CdnDistributions Object
Relationships
graph LR
CdnDistributions -->|"account"| Accounts
CdnDistributions -->|"certificate"| Certificates
Properties
Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
Alternate domain names (CNAMEs) the distribution serves.
The certificate served to viewers, when it is a managed certificate (on AWS: an ACM certificate, always in us-east-1). Null for the provider's default certificate or an IAM server certificate.
The target's id.
Where the certificate served to viewers comes from, normalised. certificate_manager: the provider's certificate manager (on AWS: ACM - see certificate). uploaded: uploaded to the provider outside its certificate manager (on AWS: an IAM server certificate). provider_default: the provider's shared default certificate (on AWS: *.cloudfront.net). provider_certificate_source has the provider's term.
certificate_manageruploadedprovider_defaultunknown
When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
The object served for the root URL. Read on GET only.
The provider's short id for the distribution, verbatim (on AWS: E1U5RQF7T870K0).
The provider-assigned domain name (on AWS: dxxxx.cloudfront.net).
Whether the distribution serves traffic.
none, whitelist or blacklist, verbatim.
Highest HTTP version served, verbatim (http1.1, http2, http3, http2and3).
True when the default behavior and every other cache behavior redirect to or require HTTPS (no behavior allows plain HTTP).
Whether IPv6 is enabled.
Where standard access logs go (on AWS: the S3 bucket domain name). Read on GET only.
Whether standard access logging is on. Read on GET only - see unreadable_fields on the list.
The lowest TLS version viewers can use, as major.minor (1.0, 1.1, 1.2, 1.3), or ssl3. When the distribution uses the provider's default certificate, this is the provider's fixed policy for it, not tls_policy.
The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
Where the distribution fetches content from. Custom header VALUES (often an origin-verification secret) are never returned - only header names.
For s3 origins: origin_access_control, origin_access_identity, or none (the bucket must then be readable by anyone the bucket policy allows).
Names of custom headers sent to the origin. Values are never returned.
The origin domain name.
The origin id within the distribution.
s3, custom or vpc.
For custom origins: http-only, match-viewer or https-only, verbatim.
For custom origins: TLS/SSL versions used to the origin, verbatim (SSLv3, TLSv1, TLSv1.1, TLSv1.2).
Edge location price class, verbatim.
Which cloud this object was read from.
awsazuregcp
The provider's own term for the certificate source (on AWS: acm, iam or cloudfront, the values of the deprecated ViewerCertificate.CertificateSource, read from which certificate field is set).
The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
The provider's own deployment state, verbatim (on AWS: Deployed or InProgress).
Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
Raw data returned from the remote API call.
Deployment state, normalised. deploying: a configuration change is still reaching the edge locations (on AWS: InProgress). provider_status has the provider's value verbatim.
deployeddeployingunknown
Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
The viewer TLS security policy, verbatim (on AWS: MinimumProtocolVersion, e.g. TLSv1.2_2021).
Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
Explanation of the reason, where one adds anything.
The property on this resource that could not be read.
Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
not_supported_by_providernot_configuredpermission_deniednot_collectedcollection_errorpartially_collectedavailable_on_get
When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
The default behavior's viewer protocol policy, verbatim (on AWS: allow-all, redirect-to-https or https-only).
The web application firewall attached, verbatim (on AWS: a WAFv2 web ACL ARN or a WAF Classic web ACL id). Null when none.