cloudfront
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseAmazon CloudFront
Amazon CloudFront
Overview
概述
Domain expertise for configuring Amazon CloudFront content delivery: deciding when to use
CloudFront and how it fits the wider architecture, managing custom-domain certificates and
multi-tenant distributions, protecting origins, securing content, and observing traffic.
This skill is a router. Each customer task maps to a procedure file under . Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.
references/Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. CloudFront is a global service; its API calls
and the AWS Certificate Manager (ACM) certificates it uses are made in regardless of
where the customer's application runs.
us-east-1具备配置Amazon CloudFront内容分发的领域专业能力：判断何时使用CloudFront及其在更广泛架构中的适配方式、管理自定义域名证书与多租户分发、保护源站、保障内容安全以及监控流量。
本技能是一个路由工具。每个客户任务都对应目录下的一个流程文件。执行操作前请完整阅读匹配的参考文档，然后遵循其约束条件和步骤。参考文件是独立完整的：每个文件都包含自己的决策表、约束条件、流程和故障排查指南。
references/连接AWS MCP服务器时，请使用该服务器执行命令（沙箱执行、审计日志、可观测性）。否则请使用AWS CLI作为备选方案。CloudFront是一项全球服务；无论客户的应用运行在哪个区域，其API调用以及所使用的AWS Certificate Manager(ACM)证书都需在区域操作。
us-east-1Which CloudFront task do you need?
您需要执行哪些CloudFront任务？
| Goal | Reference |
|---|---|
| Decide whether CloudFront is the right layer, see how it integrates, create a distribution, tune caching, or choose pricing | when to use CloudFront |
| Serve a custom domain over HTTPS, manage ACM certificates, or run many domains with a certificate per tenant | managing certificates with CloudFront |
| Make CloudFront the only way to reach the origin (S3 OAC, VPC origins, origin mutual TLS, security groups) | protecting your origins |
| Limit who can view content by identity, location, client certificate, or auth token | securing your content |
| Get visibility into traffic with standard and real-time logs, and analyze them | CloudFront observability |
| Serve multiple domains through shared configuration with per-tenant customization (SaaS, platform) | multi-tenant distributions |
| 目标 | 参考文档 |
|---|---|
| 判断CloudFront是否为合适的层级、了解其集成方式、创建分发、优化缓存或选择定价方案 | 何时使用CloudFront |
| 通过HTTPS提供自定义域名服务、管理ACM证书，或为每个租户使用单独证书运行多个域名 | CloudFront证书管理 |
| 仅允许通过CloudFront访问源站（S3 OAC、VPC源站、源站双向TLS、安全组） | 保护您的源站 |
| 通过身份、地理位置、客户端证书或认证令牌限制内容查看权限 | 保障您的内容安全 |
| 通过标准日志和实时日志获取流量可见性并进行分析 | CloudFront可观测性 |
| 通过共享配置结合租户自定义设置提供多域名服务（SaaS、平台场景） | 多租户分发 |
Routing notes
路由说明
- Choosing the layer and creating a distribution vs the rest. Whether CloudFront is the right entry layer, what it integrates with, creating a distribution, caching, and pricing live in the when-to-use reference. The other references assume a distribution exists and configure one aspect of it.
- Protecting origins vs securing content. Locking the origin so it is reachable only through CloudFront (OAC, VPC origins, origin mTLS) is the protecting-your-origins reference. Restricting which viewers can see content (signed URLs and cookies, geographic restrictions, viewer mTLS, edge token validation) is the securing-your-content reference. They are paired: a content control only holds when the origin is also locked.
- Viewer mTLS vs origin mTLS. Authenticating the client to CloudFront (viewer mTLS) is content security. Authenticating CloudFront to the origin (origin mTLS) is origin protection. Different controls, different references.
- Custom domain certificate vs Route 53 DNS cutover. Requesting and validating the ACM
certificate and adding the alternate domain name is the managing-certificates reference here.
Pointing the domain's DNS at the distribution, including the zone apex alias and any failover, is
Route 53 work owned by the separate skill.
route53-cloudfront
- 选择层级与创建分发 vs 其他任务：判断CloudFront是否为合适的入口层、其集成方式、创建分发、缓存配置及定价方案相关内容均在「何时使用CloudFront」参考文档中。其他参考文档均假设已存在分发，仅针对分发的某一方面进行配置。
- 源站保护 vs 内容安全：锁定源站使其仅能通过CloudFront访问（OAC、VPC源站、源站mTLS）属于「保护您的源站」参考文档范畴。限制哪些查看者可以访问内容（签名URL和Cookie、地域限制、查看者mTLS、边缘令牌验证）属于「保障您的内容安全」参考文档范畴。二者相辅相成：只有在源站被锁定的情况下，内容控制措施才有效。
- 查看者mTLS vs 源站mTLS：验证客户端到CloudFront的身份（查看者mTLS）属于内容安全范畴。验证CloudFront到源站的身份（源站mTLS）属于源站保护范畴。二者是不同的控制措施，对应不同的参考文档。
- 自定义域名证书 vs Route 53 DNS切换：申请并验证ACM证书、添加备用域名属于本文档中的「证书管理」参考内容。将域名DNS指向分发（包括区域顶点别名及故障转移）属于Route 53相关工作，由独立的技能负责。
route53-cloudfront
Cross-service work
跨服务工作
Pointing a custom domain's DNS at a CloudFront distribution, or failing over between distributions
with Route 53 records, is cross-service work owned by the separate skill. Use
this skill for the CloudFront-side configuration only.
route53-cloudfront将自定义域名的DNS指向CloudFront分发，或通过Route 53记录实现分发之间的故障转移，属于跨服务工作，由独立的技能负责。本技能仅处理CloudFront侧的配置。
route53-cloudfront