feat(cloudfront): mutual TLS by badmintoncryer · Pull Request #36245 · aws/aws-cdk

badmintoncryer · 2025-11-30T01:20:44Z

Issue # (if applicable)

None

Reason for this change

AWS cloudfront now supports for mTLS authentication.
https://aws.amazon.com/jp/about-aws/whats-new/2025/11/amazon-cloudfront-mutual-tls-authentication/

Description of changes

L2 Construct Implementation
(distribution.ts)

Added MtlsMode enum with REQUIRED and OPTIONAL values
Added ViewerMtlsConfig interface with flat structure:
- mode: mTLS enforcement mode
- trustStore: Interface of the CloudFront TrustStore
- advertiseTrustStoreCaNames: Optional flag to advertise CA names during TLS handshake
- ignoreCertificateExpiry: Optional flag to accept expiredcertificates
Added viewerMtlsConfig property to DistributionProps

Add truststore L2 construct.

Describe any new or updated permissions being added

None

Description of how you validated changes

added both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…Distribution

...framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.assets/mtls-test-handler.ts

...4059581719d059fbdfc854912e8a27be60d7784f4bf89aae78071ca0219ecb40.assets/mtls-test-handler.js

...8fa19fb03891638e9070c4bee8ad539f11932b9cd7f884f6570b5622df2fc78c.assets/mtls-test-handler.js

badmintoncryer · 2025-11-30T05:49:31Z

It might be better to avoid using NodejsFunction in integ test.

mazyu36

Thanks for the contribution. Before reviewing, let me confirm the implementation direction.

mazyu36 · 2025-12-03T13:04:18Z

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.distribution-mtls.ts

+    });
+
+    // Create TrustStore using L1 construct (CfnTrustStore)
+    const trustStore = new cloudfront.CfnTrustStore(this, 'TrustStore', {


Is there any reason why the trust store is not implemented as an L2 construct?
I don't think creating L2 constructs is mandatory, so if you have a reason, please let me know.

Of course, I’m planning to implement it! My initial thought was to merge this PR first, then implement the L2 for truststore while deprecating truststoreId.

However, I’m starting to think it might not be ideal to implement an argument that will soon become obsolete. So it might be better to either implement the L2 first, or include it in this PR.

That said, including the L2 implementation might make this PR a bit too large. What are your thoughts on this?

Thank you.
In my opinion, if you are going to deprecate the property after implementing L2, it would be better to implement L2 from the beginning. I don't think the trust store itself will be a very complex construct.
If you're not going to deprecate it, I think the current policy is fine.

Sure! I'll add TruestStore L2 construct in this PR. Please wait for a while.

…ruct and simplify S3 bucket reference

… name length

…d update validation

aws-cdk-automation

(This review is outdated)

github-actions · 2025-12-05T13:53:48Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

View Security Guardian Results

github-actions · 2025-12-05T13:53:49Z

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
This security report is NOT a review blocker. Please try merge from main to avoid findings unrelated to the PR.

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

View Security Guardian Results with resolved templates

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

… 1 character

…iles

DCzajkowski · 2026-03-10T11:07:22Z

Sorry for the nudge, but are there plans to merge this? Our organization would benefit from using this new feature, but as of now we are blocked.

badmintoncryer · 2026-03-10T13:50:44Z

@DCzajkowski This PR is waiting for maintainer's review. Please wait for a while. I think it would take a several months to be merged.

mazyu36 · 2026-03-10T14:51:56Z

@badmintoncryer
I already approved , but CI is now failing because of other PRs merged since then.
Could you fix them?

aws-cdk-lib: error: [awslint:prefer-ref-interface:aws-cdk-lib.aws_cloudfront.ViewerMtlsConfig.trustStore] API should prefer to use the L1 reference interface (IxxxRef) and not the L2 interface (aws-cdk-lib.aws_cloudfront.ITrustStore). If this is intentional, add "[disable-awslint:prefer-ref-interface]" to element's jsdoc
aws-cdk-lib: error: [awslint:prefer-ref-interface:aws-cdk-lib.aws_cloudfront.CaCertificatesBundleS3Location.bucket] API should prefer to use the L1 reference interface (IxxxRef) and not the L2 interface (aws-cdk-lib.aws_s3.IBucket). If this is intentional, add "[disable-awslint:prefer-ref-interface]" to element's jsdoc
aws-cdk-lib: Error: /codebuild/output/src1798668233/src/actions-runner/_work/aws-cdk/aws-cdk/tools/@aws-cdk/cdk-build-tools/bin/cdk-awslint exited with error code 1
aws-cdk-lib: Build failed.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
aws-cdk-lib:

badmintoncryer · 2026-03-10T15:26:53Z

@mazyu36 Thanks! I've not realized the error. I'll fix it later.

- Use ITrustStoreRef instead of ITrustStore for ViewerMtlsConfig.trustStore - Use IBucketRef instead of IBucket for CaCertificatesBundleS3Location.bucket - Convert integ test zip asset to Git LFS pointer Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…t/no-duplicates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Use `import type` for Construct in integ.distribution-mtls.ts - Remove unused eslint-disable directive in mtls-test-handler.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fn::GetAtt -> Ref for TrustStoreId, both resolve to the same value. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

DCzajkowski · 2026-03-26T17:22:58Z

@badmintoncryer sorry for the ping, but it seems like the PR is green and approved. Is there anything left to do?

badmintoncryer · 2026-03-26T17:27:52Z

@DCzajkowski Thanks! This PR passed community review and is waiting for maintainers review. I think it will take several months...

badmintoncryer added 3 commits November 30, 2025 08:28

feat(cloudfront): add support for mutual TLS (mTLS) configuration in …

dd850cd

…Distribution

add integ

4171d17

update readme

d5ece7b

github-actions bot added the p2 label Nov 30, 2025

aws-cdk-automation requested a review from a team November 30, 2025 01:20

github-actions bot added the distinguished-contributor [Pilot] contributed 50+ PRs to the CDK label Nov 30, 2025

github-advanced-security bot found potential problems Nov 30, 2025

View reviewed changes

aws-cdk-automation added pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Nov 30, 2025

badmintoncryer added 2 commits November 30, 2025 14:15

update unit test

9393986

add validation

0b2c955

aws-cdk-automation removed the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Nov 30, 2025

update integ

7ab49a8

github-actions bot mentioned this pull request Dec 1, 2025

Monthly PR metrics report #36251

Open

Merge branch 'main' into mtls

4ade6c6

mazyu36 reviewed Dec 3, 2025

View reviewed changes

badmintoncryer added 5 commits December 5, 2025 21:15

feat: add Trust Store for mTLS authentication in CloudFront

08f1c7d

fix(cloudfront): update TrustStore creation to use higher-level const…

fa6ab9d

…ruct and simplify S3 bucket reference

fix(truststore): rename trustStoreName to name and add validation for…

ef74c4a

… name length

Merge remote-tracking branch 'origin/main' into mtls

80e0ed4

fix(truststore): rename 'name' to 'trustStoreName' for consistency an…

a8a4248

…d update validation

aws-cdk-automation previously requested changes Dec 5, 2025

View reviewed changes

add snapshot

590a435

aws-cdk-automation added the pr/needs-further-review PR requires additional review from our team specialists due to the scope or complexity of changes. label Dec 5, 2025

badmintoncryer added 2 commits December 5, 2025 23:24

fix(truststore): update validation for trustStoreName length to allow…

d474f54

… 1 character

Merge branch 'main' into mtls

27454ef

badmintoncryer added 2 commits February 12, 2026 15:46

fix: change imports to type imports in distribution and trust-store f…

f6733ad

…iles

Merge branch 'main' into mtls

2ceb1f4

badmintoncryer temporarily deployed to automation March 11, 2026 11:54 — with GitHub Actions Inactive

badmintoncryer temporarily deployed to automation March 11, 2026 11:55 — with GitHub Actions Inactive

fix: merge ITrustStoreRef import to fix ESLint import/order and impor…

240640f

…t/no-duplicates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

badmintoncryer temporarily deployed to automation March 11, 2026 12:30 — with GitHub Actions Inactive

badmintoncryer temporarily deployed to automation March 11, 2026 12:31 — with GitHub Actions Inactive

fix: fix ESLint errors in integ test files

56b4ac2

- Use `import type` for Construct in integ.distribution-mtls.ts - Remove unused eslint-disable directive in mtls-test-handler.ts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

badmintoncryer temporarily deployed to automation March 11, 2026 13:01 — with GitHub Actions Inactive

badmintoncryer temporarily deployed to automation March 11, 2026 13:02 — with GitHub Actions Inactive

fix: update integ test snapshot for TrustStoreId Ref change

be3a644

Fn::GetAtt -> Ref for TrustStoreId, both resolve to the same value. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

badmintoncryer temporarily deployed to automation March 11, 2026 14:23 — with GitHub Actions Inactive

Merge branch 'main' into mtls

b9d7d03

badmintoncryer temporarily deployed to automation March 11, 2026 14:26 — with GitHub Actions Inactive

badmintoncryer temporarily deployed to automation March 11, 2026 14:27 — with GitHub Actions Inactive

badmintoncryer added 2 commits March 18, 2026 10:49

Merge remote-tracking branch 'origin/main' into mtls

71e75f3

fix: add error code names to ValidationError calls after merging main

22f656a

badmintoncryer temporarily deployed to automation March 18, 2026 01:56 — with GitHub Actions Inactive

Merge branch 'main' into mtls

4297038

badmintoncryer temporarily deployed to automation April 2, 2026 03:08 — with GitHub Actions Inactive

Conversation

badmintoncryer commented Nov 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

badmintoncryer commented Nov 30, 2025

Uh oh!

mazyu36 left a comment

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

mazyu36 Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

badmintoncryer Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DCzajkowski commented Mar 10, 2026

Uh oh!

badmintoncryer commented Mar 10, 2026

Uh oh!

mazyu36 commented Mar 10, 2026

Uh oh!

badmintoncryer commented Mar 10, 2026

Uh oh!

DCzajkowski commented Mar 26, 2026

Uh oh!

badmintoncryer commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

badmintoncryer commented Nov 30, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading