.js.snapshot/integ-distribution-mtls.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
s3-encryption-enabled.guard	❌ failure

View Security Guardian Results with resolved templates

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

… 1 character

packages/aws-cdk-lib/aws-cloudfront/README.md

badmintoncryer · 2025-12-05T14:31:04Z

packages/aws-cdk-lib/aws-cloudfront/lib/trust-store.ts

+      return;
+    }
+
+    if (name.length < 1 || name.length > 64) {


Names with 65 or more characters were rejected as an error.

Resource handler returned message: "Invalid request provided: AWS::CloudFront::TrustStore: The request contains an invalid TrustStore name. (Service: CloudFront, Status Code: 400, Request ID: 5c270f44-3775-440c-a4af-41e02ee0d3d2) (SDK Attempt Count: 1)" (RequestToken: fc166deb-1f5c-5130-4875-684a71de8efb, HandlerErrorCode: InvalidRequest)

Names with only 1 character result in an error in the Management Console, but could be created via CloudFormation.

Therefore, I have implemented validation for 1-64 characters.

badmintoncryer · 2025-12-05T15:09:32Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+    }
+
+    // Validate viewerProtocolPolicy - mTLS requires HTTPS.
+    // When viewerProtocolPolicy is not specified, it defaults to ALLOW_ALL which is not compatible with mTLS.


ViewerProtocolPolicy.ALLOW_ALL with mTLS configuration causes deployment error.

Resource handler returned message: "Invalid request provided: AWS::CloudFront::Distribution: The parameter ViewerMutualAuthentication cannot be enabled when cache behaviors allow HTTP. (Service: CloudFront, Status Code: 400, Request ID: 936f22cb-4e79-4671-8dd3-49145f995dd2) (SDK Attempt Count: 1)" (RequestToken: a45f9420-c513-9105-637b-0aa3c531a1b8, HandlerErrorCode: InvalidRequest)

badmintoncryer · 2025-12-05T15:11:24Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+    // Validate viewerProtocolPolicy - mTLS requires HTTPS.
+    // When viewerProtocolPolicy is not specified, it defaults to ALLOW_ALL which is not compatible with mTLS.
+    const validPolicies = [ViewerProtocolPolicy.HTTPS_ONLY, ViewerProtocolPolicy.REDIRECT_TO_HTTPS];
+    const defaultPolicy = props.defaultBehavior.viewerProtocolPolicy ?? ViewerProtocolPolicy.ALLOW_ALL;


Default behavior of viewerProtocolPolicy is ALLOW_ALL.
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts#L1149

I understand that even if the default value ALLOW_ALL is set, it will result in an error with the next validation.
It might be a matter of preference, but the behavior where an error occurs after the default value is supplemented could be confusing.

Would it be acceptable to raise an error if it is not specified?

packages/aws-cdk-lib/aws-cloudfront/test/trust-store.test.ts

…or mTLS

badmintoncryer · 2025-12-05T15:34:49Z

@mazyu36 I've added TrustStore L2 construct! Could you please review this PR?

mazyu36

Thanks. Great work!
I've added two minor comments.

mazyu36 · 2025-12-07T05:09:50Z

packages/aws-cdk-lib/aws-cloudfront/README.md

+});
+```
+
+See [Configuring mutual TLS authentication](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-mutual-tls.html) in the CloudFront User Guide.


I can't access the link. It may have been changed.
Is this the link you were referring to?

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/mtls-authentication.html

mazyu36 · 2025-12-07T05:35:53Z

packages/aws-cdk-lib/aws-cloudfront/lib/distribution.ts

+    // Validate viewerProtocolPolicy - mTLS requires HTTPS.
+    // When viewerProtocolPolicy is not specified, it defaults to ALLOW_ALL which is not compatible with mTLS.
+    const validPolicies = [ViewerProtocolPolicy.HTTPS_ONLY, ViewerProtocolPolicy.REDIRECT_TO_HTTPS];
+    const defaultPolicy = props.defaultBehavior.viewerProtocolPolicy ?? ViewerProtocolPolicy.ALLOW_ALL;


I understand that even if the default value ALLOW_ALL is set, it will result in an error with the next validation.
It might be a matter of preference, but the behavior where an error occurs after the default value is supplemented could be confusing.

Would it be acceptable to raise an error if it is not specified?

packages/aws-cdk-lib/aws-cloudfront/README.md

badmintoncryer added 3 commits November 30, 2025 08:28

feat(cloudfront): add support for mutual TLS (mTLS) configuration in …

dd850cd

…Distribution

add integ

4171d17

update readme

d5ece7b

github-actions bot added the p2 label Nov 30, 2025

aws-cdk-automation requested a review from a team November 30, 2025 01:20

github-actions bot added the distinguished-contributor [Pilot] contributed 50+ PRs to the CDK label Nov 30, 2025

github-advanced-security bot found potential problems Nov 30, 2025

View reviewed changes

aws-cdk-automation added pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Nov 30, 2025

badmintoncryer added 2 commits November 30, 2025 14:15

update unit test

9393986

add validation

0b2c955

aws-cdk-automation removed the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Nov 30, 2025

update integ

7ab49a8

github-actions bot mentioned this pull request Dec 1, 2025

Monthly PR metrics report #36251

Open

Merge branch 'main' into mtls

4ade6c6

mazyu36 reviewed Dec 3, 2025

View reviewed changes

badmintoncryer added 5 commits December 5, 2025 21:15

feat: add Trust Store for mTLS authentication in CloudFront

08f1c7d

fix(cloudfront): update TrustStore creation to use higher-level const…

fa6ab9d

…ruct and simplify S3 bucket reference

fix(truststore): rename trustStoreName to name and add validation for…

ef74c4a

… name length

Merge remote-tracking branch 'origin/main' into mtls

80e0ed4

fix(truststore): rename 'name' to 'trustStoreName' for consistency an…

a8a4248

…d update validation

aws-cdk-automation previously requested changes Dec 5, 2025

View reviewed changes

add snapshot

590a435

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Dec 5, 2025

badmintoncryer added 2 commits December 5, 2025 23:24

fix(truststore): update validation for trustStoreName length to allow…

d474f54

… 1 character

Merge branch 'main' into mtls

27454ef

badmintoncryer commented Dec 5, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront/README.md Outdated Show resolved Hide resolved

Update packages/aws-cdk-lib/aws-cloudfront/README.md

1032488

badmintoncryer commented Dec 5, 2025

View reviewed changes

fix(cloudfront): enforce HTTPS for mTLS configurations in Distribution

f866228

badmintoncryer commented Dec 5, 2025

View reviewed changes

badmintoncryer added 2 commits December 6, 2025 00:18

fix(truststore): add validation for S3 key to prevent empty strings

5f7eab8

fix(distribution): simplify mTLS test cases by removing expected values

7b11d15

badmintoncryer commented Dec 5, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront/test/trust-store.test.ts Outdated Show resolved Hide resolved

badmintoncryer added 3 commits December 6, 2025 00:28

Update packages/aws-cdk-lib/aws-cloudfront/test/trust-store.test.ts

d9f166b

feat(cloudfront): add TrustStore L2 construct and integration tests f…

4b500e4

…or mTLS

Merge remote-tracking branch 'cryer/mtls' into mtls

a2ac411

Merge branch 'main' into mtls

a492868

mazyu36 reviewed Dec 7, 2025

View reviewed changes

badmintoncryer commented Dec 7, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cloudfront/README.md Outdated Show resolved Hide resolved

Update packages/aws-cdk-lib/aws-cloudfront/README.md

2658292

feat(cloudfront): mutual TLS #36245

Are you sure you want to change the base?

feat(cloudfront): mutual TLS #36245

Conversation

badmintoncryer commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

badmintoncryer commented Nov 30, 2025

Uh oh!

mazyu36 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

badmintoncryer Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

badmintoncryer commented Dec 5, 2025

Uh oh!

mazyu36 left a comment

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

badmintoncryer commented Nov 30, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading

badmintoncryer Dec 5, 2025 •

edited

Loading

mazyu36 Dec 7, 2025 •

edited

Loading