CloudFront
Prefix cloudfront, 173 actions · Domain Networking & Content Delivery
7 AWS managed policies. 1 have reviewed guidance; the rest have authoritative permission data pending editorial review. 3 are service-linked role policies, shown with permission data only.
User access (2)
- CloudFrontFullAccessAdmin
- CloudFrontReadOnlyAccessReader
Operator and limited (1)
- AWSForWordPressPluginPolicyOperator
Service roles (1)
Service-linked roles (3)
- AWSLambdaReplicatorOperator
- AWSShieldServiceRolePolicyOperator
- CloudWatchInternetMonitorServiceRolePolicyOperator
Also grants CloudFront actions (37)
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonRoute53FullAccess
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSIPAMServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMobileHub_FullAccess
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
- AWSPartnerLedSupportReadOnlyAccess
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSTrustedAdvisorServiceRolePolicy
- AWSWAFConsoleFullAccess
- AWSWAFConsoleReadOnlyAccess
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudWatchAutomaticDashboardsAccess
- CloudWatchInternetMonitorFullAccess
- CloudWatchOmniAWSIntegrationPolicy
- FMSServiceRolePolicy
- NetworkAdministrator
- NetworkSecurityDirectorServiceLinkedRolePolicy
- NetworkSecurityManagerServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SecurityAudit
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
allowvendedlogdeliveryforresource associatealias associatedistributiontenantwebacl associatedistributionwebacl copydistribution createanycastiplist createcachepolicy createcloudfrontoriginaccessidentity createconnectionfunction createconnectiongroup createcontinuousdeploymentpolicy createdistribution createdistributiontenant createfieldlevelencryptionconfig createfieldlevelencryptionprofile createfunction createinvalidation createinvalidationfordistributiontenant createkeygroup createkeyvaluestore createmonitoringsubscription createoriginaccesscontrol createoriginrequestpolicy createpublickey createrealtimelogconfig createresponseheaderspolicy createsavingsplan createstreamingdistribution createstreamingdistributionwithtags createtruststore createvpcorigin deleteanycastiplist deletecachepolicy deletecloudfrontoriginaccessidentity deleteconnectionfunction deleteconnectiongroup deletecontinuousdeploymentpolicy deletedistribution deletedistributiontenant deletefieldlevelencryptionconfig deletefieldlevelencryptionprofile deletefunction deletekeygroup deletekeyvaluestore deletemonitoringsubscription deleteoriginaccesscontrol deleteoriginrequestpolicy deletepublickey deleterealtimelogconfig deleteresourcepolicy deleteresponseheaderspolicy deletestreamingdistribution deletetruststore deletevpcorigin describeconnectionfunction describefunction describekeyvaluestore disassociatedistributiontenantwebacl disassociatedistributionwebacl getanycastiplist getcachepolicy getcachepolicyconfig getcloudfrontoriginaccessidentity getcloudfrontoriginaccessidentityconfig getconnectionfunction getconnectiongroup getconnectiongroupbyroutingendpoint getcontinuousdeploymentpolicy getcontinuousdeploymentpolicyconfig getdistribution getdistributionconfig getdistributiontenant getdistributiontenantbydomain getfieldlevelencryption getfieldlevelencryptionconfig getfieldlevelencryptionprofile getfieldlevelencryptionprofileconfig getfunction getinvalidation getinvalidationfordistributiontenant getkeygroup getkeygroupconfig getmanagedcertificatedetails getmonitoringsubscription getoriginaccesscontrol getoriginaccesscontrolconfig getoriginrequestpolicy getoriginrequestpolicyconfig getpublickey getpublickeyconfig getrealtimelogconfig getresourcepolicy getresponseheaderspolicy getresponseheaderspolicyconfig getsavingsplan getstreamingdistribution getstreamingdistributionconfig gettruststore getvpcorigin listanycastiplists listcachepolicies listcloudfrontoriginaccessidentities listconflictingaliases listconnectionfunctions listconnectiongroups listcontinuousdeploymentpolicies listdistributiontenants listdistributiontenantsbycustomization listdistributions listdistributionsbyanycastiplistid listdistributionsbycachepolicyid listdistributionsbyconnectionfunction listdistributionsbyconnectionmode listdistributionsbykeygroup listdistributionsbylambdafunction listdistributionsbyoriginrequestpolicyid listdistributionsbyrealtimelogconfig listdistributionsbyresponseheaderspolicyid listdistributionsbytruststore listdistributionsbyvpcoriginid listdistributionsbywebaclid listdomainconflicts listfieldlevelencryptionconfigs listfieldlevelencryptionprofiles listfunctions listinvalidations listinvalidationsfordistributiontenant listkeygroups listkeyvaluestores listoriginaccesscontrols listoriginrequestpolicies listpublickeys listratecards listrealtimelogconfigs listresponseheaderspolicies listsavingsplans liststreamingdistributions listtagsforresource listtruststores listusages listvpcorigins publishconnectionfunction publishfunction putresourcepolicy tagresource testconnectionfunction testfunction untagresource updateanycastiplist updatecachepolicy updatecloudfrontoriginaccessidentity updateconnectionfunction updateconnectiongroup updatecontinuousdeploymentpolicy updatedistribution updatedistributiontenant updatedistributionwithstagingconfig updatedomainassociation updatefieldlevelencryptionconfig updatefieldlevelencryptionprofile updatefunction updatekeygroup updatekeyvaluestore updateoriginaccesscontrol updateoriginrequestpolicy updatepublickey updaterealtimelogconfig updateresponseheaderspolicy updatesavingsplan updatestreamingdistribution updatetruststore updatevpcorigin verifydnsconfiguration
Actions (173)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| cloudfront:AllowVendedLogDeliveryForResource | Permissions management | 5 | 2 |
| cloudfront:AssociateAlias | Write | 5 | 1 |
| cloudfront:AssociateDistributionTenantWebACL | Write | 5 | 2 |
| cloudfront:AssociateDistributionWebACL | Write | 6 | 3 |
| cloudfront:CopyDistribution | Write | 5 | 1 |
| cloudfront:CreateAnycastIpList | Write | 5 | 1 |
| cloudfront:CreateCachePolicy | Write | 5 | 1 |
| cloudfront:CreateCloudFrontOriginAccessIdentity | Write | 6 | 1 |
| cloudfront:CreateConnectionFunction | Write | 5 | 1 |
| cloudfront:CreateConnectionGroup | Write | 5 | 1 |
| cloudfront:CreateContinuousDeploymentPolicy | Write | 5 | 1 |
| cloudfront:CreateDistribution | Write | 6 | 2 |
| cloudfront:CreateDistributionTenant | Write | 5 | 1 |
| cloudfront:CreateFieldLevelEncryptionConfig | Write | 5 | 1 |
| cloudfront:CreateFieldLevelEncryptionProfile | Write | 5 | 1 |
| cloudfront:CreateFunction | Write | 5 | 1 |
| cloudfront:CreateInvalidation | Write | 6 | 2 |
| cloudfront:CreateInvalidationForDistributionTenant | Write | 5 | 1 |
| cloudfront:CreateKeyGroup | Write | 5 | 1 |
| cloudfront:CreateKeyValueStore | Write | 5 | 1 |
| cloudfront:CreateMonitoringSubscription | Write | 5 | 1 |
| cloudfront:CreateOriginAccessControl | Write | 5 | 1 |
| cloudfront:CreateOriginRequestPolicy | Write | 5 | 1 |
| cloudfront:CreatePublicKey | Write | 5 | 1 |
| cloudfront:CreateRealtimeLogConfig | Write | 5 | 1 |
| cloudfront:CreateResponseHeadersPolicy | Write | 5 | 1 |
| cloudfront:CreateSavingsPlan | Write | 5 | 1 |
| cloudfront:CreateStreamingDistribution | Write | 5 | 1 |
| cloudfront:CreateStreamingDistributionWithTags | Write | 5 | 1 |
| cloudfront:CreateTrustStore | Write | 5 | 1 |
| cloudfront:CreateVpcOrigin | Write | 5 | 1 |
| cloudfront:DeleteAnycastIpList | Write | 5 | 1 |
| cloudfront:DeleteCachePolicy | Write | 5 | 1 |
| cloudfront:DeleteCloudFrontOriginAccessIdentity | Write | 5 | 2 |
| cloudfront:DeleteConnectionFunction | Write | 5 | 1 |
| cloudfront:DeleteConnectionGroup | Write | 5 | 1 |
| cloudfront:DeleteContinuousDeploymentPolicy | Write | 5 | 1 |
| cloudfront:DeleteDistribution | Write | 6 | 2 |
| cloudfront:DeleteDistributionTenant | Write | 5 | 1 |
| cloudfront:DeleteFieldLevelEncryptionConfig | Write | 5 | 1 |
| cloudfront:DeleteFieldLevelEncryptionProfile | Write | 5 | 1 |
| cloudfront:DeleteFunction | Write | 5 | 1 |
| cloudfront:DeleteKeyGroup | Write | 5 | 1 |
| cloudfront:DeleteKeyValueStore | Write | 5 | 1 |
| cloudfront:DeleteMonitoringSubscription | Write | 5 | 1 |
| cloudfront:DeleteOriginAccessControl | Write | 5 | 1 |
| cloudfront:DeleteOriginRequestPolicy | Write | 5 | 1 |
| cloudfront:DeletePublicKey | Write | 5 | 1 |
| cloudfront:DeleteRealtimeLogConfig | Write | 5 | 1 |
| cloudfront:DeleteResourcePolicy | Write | 5 | 1 |
| cloudfront:DeleteResponseHeadersPolicy | Write | 5 | 1 |
| cloudfront:DeleteStreamingDistribution | Write | 5 | 1 |
| cloudfront:DeleteTrustStore | Write | 5 | 1 |
| cloudfront:DeleteVpcOrigin | Write | 5 | 1 |
| cloudfront:DescribeConnectionFunction | Read | 13 | 2 |
| cloudfront:DescribeFunction | Read | 16 | 2 |
| cloudfront:DescribeKeyValueStore | Read | 15 | 3 |
| cloudfront:DisassociateDistributionTenantWebACL | Write | 5 | 2 |
| cloudfront:DisassociateDistributionWebACL | Write | 6 | 3 |
| cloudfront:GetAnycastIpList | Read | 15 | 2 |
| cloudfront:GetCachePolicy | Read | 18 | 2 |
| cloudfront:GetCachePolicyConfig | Read | 13 | 1 |
| cloudfront:GetCloudFrontOriginAccessIdentity | Read | 19 | 2 |
| cloudfront:GetCloudFrontOriginAccessIdentityConfig | Read | 14 | 1 |
| cloudfront:GetConnectionFunction | Read | 13 | 2 |
| cloudfront:GetConnectionGroup | Read | 16 | 2 |
| cloudfront:GetConnectionGroupByRoutingEndpoint | Read | 12 | 1 |
| cloudfront:GetContinuousDeploymentPolicy | Read | 18 | 2 |
| cloudfront:GetContinuousDeploymentPolicyConfig | Read | 13 | 1 |
| cloudfront:GetDistribution | Read | 26 | 8 |
| cloudfront:GetDistributionConfig | Read | 20 | 6 |
| cloudfront:GetDistributionTenant | Read | 16 | 4 |
| cloudfront:GetDistributionTenantByDomain | Read | 14 | 1 |
| cloudfront:GetFieldLevelEncryption | Read | 11 | 1 |
| cloudfront:GetFieldLevelEncryptionConfig | Read | 11 | 1 |
| cloudfront:GetFieldLevelEncryptionProfile | Read | 11 | 1 |
| cloudfront:GetFieldLevelEncryptionProfileConfig | Read | 11 | 1 |
| cloudfront:GetFunction | Read | 16 | 2 |
| cloudfront:GetInvalidation | Read | 13 | 2 |
| cloudfront:GetInvalidationForDistributionTenant | Read | 12 | 1 |
| cloudfront:GetKeyGroup | Read | 18 | 2 |
| cloudfront:GetKeyGroupConfig | Read | 13 | 1 |
| cloudfront:GetManagedCertificateDetails | Read | 12 | 1 |
| cloudfront:GetMonitoringSubscription | Read | 18 | 1 |
| cloudfront:GetOriginAccessControl | Read | 18 | 2 |
| cloudfront:GetOriginAccessControlConfig | Read | 13 | 1 |
| cloudfront:GetOriginRequestPolicy | Read | 18 | 2 |
| cloudfront:GetOriginRequestPolicyConfig | Read | 13 | 1 |
| cloudfront:GetPublicKey | Read | 18 | 3 |
| cloudfront:GetPublicKeyConfig | Read | 13 | 1 |
| cloudfront:GetRealtimeLogConfig | Read | 19 | 3 |
| cloudfront:GetResourcePolicy | Read | 12 | 1 |
| cloudfront:GetResponseHeadersPolicy | Read | 18 | 2 |
| cloudfront:GetResponseHeadersPolicyConfig | Read | 13 | 1 |
| cloudfront:GetSavingsPlan | Read | 11 | 1 |
| cloudfront:GetStreamingDistribution | Read | 13 | 1 |
| cloudfront:GetStreamingDistributionConfig | Read | 13 | 1 |
| cloudfront:GetTrustStore | Read | 13 | 2 |
| cloudfront:GetVpcOrigin | Read | 15 | 4 |
| cloudfront:ListAnycastIpLists | List | 21 | 2 |
| cloudfront:ListCachePolicies | List | 21 | 2 |
| cloudfront:ListCloudFrontOriginAccessIdentities | List | 22 | 2 |
| cloudfront:ListConflictingAliases | List | 17 | 1 |
| cloudfront:ListConnectionFunctions | List | 18 | 2 |
| cloudfront:ListConnectionGroups | List | 20 | 2 |
| cloudfront:ListContinuousDeploymentPolicies | List | 21 | 2 |
| cloudfront:ListDistributionTenants | List | 22 | 2 |
| cloudfront:ListDistributionTenantsByCustomization | List | 19 | 1 |
| cloudfront:ListDistributions | List | 34 | 4 |
| cloudfront:ListDistributionsByAnycastIpListId | List | 18 | 1 |
| cloudfront:ListDistributionsByCachePolicyId | List | 18 | 1 |
| cloudfront:ListDistributionsByConnectionFunction | List | 17 | 1 |
| cloudfront:ListDistributionsByConnectionMode | List | 17 | 1 |
| cloudfront:ListDistributionsByKeyGroup | List | 18 | 1 |
| cloudfront:ListDistributionsByLambdaFunction | List | 18 | 1 |
| cloudfront:ListDistributionsByOriginRequestPolicyId | List | 18 | 1 |
| cloudfront:ListDistributionsByRealtimeLogConfig | List | 18 | 1 |
| cloudfront:ListDistributionsByResponseHeadersPolicyId | List | 18 | 1 |
| cloudfront:ListDistributionsByTrustStore | List | 17 | 1 |
| cloudfront:ListDistributionsByVpcOriginId | List | 17 | 1 |
| cloudfront:ListDistributionsByWebACLId | List | 23 | 1 |
| cloudfront:ListDomainConflicts | List | 17 | 1 |
| cloudfront:ListFieldLevelEncryptionConfigs | List | 18 | 1 |
| cloudfront:ListFieldLevelEncryptionProfiles | List | 18 | 1 |
| cloudfront:ListFunctions | List | 21 | 2 |
| cloudfront:ListInvalidations | List | 19 | 1 |
| cloudfront:ListInvalidationsForDistributionTenant | List | 17 | 1 |
| cloudfront:ListKeyGroups | List | 21 | 2 |
| cloudfront:ListKeyValueStores | List | 20 | 3 |
| cloudfront:ListOriginAccessControls | List | 21 | 2 |
| cloudfront:ListOriginRequestPolicies | List | 21 | 2 |
| cloudfront:ListPublicKeys | List | 22 | 3 |
| cloudfront:ListRateCards | List | 16 | 1 |
| cloudfront:ListRealtimeLogConfigs | List | 21 | 3 |
| cloudfront:ListResponseHeadersPolicies | List | 21 | 2 |
| cloudfront:ListSavingsPlans | List | 16 | 1 |
| cloudfront:ListStreamingDistributions | List | 19 | 1 |
| cloudfront:ListTagsForResource | Read | 24 | 4 |
| cloudfront:ListTrustStores | List | 18 | 2 |
| cloudfront:ListUsages | List | 16 | 1 |
| cloudfront:ListVpcOrigins | List | 20 | 2 |
| cloudfront:PublishConnectionFunction | Write | 5 | 1 |
| cloudfront:PublishFunction | Write | 5 | 1 |
| cloudfront:PutResourcePolicy | Write | 5 | 1 |
| cloudfront:TagResource | Tagging | 7 | 2 |
| cloudfront:TestConnectionFunction | Write | 5 | 1 |
| cloudfront:TestFunction | Write | 5 | 1 |
| cloudfront:UntagResource | Tagging | 7 | 1 |
| cloudfront:UpdateAnycastIpList | Write | 5 | 1 |
| cloudfront:UpdateCachePolicy | Write | 5 | 1 |
| cloudfront:UpdateCloudFrontOriginAccessIdentity | Write | 5 | 2 |
| cloudfront:UpdateConnectionFunction | Write | 5 | 1 |
| cloudfront:UpdateConnectionGroup | Write | 5 | 1 |
| cloudfront:UpdateContinuousDeploymentPolicy | Write | 5 | 1 |
| cloudfront:UpdateDistribution | Write | 8 | 3 |
| cloudfront:UpdateDistributionTenant | Write | 5 | 1 |
| cloudfront:UpdateDistributionWithStagingConfig | Write | 5 | 1 |
| cloudfront:UpdateDomainAssociation | Write | 5 | 1 |
| cloudfront:UpdateFieldLevelEncryptionConfig | Write | 5 | 1 |
| cloudfront:UpdateFieldLevelEncryptionProfile | Write | 5 | 1 |
| cloudfront:UpdateFunction | Write | 5 | 1 |
| cloudfront:UpdateKeyGroup | Write | 5 | 1 |
| cloudfront:UpdateKeyValueStore | Write | 5 | 1 |
| cloudfront:UpdateOriginAccessControl | Write | 5 | 1 |
| cloudfront:UpdateOriginRequestPolicy | Write | 5 | 1 |
| cloudfront:UpdatePublicKey | Write | 5 | 1 |
| cloudfront:UpdateRealtimeLogConfig | Write | 5 | 1 |
| cloudfront:UpdateResponseHeadersPolicy | Write | 5 | 1 |
| cloudfront:UpdateSavingsPlan | Write | 5 | 1 |
| cloudfront:UpdateStreamingDistribution | Write | 5 | 1 |
| cloudfront:UpdateTrustStore | Write | 5 | 1 |
| cloudfront:UpdateVpcOrigin | Write | 5 | 1 |
| cloudfront:VerifyDnsConfiguration | Read | 5 | 1 |