feat(client-cloudfront): Add OriginMTLS support to CloudFront Distribution APIs

awstools · awstools · commit 4b7b074bcff8 · 2026-02-02T19:11:42.000Z
diff --git a/clients/client-cloudfront/src/commands/CopyDistributionCommand.ts b/clients/client-cloudfront/src/commands/CopyDistributionCommand.ts
@@ -125,6 +125,9 @@ export interface CopyDistributionCommandOutput extends CopyDistributionResult, _
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/CreateDistributionCommand.ts b/clients/client-cloudfront/src/commands/CreateDistributionCommand.ts
@@ -79,6 +79,9 @@ export interface CreateDistributionCommandOutput extends CreateDistributionResul
  *             OriginReadTimeout: Number("int"),
  *             OriginKeepaliveTimeout: Number("int"),
  *             IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ *             OriginMtlsConfig: { // OriginMtlsConfig
+ *               ClientCertificateArn: "STRING_VALUE", // required
+ *             },
  *           },
  *           VpcOriginConfig: { // VpcOriginConfig
  *             VpcOriginId: "STRING_VALUE", // required
@@ -450,6 +453,9 @@ export interface CreateDistributionCommandOutput extends CreateDistributionResul
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/CreateDistributionWithTagsCommand.ts b/clients/client-cloudfront/src/commands/CreateDistributionWithTagsCommand.ts
@@ -80,6 +80,9 @@ export interface CreateDistributionWithTagsCommandOutput extends CreateDistribut
  *               OriginReadTimeout: Number("int"),
  *               OriginKeepaliveTimeout: Number("int"),
  *               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ *               OriginMtlsConfig: { // OriginMtlsConfig
+ *                 ClientCertificateArn: "STRING_VALUE", // required
+ *               },
  *             },
  *             VpcOriginConfig: { // VpcOriginConfig
  *               VpcOriginId: "STRING_VALUE", // required
@@ -460,6 +463,9 @@ export interface CreateDistributionWithTagsCommandOutput extends CreateDistribut
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/GetDistributionCommand.ts b/clients/client-cloudfront/src/commands/GetDistributionCommand.ts
@@ -121,6 +121,9 @@ export interface GetDistributionCommandOutput extends GetDistributionResult, __M
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/GetDistributionConfigCommand.ts b/clients/client-cloudfront/src/commands/GetDistributionConfigCommand.ts
@@ -84,6 +84,9 @@ export interface GetDistributionConfigCommandOutput extends GetDistributionConfi
  * //             OriginReadTimeout: Number("int"),
  * //             OriginKeepaliveTimeout: Number("int"),
  * //             IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //             OriginMtlsConfig: { // OriginMtlsConfig
+ * //               ClientCertificateArn: "STRING_VALUE", // required
+ * //             },
  * //           },
  * //           VpcOriginConfig: { // VpcOriginConfig
  * //             VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/GetManagedCertificateDetailsCommand.ts b/clients/client-cloudfront/src/commands/GetManagedCertificateDetailsCommand.ts
@@ -5,8 +5,7 @@ import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
 
 import type { CloudFrontClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CloudFrontClient";
 import { commonParams } from "../endpoint/EndpointParameters";
-import type { GetManagedCertificateDetailsRequest } from "../models/models_0";
-import type { GetManagedCertificateDetailsResult } from "../models/models_1";
+import type { GetManagedCertificateDetailsRequest, GetManagedCertificateDetailsResult } from "../models/models_1";
 import { GetManagedCertificateDetails$ } from "../schemas/schemas_0";
 
 /**
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByAnycastIpListIdCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByAnycastIpListIdCommand.ts
@@ -100,6 +100,9 @@ export interface ListDistributionsByAnycastIpListIdCommandOutput extends ListDis
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByConnectionFunctionCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByConnectionFunctionCommand.ts
@@ -100,6 +100,9 @@ export interface ListDistributionsByConnectionFunctionCommandOutput extends List
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByConnectionModeCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByConnectionModeCommand.ts
@@ -100,6 +100,9 @@ export interface ListDistributionsByConnectionModeCommandOutput extends ListDist
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByRealtimeLogConfigCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByRealtimeLogConfigCommand.ts
@@ -101,6 +101,9 @@ export interface ListDistributionsByRealtimeLogConfigCommandOutput extends ListD
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByTrustStoreCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByTrustStoreCommand.ts
@@ -97,6 +97,9 @@ export interface ListDistributionsByTrustStoreCommandOutput extends ListDistribu
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsByWebACLIdCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsByWebACLIdCommand.ts
@@ -97,6 +97,9 @@ export interface ListDistributionsByWebACLIdCommandOutput extends ListDistributi
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/ListDistributionsCommand.ts b/clients/client-cloudfront/src/commands/ListDistributionsCommand.ts
@@ -96,6 +96,9 @@ export interface ListDistributionsCommandOutput extends ListDistributionsResult,
  * //                 OriginReadTimeout: Number("int"),
  * //                 OriginKeepaliveTimeout: Number("int"),
  * //                 IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //                 OriginMtlsConfig: { // OriginMtlsConfig
+ * //                   ClientCertificateArn: "STRING_VALUE", // required
+ * //                 },
  * //               },
  * //               VpcOriginConfig: { // VpcOriginConfig
  * //                 VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/UpdateDistributionCommand.ts b/clients/client-cloudfront/src/commands/UpdateDistributionCommand.ts
@@ -79,6 +79,9 @@ export interface UpdateDistributionCommandOutput extends UpdateDistributionResul
  *             OriginReadTimeout: Number("int"),
  *             OriginKeepaliveTimeout: Number("int"),
  *             IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ *             OriginMtlsConfig: { // OriginMtlsConfig
+ *               ClientCertificateArn: "STRING_VALUE", // required
+ *             },
  *           },
  *           VpcOriginConfig: { // VpcOriginConfig
  *             VpcOriginId: "STRING_VALUE", // required
@@ -452,6 +455,9 @@ export interface UpdateDistributionCommandOutput extends UpdateDistributionResul
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/commands/UpdateDistributionWithStagingConfigCommand.ts b/clients/client-cloudfront/src/commands/UpdateDistributionWithStagingConfigCommand.ts
@@ -126,6 +126,9 @@ export interface UpdateDistributionWithStagingConfigCommandOutput extends Update
  * //               OriginReadTimeout: Number("int"),
  * //               OriginKeepaliveTimeout: Number("int"),
  * //               IpAddressType: "ipv4" || "ipv6" || "dualstack",
+ * //               OriginMtlsConfig: { // OriginMtlsConfig
+ * //                 ClientCertificateArn: "STRING_VALUE", // required
+ * //               },
  * //             },
  * //             VpcOriginConfig: { // VpcOriginConfig
  * //               VpcOriginId: "STRING_VALUE", // required
diff --git a/clients/client-cloudfront/src/models/models_0.ts b/clients/client-cloudfront/src/models/models_0.ts
@@ -1635,6 +1635,18 @@ export interface CustomHeaders {
   Items?: OriginCustomHeader[] | undefined;
 }
 
+/**
+ * <p>Configures mutual TLS authentication between CloudFront and your origin server.</p>
+ * @public
+ */
+export interface OriginMtlsConfig {
+  /**
+   * <p>The Amazon Resource Name (ARN) of the client certificate stored in Amazon Web Services Certificate Manager (ACM) that CloudFront uses to authenticate with your origin using Mutual TLS.</p>
+   * @public
+   */
+  ClientCertificateArn: string | undefined;
+}
+
 /**
  * <p>A complex type that contains information about the SSL/TLS protocols that CloudFront can use when establishing an HTTPS connection with your origin.</p>
  * @public
@@ -1699,6 +1711,12 @@ export interface CustomOriginConfig {
    * @public
    */
   IpAddressType?: IpAddressType | undefined;
+
+  /**
+   * <p>Configures mutual TLS authentication between CloudFront and your origin server.</p>
+   * @public
+   */
+  OriginMtlsConfig?: OriginMtlsConfig | undefined;
 }
 
 /**
@@ -6791,14 +6809,3 @@ export interface GetKeyGroupConfigResult {
    */
   ETag?: string | undefined;
 }
-
-/**
- * @public
- */
-export interface GetManagedCertificateDetailsRequest {
-  /**
-   * <p>The identifier of the distribution tenant. You can specify the ARN, ID, or name of the distribution tenant.</p>
-   * @public
-   */
-  Identifier: string | undefined;
-}
diff --git a/clients/client-cloudfront/src/models/models_1.ts b/clients/client-cloudfront/src/models/models_1.ts
@@ -82,6 +82,17 @@ import {
   RealtimeLogConfig,
 } from "./models_0";
 
+/**
+ * @public
+ */
+export interface GetManagedCertificateDetailsRequest {
+  /**
+   * <p>The identifier of the distribution tenant. You can specify the ARN, ID, or name of the distribution tenant.</p>
+   * @public
+   */
+  Identifier: string | undefined;
+}
+
 /**
  * <p>Contains details about the validation token.</p>
  * @public
diff --git a/clients/client-cloudfront/src/schemas/schemas_0.ts b/clients/client-cloudfront/src/schemas/schemas_0.ts
@@ -58,6 +58,7 @@ const _CBL = "CacheBehaviorList";
 const _CBa = "CacheBehaviors";
 const _CBo = "CookieBehavior";
 const _CC = "CookiesConfig";
+const _CCA = "ClientCertificateArn";
 const _CCBS = "CaCertificatesBundleSource";
 const _CCBSL = "CaCertificatesBundleS3Location";
 const _CCDP = "CreateContinuousDeploymentPolicy";
@@ -800,6 +801,7 @@ const _OGr = "OriginGroup";
 const _OI = "OriginId";
 const _OKT = "OriginKeepaliveTimeout";
 const _OL = "OriginList";
+const _OMC = "OriginMtlsConfig";
 const _OO = "OriginOverride";
 const _OP = "OriginPath";
 const _OPP = "OriginProtocolPolicy";
@@ -1948,8 +1950,8 @@ export var Customizations$: StaticStructureSchema = [3, n0, _Cu,
 ];
 export var CustomOriginConfig$: StaticStructureSchema = [3, n0, _COC,
   0,
-  [_HTTPP, _HTTPSP, _OPP, _OSP, _ORT, _OKT, _IAT],
-  [1, 1, 0, [() => OriginSslProtocols$, 0], 1, 1, 0], 3
+  [_HTTPP, _HTTPSP, _OPP, _OSP, _ORT, _OKT, _IAT, _OMC],
+  [1, 1, 0, [() => OriginSslProtocols$, 0], 1, 1, 0, () => OriginMtlsConfig$], 3
 ];
 export var DefaultCacheBehavior$: StaticStructureSchema = [3, n0, _DCB,
   0,
@@ -3689,6 +3691,11 @@ export var OriginGroups$: StaticStructureSchema = [3, n0, _OG,
   [_Q, _I],
   [1, [() => OriginGroupList, 0]], 1
 ];
+export var OriginMtlsConfig$: StaticStructureSchema = [3, n0, _OMC,
+  0,
+  [_CCA],
+  [0], 1
+];
 export var OriginRequestPolicy$: StaticStructureSchema = [3, n0, _ORP,
   0,
   [_Id, _LMT, _ORPC],
diff --git a/clients/client-cloudfront/test/index-objects.spec.mjs b/clients/client-cloudfront/test/index-objects.spec.mjs
@@ -839,6 +839,7 @@ import {
   OriginGroupMembers$,
   OriginGroups$,
   OriginGroupSelectionCriteria,
+  OriginMtlsConfig$,
   OriginProtocolPolicy,
   OriginRequestPolicy$,
   OriginRequestPolicyAlreadyExists,
@@ -1943,6 +1944,7 @@ assert(typeof OriginGroupFailoverCriteria$ === "object");
 assert(typeof OriginGroupMember$ === "object");
 assert(typeof OriginGroupMembers$ === "object");
 assert(typeof OriginGroups$ === "object");
+assert(typeof OriginMtlsConfig$ === "object");
 assert(typeof OriginRequestPolicy$ === "object");
 assert(typeof OriginRequestPolicyConfig$ === "object");
 assert(typeof OriginRequestPolicyCookiesConfig$ === "object");
diff --git a/clients/client-cloudfront/test/index-types.ts b/clients/client-cloudfront/test/index-types.ts
@@ -924,6 +924,7 @@ export type {
   OriginGroupMember,
   OriginGroupMembers,
   OriginGroups,
+  OriginMtlsConfig,
   OriginRequestPolicy,
   OriginRequestPolicyConfig,
   OriginRequestPolicyCookiesConfig,
diff --git a/codegen/sdk-codegen/aws-models/cloudfront.json b/codegen/sdk-codegen/aws-models/cloudfront.json
@@ -7063,6 +7063,12 @@
           "traits": {
             "smithy.api#documentation": "<p>Specifies which IP protocol CloudFront uses when connecting to your origin. If your origin uses both IPv4 and IPv6 protocols, you can choose <code>dualstack</code> to help optimize reliability.</p>"
           }
+        },
+        "OriginMtlsConfig": {
+          "target": "com.amazonaws.cloudfront#OriginMtlsConfig",
+          "traits": {
+            "smithy.api#documentation": "<p>Configures mutual TLS authentication between CloudFront and your origin server.</p>"
+          }
         }
       },
       "traits": {
@@ -18995,6 +19001,21 @@
         }
       }
     },
+    "com.amazonaws.cloudfront#OriginMtlsConfig": {
+      "type": "structure",
+      "members": {
+        "ClientCertificateArn": {
+          "target": "com.amazonaws.cloudfront#string",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the client certificate stored in Amazon Web Services Certificate Manager (ACM) that CloudFront uses to authenticate with your origin using Mutual TLS.</p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Configures mutual TLS authentication between CloudFront and your origin server.</p>"
+      }
+    },
     "com.amazonaws.cloudfront#OriginProtocolPolicy": {
       "type": "enum",
       "members": {
