CloudFront Object Structure

The cloudfront object configures CloudFront delivery for files stored in S3. It is required when fileStrategy or any fileStrategies entry uses "cloudfront".

Example

fileStrategies:
  avatar: 'cloudfront'
  image: 'cloudfront'
  document: 's3'
 
cloudfront:
  domain: 'https://cdn.example.com'
  distributionId: 'E1234ABCD'
  invalidateOnDelete: false
  imageSigning: 'cookies'
  cookieDomain: '.example.com'
  cookieExpiry: 1800
  urlExpiry: 3600
  storageRegion: 'us-east-2'
  includeRegionInPath: false
  requireSignedAccess: true

Fields

KeyTypeDescriptionExample
domainStringCloudFront distribution domain or CNAME. Required.domain: "https://cdn.example.com"
distributionIdStringCloudFront distribution ID. Required when `invalidateOnDelete` is true.distributionId: "E1234ABCD"
invalidateOnDeleteBooleanCreates a CloudFront invalidation after deleting the S3 object. Default: false.invalidateOnDelete: false
imageSigningStringInline media signing mode. Options: `"none"`, `"cookies"`, `"url"`. `"url"` is reserved and not implemented for images.imageSigning: "cookies"
urlExpiryNumberSigned CloudFront download URL lifetime in seconds. Default: 3600.urlExpiry: 3600
cookieExpiryNumberSigned cookie lifetime in seconds. Default: 1800. Maximum: 604800.cookieExpiry: 1800
cookieDomainStringShared parent domain for signed cookies. Required when `imageSigning` is `"cookies"`. Must start with a dot.cookieDomain: ".example.com"
storageRegionStringOptional region label used in generated object keys when `includeRegionInPath` is true.storageRegion: "us-east-2"
includeRegionInPathBooleanIncludes the storage region in newly generated object keys. Default: false.includeRegionInPath: false
requireSignedAccessBooleanRequires signed-cookie CloudFront access to initialize successfully at startup. Default: false.requireSignedAccess: true

Validation Rules

  • distributionId is required when invalidateOnDelete is true.
  • cookieDomain is required when imageSigning is "cookies".
  • cookieDomain must start with a dot, for example .example.com.
  • requireSignedAccess: true requires imageSigning: "cookies".
KeyTypeDescriptionExample
CLOUDFRONT_KEY_PAIR_IDStringCloudFront public key pair ID. Required for signed cookies and signed downloads.# CLOUDFRONT_KEY_PAIR_ID=K1234567890ABC
CLOUDFRONT_PRIVATE_KEYStringCloudFront private key PEM. Required for signed cookies and signed downloads.# CLOUDFRONT_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

For deployment guidance, see CloudFront with S3.

Last updated on