MultitenantDistribution class

Creates an Amazon CloudFront multi-tenant distribution.

Multi-tenant distributions are a specialized type of CloudFront distribution designed for multi-tenant applications. They have specific limitations and requirements compared to standard CloudFront distributions.

For information about CloudFront multi-tenant distributions, see the Amazon CloudFront Developer Guide.

Example Usage

Multi-tenant Distribution Limitations

Multi-tenant distributions have the following limitations compared to standard CloudFront distributions:

Connection Mode: Automatically set to tenant-only and cannot be modified
Cache Policies: Must use cache policies instead of legacy TTL settings
Trusted Key Groups: Must use trusted key groups instead of trusted signers
WAF Integration: Only supports WAF v2 web ACLs
Certificate Management: Must use ACM certificates (IAM certificates not supported)

Unsupported Attributes

The following attributes that are available in standard CloudFront distributions are not supported for multi-tenant distributions:

activeTrustedSigners - Use activeTrustedKeyGroups instead
aliasIcpRecordals - Managed by connection groups
aliases - Managed by connection groups
anycastIpListId - Use connection groups instead
continuousDeploymentPolicyId
forwardedValues in cache behaviors - Deprecated, use cache policies instead
isIpv6Enabled - Managed by connection groups
priceClass - Managed by connection groups
smoothStreaming in cache behaviors
staging mode
trustedSigners in cache behaviors - Use trustedKeyGroups instead
Cache behavior TTL settings (defaultTtl, maxTtl, minTtl) - Use cache policies instead

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.cloudfront.MultitenantDistribution("example", {
    defaultCacheBehavior: {
        allowedMethods: {
            items: [
                "DELETE",
                "GET",
                "HEAD",
                "OPTIONS",
                "PATCH",
                "POST",
                "PUT",
            ],
            cachedMethods: [
                "GET",
                "HEAD",
            ],
        },
        targetOriginId: "example-origin",
        viewerProtocolPolicy: "redirect-to-https",
        cachePolicyId: exampleAwsCloudfrontCachePolicy.id,
    },
    restrictions: {
        geoRestriction: {
            restrictionType: "none",
        },
    },
    viewerCertificate: {
        acmCertificateArn: exampleAwsAcmCertificate.arn,
        sslSupportMethod: "sni-only",
    },
    tenantConfig: {
        parameterDefinitions: [{
            definitions: [{
                stringSchemas: [{
                    required: true,
                    comment: "Origin domain parameter for tenants",
                }],
            }],
            name: "origin_domain",
        }],
    },
    origins: [{
        customOriginConfigs: [{
            httpPort: 80,
            httpsPort: 443,
            originProtocolPolicy: "https-only",
            originSslProtocols: ["TLSv1.2"],
        }],
        domainName: "example.com",
        id: "example-origin",
    }],
    comment: "Multi-tenant distribution for my application",
    enabled: true,
    tags: {
        Environment: "production",
    },
});

import pulumi
import pulumi_aws as aws

example = aws.cloudfront.MultitenantDistribution("example",
    default_cache_behavior={
        "allowed_methods": {
            "items": [
                "DELETE",
                "GET",
                "HEAD",
                "OPTIONS",
                "PATCH",
                "POST",
                "PUT",
            ],
            "cached_methods": [
                "GET",
                "HEAD",
            ],
        },
        "target_origin_id": "example-origin",
        "viewer_protocol_policy": "redirect-to-https",
        "cache_policy_id": example_aws_cloudfront_cache_policy["id"],
    },
    restrictions={
        "geo_restriction": {
            "restriction_type": "none",
        },
    },
    viewer_certificate={
        "acm_certificate_arn": example_aws_acm_certificate["arn"],
        "ssl_support_method": "sni-only",
    },
    tenant_config={
        "parameter_definitions": [{
            "definitions": [{
                "string_schemas": [{
                    "required": True,
                    "comment": "Origin domain parameter for tenants",
                }],
            }],
            "name": "origin_domain",
        }],
    },
    origins=[{
        "custom_origin_configs": [{
            "http_port": 80,
            "https_port": 443,
            "origin_protocol_policy": "https-only",
            "origin_ssl_protocols": ["TLSv1.2"],
        }],
        "domain_name": "example.com",
        "id": "example-origin",
    }],
    comment="Multi-tenant distribution for my application",
    enabled=True,
    tags={
        "Environment": "production",
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var example = new Aws.CloudFront.MultitenantDistribution("example", new()
    {
        DefaultCacheBehavior = new Aws.CloudFront.Inputs.MultitenantDistributionDefaultCacheBehaviorArgs
        {
            AllowedMethods = new Aws.CloudFront.Inputs.MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs
            {
                Items = new[]
                {
                    "DELETE",
                    "GET",
                    "HEAD",
                    "OPTIONS",
                    "PATCH",
                    "POST",
                    "PUT",
                },
                CachedMethods = new[]
                {
                    "GET",
                    "HEAD",
                },
            },
            TargetOriginId = "example-origin",
            ViewerProtocolPolicy = "redirect-to-https",
            CachePolicyId = exampleAwsCloudfrontCachePolicy.Id,
        },
        Restrictions = new Aws.CloudFront.Inputs.MultitenantDistributionRestrictionsArgs
        {
            GeoRestriction = new Aws.CloudFront.Inputs.MultitenantDistributionRestrictionsGeoRestrictionArgs
            {
                RestrictionType = "none",
            },
        },
        ViewerCertificate = new Aws.CloudFront.Inputs.MultitenantDistributionViewerCertificateArgs
        {
            AcmCertificateArn = exampleAwsAcmCertificate.Arn,
            SslSupportMethod = "sni-only",
        },
        TenantConfig = new Aws.CloudFront.Inputs.MultitenantDistributionTenantConfigArgs
        {
            ParameterDefinitions = new[]
            {
                new Aws.CloudFront.Inputs.MultitenantDistributionTenantConfigParameterDefinitionArgs
                {
                    Definitions = new[]
                    {
                        new Aws.CloudFront.Inputs.MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs
                        {
                            StringSchemas = new[]
                            {
                                new Aws.CloudFront.Inputs.MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs
                                {
                                    Required = true,
                                    Comment = "Origin domain parameter for tenants",
                                },
                            },
                        },
                    },
                    Name = "origin_domain",
                },
            },
        },
        Origins = new[]
        {
            new Aws.CloudFront.Inputs.MultitenantDistributionOriginArgs
            {
                CustomOriginConfigs = new[]
                {
                    new Aws.CloudFront.Inputs.MultitenantDistributionOriginCustomOriginConfigArgs
                    {
                        HttpPort = 80,
                        HttpsPort = 443,
                        OriginProtocolPolicy = "https-only",
                        OriginSslProtocols = new[]
                        {
                            "TLSv1.2",
                        },
                    },
                },
                DomainName = "example.com",
                Id = "example-origin",
            },
        },
        Comment = "Multi-tenant distribution for my application",
        Enabled = true,
        Tags =
        {
            { "Environment", "production" },
        },
    });

});

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/cloudfront"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudfront.NewMultitenantDistribution(ctx, "example", &cloudfront.MultitenantDistributionArgs{
			DefaultCacheBehavior: &cloudfront.MultitenantDistributionDefaultCacheBehaviorArgs{
				AllowedMethods: &cloudfront.MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs{
					Items: pulumi.StringArray{
						pulumi.String("DELETE"),
						pulumi.String("GET"),
						pulumi.String("HEAD"),
						pulumi.String("OPTIONS"),
						pulumi.String("PATCH"),
						pulumi.String("POST"),
						pulumi.String("PUT"),
					},
					CachedMethods: pulumi.StringArray{
						pulumi.String("GET"),
						pulumi.String("HEAD"),
					},
				},
				TargetOriginId:       pulumi.String("example-origin"),
				ViewerProtocolPolicy: pulumi.String("redirect-to-https"),
				CachePolicyId:        pulumi.Any(exampleAwsCloudfrontCachePolicy.Id),
			},
			Restrictions: &cloudfront.MultitenantDistributionRestrictionsArgs{
				GeoRestriction: &cloudfront.MultitenantDistributionRestrictionsGeoRestrictionArgs{
					RestrictionType: pulumi.String("none"),
				},
			},
			ViewerCertificate: &cloudfront.MultitenantDistributionViewerCertificateArgs{
				AcmCertificateArn: pulumi.Any(exampleAwsAcmCertificate.Arn),
				SslSupportMethod:  pulumi.String("sni-only"),
			},
			TenantConfig: &cloudfront.MultitenantDistributionTenantConfigArgs{
				ParameterDefinitions: cloudfront.MultitenantDistributionTenantConfigParameterDefinitionArray{
					&cloudfront.MultitenantDistributionTenantConfigParameterDefinitionArgs{
						Definitions: cloudfront.MultitenantDistributionTenantConfigParameterDefinitionDefinitionArray{
							&cloudfront.MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs{
								StringSchemas: cloudfront.MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArray{
									&cloudfront.MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs{
										Required: pulumi.Bool(true),
										Comment:  pulumi.String("Origin domain parameter for tenants"),
									},
								},
							},
						},
						Name: pulumi.String("origin_domain"),
					},
				},
			},
			Origins: cloudfront.MultitenantDistributionOriginArray{
				&cloudfront.MultitenantDistributionOriginArgs{
					CustomOriginConfigs: cloudfront.MultitenantDistributionOriginCustomOriginConfigArray{
						&cloudfront.MultitenantDistributionOriginCustomOriginConfigArgs{
							HttpPort:             pulumi.Int(80),
							HttpsPort:            pulumi.Int(443),
							OriginProtocolPolicy: pulumi.String("https-only"),
							OriginSslProtocols: pulumi.StringArray{
								pulumi.String("TLSv1.2"),
							},
						},
					},
					DomainName: pulumi.String("example.com"),
					Id:         pulumi.String("example-origin"),
				},
			},
			Comment: pulumi.String("Multi-tenant distribution for my application"),
			Enabled: pulumi.Bool(true),
			Tags: pulumi.StringMap{
				"Environment": pulumi.String("production"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_cloudfront_multitenantdistribution" "example" {
  default_cache_behavior = {
    allowed_methods = {
      items          = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
      cached_methods = ["GET", "HEAD"]
    }
    target_origin_id       = "example-origin"
    viewer_protocol_policy = "redirect-to-https"
    cache_policy_id        = exampleAwsCloudfrontCachePolicy.id
  }
  restrictions = {
    geo_restriction = {
      restriction_type = "none"
    }
  }
  viewer_certificate = {
    acm_certificate_arn = exampleAwsAcmCertificate.arn
    ssl_support_method  = "sni-only"
  }
  tenant_config = {
    parameter_definitions = [{
      "definitions" = [{
        "stringSchemas" = [{
          "required" = true
          "comment"  = "Origin domain parameter for tenants"
        }]
      }]
      "name" = "origin_domain"
    }]
  }
  origins {
    custom_origin_configs {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
    domain_name = "example.com"
    id          = "example-origin"
  }
  comment = "Multi-tenant distribution for my application"
  enabled = true
  tags = {
    "Environment" = "production"
  }
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.cloudfront.MultitenantDistribution;
import com.pulumi.aws.cloudfront.MultitenantDistributionArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionDefaultCacheBehaviorArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionRestrictionsArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionRestrictionsGeoRestrictionArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionViewerCertificateArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionTenantConfigArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionTenantConfigParameterDefinitionArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionOriginArgs;
import com.pulumi.aws.cloudfront.inputs.MultitenantDistributionOriginCustomOriginConfigArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new MultitenantDistribution("example", MultitenantDistributionArgs.builder()
            .defaultCacheBehavior(MultitenantDistributionDefaultCacheBehaviorArgs.builder()
                .allowedMethods(MultitenantDistributionDefaultCacheBehaviorAllowedMethodsArgs.builder()
                    .items(
                        "DELETE",
                        "GET",
                        "HEAD",
                        "OPTIONS",
                        "PATCH",
                        "POST",
                        "PUT")
                    .cachedMethods(
                        "GET",
                        "HEAD")
                    .build())
                .targetOriginId("example-origin")
                .viewerProtocolPolicy("redirect-to-https")
                .cachePolicyId(exampleAwsCloudfrontCachePolicy.id())
                .build())
            .restrictions(MultitenantDistributionRestrictionsArgs.builder()
                .geoRestriction(MultitenantDistributionRestrictionsGeoRestrictionArgs.builder()
                    .restrictionType("none")
                    .build())
                .build())
            .viewerCertificate(MultitenantDistributionViewerCertificateArgs.builder()
                .acmCertificateArn(exampleAwsAcmCertificate.arn())
                .sslSupportMethod("sni-only")
                .build())
            .tenantConfig(MultitenantDistributionTenantConfigArgs.builder()
                .parameterDefinitions(MultitenantDistributionTenantConfigParameterDefinitionArgs.builder()
                    .definitions(MultitenantDistributionTenantConfigParameterDefinitionDefinitionArgs.builder()
                        .stringSchemas(MultitenantDistributionTenantConfigParameterDefinitionDefinitionStringSchemaArgs.builder()
                            .required(true)
                            .comment("Origin domain parameter for tenants")
                            .build())
                        .build())
                    .name("origin_domain")
                    .build())
                .build())
            .origins(MultitenantDistributionOriginArgs.builder()
                .customOriginConfigs(MultitenantDistributionOriginCustomOriginConfigArgs.builder()
                    .httpPort(80)
                    .httpsPort(443)
                    .originProtocolPolicy("https-only")
                    .originSslProtocols("TLSv1.2")
                    .build())
                .domainName("example.com")
                .id("example-origin")
                .build())
            .comment("Multi-tenant distribution for my application")
            .enabled(true)
            .tags(Map.of("Environment", "production"))
            .build());

    }
}

resources:
  example:
    type: aws:cloudfront:MultitenantDistribution
    properties:
      defaultCacheBehavior:
        allowedMethods:
          items:
            - DELETE
            - GET
            - HEAD
            - OPTIONS
            - PATCH
            - POST
            - PUT
          cachedMethods:
            - GET
            - HEAD
        targetOriginId: example-origin
        viewerProtocolPolicy: redirect-to-https
        cachePolicyId: ${exampleAwsCloudfrontCachePolicy.id}
      restrictions:
        geoRestriction:
          restrictionType: none
      viewerCertificate:
        acmCertificateArn: ${exampleAwsAcmCertificate.arn}
        sslSupportMethod: sni-only
      tenantConfig:
        parameterDefinitions:
          - definitions:
              - stringSchemas:
                  - required: true
                    comment: Origin domain parameter for tenants
            name: origin_domain
      origins:
        - customOriginConfigs:
            - httpPort: 80
              httpsPort: 443
              originProtocolPolicy: https-only
              originSslProtocols:
                - TLSv1.2
          domainName: example.com
          id: example-origin
      comment: Multi-tenant distribution for my application
      enabled: true
      tags:
        Environment: production

Import

Using pulumi import, import CloudFront Multi-tenant Distributions using the id. For example:

$ pulumi import aws:cloudfront/multitenantDistribution:MultitenantDistribution distribution E74FTE3AEXAMPLE

Constructors

MultitenantDistribution(String name, {MultitenantDistributionArgs? args, CustomResourceOptions? options}): Creates a new MultitenantDistribution. name The Pulumi resource name. args Arguments used to configure this MultitenantDistribution. The set of arguments for MultitenantDistribution. options Resource options controlling this resource's behavior.
MultitenantDistribution.reference(String urn): Creates a typed reference to an existing MultitenantDistribution resource.

Properties

activeTrustedKeyGroups ↔ Output<List<MultitenantDistributionActiveTrustedKeyGroup>?>: List of key groups that CloudFront can use to validate signed URLs or signed cookies. See Active Trusted Key Groups below.
latefinal
arn ↔ Output<String>: ARN for the distribution.
latefinal
cacheBehaviors ↔ Output<List<MultitenantDistributionCacheBehavior>?>: Ordered list of cache behaviors resource for this distribution. See Cache Behavior below.
latefinal
callerReference ↔ Output<String>: Internal value used by CloudFront to allow future updates to the distribution configuration.
latefinal
childResources → Set<Resource>: finalinherited
comment ↔ Output<String>: Any comments you want to include about the distribution.
latefinal
completionSources ↔ Map<String, IOutputCompletionSource>: latefinalinherited
connectionMode ↔ Output<String>: Connection mode for the distribution. Always set to tenant-only for multi-tenant distributions.
latefinal
customErrorResponses ↔ Output<List<MultitenantDistributionCustomErrorResponse>?>: One or more custom error response elements. See Custom Error Response below.
latefinal
defaultCacheBehavior ↔ Output<MultitenantDistributionDefaultCacheBehavior>: Default cache behavior for this distribution. See Default Cache Behavior below.
latefinal
defaultRootObject ↔ Output<String?>: Object that you want CloudFront to return when an end user requests the root URL.
latefinal
domainName ↔ Output<String>: Domain name corresponding to the distribution.
latefinal
enabled ↔ Output<bool>: Whether the distribution is enabled to accept end user requests for content.
latefinal
etag ↔ Output<String>: Current version of the distribution's information.
latefinal
hashCode → int: The hash code for this object.
no setterinherited
httpVersion ↔ Output<String>: Maximum HTTP version to support on the distribution. Allowed values are http1.1, http2, http2and3, and http3. Default: http2.
latefinal
id ↔ Output<String>: getter/setter pairinherited
inProgressInvalidationBatches ↔ Output<int>: Number of invalidation batches currently in progress.
latefinal
isCustom → bool: Returns whether this resource is provider-managed.
no setterinherited
isProtected → bool: Returns whether this resource is protected from deletion.
no setterinherited
isRemote → bool: Whether this resource is registered as remote.
no setterinherited
isResourceReference → bool: Whether this instance represents a resource value returned over RPC.
finalinherited
lastModifiedTime ↔ Output<String>: Date and time the distribution was last modified.
latefinal
originGroups ↔ Output<List<MultitenantDistributionOriginGroup>?>: One or more originGroup for this distribution (multiples allowed). See Origin Group below.
latefinal
origins ↔ Output<List<MultitenantDistributionOrigin>?>: One or more origins for this distribution (multiples allowed). See Origin below.
latefinal
resourceTransforms → List<ResourceTransform>: Inherited/explicit async transforms.
no setterinherited
restrictions ↔ Output<MultitenantDistributionRestrictions?>: Restriction configuration for this distribution. See Restrictions below.
latefinal
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
status ↔ Output<String>: Current status of the distribution. Deployed if the distribution's information is fully propagated throughout the Amazon CloudFront system.
latefinal
tags ↔ Output<Map<String, String>?>: Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
latefinal
tagsAll ↔ Output<Map<String, String>>: Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
latefinal
tenantConfig ↔ Output<MultitenantDistributionTenantConfig>: Tenant configuration that contains parameter definitions for multi-tenant distributions. See Tenant Config below.
latefinal
timeouts ↔ Output<MultitenantDistributionTimeouts?>: latefinal
transformations → List<ResourceTransformation>: Inherited/explicit legacy transformations.
no setterinherited
urn ↔ Output<String>: latefinalinherited
viewerCertificate ↔ Output<MultitenantDistributionViewerCertificate>: SSL configuration for this distribution. See Viewer Certificate below.
latefinal
webAclId ↔ Output<String?>: Unique identifier that specifies the AWS WAF v2 web ACL to associate with this distribution.
latefinal

Methods

failId(Object error) → void: Completes this resource ID with an error when registration fails.
inherited
failOutputs(Object error) → void: Completes all output properties with error.
inherited
failUrn(Object error) → void: Completes this resource URN with an error when registration fails.
inherited
getProvider(String moduleMember) → ProviderResource?: Returns provider for moduleMember's package, if configured.
inherited
getResourceName() → String: Returns this resource's logical name.
inherited
getResourceType() → String: Returns this resource's Pulumi type token.
inherited
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>: Registers a dynamic output property for this resource.
inherited
resolveId(String? value, {required bool isKnown}) → void: Resolves the provider-assigned ID for this resource.
inherited
resolveOutputs(Struct outputs) → void: Resolves all output properties from a monitor response payload.
inherited
resolveUrn(String value) → void: Resolves this resource's URN once assigned by the engine.
inherited
serializeProperties(Map<String, dynamic> properties) → Future<Struct>: Serializes resource properties for RPC transmission.
inherited
toString() → String: A string representation of this object.
inherited

Operators

operator ==(Object other) → bool: The equality operator.
inherited

Static Methods

get(String name, Input<String> id, {MultitenantDistributionState? state, CustomResourceOptions? options}) → MultitenantDistribution: Gets an existing MultitenantDistribution resource's state with the given name and id.