Accessing OriginShieldProperty in cloudfront.distribution

[MEGrimshaw]

https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.CfnDistribution.OriginShieldProperty.html

I am trying to add OriginShielding to a Cloudfront Distribution via CDK and the docs are very unclear about the approach.

To access origin shield within CDK you have to call cfnDistribution, however that doesn't appear to be compatible with the cloudfront distribution construct, nor cloudfront-origins.

Do I need to use cfnDistribution for the whole distribution?

It would be very helpful to have more thorough examples of a Cloudfront Distribution setup, especially after deprecating CloudFrontWebDistribution.

[njlynch]

Origin shield support has not yet been added to either Distribution or CloudFrontWebDistribution; the two new properties would need to be added to both the OriginProps (https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-cloudfront/lib/origin.ts#L56) and SourceConfiguration (https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-cloudfront/lib/web-distribution.ts#L134).

Contributions welcome!

In the mean time, you can use escape hatch raw overrides to set the properties. For example:

  const cfnDist = dist.node.defaultChild as CfnDistribution;
  cfnDist.addPropertyOverride('DistributionConfig.Origins.0.OriginShield', {
    Enabled: true,
    OriginShieldRegion: 'us-east-2',
  });

[MEGrimshaw]

@njlynch Thanks for the response! I'll take a look at contributing to getting this into cf.distribution.

In the meantime here is approach I was looking at (from https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-cloudfront.CfnDistribution.OriginShieldProperty.html):

    const EgDist = new cloudfront.CfnDistribution(this, 'CfDistribution', {
      distributionConfig: {
        enabled: true,
        priceClass: "Use All Edge Locations (Best Performance)",
        comment: "Example CF Distro",
        originShield: {
          enabled: true,
          originShieldRegion: envVars.REGION,
        },

I haven't tested the above yet, and the docs aren't clear if originShield should be under distributionConfig, or under origin like so:

    const EgDist = new cloudfront.CfnDistribution(this, 'CfDistribution', {
      distributionConfig: {
        enabled: true,
        priceClass: "Use All Edge Locations (Best Performance)",
        comment: "CF Distro",
        origin: {
          domainName: envVars.ORIGIN_DOMAIN,
          originShield: {
            enabled: true,
            originShieldRegion: envVars.REGION, 
        },

Would either of these work & simply be another way to do approach this?
I'll try it with your approach as well.
Thanks!

[MEGrimshaw]

@njlynch Wanted to circle back here to close the loop if others were looking for possible solutions to this issue. I was able to get this to work with CfnDistribution, specifically within distributionConfig:

        origins: [{
          domainName: envVars.ORIGIN_DOMAIN,
          id: envVars.ORIGIN_ID,
          customOriginConfig: {
            originProtocolPolicy: "https-only",
            originSslProtocols: ["TLSv1.2"],
          },
          originShield: {
            enabled: true,
            originShieldRegion: envVars.REGION,
          },
        }],

FWIW, even with these issues, I'm loving CDK.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.