AWS CloudFront
Copy link to the page “AWS CloudFront”
Imports the certificate into ACM in us-east-1 and puts it on the distribution.
What happens
- The appliance connects to AWS CloudFront through AWS API on port 443.
- The certificate is imported into ACM in us-east-1.
- The distribution's viewer certificate points at the new one. Existing TLS settings are kept; a switch from the default certificate uses sni-only and TLSv1.2_2021. If it fails: State is kept on timeout. Automatic rollback only reads the reported transaction and does not restore because of an uncertain API response, including after a completed deploy. Undeploy restores the previous viewer certificate from backup if the distribution still uses the package’s certificate and TLS settings.
- The package waits for Deployed with the expected ACM ARN. A retry reads the distribution before another write; the original restore point is kept. Status confirms API configuration; the certificate served over TLS must be checked independently.
Technical details
- Connection
- The package runs on the appliance, which connects over HTTPS to AWS API, port 443. No agent is installed.
- You need
- AWS CLI v2, AWS_PROFILE or AWS Access Key ID + Secret Access Key with optional AWS_SESSION_TOKEN. IAM must allow ACM import, read and delete operations plus reads and updates of the selected distribution.
- Actions
- Discovery, Installation, Verification, Rollback, Removal
- Packages
-
aws-cloudfront-api1.1.0 - Note
-
- Management TLS is verified by default. MANAGEMENT_TLS_CA_BUNDLE selects a CA file; MANAGEMENT_TLS_INSECURE is an optional explicit opt-out. AWS_CLOUDFRONT_TLS_CA_BUNDLE and AWS_CLOUDFRONT_TLS_INSECURE remain aliases. AWS CLI does not support MANAGEMENT_TLS_PIN_SHA256; a supplied pin is refused before API calls.
- Verify uses optional CERTIFICATE_ARN from the preceding deploy. Without an ARN, CERT_PEM can be compared using acm:GetCertificate, which then needs IAM permission. With neither, only inspection is reported. No new fields are required on appliance 0.4.44.
- Backup persists under the appliance user’s HOME and belongs to the distribution; BACKUP_DIR is optional for deploy and Undeploy and can select an existing backup within the managed backup area under HOME. Automatic rollback requires the backup from that reported deploy. DEPLOY_WAIT_SECONDS and DEPLOY_POLL_SECONDS are optional (480 and 15 seconds); all waits share a budget capped at 720 seconds. Undeploy deletes only the package’s imported ACM certificate after the restored distribution is Deployed and ACM reports no consumers. Other certificates are retained.
- If an import ARN is lost on timeout (import_outcome_unknown), import is not repeated automatically. Undeploy can abandon the unresolved transaction after reading the original viewer certificate; deploy can then be retried. Unknown imports are neither deleted nor adopted. If another administrator changes the certificate, clarify control first.