Amazon CloudFront Configuration
OfficialFreeStreamline your content delivery with CloudFront.
Free · Opens the source repo
What Amazon CloudFront Configuration does
The Amazon CloudFront Configuration skill provides developers and designers with the necessary tools to effectively configure Amazon CloudFront for content delivery. It covers a range of workflows, including determining when to utilize CloudFront, managing custom-domain TLS certificates, and setting up multi-tenant distributions. This skill is designed for users who want to optimize their content delivery strategy by integrating CloudFront within their AWS architecture, ensuring secure and efficient access to their origins.
Each task is mapped to a specific procedure file located in the references directory, allowing users to follow detailed steps and constraints tailored to their needs. The references include topics such as protecting origins with origin access control, securing content through signed URLs and geographic restrictions, and observing traffic patterns using standard and real-time logs. This structured approach helps users navigate the complexities of CloudFront configuration with ease.
The skill utilizes the AWS MCP server for command execution, ensuring sandboxed operations with audit logging and observability. For scenarios where the MCP server is not available, it can fall back to the AWS CLI. This flexibility allows users to manage CloudFront configurations effectively, regardless of their environment. The skill is particularly useful for organizations looking to enhance their content delivery capabilities while maintaining security and performance.
However, it is important to note that this skill does not cover Route 53 DNS configurations or failover between distributions, which are handled by a separate skill. Users should be aware of this limitation when planning their CloudFront implementations, ensuring they have the right tools for their specific requirements.
When to use it
Use this skill when you need to configure CloudFront for secure and efficient content delivery, manage TLS certificates, or set up multi-tenant distributions.
When not to use it
This skill is not suitable for DNS configurations with Route 53 or for failover management between CloudFront distributions.
What you can build with it
Setting Up a Custom Domain
Use this skill to configure a custom domain for your CloudFront distribution, including managing the necessary TLS certificates.
Securing Content Access
Implement viewer mutual TLS and signed URLs to restrict access to your content, ensuring that only authorized users can view it.
Multi-Tenant Distribution Management
Configure CloudFront to serve multiple domains through a single distribution, allowing for per-tenant customization in a SaaS application.
How to install Amazon CloudFront Configuration
View source1. Install with the skills CLI
npx skills add aws/agent-toolkit-for-aws/cloudfront --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by awsAmazon CloudFront
Overview
Domain expertise for configuring Amazon CloudFront content delivery: deciding when to use CloudFront and how it fits the wider architecture, managing custom-domain certificates and multi-tenant distributions, protecting origins, securing content, and observing traffic.
This skill is a router. Each customer task maps to a procedure file under references/. Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. CloudFront is a global service; its API calls
and the AWS Certificate Manager (ACM) certificates it uses are made in us-east-1 regardless of
where the customer's application runs.
Which CloudFront task do you need?
| Goal | Reference |
|---|---|
| Decide whether CloudFront is the right layer, see how it integrates, create a distribution, tune caching, or choose pricing | when to use CloudFront |
| Serve a custom domain over HTTPS, manage ACM certificates, or run many domains with a certificate per tenant | managing certificates with CloudFront |
| Make CloudFront the only way to reach the origin (S3 OAC, VPC origins, origin mutual TLS, security groups) | protecting your origins |
| Limit who can view content by identity, location, client certificate, or auth token | securing your content |
| Get visibility into traffic with standard and real-time logs, and analyze them | CloudFront observability |
| Serve multiple domains through shared configuration with per-tenant customization (SaaS, platform) | multi-tenant distributions |
Routing notes
- Choosing the layer and creating a distribution vs the rest. Whether CloudFront is the right entry layer, what it integrates with, creating a distribution, caching, and pricing live in the when-to-use reference. The other references assume a distribution exists and configure one aspect of it.
- Protecting origins vs securing content. Locking the origin so it is reachable only through CloudFront (OAC, VPC origins, origin mTLS) is the protecting-your-origins reference. Restricting which viewers can see content (signed URLs and cookies, geographic restrictions, viewer mTLS, edge token validation) is the securing-your-content reference. They are paired: a content control only holds when the origin is also locked.
- Viewer mTLS vs origin mTLS. Authenticating the client to CloudFront (viewer mTLS) is content security. Authenticating CloudFront to the origin (origin mTLS) is origin protection. Different controls, different references.
- Custom domain certificate vs Route 53 DNS cutover. Requesting and validating the ACM
certificate and adding the alternate domain name is the managing-certificates reference here.
Pointing the domain's DNS at the distribution, including the zone apex alias and any failover, is
Route 53 work owned by the separate
route53-cloudfrontskill.
Cross-service work
Pointing a custom domain's DNS at a CloudFront distribution, or failing over between distributions
with Route 53 records, is cross-service work owned by the separate route53-cloudfront skill. Use
this skill for the CloudFront-side configuration only.
Additional Resources
Frequently asked questions about Amazon CloudFront Configuration
Similar skills
Turborepo
Optimized build system for JavaScript/TypeScript monorepos.
Azure Pipelines Validation
Streamline your Azure DevOps pipeline changes locally.
Azure Developer CLI
Streamline your Azure project workflows with best practices.
Azure Container Registry CLI
Manage Azure Container Registry resources with ease.
Aspire
Build and orchestrate polyglot distributed applications seamlessly.
Vercel CLI
Manage and deploy Vercel projects from the command line.