Setting the chapter. One moment.
AWS Agents For Devsecops
AWS Core
Core Skills · AWS…
Messaging And Streaming Skills
Migration And Modernization Skills
Networking And Content Delivery Skills
Security And Identity Skills
System Table Skills
Web And Mobile Development
120 chapters · 648 min
Networking And Content Delivery Skills
Chapter 78 of 120
Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and…
2 minutes · 463 words · 6 sections
Domain expertise for configuring Amazon CloudFront content delivery: deciding when to use CloudFront and how it fits the wider architecture, managing custom-domain certificates and multi-tenant distributions, protecting origins, securing content, and observing traffic.
This skill is a router. Each customer task maps to a procedure file under references/. Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. CloudFront is a global service; its API calls
and the AWS Certificate Manager (ACM) certificates it uses are made in us-east-1 regardless of
where the customer’s application runs.
| Goal | Reference |
|---|---|
| Decide whether CloudFront is the right layer, see how it integrates, create a distribution, tune caching, or choose pricing | when to use CloudFront (opens in a new tab) |
| Serve a custom domain over HTTPS, manage ACM certificates, or run many domains with a certificate per tenant | managing certificates with CloudFront (opens in a new tab) |
| Make CloudFront the only way to reach the origin (S3 OAC, VPC origins, origin mutual TLS, security groups) | protecting your origins (opens in a new tab) |
route53-cloudfront skill.Pointing a custom domain’s DNS at a CloudFront distribution, or failing over between distributions
with Route 53 records, is cross-service work owned by the separate route53-cloudfront skill. Use
this skill for the CloudFront-side configuration only.
Install this repository
npx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsSkills install per repository, not per chapter — the CLI has no documented per-skill form, so we do not print one.
Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and origins (creating a distribution, caching, and Flat Rate Pricing (FRP) versus pay-as-you-go pricing); managing custom-domain TLS certificates (ACM in us-east-1); configuring multi-tenant distributions; protecting origins with origin access control (OAC), VPC origins, and origin mutual TLS (mTLS); securing content with signed URLs and cookies, geographic restrictions, viewer mutual TLS, and edge token validation; and observing traffic with standard and real-time logs. Applicable when the customer wants to put CloudFront in front of content, choose pricing, lock an origin, restrict who can view content, or analyze logs. Not applicable for the Route 53 DNS side of a CloudFront custom domain or failover between distributions (see the route53-cloudfront skill), or for pure-Route 53 DNS work (see the route53 skill).
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
main, last pushed 10 August 2026.SKILL.md, not by matching a directory convention. 17 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md.| Limit who can view content by identity, location, client certificate, or auth token | securing your content (opens in a new tab) |
| Get visibility into traffic with standard and real-time logs, and analyze them | CloudFront observability (opens in a new tab) |
| Serve multiple domains through shared configuration with per-tenant customization (SaaS, platform) | multi-tenant distributions (opens in a new tab) |
skills/specialized-skills/storage-skills/*/SKILL.mdskills/specialized-skills/system-table-skills/*/SKILL.mdskills/specialized-skills/web-and-mobile-development/*/SKILL.mdh1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each chapter at its own .md URL.6 files · 81 KB
Everything this skill ships beside its prose. All of it is set here, as subchapters of chapter 78.
Documentation the agent loads on demand, rather than up front.