https://github.com/capralifecycle/cdk-cloudfront-auth
https://github.com/capralifecycle/cdk-cloudfront-auth
Last synced: about 2 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/capralifecycle/cdk-cloudfront-auth
- Owner: capralifecycle
- License: apache-2.0
- Created: 2025-06-27T13:54:04.000Z (12 months ago)
- Default Branch: master
- Last Pushed: 2026-04-19T11:41:52.000Z (2 months ago)
- Last Synced: 2026-04-19T13:27:32.553Z (2 months ago)
- Language: TypeScript
- Size: 8.67 MB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# CloudFront authorization with Cognito for CDK
Easily add Cognito-based authorization to your CloudFront distribution,
to place static files behind authorization.
This is based on https://github.com/aws-samples/cloudfront-authorization-at-edge.
## Usage
```bash
bun add @liflig/cdk-cloudfront-auth
```
Deploy the Lambda@Edge functions to us-east-1:
```ts
// In a stack deployed to us-east-1.
const authLambdas = new AuthLambdas(this, "AuthLambdas", {
regions: ["eu-west-1"], // Regions to make Lambda version params available.
})
```
Deploy the Cognito and CloudFront setup in whatever region
of your choice:
```ts
const auth = new CloudFrontAuth(this, "Auth", {
cognitoAuthDomain: `${domain.domainName}.auth.${region}.amazoncognito.com`,
authLambdas, // AuthLambdas from above
userPool, // Cognito User Pool
})
const distribution = new cloudfront.Distribution(this, "Distribution", {
defaultBehavior: auth.createProtectedBehavior(origin),
additionalBehaviors: auth.createAuthPagesBehaviors(origin),
})
auth.updateClient("ClientUpdate", {
signOutUrl: `https://${distribution.distributionDomainName}${auth.signOutRedirectTo}`,
callbackUrl: `https://${distribution.distributionDomainName}${auth.callbackPath}`,
})
```
If using `CloudFrontWebDistribution` instead of `Distribution`:
```ts
const distribution = new cloudfront.CloudFrontWebDistribution(this, "Distribution", {
originConfigs: [
{
behaviors: [
...auth.authPages,
{
isDefaultBehavior: true,
lambdaFunctionAssociations: auth.authFilters,
},
],
},
],
})
```
## Customizing authorization
The `CloudFrontAuth` construct accepts a `requireGroupAnyOf` property
that causes access to be restricted to only users in specific groups.