Skip to content

CloudFront Commands

Audit CloudFront distributions, turn on access logging across a fleet, and invalidate caches.

update-logging is a bulk operation that walks every distribution in the account. It also handles the CloudWatch alarm side, so read the notes below before running it without --dry-run.

Commands

cloudfront distribution-details

Get detailed information about a specific CloudFront distribution.

aws-cloud-utilities cloudfront distribution-details DISTRIBUTION_ID [OPTIONS]
Option Value Description
--show-config flag Show detailed distribution configuration
--output-file TEXT Output file for distribution details (supports .json, .yaml)

cloudfront invalidate

Invalidate CloudFront distribution cache by domain name or distribution ID.

aws-cloud-utilities cloudfront invalidate TARGET [OPTIONS]
Option Value Description
--paths TEXT Paths to invalidate (default: /*) (repeatable)
--output-file TEXT Output file for invalidation details (supports .json, .yaml)

cloudfront list-distributions

List CloudFront distributions with their configuration details.

aws-cloud-utilities cloudfront list-distributions [OPTIONS]
Option Value Description
--include-disabled flag Include disabled distributions in the list
--show-logging-status flag Show logging configuration status for each distribution
--output-file TEXT Output file for distributions list (supports .json, .yaml, .csv)

cloudfront update-logging

Update CloudFront distributions to enable logging and optionally setup alarms.

aws-cloud-utilities cloudfront update-logging [OPTIONS]
Option Value Description
--log-bucket TEXT S3 bucket for CloudFront logs (required for logging configuration)
--log-prefix TEXT Default log prefix when no alternate domain names found (default: cf-logs)
--setup-alarms flag Setup CloudWatch alarms for CloudFront distributions
--remove-alarms flag Remove CloudWatch alarms for CloudFront distributions
--sns-topic TEXT SNS topic name for alarm notifications (required for alarm setup)
--region TEXT AWS region for SNS topic and CloudWatch alarms (default: current region)
--dry-run flag Show what would be changed without making changes
--output-file TEXT Output file for results (supports .json, .yaml, .csv)

Examples

# All enabled distributions
aws-cloud-utilities cloudfront list-distributions

# Include disabled ones, and show whether logging is on
aws-cloud-utilities cloudfront list-distributions --include-disabled --show-logging-status

# Save the inventory
aws-cloud-utilities cloudfront list-distributions --output-file distributions.csv

# Detail for one distribution, including its full config
aws-cloud-utilities cloudfront distribution-details E1234567890ABC --show-config

# See what enabling logging would change, then do it
aws-cloud-utilities cloudfront update-logging --log-bucket my-cf-logs --dry-run
aws-cloud-utilities cloudfront update-logging --log-bucket my-cf-logs --log-prefix cf-logs

# Invalidate by distribution ID or by domain name
aws-cloud-utilities cloudfront invalidate E1234567890ABC
aws-cloud-utilities cloudfront invalidate cdn.example.com --paths "/index.html,/assets/*"

Notes

update-logging applies to every distribution in the account. Always run it with --dry-run first. The dry run reports how many distributions would actually change, so a count well below your total means most are already configured the way you asked for.

--setup-alarms creates CloudWatch alarms and requires --sns-topic. CloudWatch alarms are billable per alarm per month, so this is opt-in rather than part of the default logging change.

invalidate accepts either a distribution ID or an alternate domain name as its argument. Paths default to /*, which invalidates everything.

Reading logging state costs an extra call per distribution

list-distributions is one paginated call, but the summaries it returns carry no logging configuration. --show-logging-status therefore issues one additional GetDistributionConfig per distribution, as does update-logging. On an account with a hundred distributions that is a hundred extra calls and a noticeably slower run, so omit --show-logging-status when you only need the inventory.

# Fast: one paginated call
aws-cloud-utilities cloudfront list-distributions

# Slower: adds one API call per distribution
aws-cloud-utilities cloudfront list-distributions --show-logging-status