Setting the skill. One moment.
Networking And Content Delivery Skills
Skill 85 of 130
Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and…
2 minutes · 463 words · 6 sections
Install
npx skills add aws/agent-toolkit-for-aws --skill cloudfrontnpx skills add aws/agent-toolkit-for-aws/plugin marketplace add aws/agent-toolkit-for-awsThe first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Domain expertise for configuring Amazon CloudFront content delivery: deciding when to use CloudFront and how it fits the wider architecture, managing custom-domain certificates and multi-tenant distributions, protecting origins, securing content, and observing traffic.
This skill is a router. Each customer task maps to a procedure file under references/. Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. CloudFront is a global service; its API calls
and the AWS Certificate Manager (ACM) certificates it uses are made in us-east-1 regardless of
where the customer’s application runs.
| Goal | Reference |
|---|---|
| Decide whether CloudFront is the right layer, see how it integrates, create a distribution, tune caching, or choose pricing | when to use CloudFront (opens in a new tab) |
| Serve a custom domain over HTTPS, manage ACM certificates, or run many domains with a certificate per tenant | managing certificates with CloudFront (opens in a new tab) |
| Make CloudFront the only way to reach the origin (S3 OAC, VPC origins, origin mutual TLS, security groups) | protecting your origins (opens in a new tab) |
| Limit who can view content by identity, location, client certificate, or auth token | securing your content (opens in a new tab) |
| Get visibility into traffic with standard and real-time logs, and analyze them | CloudFront observability (opens in a new tab) |
| Serve multiple domains through shared configuration with per-tenant customization (SaaS, platform) | multi-tenant distributions (opens in a new tab) |
route53-cloudfront skill.Pointing a custom domain’s DNS at a CloudFront distribution, or failing over between distributions
with Route 53 records, is cross-service work owned by the separate route53-cloudfront skill. Use
this skill for the CloudFront-side configuration only.
Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions, Lambda@Edge, Route 53, and origins (creating a distribution, caching, and Flat Rate Pricing (FRP) versus pay-as-you-go pricing); managing custom-domain TLS certificates (ACM in us-east-1); configuring multi-tenant distributions; protecting origins with origin access control (OAC), VPC origins, and origin mutual TLS (mTLS); securing content with signed URLs and cookies, geographic restrictions, viewer mutual TLS, and edge token validation; and observing traffic with standard and real-time logs. Applicable when the customer wants to put CloudFront in front of content, choose pricing, lock an origin, restrict who can view content, or analyze logs. Not applicable for the Route 53 DNS side of a CloudFront custom domain or failover between distributions (see the route53-cloudfront skill), or for pure-Route 53 DNS work (see the route53 skill).
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
main, last pushed 23 September 2026.SKILL.md, not by matching a directory convention. 19 distinct layouts observed: plugins/aws-agents-for-devsecops/skills/*/SKILL.md, plugins/aws-agents/skills/*/SKILL.md, plugins/aws-core/skills/*/SKILL.md, skills/core-skills/*/SKILL.md, skills/specialized-skills/analytics-skills/*/SKILL.md, skills/specialized-skills/database-skills/*/SKILL.md, skills/specialized-skills/ec2-skills/*/SKILL.md, skills/specialized-skills/end-user-computing-skills/*/SKILL.md, skills/specialized-skills/messaging-and-streaming-skills/*/SKILL.md, skills/specialized-skills/migration-and-modernization-skills/*/SKILL.md, skills/specialized-skills/networking-and-content-delivery-skills/*/SKILL.md, skills/specialized-skills/operations-skills/*/SKILL.md, skills/specialized-skills/quantum-computing-skills/*/SKILL.md, skills/specialized-skills/resilience-skills/*/SKILL.md, skills/specialized-skills/security-and-identity-skills/*/SKILL.md, skills/specialized-skills/serverless-skills/*/SKILL.md, skills/specialized-skills/storage-skills/*/SKILL.md, skills/specialized-skills/system-table-skills/*/SKILL.md, skills/specialized-skills/web-and-mobile-development/*/SKILL.md.h1 and no skipped levels:.claude-plugin/marketplace.json by Amazon Web Services, declaring 4 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree./aws/agent-toolkit-for-aws.md, and each skill at its own .md URL.6 files · 81 KB
Everything this skill ships beside its prose. All of it is set here, as subchapters of skill 85.
Documentation the agent loads on demand, rather than up front.