# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import copy
import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = [
    'CachePolicyParametersInCacheKeyAndForwardedToOriginArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs',
    'CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs',
    'DistributionCustomErrorResponseArgs',
    'DistributionDefaultCacheBehaviorArgs',
    'DistributionDefaultCacheBehaviorForwardedValuesArgs',
    'DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs',
    'DistributionDefaultCacheBehaviorFunctionAssociationArgs',
    'DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs',
    'DistributionLoggingConfigArgs',
    'DistributionOrderedCacheBehaviorArgs',
    'DistributionOrderedCacheBehaviorForwardedValuesArgs',
    'DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs',
    'DistributionOrderedCacheBehaviorFunctionAssociationArgs',
    'DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs',
    'DistributionOriginArgs',
    'DistributionOriginCustomHeaderArgs',
    'DistributionOriginCustomOriginConfigArgs',
    'DistributionOriginGroupArgs',
    'DistributionOriginGroupFailoverCriteriaArgs',
    'DistributionOriginGroupMemberArgs',
    'DistributionOriginOriginShieldArgs',
    'DistributionOriginS3OriginConfigArgs',
    'DistributionRestrictionsArgs',
    'DistributionRestrictionsGeoRestrictionArgs',
    'DistributionTrustedKeyGroupArgs',
    'DistributionTrustedKeyGroupItemArgs',
    'DistributionTrustedSignerArgs',
    'DistributionTrustedSignerItemArgs',
    'DistributionViewerCertificateArgs',
    'FieldLevelEncryptionConfigContentTypeProfileConfigArgs',
    'FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs',
    'FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs',
    'FieldLevelEncryptionConfigQueryArgProfileConfigArgs',
    'FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs',
    'FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs',
    'FieldLevelEncryptionProfileEncryptionEntitiesArgs',
    'FieldLevelEncryptionProfileEncryptionEntitiesItemArgs',
    'FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs',
    'MonitoringSubscriptionMonitoringSubscriptionArgs',
    'MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs',
    'OriginRequestPolicyCookiesConfigArgs',
    'OriginRequestPolicyCookiesConfigCookiesArgs',
    'OriginRequestPolicyHeadersConfigArgs',
    'OriginRequestPolicyHeadersConfigHeadersArgs',
    'OriginRequestPolicyQueryStringsConfigArgs',
    'OriginRequestPolicyQueryStringsConfigQueryStringsArgs',
    'RealtimeLogConfigEndpointArgs',
    'RealtimeLogConfigEndpointKinesisStreamConfigArgs',
    'ResponseHeadersPolicyCorsConfigArgs',
    'ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs',
    'ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs',
    'ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs',
    'ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs',
    'ResponseHeadersPolicyCustomHeadersConfigArgs',
    'ResponseHeadersPolicyCustomHeadersConfigItemArgs',
    'ResponseHeadersPolicySecurityHeadersConfigArgs',
    'ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs',
    'ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs',
    'ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs',
    'ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs',
    'ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs',
    'ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs',
    'ResponseHeadersPolicyServerTimingHeadersConfigArgs',
]

@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginArgs:
    def __init__(__self__, *,
                 cookies_config: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs'],
                 headers_config: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs'],
                 query_strings_config: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs'],
                 enable_accept_encoding_brotli: Optional[pulumi.Input[bool]] = None,
                 enable_accept_encoding_gzip: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs'] cookies_config: Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Cookies Config for more information.
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs'] headers_config: Object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Headers Config for more information.
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs'] query_strings_config: Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Query String Config for more information.
        :param pulumi.Input[bool] enable_accept_encoding_brotli: A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
        :param pulumi.Input[bool] enable_accept_encoding_gzip: A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
        """
        pulumi.set(__self__, "cookies_config", cookies_config)
        pulumi.set(__self__, "headers_config", headers_config)
        pulumi.set(__self__, "query_strings_config", query_strings_config)
        if enable_accept_encoding_brotli is not None:
            pulumi.set(__self__, "enable_accept_encoding_brotli", enable_accept_encoding_brotli)
        if enable_accept_encoding_gzip is not None:
            pulumi.set(__self__, "enable_accept_encoding_gzip", enable_accept_encoding_gzip)

    @property
    @pulumi.getter(name="cookiesConfig")
    def cookies_config(self) -> pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs']:
        """
        Object that determines whether any cookies in viewer requests (and if so, which cookies) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Cookies Config for more information.
        """
        return pulumi.get(self, "cookies_config")

    @cookies_config.setter
    def cookies_config(self, value: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs']):
        pulumi.set(self, "cookies_config", value)

    @property
    @pulumi.getter(name="headersConfig")
    def headers_config(self) -> pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs']:
        """
        Object that determines whether any HTTP headers (and if so, which headers) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Headers Config for more information.
        """
        return pulumi.get(self, "headers_config")

    @headers_config.setter
    def headers_config(self, value: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs']):
        pulumi.set(self, "headers_config", value)

    @property
    @pulumi.getter(name="queryStringsConfig")
    def query_strings_config(self) -> pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs']:
        """
        Object that determines whether any URL query strings in viewer requests (and if so, which query strings) are included in the cache key and automatically included in requests that CloudFront sends to the origin. See Query String Config for more information.
        """
        return pulumi.get(self, "query_strings_config")

    @query_strings_config.setter
    def query_strings_config(self, value: pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs']):
        pulumi.set(self, "query_strings_config", value)

    @property
    @pulumi.getter(name="enableAcceptEncodingBrotli")
    def enable_accept_encoding_brotli(self) -> Optional[pulumi.Input[bool]]:
        """
        A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
        """
        return pulumi.get(self, "enable_accept_encoding_brotli")

    @enable_accept_encoding_brotli.setter
    def enable_accept_encoding_brotli(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enable_accept_encoding_brotli", value)

    @property
    @pulumi.getter(name="enableAcceptEncodingGzip")
    def enable_accept_encoding_gzip(self) -> Optional[pulumi.Input[bool]]:
        """
        A flag that can affect whether the Accept-Encoding HTTP header is included in the cache key and included in requests that CloudFront sends to the origin.
        """
        return pulumi.get(self, "enable_accept_encoding_gzip")

    @enable_accept_encoding_gzip.setter
    def enable_accept_encoding_gzip(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enable_accept_encoding_gzip", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigArgs:
    def __init__(__self__, *,
                 cookie_behavior: pulumi.Input[str],
                 cookies: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs']] = None):
        """
        :param pulumi.Input[str] cookie_behavior: Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs'] cookies: Object that contains a list of cookie names. See Items for more information.
        """
        pulumi.set(__self__, "cookie_behavior", cookie_behavior)
        if cookies is not None:
            pulumi.set(__self__, "cookies", cookies)

    @property
    @pulumi.getter(name="cookieBehavior")
    def cookie_behavior(self) -> pulumi.Input[str]:
        """
        Determines whether any cookies in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
        """
        return pulumi.get(self, "cookie_behavior")

    @cookie_behavior.setter
    def cookie_behavior(self, value: pulumi.Input[str]):
        pulumi.set(self, "cookie_behavior", value)

    @property
    @pulumi.getter
    def cookies(self) -> Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs']]:
        """
        Object that contains a list of cookie names. See Items for more information.
        """
        return pulumi.get(self, "cookies")

    @cookies.setter
    def cookies(self, value: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs']]):
        pulumi.set(self, "cookies", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginCookiesConfigCookiesArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigArgs:
    def __init__(__self__, *,
                 header_behavior: Optional[pulumi.Input[str]] = None,
                 headers: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs']] = None):
        """
        :param pulumi.Input[str] header_behavior: Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`.
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs'] headers: Object that contains a list of header names. See Items for more information.
        """
        if header_behavior is not None:
            pulumi.set(__self__, "header_behavior", header_behavior)
        if headers is not None:
            pulumi.set(__self__, "headers", headers)

    @property
    @pulumi.getter(name="headerBehavior")
    def header_behavior(self) -> Optional[pulumi.Input[str]]:
        """
        Determines whether any HTTP headers are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`.
        """
        return pulumi.get(self, "header_behavior")

    @header_behavior.setter
    def header_behavior(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "header_behavior", value)

    @property
    @pulumi.getter
    def headers(self) -> Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs']]:
        """
        Object that contains a list of header names. See Items for more information.
        """
        return pulumi.get(self, "headers")

    @headers.setter
    def headers(self, value: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs']]):
        pulumi.set(self, "headers", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginHeadersConfigHeadersArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigArgs:
    def __init__(__self__, *,
                 query_string_behavior: pulumi.Input[str],
                 query_strings: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs']] = None):
        """
        :param pulumi.Input[str] query_string_behavior: Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
        :param pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs'] query_strings: Object that contains a list of query string names. See Items for more information.
        """
        pulumi.set(__self__, "query_string_behavior", query_string_behavior)
        if query_strings is not None:
            pulumi.set(__self__, "query_strings", query_strings)

    @property
    @pulumi.getter(name="queryStringBehavior")
    def query_string_behavior(self) -> pulumi.Input[str]:
        """
        Determines whether any URL query strings in viewer requests are included in the cache key and automatically included in requests that CloudFront sends to the origin. Valid values are `none`, `whitelist`, `allExcept`, `all`.
        """
        return pulumi.get(self, "query_string_behavior")

    @query_string_behavior.setter
    def query_string_behavior(self, value: pulumi.Input[str]):
        pulumi.set(self, "query_string_behavior", value)

    @property
    @pulumi.getter(name="queryStrings")
    def query_strings(self) -> Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs']]:
        """
        Object that contains a list of query string names. See Items for more information.
        """
        return pulumi.get(self, "query_strings")

    @query_strings.setter
    def query_strings(self, value: Optional[pulumi.Input['CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs']]):
        pulumi.set(self, "query_strings", value)


@pulumi.input_type
class CachePolicyParametersInCacheKeyAndForwardedToOriginQueryStringsConfigQueryStringsArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class DistributionCustomErrorResponseArgs:
    def __init__(__self__, *,
                 error_code: pulumi.Input[int],
                 error_caching_min_ttl: Optional[pulumi.Input[int]] = None,
                 response_code: Optional[pulumi.Input[int]] = None,
                 response_page_path: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[int] error_code: 4xx or 5xx HTTP status code that you want to customize.
        :param pulumi.Input[int] error_caching_min_ttl: Minimum amount of time you want HTTP error codes to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated.
        :param pulumi.Input[int] response_code: HTTP status code that you want CloudFront to return with the custom error page to the viewer.
        :param pulumi.Input[str] response_page_path: Path of the custom error page (for example, `/custom_404.html`).
        """
        pulumi.set(__self__, "error_code", error_code)
        if error_caching_min_ttl is not None:
            pulumi.set(__self__, "error_caching_min_ttl", error_caching_min_ttl)
        if response_code is not None:
            pulumi.set(__self__, "response_code", response_code)
        if response_page_path is not None:
            pulumi.set(__self__, "response_page_path", response_page_path)

    @property
    @pulumi.getter(name="errorCode")
    def error_code(self) -> pulumi.Input[int]:
        """
        4xx or 5xx HTTP status code that you want to customize.
        """
        return pulumi.get(self, "error_code")

    @error_code.setter
    def error_code(self, value: pulumi.Input[int]):
        pulumi.set(self, "error_code", value)

    @property
    @pulumi.getter(name="errorCachingMinTtl")
    def error_caching_min_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Minimum amount of time you want HTTP error codes to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated.
        """
        return pulumi.get(self, "error_caching_min_ttl")

    @error_caching_min_ttl.setter
    def error_caching_min_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "error_caching_min_ttl", value)

    @property
    @pulumi.getter(name="responseCode")
    def response_code(self) -> Optional[pulumi.Input[int]]:
        """
        HTTP status code that you want CloudFront to return with the custom error page to the viewer.
        """
        return pulumi.get(self, "response_code")

    @response_code.setter
    def response_code(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "response_code", value)

    @property
    @pulumi.getter(name="responsePagePath")
    def response_page_path(self) -> Optional[pulumi.Input[str]]:
        """
        Path of the custom error page (for example, `/custom_404.html`).
        """
        return pulumi.get(self, "response_page_path")

    @response_page_path.setter
    def response_page_path(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "response_page_path", value)


@pulumi.input_type
class DistributionDefaultCacheBehaviorArgs:
    def __init__(__self__, *,
                 allowed_methods: pulumi.Input[Sequence[pulumi.Input[str]]],
                 cached_methods: pulumi.Input[Sequence[pulumi.Input[str]]],
                 target_origin_id: pulumi.Input[str],
                 viewer_protocol_policy: pulumi.Input[str],
                 cache_policy_id: Optional[pulumi.Input[str]] = None,
                 compress: Optional[pulumi.Input[bool]] = None,
                 default_ttl: Optional[pulumi.Input[int]] = None,
                 field_level_encryption_id: Optional[pulumi.Input[str]] = None,
                 forwarded_values: Optional[pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesArgs']] = None,
                 function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorFunctionAssociationArgs']]]] = None,
                 lambda_function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]] = None,
                 max_ttl: Optional[pulumi.Input[int]] = None,
                 min_ttl: Optional[pulumi.Input[int]] = None,
                 origin_request_policy_id: Optional[pulumi.Input[str]] = None,
                 realtime_log_config_arn: Optional[pulumi.Input[str]] = None,
                 response_headers_policy_id: Optional[pulumi.Input[str]] = None,
                 smooth_streaming: Optional[pulumi.Input[bool]] = None,
                 trusted_key_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 trusted_signers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_methods: Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] cached_methods: Controls whether CloudFront caches the response to requests using the specified HTTP methods.
        :param pulumi.Input[str] target_origin_id: Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
        :param pulumi.Input[str] viewer_protocol_policy: Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
        :param pulumi.Input[str] cache_policy_id: Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `default_cache_behavior` either `cache_policy_id` or `forwarded_values` must be set.
        :param pulumi.Input[bool] compress: Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
        :param pulumi.Input[int] default_ttl: Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `Expires` header.
        :param pulumi.Input[str] field_level_encryption_id: Field level encryption configuration ID.
        :param pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesArgs'] forwarded_values: The forwarded values configuration that specifies how CloudFront handles query strings, cookies and headers (maximum one).
        :param pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorFunctionAssociationArgs']]] function_associations: A config block that triggers a cloudfront function with specific actions (maximum 2).
        :param pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]] lambda_function_associations: A config block that triggers a lambda function with specific actions (maximum 4).
        :param pulumi.Input[int] max_ttl: Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `Expires` headers.
        :param pulumi.Input[int] min_ttl: Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
        :param pulumi.Input[str] origin_request_policy_id: Unique identifier of the origin request policy that is attached to the behavior.
        :param pulumi.Input[str] realtime_log_config_arn: ARN of the real-time log configuration that is attached to this cache behavior.
        :param pulumi.Input[str] response_headers_policy_id: Identifier for a response headers policy.
        :param pulumi.Input[bool] smooth_streaming: Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] trusted_key_groups: List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] trusted_signers: List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        pulumi.set(__self__, "allowed_methods", allowed_methods)
        pulumi.set(__self__, "cached_methods", cached_methods)
        pulumi.set(__self__, "target_origin_id", target_origin_id)
        pulumi.set(__self__, "viewer_protocol_policy", viewer_protocol_policy)
        if cache_policy_id is not None:
            pulumi.set(__self__, "cache_policy_id", cache_policy_id)
        if compress is not None:
            pulumi.set(__self__, "compress", compress)
        if default_ttl is not None:
            pulumi.set(__self__, "default_ttl", default_ttl)
        if field_level_encryption_id is not None:
            pulumi.set(__self__, "field_level_encryption_id", field_level_encryption_id)
        if forwarded_values is not None:
            pulumi.set(__self__, "forwarded_values", forwarded_values)
        if function_associations is not None:
            pulumi.set(__self__, "function_associations", function_associations)
        if lambda_function_associations is not None:
            pulumi.set(__self__, "lambda_function_associations", lambda_function_associations)
        if max_ttl is not None:
            pulumi.set(__self__, "max_ttl", max_ttl)
        if min_ttl is not None:
            pulumi.set(__self__, "min_ttl", min_ttl)
        if origin_request_policy_id is not None:
            pulumi.set(__self__, "origin_request_policy_id", origin_request_policy_id)
        if realtime_log_config_arn is not None:
            pulumi.set(__self__, "realtime_log_config_arn", realtime_log_config_arn)
        if response_headers_policy_id is not None:
            pulumi.set(__self__, "response_headers_policy_id", response_headers_policy_id)
        if smooth_streaming is not None:
            pulumi.set(__self__, "smooth_streaming", smooth_streaming)
        if trusted_key_groups is not None:
            pulumi.set(__self__, "trusted_key_groups", trusted_key_groups)
        if trusted_signers is not None:
            pulumi.set(__self__, "trusted_signers", trusted_signers)

    @property
    @pulumi.getter(name="allowedMethods")
    def allowed_methods(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
        """
        return pulumi.get(self, "allowed_methods")

    @allowed_methods.setter
    def allowed_methods(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "allowed_methods", value)

    @property
    @pulumi.getter(name="cachedMethods")
    def cached_methods(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
        """
        return pulumi.get(self, "cached_methods")

    @cached_methods.setter
    def cached_methods(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "cached_methods", value)

    @property
    @pulumi.getter(name="targetOriginId")
    def target_origin_id(self) -> pulumi.Input[str]:
        """
        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
        """
        return pulumi.get(self, "target_origin_id")

    @target_origin_id.setter
    def target_origin_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "target_origin_id", value)

    @property
    @pulumi.getter(name="viewerProtocolPolicy")
    def viewer_protocol_policy(self) -> pulumi.Input[str]:
        """
        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
        """
        return pulumi.get(self, "viewer_protocol_policy")

    @viewer_protocol_policy.setter
    def viewer_protocol_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "viewer_protocol_policy", value)

    @property
    @pulumi.getter(name="cachePolicyId")
    def cache_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `default_cache_behavior` either `cache_policy_id` or `forwarded_values` must be set.
        """
        return pulumi.get(self, "cache_policy_id")

    @cache_policy_id.setter
    def cache_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "cache_policy_id", value)

    @property
    @pulumi.getter
    def compress(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
        """
        return pulumi.get(self, "compress")

    @compress.setter
    def compress(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "compress", value)

    @property
    @pulumi.getter(name="defaultTtl")
    def default_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `Expires` header.
        """
        return pulumi.get(self, "default_ttl")

    @default_ttl.setter
    def default_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "default_ttl", value)

    @property
    @pulumi.getter(name="fieldLevelEncryptionId")
    def field_level_encryption_id(self) -> Optional[pulumi.Input[str]]:
        """
        Field level encryption configuration ID.
        """
        return pulumi.get(self, "field_level_encryption_id")

    @field_level_encryption_id.setter
    def field_level_encryption_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "field_level_encryption_id", value)

    @property
    @pulumi.getter(name="forwardedValues")
    def forwarded_values(self) -> Optional[pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesArgs']]:
        """
        The forwarded values configuration that specifies how CloudFront handles query strings, cookies and headers (maximum one).
        """
        return pulumi.get(self, "forwarded_values")

    @forwarded_values.setter
    def forwarded_values(self, value: Optional[pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesArgs']]):
        pulumi.set(self, "forwarded_values", value)

    @property
    @pulumi.getter(name="functionAssociations")
    def function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorFunctionAssociationArgs']]]]:
        """
        A config block that triggers a cloudfront function with specific actions (maximum 2).
        """
        return pulumi.get(self, "function_associations")

    @function_associations.setter
    def function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorFunctionAssociationArgs']]]]):
        pulumi.set(self, "function_associations", value)

    @property
    @pulumi.getter(name="lambdaFunctionAssociations")
    def lambda_function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]]:
        """
        A config block that triggers a lambda function with specific actions (maximum 4).
        """
        return pulumi.get(self, "lambda_function_associations")

    @lambda_function_associations.setter
    def lambda_function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs']]]]):
        pulumi.set(self, "lambda_function_associations", value)

    @property
    @pulumi.getter(name="maxTtl")
    def max_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `Expires` headers.
        """
        return pulumi.get(self, "max_ttl")

    @max_ttl.setter
    def max_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "max_ttl", value)

    @property
    @pulumi.getter(name="minTtl")
    def min_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
        """
        return pulumi.get(self, "min_ttl")

    @min_ttl.setter
    def min_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "min_ttl", value)

    @property
    @pulumi.getter(name="originRequestPolicyId")
    def origin_request_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Unique identifier of the origin request policy that is attached to the behavior.
        """
        return pulumi.get(self, "origin_request_policy_id")

    @origin_request_policy_id.setter
    def origin_request_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "origin_request_policy_id", value)

    @property
    @pulumi.getter(name="realtimeLogConfigArn")
    def realtime_log_config_arn(self) -> Optional[pulumi.Input[str]]:
        """
        ARN of the real-time log configuration that is attached to this cache behavior.
        """
        return pulumi.get(self, "realtime_log_config_arn")

    @realtime_log_config_arn.setter
    def realtime_log_config_arn(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "realtime_log_config_arn", value)

    @property
    @pulumi.getter(name="responseHeadersPolicyId")
    def response_headers_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Identifier for a response headers policy.
        """
        return pulumi.get(self, "response_headers_policy_id")

    @response_headers_policy_id.setter
    def response_headers_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "response_headers_policy_id", value)

    @property
    @pulumi.getter(name="smoothStreaming")
    def smooth_streaming(self) -> Optional[pulumi.Input[bool]]:
        """
        Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
        """
        return pulumi.get(self, "smooth_streaming")

    @smooth_streaming.setter
    def smooth_streaming(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "smooth_streaming", value)

    @property
    @pulumi.getter(name="trustedKeyGroups")
    def trusted_key_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        return pulumi.get(self, "trusted_key_groups")

    @trusted_key_groups.setter
    def trusted_key_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "trusted_key_groups", value)

    @property
    @pulumi.getter(name="trustedSigners")
    def trusted_signers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        return pulumi.get(self, "trusted_signers")

    @trusted_signers.setter
    def trusted_signers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "trusted_signers", value)


@pulumi.input_type
class DistributionDefaultCacheBehaviorForwardedValuesArgs:
    def __init__(__self__, *,
                 cookies: pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs'],
                 query_string: pulumi.Input[bool],
                 headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 query_string_cache_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs'] cookies: The forwarded values cookies that specifies how CloudFront handles cookies (maximum one).
        :param pulumi.Input[bool] query_string: Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] headers: Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] query_string_cache_keys: When specified, along with a value of `true` for `query_string`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `query_string`, all query string keys are cached.
        """
        pulumi.set(__self__, "cookies", cookies)
        pulumi.set(__self__, "query_string", query_string)
        if headers is not None:
            pulumi.set(__self__, "headers", headers)
        if query_string_cache_keys is not None:
            pulumi.set(__self__, "query_string_cache_keys", query_string_cache_keys)

    @property
    @pulumi.getter
    def cookies(self) -> pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs']:
        """
        The forwarded values cookies that specifies how CloudFront handles cookies (maximum one).
        """
        return pulumi.get(self, "cookies")

    @cookies.setter
    def cookies(self, value: pulumi.Input['DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs']):
        pulumi.set(self, "cookies", value)

    @property
    @pulumi.getter(name="queryString")
    def query_string(self) -> pulumi.Input[bool]:
        """
        Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
        """
        return pulumi.get(self, "query_string")

    @query_string.setter
    def query_string(self, value: pulumi.Input[bool]):
        pulumi.set(self, "query_string", value)

    @property
    @pulumi.getter
    def headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
        """
        return pulumi.get(self, "headers")

    @headers.setter
    def headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "headers", value)

    @property
    @pulumi.getter(name="queryStringCacheKeys")
    def query_string_cache_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        When specified, along with a value of `true` for `query_string`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `query_string`, all query string keys are cached.
        """
        return pulumi.get(self, "query_string_cache_keys")

    @query_string_cache_keys.setter
    def query_string_cache_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "query_string_cache_keys", value)


@pulumi.input_type
class DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs:
    def __init__(__self__, *,
                 forward: pulumi.Input[str],
                 whitelisted_names: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] forward: Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelisted_names`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] whitelisted_names: If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
        """
        pulumi.set(__self__, "forward", forward)
        if whitelisted_names is not None:
            pulumi.set(__self__, "whitelisted_names", whitelisted_names)

    @property
    @pulumi.getter
    def forward(self) -> pulumi.Input[str]:
        """
        Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelisted_names`.
        """
        return pulumi.get(self, "forward")

    @forward.setter
    def forward(self, value: pulumi.Input[str]):
        pulumi.set(self, "forward", value)

    @property
    @pulumi.getter(name="whitelistedNames")
    def whitelisted_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
        """
        return pulumi.get(self, "whitelisted_names")

    @whitelisted_names.setter
    def whitelisted_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "whitelisted_names", value)


@pulumi.input_type
class DistributionDefaultCacheBehaviorFunctionAssociationArgs:
    def __init__(__self__, *,
                 event_type: pulumi.Input[str],
                 function_arn: pulumi.Input[str]):
        """
        :param pulumi.Input[str] event_type: Specific event to trigger this function. Valid values: `viewer-request` or `viewer-response`.
        :param pulumi.Input[str] function_arn: ARN of the CloudFront function.
        """
        pulumi.set(__self__, "event_type", event_type)
        pulumi.set(__self__, "function_arn", function_arn)

    @property
    @pulumi.getter(name="eventType")
    def event_type(self) -> pulumi.Input[str]:
        """
        Specific event to trigger this function. Valid values: `viewer-request` or `viewer-response`.
        """
        return pulumi.get(self, "event_type")

    @event_type.setter
    def event_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "event_type", value)

    @property
    @pulumi.getter(name="functionArn")
    def function_arn(self) -> pulumi.Input[str]:
        """
        ARN of the CloudFront function.
        """
        return pulumi.get(self, "function_arn")

    @function_arn.setter
    def function_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "function_arn", value)


@pulumi.input_type
class DistributionDefaultCacheBehaviorLambdaFunctionAssociationArgs:
    def __init__(__self__, *,
                 event_type: pulumi.Input[str],
                 lambda_arn: pulumi.Input[str],
                 include_body: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
        :param pulumi.Input[str] lambda_arn: ARN of the Lambda function.
        :param pulumi.Input[bool] include_body: When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
        """
        pulumi.set(__self__, "event_type", event_type)
        pulumi.set(__self__, "lambda_arn", lambda_arn)
        if include_body is not None:
            pulumi.set(__self__, "include_body", include_body)

    @property
    @pulumi.getter(name="eventType")
    def event_type(self) -> pulumi.Input[str]:
        """
        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
        """
        return pulumi.get(self, "event_type")

    @event_type.setter
    def event_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "event_type", value)

    @property
    @pulumi.getter(name="lambdaArn")
    def lambda_arn(self) -> pulumi.Input[str]:
        """
        ARN of the Lambda function.
        """
        return pulumi.get(self, "lambda_arn")

    @lambda_arn.setter
    def lambda_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "lambda_arn", value)

    @property
    @pulumi.getter(name="includeBody")
    def include_body(self) -> Optional[pulumi.Input[bool]]:
        """
        When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
        """
        return pulumi.get(self, "include_body")

    @include_body.setter
    def include_body(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_body", value)


@pulumi.input_type
class DistributionLoggingConfigArgs:
    def __init__(__self__, *,
                 bucket: pulumi.Input[str],
                 include_cookies: Optional[pulumi.Input[bool]] = None,
                 prefix: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] bucket: Amazon S3 bucket to store the access logs in, for example, `myawslogbucket.s3.amazonaws.com`.
        :param pulumi.Input[bool] include_cookies: Whether to include cookies in access logs (default: `false`).
        :param pulumi.Input[str] prefix: Prefix to the access log filenames for this distribution, for example, `myprefix/`.
        """
        pulumi.set(__self__, "bucket", bucket)
        if include_cookies is not None:
            pulumi.set(__self__, "include_cookies", include_cookies)
        if prefix is not None:
            pulumi.set(__self__, "prefix", prefix)

    @property
    @pulumi.getter
    def bucket(self) -> pulumi.Input[str]:
        """
        Amazon S3 bucket to store the access logs in, for example, `myawslogbucket.s3.amazonaws.com`.
        """
        return pulumi.get(self, "bucket")

    @bucket.setter
    def bucket(self, value: pulumi.Input[str]):
        pulumi.set(self, "bucket", value)

    @property
    @pulumi.getter(name="includeCookies")
    def include_cookies(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether to include cookies in access logs (default: `false`).
        """
        return pulumi.get(self, "include_cookies")

    @include_cookies.setter
    def include_cookies(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_cookies", value)

    @property
    @pulumi.getter
    def prefix(self) -> Optional[pulumi.Input[str]]:
        """
        Prefix to the access log filenames for this distribution, for example, `myprefix/`.
        """
        return pulumi.get(self, "prefix")

    @prefix.setter
    def prefix(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "prefix", value)


@pulumi.input_type
class DistributionOrderedCacheBehaviorArgs:
    def __init__(__self__, *,
                 allowed_methods: pulumi.Input[Sequence[pulumi.Input[str]]],
                 cached_methods: pulumi.Input[Sequence[pulumi.Input[str]]],
                 path_pattern: pulumi.Input[str],
                 target_origin_id: pulumi.Input[str],
                 viewer_protocol_policy: pulumi.Input[str],
                 cache_policy_id: Optional[pulumi.Input[str]] = None,
                 compress: Optional[pulumi.Input[bool]] = None,
                 default_ttl: Optional[pulumi.Input[int]] = None,
                 field_level_encryption_id: Optional[pulumi.Input[str]] = None,
                 forwarded_values: Optional[pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesArgs']] = None,
                 function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorFunctionAssociationArgs']]]] = None,
                 lambda_function_associations: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs']]]] = None,
                 max_ttl: Optional[pulumi.Input[int]] = None,
                 min_ttl: Optional[pulumi.Input[int]] = None,
                 origin_request_policy_id: Optional[pulumi.Input[str]] = None,
                 realtime_log_config_arn: Optional[pulumi.Input[str]] = None,
                 response_headers_policy_id: Optional[pulumi.Input[str]] = None,
                 smooth_streaming: Optional[pulumi.Input[bool]] = None,
                 trusted_key_groups: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 trusted_signers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_methods: Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] cached_methods: Controls whether CloudFront caches the response to requests using the specified HTTP methods.
        :param pulumi.Input[str] path_pattern: Pattern (for example, `images/*.jpg`) that specifies which requests you want this cache behavior to apply to.
        :param pulumi.Input[str] target_origin_id: Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
        :param pulumi.Input[str] viewer_protocol_policy: Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
        :param pulumi.Input[str] cache_policy_id: Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `default_cache_behavior` either `cache_policy_id` or `forwarded_values` must be set.
        :param pulumi.Input[bool] compress: Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
        :param pulumi.Input[int] default_ttl: Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `Expires` header.
        :param pulumi.Input[str] field_level_encryption_id: Field level encryption configuration ID.
        :param pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesArgs'] forwarded_values: The forwarded values configuration that specifies how CloudFront handles query strings, cookies and headers (maximum one).
        :param pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorFunctionAssociationArgs']]] function_associations: A config block that triggers a cloudfront function with specific actions (maximum 2).
        :param pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs']]] lambda_function_associations: A config block that triggers a lambda function with specific actions (maximum 4).
        :param pulumi.Input[int] max_ttl: Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `Expires` headers.
        :param pulumi.Input[int] min_ttl: Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
        :param pulumi.Input[str] origin_request_policy_id: Unique identifier of the origin request policy that is attached to the behavior.
        :param pulumi.Input[str] realtime_log_config_arn: ARN of the real-time log configuration that is attached to this cache behavior.
        :param pulumi.Input[str] response_headers_policy_id: Identifier for a response headers policy.
        :param pulumi.Input[bool] smooth_streaming: Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] trusted_key_groups: List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] trusted_signers: List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        pulumi.set(__self__, "allowed_methods", allowed_methods)
        pulumi.set(__self__, "cached_methods", cached_methods)
        pulumi.set(__self__, "path_pattern", path_pattern)
        pulumi.set(__self__, "target_origin_id", target_origin_id)
        pulumi.set(__self__, "viewer_protocol_policy", viewer_protocol_policy)
        if cache_policy_id is not None:
            pulumi.set(__self__, "cache_policy_id", cache_policy_id)
        if compress is not None:
            pulumi.set(__self__, "compress", compress)
        if default_ttl is not None:
            pulumi.set(__self__, "default_ttl", default_ttl)
        if field_level_encryption_id is not None:
            pulumi.set(__self__, "field_level_encryption_id", field_level_encryption_id)
        if forwarded_values is not None:
            pulumi.set(__self__, "forwarded_values", forwarded_values)
        if function_associations is not None:
            pulumi.set(__self__, "function_associations", function_associations)
        if lambda_function_associations is not None:
            pulumi.set(__self__, "lambda_function_associations", lambda_function_associations)
        if max_ttl is not None:
            pulumi.set(__self__, "max_ttl", max_ttl)
        if min_ttl is not None:
            pulumi.set(__self__, "min_ttl", min_ttl)
        if origin_request_policy_id is not None:
            pulumi.set(__self__, "origin_request_policy_id", origin_request_policy_id)
        if realtime_log_config_arn is not None:
            pulumi.set(__self__, "realtime_log_config_arn", realtime_log_config_arn)
        if response_headers_policy_id is not None:
            pulumi.set(__self__, "response_headers_policy_id", response_headers_policy_id)
        if smooth_streaming is not None:
            pulumi.set(__self__, "smooth_streaming", smooth_streaming)
        if trusted_key_groups is not None:
            pulumi.set(__self__, "trusted_key_groups", trusted_key_groups)
        if trusted_signers is not None:
            pulumi.set(__self__, "trusted_signers", trusted_signers)

    @property
    @pulumi.getter(name="allowedMethods")
    def allowed_methods(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Controls which HTTP methods CloudFront processes and forwards to your Amazon S3 bucket or your custom origin.
        """
        return pulumi.get(self, "allowed_methods")

    @allowed_methods.setter
    def allowed_methods(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "allowed_methods", value)

    @property
    @pulumi.getter(name="cachedMethods")
    def cached_methods(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        Controls whether CloudFront caches the response to requests using the specified HTTP methods.
        """
        return pulumi.get(self, "cached_methods")

    @cached_methods.setter
    def cached_methods(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "cached_methods", value)

    @property
    @pulumi.getter(name="pathPattern")
    def path_pattern(self) -> pulumi.Input[str]:
        """
        Pattern (for example, `images/*.jpg`) that specifies which requests you want this cache behavior to apply to.
        """
        return pulumi.get(self, "path_pattern")

    @path_pattern.setter
    def path_pattern(self, value: pulumi.Input[str]):
        pulumi.set(self, "path_pattern", value)

    @property
    @pulumi.getter(name="targetOriginId")
    def target_origin_id(self) -> pulumi.Input[str]:
        """
        Value of ID for the origin that you want CloudFront to route requests to when a request matches the path pattern either for a cache behavior or for the default cache behavior.
        """
        return pulumi.get(self, "target_origin_id")

    @target_origin_id.setter
    def target_origin_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "target_origin_id", value)

    @property
    @pulumi.getter(name="viewerProtocolPolicy")
    def viewer_protocol_policy(self) -> pulumi.Input[str]:
        """
        Use this element to specify the protocol that users can use to access the files in the origin specified by TargetOriginId when a request matches the path pattern in PathPattern. One of `allow-all`, `https-only`, or `redirect-to-https`.
        """
        return pulumi.get(self, "viewer_protocol_policy")

    @viewer_protocol_policy.setter
    def viewer_protocol_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "viewer_protocol_policy", value)

    @property
    @pulumi.getter(name="cachePolicyId")
    def cache_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Unique identifier of the cache policy that is attached to the cache behavior. If configuring the `default_cache_behavior` either `cache_policy_id` or `forwarded_values` must be set.
        """
        return pulumi.get(self, "cache_policy_id")

    @cache_policy_id.setter
    def cache_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "cache_policy_id", value)

    @property
    @pulumi.getter
    def compress(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether you want CloudFront to automatically compress content for web requests that include `Accept-Encoding: gzip` in the request header (default: `false`).
        """
        return pulumi.get(self, "compress")

    @compress.setter
    def compress(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "compress", value)

    @property
    @pulumi.getter(name="defaultTtl")
    def default_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Default amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request in the absence of an `Cache-Control max-age` or `Expires` header.
        """
        return pulumi.get(self, "default_ttl")

    @default_ttl.setter
    def default_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "default_ttl", value)

    @property
    @pulumi.getter(name="fieldLevelEncryptionId")
    def field_level_encryption_id(self) -> Optional[pulumi.Input[str]]:
        """
        Field level encryption configuration ID.
        """
        return pulumi.get(self, "field_level_encryption_id")

    @field_level_encryption_id.setter
    def field_level_encryption_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "field_level_encryption_id", value)

    @property
    @pulumi.getter(name="forwardedValues")
    def forwarded_values(self) -> Optional[pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesArgs']]:
        """
        The forwarded values configuration that specifies how CloudFront handles query strings, cookies and headers (maximum one).
        """
        return pulumi.get(self, "forwarded_values")

    @forwarded_values.setter
    def forwarded_values(self, value: Optional[pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesArgs']]):
        pulumi.set(self, "forwarded_values", value)

    @property
    @pulumi.getter(name="functionAssociations")
    def function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorFunctionAssociationArgs']]]]:
        """
        A config block that triggers a cloudfront function with specific actions (maximum 2).
        """
        return pulumi.get(self, "function_associations")

    @function_associations.setter
    def function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorFunctionAssociationArgs']]]]):
        pulumi.set(self, "function_associations", value)

    @property
    @pulumi.getter(name="lambdaFunctionAssociations")
    def lambda_function_associations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs']]]]:
        """
        A config block that triggers a lambda function with specific actions (maximum 4).
        """
        return pulumi.get(self, "lambda_function_associations")

    @lambda_function_associations.setter
    def lambda_function_associations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs']]]]):
        pulumi.set(self, "lambda_function_associations", value)

    @property
    @pulumi.getter(name="maxTtl")
    def max_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Maximum amount of time (in seconds) that an object is in a CloudFront cache before CloudFront forwards another request to your origin to determine whether the object has been updated. Only effective in the presence of `Cache-Control max-age`, `Cache-Control s-maxage`, and `Expires` headers.
        """
        return pulumi.get(self, "max_ttl")

    @max_ttl.setter
    def max_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "max_ttl", value)

    @property
    @pulumi.getter(name="minTtl")
    def min_ttl(self) -> Optional[pulumi.Input[int]]:
        """
        Minimum amount of time that you want objects to stay in CloudFront caches before CloudFront queries your origin to see whether the object has been updated. Defaults to 0 seconds.
        """
        return pulumi.get(self, "min_ttl")

    @min_ttl.setter
    def min_ttl(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "min_ttl", value)

    @property
    @pulumi.getter(name="originRequestPolicyId")
    def origin_request_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Unique identifier of the origin request policy that is attached to the behavior.
        """
        return pulumi.get(self, "origin_request_policy_id")

    @origin_request_policy_id.setter
    def origin_request_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "origin_request_policy_id", value)

    @property
    @pulumi.getter(name="realtimeLogConfigArn")
    def realtime_log_config_arn(self) -> Optional[pulumi.Input[str]]:
        """
        ARN of the real-time log configuration that is attached to this cache behavior.
        """
        return pulumi.get(self, "realtime_log_config_arn")

    @realtime_log_config_arn.setter
    def realtime_log_config_arn(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "realtime_log_config_arn", value)

    @property
    @pulumi.getter(name="responseHeadersPolicyId")
    def response_headers_policy_id(self) -> Optional[pulumi.Input[str]]:
        """
        Identifier for a response headers policy.
        """
        return pulumi.get(self, "response_headers_policy_id")

    @response_headers_policy_id.setter
    def response_headers_policy_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "response_headers_policy_id", value)

    @property
    @pulumi.getter(name="smoothStreaming")
    def smooth_streaming(self) -> Optional[pulumi.Input[bool]]:
        """
        Indicates whether you want to distribute media files in Microsoft Smooth Streaming format using the origin that is associated with this cache behavior.
        """
        return pulumi.get(self, "smooth_streaming")

    @smooth_streaming.setter
    def smooth_streaming(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "smooth_streaming", value)

    @property
    @pulumi.getter(name="trustedKeyGroups")
    def trusted_key_groups(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of key group IDs that CloudFront can use to validate signed URLs or signed cookies. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        return pulumi.get(self, "trusted_key_groups")

    @trusted_key_groups.setter
    def trusted_key_groups(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "trusted_key_groups", value)

    @property
    @pulumi.getter(name="trustedSigners")
    def trusted_signers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        List of AWS account IDs (or `self`) that you want to allow to create signed URLs for private content. See the [CloudFront User Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html) for more information about this feature.
        """
        return pulumi.get(self, "trusted_signers")

    @trusted_signers.setter
    def trusted_signers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "trusted_signers", value)


@pulumi.input_type
class DistributionOrderedCacheBehaviorForwardedValuesArgs:
    def __init__(__self__, *,
                 cookies: pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs'],
                 query_string: pulumi.Input[bool],
                 headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                 query_string_cache_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs'] cookies: The forwarded values cookies that specifies how CloudFront handles cookies (maximum one).
        :param pulumi.Input[bool] query_string: Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] headers: Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] query_string_cache_keys: When specified, along with a value of `true` for `query_string`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `query_string`, all query string keys are cached.
        """
        pulumi.set(__self__, "cookies", cookies)
        pulumi.set(__self__, "query_string", query_string)
        if headers is not None:
            pulumi.set(__self__, "headers", headers)
        if query_string_cache_keys is not None:
            pulumi.set(__self__, "query_string_cache_keys", query_string_cache_keys)

    @property
    @pulumi.getter
    def cookies(self) -> pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs']:
        """
        The forwarded values cookies that specifies how CloudFront handles cookies (maximum one).
        """
        return pulumi.get(self, "cookies")

    @cookies.setter
    def cookies(self, value: pulumi.Input['DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs']):
        pulumi.set(self, "cookies", value)

    @property
    @pulumi.getter(name="queryString")
    def query_string(self) -> pulumi.Input[bool]:
        """
        Indicates whether you want CloudFront to forward query strings to the origin that is associated with this cache behavior.
        """
        return pulumi.get(self, "query_string")

    @query_string.setter
    def query_string(self, value: pulumi.Input[bool]):
        pulumi.set(self, "query_string", value)

    @property
    @pulumi.getter
    def headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Headers, if any, that you want CloudFront to vary upon for this cache behavior. Specify `*` to include all headers.
        """
        return pulumi.get(self, "headers")

    @headers.setter
    def headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "headers", value)

    @property
    @pulumi.getter(name="queryStringCacheKeys")
    def query_string_cache_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        When specified, along with a value of `true` for `query_string`, all query strings are forwarded, however only the query string keys listed in this argument are cached. When omitted with a value of `true` for `query_string`, all query string keys are cached.
        """
        return pulumi.get(self, "query_string_cache_keys")

    @query_string_cache_keys.setter
    def query_string_cache_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "query_string_cache_keys", value)


@pulumi.input_type
class DistributionOrderedCacheBehaviorForwardedValuesCookiesArgs:
    def __init__(__self__, *,
                 forward: pulumi.Input[str],
                 whitelisted_names: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] forward: Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelisted_names`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] whitelisted_names: If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
        """
        pulumi.set(__self__, "forward", forward)
        if whitelisted_names is not None:
            pulumi.set(__self__, "whitelisted_names", whitelisted_names)

    @property
    @pulumi.getter
    def forward(self) -> pulumi.Input[str]:
        """
        Whether you want CloudFront to forward cookies to the origin that is associated with this cache behavior. You can specify `all`, `none` or `whitelist`. If `whitelist`, you must include the subsequent `whitelisted_names`.
        """
        return pulumi.get(self, "forward")

    @forward.setter
    def forward(self, value: pulumi.Input[str]):
        pulumi.set(self, "forward", value)

    @property
    @pulumi.getter(name="whitelistedNames")
    def whitelisted_names(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        If you have specified `whitelist` to `forward`, the whitelisted cookies that you want CloudFront to forward to your origin.
        """
        return pulumi.get(self, "whitelisted_names")

    @whitelisted_names.setter
    def whitelisted_names(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "whitelisted_names", value)


@pulumi.input_type
class DistributionOrderedCacheBehaviorFunctionAssociationArgs:
    def __init__(__self__, *,
                 event_type: pulumi.Input[str],
                 function_arn: pulumi.Input[str]):
        """
        :param pulumi.Input[str] event_type: Specific event to trigger this function. Valid values: `viewer-request` or `viewer-response`.
        :param pulumi.Input[str] function_arn: ARN of the CloudFront function.
        """
        pulumi.set(__self__, "event_type", event_type)
        pulumi.set(__self__, "function_arn", function_arn)

    @property
    @pulumi.getter(name="eventType")
    def event_type(self) -> pulumi.Input[str]:
        """
        Specific event to trigger this function. Valid values: `viewer-request` or `viewer-response`.
        """
        return pulumi.get(self, "event_type")

    @event_type.setter
    def event_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "event_type", value)

    @property
    @pulumi.getter(name="functionArn")
    def function_arn(self) -> pulumi.Input[str]:
        """
        ARN of the CloudFront function.
        """
        return pulumi.get(self, "function_arn")

    @function_arn.setter
    def function_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "function_arn", value)


@pulumi.input_type
class DistributionOrderedCacheBehaviorLambdaFunctionAssociationArgs:
    def __init__(__self__, *,
                 event_type: pulumi.Input[str],
                 lambda_arn: pulumi.Input[str],
                 include_body: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[str] event_type: Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
        :param pulumi.Input[str] lambda_arn: ARN of the Lambda function.
        :param pulumi.Input[bool] include_body: When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
        """
        pulumi.set(__self__, "event_type", event_type)
        pulumi.set(__self__, "lambda_arn", lambda_arn)
        if include_body is not None:
            pulumi.set(__self__, "include_body", include_body)

    @property
    @pulumi.getter(name="eventType")
    def event_type(self) -> pulumi.Input[str]:
        """
        Specific event to trigger this function. Valid values: `viewer-request`, `origin-request`, `viewer-response`, `origin-response`.
        """
        return pulumi.get(self, "event_type")

    @event_type.setter
    def event_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "event_type", value)

    @property
    @pulumi.getter(name="lambdaArn")
    def lambda_arn(self) -> pulumi.Input[str]:
        """
        ARN of the Lambda function.
        """
        return pulumi.get(self, "lambda_arn")

    @lambda_arn.setter
    def lambda_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "lambda_arn", value)

    @property
    @pulumi.getter(name="includeBody")
    def include_body(self) -> Optional[pulumi.Input[bool]]:
        """
        When set to true it exposes the request body to the lambda function. Defaults to false. Valid values: `true`, `false`.
        """
        return pulumi.get(self, "include_body")

    @include_body.setter
    def include_body(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_body", value)


@pulumi.input_type
class DistributionOriginArgs:
    def __init__(__self__, *,
                 domain_name: pulumi.Input[str],
                 origin_id: pulumi.Input[str],
                 connection_attempts: Optional[pulumi.Input[int]] = None,
                 connection_timeout: Optional[pulumi.Input[int]] = None,
                 custom_headers: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOriginCustomHeaderArgs']]]] = None,
                 custom_origin_config: Optional[pulumi.Input['DistributionOriginCustomOriginConfigArgs']] = None,
                 origin_access_control_id: Optional[pulumi.Input[str]] = None,
                 origin_path: Optional[pulumi.Input[str]] = None,
                 origin_shield: Optional[pulumi.Input['DistributionOriginOriginShieldArgs']] = None,
                 s3_origin_config: Optional[pulumi.Input['DistributionOriginS3OriginConfigArgs']] = None):
        """
        :param pulumi.Input[str] domain_name: DNS domain name of either the S3 bucket, or web site of your custom origin.
        :param pulumi.Input[str] origin_id: Unique identifier for the origin.
        :param pulumi.Input[int] connection_attempts: Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Defaults to 3.
        :param pulumi.Input[int] connection_timeout: Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Defaults to 10.
        :param pulumi.Input[Sequence[pulumi.Input['DistributionOriginCustomHeaderArgs']]] custom_headers: One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin (multiples allowed).
        :param pulumi.Input['DistributionOriginCustomOriginConfigArgs'] custom_origin_config: The CloudFront custom origin configuration information. If an S3 origin is required, use `origin_access_control_id` or `s3_origin_config` instead.
        :param pulumi.Input[str] origin_access_control_id: Unique identifier of a [CloudFront origin access control][8] for this origin.
        :param pulumi.Input[str] origin_path: Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
        :param pulumi.Input['DistributionOriginOriginShieldArgs'] origin_shield: The CloudFront Origin Shield configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
        :param pulumi.Input['DistributionOriginS3OriginConfigArgs'] s3_origin_config: The CloudFront S3 origin configuration information. If a custom origin is required, use `custom_origin_config` instead.
        """
        pulumi.set(__self__, "domain_name", domain_name)
        pulumi.set(__self__, "origin_id", origin_id)
        if connection_attempts is not None:
            pulumi.set(__self__, "connection_attempts", connection_attempts)
        if connection_timeout is not None:
            pulumi.set(__self__, "connection_timeout", connection_timeout)
        if custom_headers is not None:
            pulumi.set(__self__, "custom_headers", custom_headers)
        if custom_origin_config is not None:
            pulumi.set(__self__, "custom_origin_config", custom_origin_config)
        if origin_access_control_id is not None:
            pulumi.set(__self__, "origin_access_control_id", origin_access_control_id)
        if origin_path is not None:
            pulumi.set(__self__, "origin_path", origin_path)
        if origin_shield is not None:
            pulumi.set(__self__, "origin_shield", origin_shield)
        if s3_origin_config is not None:
            pulumi.set(__self__, "s3_origin_config", s3_origin_config)

    @property
    @pulumi.getter(name="domainName")
    def domain_name(self) -> pulumi.Input[str]:
        """
        DNS domain name of either the S3 bucket, or web site of your custom origin.
        """
        return pulumi.get(self, "domain_name")

    @domain_name.setter
    def domain_name(self, value: pulumi.Input[str]):
        pulumi.set(self, "domain_name", value)

    @property
    @pulumi.getter(name="originId")
    def origin_id(self) -> pulumi.Input[str]:
        """
        Unique identifier for the origin.
        """
        return pulumi.get(self, "origin_id")

    @origin_id.setter
    def origin_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_id", value)

    @property
    @pulumi.getter(name="connectionAttempts")
    def connection_attempts(self) -> Optional[pulumi.Input[int]]:
        """
        Number of times that CloudFront attempts to connect to the origin. Must be between 1-3. Defaults to 3.
        """
        return pulumi.get(self, "connection_attempts")

    @connection_attempts.setter
    def connection_attempts(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "connection_attempts", value)

    @property
    @pulumi.getter(name="connectionTimeout")
    def connection_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        Number of seconds that CloudFront waits when trying to establish a connection to the origin. Must be between 1-10. Defaults to 10.
        """
        return pulumi.get(self, "connection_timeout")

    @connection_timeout.setter
    def connection_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "connection_timeout", value)

    @property
    @pulumi.getter(name="customHeaders")
    def custom_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOriginCustomHeaderArgs']]]]:
        """
        One or more sub-resources with `name` and `value` parameters that specify header data that will be sent to the origin (multiples allowed).
        """
        return pulumi.get(self, "custom_headers")

    @custom_headers.setter
    def custom_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionOriginCustomHeaderArgs']]]]):
        pulumi.set(self, "custom_headers", value)

    @property
    @pulumi.getter(name="customOriginConfig")
    def custom_origin_config(self) -> Optional[pulumi.Input['DistributionOriginCustomOriginConfigArgs']]:
        """
        The CloudFront custom origin configuration information. If an S3 origin is required, use `origin_access_control_id` or `s3_origin_config` instead.
        """
        return pulumi.get(self, "custom_origin_config")

    @custom_origin_config.setter
    def custom_origin_config(self, value: Optional[pulumi.Input['DistributionOriginCustomOriginConfigArgs']]):
        pulumi.set(self, "custom_origin_config", value)

    @property
    @pulumi.getter(name="originAccessControlId")
    def origin_access_control_id(self) -> Optional[pulumi.Input[str]]:
        """
        Unique identifier of a [CloudFront origin access control][8] for this origin.
        """
        return pulumi.get(self, "origin_access_control_id")

    @origin_access_control_id.setter
    def origin_access_control_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "origin_access_control_id", value)

    @property
    @pulumi.getter(name="originPath")
    def origin_path(self) -> Optional[pulumi.Input[str]]:
        """
        Optional element that causes CloudFront to request your content from a directory in your Amazon S3 bucket or your custom origin.
        """
        return pulumi.get(self, "origin_path")

    @origin_path.setter
    def origin_path(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "origin_path", value)

    @property
    @pulumi.getter(name="originShield")
    def origin_shield(self) -> Optional[pulumi.Input['DistributionOriginOriginShieldArgs']]:
        """
        The CloudFront Origin Shield configuration information. Using Origin Shield can help reduce the load on your origin. For more information, see [Using Origin Shield](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html) in the Amazon CloudFront Developer Guide.
        """
        return pulumi.get(self, "origin_shield")

    @origin_shield.setter
    def origin_shield(self, value: Optional[pulumi.Input['DistributionOriginOriginShieldArgs']]):
        pulumi.set(self, "origin_shield", value)

    @property
    @pulumi.getter(name="s3OriginConfig")
    def s3_origin_config(self) -> Optional[pulumi.Input['DistributionOriginS3OriginConfigArgs']]:
        """
        The CloudFront S3 origin configuration information. If a custom origin is required, use `custom_origin_config` instead.
        """
        return pulumi.get(self, "s3_origin_config")

    @s3_origin_config.setter
    def s3_origin_config(self, value: Optional[pulumi.Input['DistributionOriginS3OriginConfigArgs']]):
        pulumi.set(self, "s3_origin_config", value)


@pulumi.input_type
class DistributionOriginCustomHeaderArgs:
    def __init__(__self__, *,
                 name: pulumi.Input[str],
                 value: pulumi.Input[str]):
        pulumi.set(__self__, "name", name)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def name(self) -> pulumi.Input[str]:
        return pulumi.get(self, "name")

    @name.setter
    def name(self, value: pulumi.Input[str]):
        pulumi.set(self, "name", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class DistributionOriginCustomOriginConfigArgs:
    def __init__(__self__, *,
                 http_port: pulumi.Input[int],
                 https_port: pulumi.Input[int],
                 origin_protocol_policy: pulumi.Input[str],
                 origin_ssl_protocols: pulumi.Input[Sequence[pulumi.Input[str]]],
                 origin_keepalive_timeout: Optional[pulumi.Input[int]] = None,
                 origin_read_timeout: Optional[pulumi.Input[int]] = None):
        """
        :param pulumi.Input[int] http_port: HTTP port the custom origin listens on.
        :param pulumi.Input[int] https_port: HTTPS port the custom origin listens on.
        :param pulumi.Input[str] origin_protocol_policy: Origin protocol policy to apply to your origin. One of `http-only`, `https-only`, or `match-viewer`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] origin_ssl_protocols: SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. A list of one or more of `SSLv3`, `TLSv1`, `TLSv1.1`, and `TLSv1.2`.
        :param pulumi.Input[int] origin_keepalive_timeout: The Custom KeepAlive timeout, in seconds. By default, AWS enforces a limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout).
        :param pulumi.Input[int] origin_read_timeout: The Custom Read timeout, in seconds. By default, AWS enforces a limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout).
        """
        pulumi.set(__self__, "http_port", http_port)
        pulumi.set(__self__, "https_port", https_port)
        pulumi.set(__self__, "origin_protocol_policy", origin_protocol_policy)
        pulumi.set(__self__, "origin_ssl_protocols", origin_ssl_protocols)
        if origin_keepalive_timeout is not None:
            pulumi.set(__self__, "origin_keepalive_timeout", origin_keepalive_timeout)
        if origin_read_timeout is not None:
            pulumi.set(__self__, "origin_read_timeout", origin_read_timeout)

    @property
    @pulumi.getter(name="httpPort")
    def http_port(self) -> pulumi.Input[int]:
        """
        HTTP port the custom origin listens on.
        """
        return pulumi.get(self, "http_port")

    @http_port.setter
    def http_port(self, value: pulumi.Input[int]):
        pulumi.set(self, "http_port", value)

    @property
    @pulumi.getter(name="httpsPort")
    def https_port(self) -> pulumi.Input[int]:
        """
        HTTPS port the custom origin listens on.
        """
        return pulumi.get(self, "https_port")

    @https_port.setter
    def https_port(self, value: pulumi.Input[int]):
        pulumi.set(self, "https_port", value)

    @property
    @pulumi.getter(name="originProtocolPolicy")
    def origin_protocol_policy(self) -> pulumi.Input[str]:
        """
        Origin protocol policy to apply to your origin. One of `http-only`, `https-only`, or `match-viewer`.
        """
        return pulumi.get(self, "origin_protocol_policy")

    @origin_protocol_policy.setter
    def origin_protocol_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_protocol_policy", value)

    @property
    @pulumi.getter(name="originSslProtocols")
    def origin_ssl_protocols(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
        """
        SSL/TLS protocols that you want CloudFront to use when communicating with your origin over HTTPS. A list of one or more of `SSLv3`, `TLSv1`, `TLSv1.1`, and `TLSv1.2`.
        """
        return pulumi.get(self, "origin_ssl_protocols")

    @origin_ssl_protocols.setter
    def origin_ssl_protocols(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
        pulumi.set(self, "origin_ssl_protocols", value)

    @property
    @pulumi.getter(name="originKeepaliveTimeout")
    def origin_keepalive_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        The Custom KeepAlive timeout, in seconds. By default, AWS enforces a limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout).
        """
        return pulumi.get(self, "origin_keepalive_timeout")

    @origin_keepalive_timeout.setter
    def origin_keepalive_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "origin_keepalive_timeout", value)

    @property
    @pulumi.getter(name="originReadTimeout")
    def origin_read_timeout(self) -> Optional[pulumi.Input[int]]:
        """
        The Custom Read timeout, in seconds. By default, AWS enforces a limit of `60`. But you can request an [increase](http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/RequestAndResponseBehaviorCustomOrigin.html#request-custom-request-timeout).
        """
        return pulumi.get(self, "origin_read_timeout")

    @origin_read_timeout.setter
    def origin_read_timeout(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "origin_read_timeout", value)


@pulumi.input_type
class DistributionOriginGroupArgs:
    def __init__(__self__, *,
                 failover_criteria: pulumi.Input['DistributionOriginGroupFailoverCriteriaArgs'],
                 members: pulumi.Input[Sequence[pulumi.Input['DistributionOriginGroupMemberArgs']]],
                 origin_id: pulumi.Input[str]):
        """
        :param pulumi.Input['DistributionOriginGroupFailoverCriteriaArgs'] failover_criteria: The failover criteria for when to failover to the secondary origin.
        :param pulumi.Input[Sequence[pulumi.Input['DistributionOriginGroupMemberArgs']]] members: Ordered member configuration blocks assigned to the origin group, where the first member is the primary origin. You must specify two members.
        :param pulumi.Input[str] origin_id: Unique identifier for the origin.
        """
        pulumi.set(__self__, "failover_criteria", failover_criteria)
        pulumi.set(__self__, "members", members)
        pulumi.set(__self__, "origin_id", origin_id)

    @property
    @pulumi.getter(name="failoverCriteria")
    def failover_criteria(self) -> pulumi.Input['DistributionOriginGroupFailoverCriteriaArgs']:
        """
        The failover criteria for when to failover to the secondary origin.
        """
        return pulumi.get(self, "failover_criteria")

    @failover_criteria.setter
    def failover_criteria(self, value: pulumi.Input['DistributionOriginGroupFailoverCriteriaArgs']):
        pulumi.set(self, "failover_criteria", value)

    @property
    @pulumi.getter
    def members(self) -> pulumi.Input[Sequence[pulumi.Input['DistributionOriginGroupMemberArgs']]]:
        """
        Ordered member configuration blocks assigned to the origin group, where the first member is the primary origin. You must specify two members.
        """
        return pulumi.get(self, "members")

    @members.setter
    def members(self, value: pulumi.Input[Sequence[pulumi.Input['DistributionOriginGroupMemberArgs']]]):
        pulumi.set(self, "members", value)

    @property
    @pulumi.getter(name="originId")
    def origin_id(self) -> pulumi.Input[str]:
        """
        Unique identifier for the origin.
        """
        return pulumi.get(self, "origin_id")

    @origin_id.setter
    def origin_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_id", value)


@pulumi.input_type
class DistributionOriginGroupFailoverCriteriaArgs:
    def __init__(__self__, *,
                 status_codes: pulumi.Input[Sequence[pulumi.Input[int]]]):
        """
        :param pulumi.Input[Sequence[pulumi.Input[int]]] status_codes: List of HTTP status codes for the origin group.
        """
        pulumi.set(__self__, "status_codes", status_codes)

    @property
    @pulumi.getter(name="statusCodes")
    def status_codes(self) -> pulumi.Input[Sequence[pulumi.Input[int]]]:
        """
        List of HTTP status codes for the origin group.
        """
        return pulumi.get(self, "status_codes")

    @status_codes.setter
    def status_codes(self, value: pulumi.Input[Sequence[pulumi.Input[int]]]):
        pulumi.set(self, "status_codes", value)


@pulumi.input_type
class DistributionOriginGroupMemberArgs:
    def __init__(__self__, *,
                 origin_id: pulumi.Input[str]):
        """
        :param pulumi.Input[str] origin_id: Unique identifier for the origin.
        """
        pulumi.set(__self__, "origin_id", origin_id)

    @property
    @pulumi.getter(name="originId")
    def origin_id(self) -> pulumi.Input[str]:
        """
        Unique identifier for the origin.
        """
        return pulumi.get(self, "origin_id")

    @origin_id.setter
    def origin_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_id", value)


@pulumi.input_type
class DistributionOriginOriginShieldArgs:
    def __init__(__self__, *,
                 enabled: pulumi.Input[bool],
                 origin_shield_region: pulumi.Input[str]):
        """
        :param pulumi.Input[bool] enabled: Whether the distribution is enabled to accept end user requests for content.
        :param pulumi.Input[str] origin_shield_region: AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as us-east-2.
        """
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "origin_shield_region", origin_shield_region)

    @property
    @pulumi.getter
    def enabled(self) -> pulumi.Input[bool]:
        """
        Whether the distribution is enabled to accept end user requests for content.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: pulumi.Input[bool]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="originShieldRegion")
    def origin_shield_region(self) -> pulumi.Input[str]:
        """
        AWS Region for Origin Shield. To specify a region, use the region code, not the region name. For example, specify the US East (Ohio) region as us-east-2.
        """
        return pulumi.get(self, "origin_shield_region")

    @origin_shield_region.setter
    def origin_shield_region(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_shield_region", value)


@pulumi.input_type
class DistributionOriginS3OriginConfigArgs:
    def __init__(__self__, *,
                 origin_access_identity: pulumi.Input[str]):
        """
        :param pulumi.Input[str] origin_access_identity: The CloudFront origin access identity to associate with the origin.
        """
        pulumi.set(__self__, "origin_access_identity", origin_access_identity)

    @property
    @pulumi.getter(name="originAccessIdentity")
    def origin_access_identity(self) -> pulumi.Input[str]:
        """
        The CloudFront origin access identity to associate with the origin.
        """
        return pulumi.get(self, "origin_access_identity")

    @origin_access_identity.setter
    def origin_access_identity(self, value: pulumi.Input[str]):
        pulumi.set(self, "origin_access_identity", value)


@pulumi.input_type
class DistributionRestrictionsArgs:
    def __init__(__self__, *,
                 geo_restriction: pulumi.Input['DistributionRestrictionsGeoRestrictionArgs']):
        pulumi.set(__self__, "geo_restriction", geo_restriction)

    @property
    @pulumi.getter(name="geoRestriction")
    def geo_restriction(self) -> pulumi.Input['DistributionRestrictionsGeoRestrictionArgs']:
        return pulumi.get(self, "geo_restriction")

    @geo_restriction.setter
    def geo_restriction(self, value: pulumi.Input['DistributionRestrictionsGeoRestrictionArgs']):
        pulumi.set(self, "geo_restriction", value)


@pulumi.input_type
class DistributionRestrictionsGeoRestrictionArgs:
    def __init__(__self__, *,
                 restriction_type: pulumi.Input[str],
                 locations: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] restriction_type: Method that you want to use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] locations: [ISO 3166-1-alpha-2 codes][4] for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
        """
        pulumi.set(__self__, "restriction_type", restriction_type)
        if locations is not None:
            pulumi.set(__self__, "locations", locations)

    @property
    @pulumi.getter(name="restrictionType")
    def restriction_type(self) -> pulumi.Input[str]:
        """
        Method that you want to use to restrict distribution of your content by country: `none`, `whitelist`, or `blacklist`.
        """
        return pulumi.get(self, "restriction_type")

    @restriction_type.setter
    def restriction_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "restriction_type", value)

    @property
    @pulumi.getter
    def locations(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        [ISO 3166-1-alpha-2 codes][4] for which you want CloudFront either to distribute your content (`whitelist`) or not distribute your content (`blacklist`). If the type is specified as `none` an empty array can be used.
        """
        return pulumi.get(self, "locations")

    @locations.setter
    def locations(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "locations", value)


@pulumi.input_type
class DistributionTrustedKeyGroupArgs:
    def __init__(__self__, *,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]] = None):
        """
        :param pulumi.Input[bool] enabled: Whether the distribution is enabled to accept end user requests for content.
        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]] items: List of nested attributes for each trusted signer
        """
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the distribution is enabled to accept end user requests for content.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]:
        """
        List of nested attributes for each trusted signer
        """
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedKeyGroupItemArgs']]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class DistributionTrustedKeyGroupItemArgs:
    def __init__(__self__, *,
                 key_group_id: Optional[pulumi.Input[str]] = None,
                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] key_group_id: ID of the key group that contains the public keys.
        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
        """
        if key_group_id is not None:
            pulumi.set(__self__, "key_group_id", key_group_id)
        if key_pair_ids is not None:
            pulumi.set(__self__, "key_pair_ids", key_pair_ids)

    @property
    @pulumi.getter(name="keyGroupId")
    def key_group_id(self) -> Optional[pulumi.Input[str]]:
        """
        ID of the key group that contains the public keys.
        """
        return pulumi.get(self, "key_group_id")

    @key_group_id.setter
    def key_group_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "key_group_id", value)

    @property
    @pulumi.getter(name="keyPairIds")
    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Set of active CloudFront key pairs associated with the signer account
        """
        return pulumi.get(self, "key_pair_ids")

    @key_pair_ids.setter
    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "key_pair_ids", value)


@pulumi.input_type
class DistributionTrustedSignerArgs:
    def __init__(__self__, *,
                 enabled: Optional[pulumi.Input[bool]] = None,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]] = None):
        """
        :param pulumi.Input[bool] enabled: Whether the distribution is enabled to accept end user requests for content.
        :param pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]] items: List of nested attributes for each trusted signer
        """
        if enabled is not None:
            pulumi.set(__self__, "enabled", enabled)
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def enabled(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether the distribution is enabled to accept end user requests for content.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]:
        """
        List of nested attributes for each trusted signer
        """
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['DistributionTrustedSignerItemArgs']]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class DistributionTrustedSignerItemArgs:
    def __init__(__self__, *,
                 aws_account_number: Optional[pulumi.Input[str]] = None,
                 key_pair_ids: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        """
        :param pulumi.Input[str] aws_account_number: AWS account ID or `self`
        :param pulumi.Input[Sequence[pulumi.Input[str]]] key_pair_ids: Set of active CloudFront key pairs associated with the signer account
        """
        if aws_account_number is not None:
            pulumi.set(__self__, "aws_account_number", aws_account_number)
        if key_pair_ids is not None:
            pulumi.set(__self__, "key_pair_ids", key_pair_ids)

    @property
    @pulumi.getter(name="awsAccountNumber")
    def aws_account_number(self) -> Optional[pulumi.Input[str]]:
        """
        AWS account ID or `self`
        """
        return pulumi.get(self, "aws_account_number")

    @aws_account_number.setter
    def aws_account_number(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "aws_account_number", value)

    @property
    @pulumi.getter(name="keyPairIds")
    def key_pair_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        """
        Set of active CloudFront key pairs associated with the signer account
        """
        return pulumi.get(self, "key_pair_ids")

    @key_pair_ids.setter
    def key_pair_ids(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "key_pair_ids", value)


@pulumi.input_type
class DistributionViewerCertificateArgs:
    def __init__(__self__, *,
                 acm_certificate_arn: Optional[pulumi.Input[str]] = None,
                 cloudfront_default_certificate: Optional[pulumi.Input[bool]] = None,
                 iam_certificate_id: Optional[pulumi.Input[str]] = None,
                 minimum_protocol_version: Optional[pulumi.Input[str]] = None,
                 ssl_support_method: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] acm_certificate_arn: ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
        :param pulumi.Input[bool] cloudfront_default_certificate: `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
        :param pulumi.Input[str] iam_certificate_id: IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
        :param pulumi.Input[str] minimum_protocol_version: Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
        :param pulumi.Input[str] ssl_support_method: How you want CloudFront to serve HTTPS requests. One of `vip` or `sni-only`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
        """
        if acm_certificate_arn is not None:
            pulumi.set(__self__, "acm_certificate_arn", acm_certificate_arn)
        if cloudfront_default_certificate is not None:
            pulumi.set(__self__, "cloudfront_default_certificate", cloudfront_default_certificate)
        if iam_certificate_id is not None:
            pulumi.set(__self__, "iam_certificate_id", iam_certificate_id)
        if minimum_protocol_version is not None:
            pulumi.set(__self__, "minimum_protocol_version", minimum_protocol_version)
        if ssl_support_method is not None:
            pulumi.set(__self__, "ssl_support_method", ssl_support_method)

    @property
    @pulumi.getter(name="acmCertificateArn")
    def acm_certificate_arn(self) -> Optional[pulumi.Input[str]]:
        """
        ARN of the [AWS Certificate Manager](https://aws.amazon.com/certificate-manager/) certificate that you wish to use with this distribution. Specify this, `cloudfront_default_certificate`, or `iam_certificate_id`.  The ACM certificate must be in  US-EAST-1.
        """
        return pulumi.get(self, "acm_certificate_arn")

    @acm_certificate_arn.setter
    def acm_certificate_arn(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "acm_certificate_arn", value)

    @property
    @pulumi.getter(name="cloudfrontDefaultCertificate")
    def cloudfront_default_certificate(self) -> Optional[pulumi.Input[bool]]:
        """
        `true` if you want viewers to use HTTPS to request your objects and you're using the CloudFront domain name for your distribution. Specify this, `acm_certificate_arn`, or `iam_certificate_id`.
        """
        return pulumi.get(self, "cloudfront_default_certificate")

    @cloudfront_default_certificate.setter
    def cloudfront_default_certificate(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "cloudfront_default_certificate", value)

    @property
    @pulumi.getter(name="iamCertificateId")
    def iam_certificate_id(self) -> Optional[pulumi.Input[str]]:
        """
        IAM certificate identifier of the custom viewer certificate for this distribution if you are using a custom domain. Specify this, `acm_certificate_arn`, or `cloudfront_default_certificate`.
        """
        return pulumi.get(self, "iam_certificate_id")

    @iam_certificate_id.setter
    def iam_certificate_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "iam_certificate_id", value)

    @property
    @pulumi.getter(name="minimumProtocolVersion")
    def minimum_protocol_version(self) -> Optional[pulumi.Input[str]]:
        """
        Minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections. Can only be set if `cloudfront_default_certificate = false`. See all possible values in [this](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html) table under "Security policy." Some examples include: `TLSv1.2_2019` and `TLSv1.2_2021`. Default: `TLSv1`. **NOTE**: If you are using a custom certificate (specified with `acm_certificate_arn` or `iam_certificate_id`), and have specified `sni-only` in `ssl_support_method`, `TLSv1` or later must be specified. If you have specified `vip` in `ssl_support_method`, only `SSLv3` or `TLSv1` can be specified. If you have specified `cloudfront_default_certificate`, `TLSv1` must be specified.
        """
        return pulumi.get(self, "minimum_protocol_version")

    @minimum_protocol_version.setter
    def minimum_protocol_version(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "minimum_protocol_version", value)

    @property
    @pulumi.getter(name="sslSupportMethod")
    def ssl_support_method(self) -> Optional[pulumi.Input[str]]:
        """
        How you want CloudFront to serve HTTPS requests. One of `vip` or `sni-only`. Required if you specify `acm_certificate_arn` or `iam_certificate_id`. **NOTE:** `vip` causes CloudFront to use a dedicated IP address and may incur extra charges.
        """
        return pulumi.get(self, "ssl_support_method")

    @ssl_support_method.setter
    def ssl_support_method(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "ssl_support_method", value)


@pulumi.input_type
class FieldLevelEncryptionConfigContentTypeProfileConfigArgs:
    def __init__(__self__, *,
                 content_type_profiles: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'],
                 forward_when_content_type_is_unknown: pulumi.Input[bool]):
        """
        :param pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs'] content_type_profiles: Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
        :param pulumi.Input[bool] forward_when_content_type_is_unknown: specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
        """
        pulumi.set(__self__, "content_type_profiles", content_type_profiles)
        pulumi.set(__self__, "forward_when_content_type_is_unknown", forward_when_content_type_is_unknown)

    @property
    @pulumi.getter(name="contentTypeProfiles")
    def content_type_profiles(self) -> pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']:
        """
        Object that contains an attribute `items` that contains the list of configurations for a field-level encryption content type-profile. See Content Type Profile.
        """
        return pulumi.get(self, "content_type_profiles")

    @content_type_profiles.setter
    def content_type_profiles(self, value: pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs']):
        pulumi.set(self, "content_type_profiles", value)

    @property
    @pulumi.getter(name="forwardWhenContentTypeIsUnknown")
    def forward_when_content_type_is_unknown(self) -> pulumi.Input[bool]:
        """
        specifies what to do when an unknown content type is provided for the profile. If true, content is forwarded without being encrypted when the content type is unknown. If false (the default), an error is returned when the content type is unknown.
        """
        return pulumi.get(self, "forward_when_content_type_is_unknown")

    @forward_when_content_type_is_unknown.setter
    def forward_when_content_type_is_unknown(self, value: pulumi.Input[bool]):
        pulumi.set(self, "forward_when_content_type_is_unknown", value)


@pulumi.input_type
class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesArgs:
    def __init__(__self__, *,
                 items: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
        pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs']]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class FieldLevelEncryptionConfigContentTypeProfileConfigContentTypeProfilesItemArgs:
    def __init__(__self__, *,
                 content_type: pulumi.Input[str],
                 format: pulumi.Input[str],
                 profile_id: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[str] content_type: he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
        :param pulumi.Input[str] format: The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
        :param pulumi.Input[str] profile_id: The profile ID for a field-level encryption content type-profile mapping.
        """
        pulumi.set(__self__, "content_type", content_type)
        pulumi.set(__self__, "format", format)
        if profile_id is not None:
            pulumi.set(__self__, "profile_id", profile_id)

    @property
    @pulumi.getter(name="contentType")
    def content_type(self) -> pulumi.Input[str]:
        """
        he content type for a field-level encryption content type-profile mapping. Valid value is `application/x-www-form-urlencoded`.
        """
        return pulumi.get(self, "content_type")

    @content_type.setter
    def content_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "content_type", value)

    @property
    @pulumi.getter
    def format(self) -> pulumi.Input[str]:
        """
        The format for a field-level encryption content type-profile mapping. Valid value is `URLEncoded`.
        """
        return pulumi.get(self, "format")

    @format.setter
    def format(self, value: pulumi.Input[str]):
        pulumi.set(self, "format", value)

    @property
    @pulumi.getter(name="profileId")
    def profile_id(self) -> Optional[pulumi.Input[str]]:
        """
        The profile ID for a field-level encryption content type-profile mapping.
        """
        return pulumi.get(self, "profile_id")

    @profile_id.setter
    def profile_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "profile_id", value)


@pulumi.input_type
class FieldLevelEncryptionConfigQueryArgProfileConfigArgs:
    def __init__(__self__, *,
                 forward_when_query_arg_profile_is_unknown: pulumi.Input[bool],
                 query_arg_profiles: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']] = None):
        """
        :param pulumi.Input[bool] forward_when_query_arg_profile_is_unknown: Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
        :param pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs'] query_arg_profiles: Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
        """
        pulumi.set(__self__, "forward_when_query_arg_profile_is_unknown", forward_when_query_arg_profile_is_unknown)
        if query_arg_profiles is not None:
            pulumi.set(__self__, "query_arg_profiles", query_arg_profiles)

    @property
    @pulumi.getter(name="forwardWhenQueryArgProfileIsUnknown")
    def forward_when_query_arg_profile_is_unknown(self) -> pulumi.Input[bool]:
        """
        Flag to set if you want a request to be forwarded to the origin even if the profile specified by the field-level encryption query argument, fle-profile, is unknown.
        """
        return pulumi.get(self, "forward_when_query_arg_profile_is_unknown")

    @forward_when_query_arg_profile_is_unknown.setter
    def forward_when_query_arg_profile_is_unknown(self, value: pulumi.Input[bool]):
        pulumi.set(self, "forward_when_query_arg_profile_is_unknown", value)

    @property
    @pulumi.getter(name="queryArgProfiles")
    def query_arg_profiles(self) -> Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]:
        """
        Object that contains an attribute `items` that contains the list ofrofiles specified for query argument-profile mapping for field-level encryption. see Query Arg Profile.
        """
        return pulumi.get(self, "query_arg_profiles")

    @query_arg_profiles.setter
    def query_arg_profiles(self, value: Optional[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs']]):
        pulumi.set(self, "query_arg_profiles", value)


@pulumi.input_type
class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs']]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class FieldLevelEncryptionConfigQueryArgProfileConfigQueryArgProfilesItemArgs:
    def __init__(__self__, *,
                 profile_id: pulumi.Input[str],
                 query_arg: pulumi.Input[str]):
        """
        :param pulumi.Input[str] profile_id: The profile ID for a field-level encryption content type-profile mapping.
        :param pulumi.Input[str] query_arg: Query argument for field-level encryption query argument-profile mapping.
        """
        pulumi.set(__self__, "profile_id", profile_id)
        pulumi.set(__self__, "query_arg", query_arg)

    @property
    @pulumi.getter(name="profileId")
    def profile_id(self) -> pulumi.Input[str]:
        """
        The profile ID for a field-level encryption content type-profile mapping.
        """
        return pulumi.get(self, "profile_id")

    @profile_id.setter
    def profile_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "profile_id", value)

    @property
    @pulumi.getter(name="queryArg")
    def query_arg(self) -> pulumi.Input[str]:
        """
        Query argument for field-level encryption query argument-profile mapping.
        """
        return pulumi.get(self, "query_arg")

    @query_arg.setter
    def query_arg(self, value: pulumi.Input[str]):
        pulumi.set(self, "query_arg", value)


@pulumi.input_type
class FieldLevelEncryptionProfileEncryptionEntitiesArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemArgs']]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class FieldLevelEncryptionProfileEncryptionEntitiesItemArgs:
    def __init__(__self__, *,
                 field_patterns: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'],
                 provider_id: pulumi.Input[str],
                 public_key_id: pulumi.Input[str]):
        """
        :param pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs'] field_patterns: Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
        :param pulumi.Input[str] provider_id: The provider associated with the public key being used for encryption.
        :param pulumi.Input[str] public_key_id: The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
        """
        pulumi.set(__self__, "field_patterns", field_patterns)
        pulumi.set(__self__, "provider_id", provider_id)
        pulumi.set(__self__, "public_key_id", public_key_id)

    @property
    @pulumi.getter(name="fieldPatterns")
    def field_patterns(self) -> pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']:
        """
        Object that contains an attribute `items` that contains the list of field patterns in a field-level encryption content type profile specify the fields that you want to be encrypted.
        """
        return pulumi.get(self, "field_patterns")

    @field_patterns.setter
    def field_patterns(self, value: pulumi.Input['FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs']):
        pulumi.set(self, "field_patterns", value)

    @property
    @pulumi.getter(name="providerId")
    def provider_id(self) -> pulumi.Input[str]:
        """
        The provider associated with the public key being used for encryption.
        """
        return pulumi.get(self, "provider_id")

    @provider_id.setter
    def provider_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "provider_id", value)

    @property
    @pulumi.getter(name="publicKeyId")
    def public_key_id(self) -> pulumi.Input[str]:
        """
        The public key associated with a set of field-level encryption patterns, to be used when encrypting the fields that match the patterns.
        """
        return pulumi.get(self, "public_key_id")

    @public_key_id.setter
    def public_key_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "public_key_id", value)


@pulumi.input_type
class FieldLevelEncryptionProfileEncryptionEntitiesItemFieldPatternsArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class MonitoringSubscriptionMonitoringSubscriptionArgs:
    def __init__(__self__, *,
                 realtime_metrics_subscription_config: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
        """
        :param pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs'] realtime_metrics_subscription_config: A subscription configuration for additional CloudWatch metrics. See below.
        """
        pulumi.set(__self__, "realtime_metrics_subscription_config", realtime_metrics_subscription_config)

    @property
    @pulumi.getter(name="realtimeMetricsSubscriptionConfig")
    def realtime_metrics_subscription_config(self) -> pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']:
        """
        A subscription configuration for additional CloudWatch metrics. See below.
        """
        return pulumi.get(self, "realtime_metrics_subscription_config")

    @realtime_metrics_subscription_config.setter
    def realtime_metrics_subscription_config(self, value: pulumi.Input['MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs']):
        pulumi.set(self, "realtime_metrics_subscription_config", value)


@pulumi.input_type
class MonitoringSubscriptionMonitoringSubscriptionRealtimeMetricsSubscriptionConfigArgs:
    def __init__(__self__, *,
                 realtime_metrics_subscription_status: pulumi.Input[str]):
        """
        :param pulumi.Input[str] realtime_metrics_subscription_status: A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
        """
        pulumi.set(__self__, "realtime_metrics_subscription_status", realtime_metrics_subscription_status)

    @property
    @pulumi.getter(name="realtimeMetricsSubscriptionStatus")
    def realtime_metrics_subscription_status(self) -> pulumi.Input[str]:
        """
        A flag that indicates whether additional CloudWatch metrics are enabled for a given CloudFront distribution. Valid values are `Enabled` and `Disabled`. See below.
        """
        return pulumi.get(self, "realtime_metrics_subscription_status")

    @realtime_metrics_subscription_status.setter
    def realtime_metrics_subscription_status(self, value: pulumi.Input[str]):
        pulumi.set(self, "realtime_metrics_subscription_status", value)


@pulumi.input_type
class OriginRequestPolicyCookiesConfigArgs:
    def __init__(__self__, *,
                 cookie_behavior: pulumi.Input[str],
                 cookies: Optional[pulumi.Input['OriginRequestPolicyCookiesConfigCookiesArgs']] = None):
        pulumi.set(__self__, "cookie_behavior", cookie_behavior)
        if cookies is not None:
            pulumi.set(__self__, "cookies", cookies)

    @property
    @pulumi.getter(name="cookieBehavior")
    def cookie_behavior(self) -> pulumi.Input[str]:
        return pulumi.get(self, "cookie_behavior")

    @cookie_behavior.setter
    def cookie_behavior(self, value: pulumi.Input[str]):
        pulumi.set(self, "cookie_behavior", value)

    @property
    @pulumi.getter
    def cookies(self) -> Optional[pulumi.Input['OriginRequestPolicyCookiesConfigCookiesArgs']]:
        return pulumi.get(self, "cookies")

    @cookies.setter
    def cookies(self, value: Optional[pulumi.Input['OriginRequestPolicyCookiesConfigCookiesArgs']]):
        pulumi.set(self, "cookies", value)


@pulumi.input_type
class OriginRequestPolicyCookiesConfigCookiesArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class OriginRequestPolicyHeadersConfigArgs:
    def __init__(__self__, *,
                 header_behavior: Optional[pulumi.Input[str]] = None,
                 headers: Optional[pulumi.Input['OriginRequestPolicyHeadersConfigHeadersArgs']] = None):
        if header_behavior is not None:
            pulumi.set(__self__, "header_behavior", header_behavior)
        if headers is not None:
            pulumi.set(__self__, "headers", headers)

    @property
    @pulumi.getter(name="headerBehavior")
    def header_behavior(self) -> Optional[pulumi.Input[str]]:
        return pulumi.get(self, "header_behavior")

    @header_behavior.setter
    def header_behavior(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "header_behavior", value)

    @property
    @pulumi.getter
    def headers(self) -> Optional[pulumi.Input['OriginRequestPolicyHeadersConfigHeadersArgs']]:
        return pulumi.get(self, "headers")

    @headers.setter
    def headers(self, value: Optional[pulumi.Input['OriginRequestPolicyHeadersConfigHeadersArgs']]):
        pulumi.set(self, "headers", value)


@pulumi.input_type
class OriginRequestPolicyHeadersConfigHeadersArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class OriginRequestPolicyQueryStringsConfigArgs:
    def __init__(__self__, *,
                 query_string_behavior: pulumi.Input[str],
                 query_strings: Optional[pulumi.Input['OriginRequestPolicyQueryStringsConfigQueryStringsArgs']] = None):
        pulumi.set(__self__, "query_string_behavior", query_string_behavior)
        if query_strings is not None:
            pulumi.set(__self__, "query_strings", query_strings)

    @property
    @pulumi.getter(name="queryStringBehavior")
    def query_string_behavior(self) -> pulumi.Input[str]:
        return pulumi.get(self, "query_string_behavior")

    @query_string_behavior.setter
    def query_string_behavior(self, value: pulumi.Input[str]):
        pulumi.set(self, "query_string_behavior", value)

    @property
    @pulumi.getter(name="queryStrings")
    def query_strings(self) -> Optional[pulumi.Input['OriginRequestPolicyQueryStringsConfigQueryStringsArgs']]:
        return pulumi.get(self, "query_strings")

    @query_strings.setter
    def query_strings(self, value: Optional[pulumi.Input['OriginRequestPolicyQueryStringsConfigQueryStringsArgs']]):
        pulumi.set(self, "query_strings", value)


@pulumi.input_type
class OriginRequestPolicyQueryStringsConfigQueryStringsArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class RealtimeLogConfigEndpointArgs:
    def __init__(__self__, *,
                 kinesis_stream_config: pulumi.Input['RealtimeLogConfigEndpointKinesisStreamConfigArgs'],
                 stream_type: pulumi.Input[str]):
        """
        :param pulumi.Input['RealtimeLogConfigEndpointKinesisStreamConfigArgs'] kinesis_stream_config: The Amazon Kinesis data stream configuration.
        :param pulumi.Input[str] stream_type: The type of data stream where real-time log data is sent. The only valid value is `Kinesis`.
        """
        pulumi.set(__self__, "kinesis_stream_config", kinesis_stream_config)
        pulumi.set(__self__, "stream_type", stream_type)

    @property
    @pulumi.getter(name="kinesisStreamConfig")
    def kinesis_stream_config(self) -> pulumi.Input['RealtimeLogConfigEndpointKinesisStreamConfigArgs']:
        """
        The Amazon Kinesis data stream configuration.
        """
        return pulumi.get(self, "kinesis_stream_config")

    @kinesis_stream_config.setter
    def kinesis_stream_config(self, value: pulumi.Input['RealtimeLogConfigEndpointKinesisStreamConfigArgs']):
        pulumi.set(self, "kinesis_stream_config", value)

    @property
    @pulumi.getter(name="streamType")
    def stream_type(self) -> pulumi.Input[str]:
        """
        The type of data stream where real-time log data is sent. The only valid value is `Kinesis`.
        """
        return pulumi.get(self, "stream_type")

    @stream_type.setter
    def stream_type(self, value: pulumi.Input[str]):
        pulumi.set(self, "stream_type", value)


@pulumi.input_type
class RealtimeLogConfigEndpointKinesisStreamConfigArgs:
    def __init__(__self__, *,
                 role_arn: pulumi.Input[str],
                 stream_arn: pulumi.Input[str]):
        """
        :param pulumi.Input[str] role_arn: The ARN of an IAM role that CloudFront can use to send real-time log data to the Kinesis data stream.
               See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
        :param pulumi.Input[str] stream_arn: The ARN of the Kinesis data stream.
        """
        pulumi.set(__self__, "role_arn", role_arn)
        pulumi.set(__self__, "stream_arn", stream_arn)

    @property
    @pulumi.getter(name="roleArn")
    def role_arn(self) -> pulumi.Input[str]:
        """
        The ARN of an IAM role that CloudFront can use to send real-time log data to the Kinesis data stream.
        See the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html#understand-real-time-log-config-iam-role) for more information.
        """
        return pulumi.get(self, "role_arn")

    @role_arn.setter
    def role_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "role_arn", value)

    @property
    @pulumi.getter(name="streamArn")
    def stream_arn(self) -> pulumi.Input[str]:
        """
        The ARN of the Kinesis data stream.
        """
        return pulumi.get(self, "stream_arn")

    @stream_arn.setter
    def stream_arn(self, value: pulumi.Input[str]):
        pulumi.set(self, "stream_arn", value)


@pulumi.input_type
class ResponseHeadersPolicyCorsConfigArgs:
    def __init__(__self__, *,
                 access_control_allow_credentials: pulumi.Input[bool],
                 access_control_allow_headers: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs'],
                 access_control_allow_methods: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs'],
                 access_control_allow_origins: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs'],
                 origin_override: pulumi.Input[bool],
                 access_control_expose_headers: Optional[pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs']] = None,
                 access_control_max_age_sec: Optional[pulumi.Input[int]] = None):
        """
        :param pulumi.Input[bool] access_control_allow_credentials: A Boolean value that CloudFront uses as the value for the `Access-Control-Allow-Credentials` HTTP response header.
        :param pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs'] access_control_allow_headers: Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the `Access-Control-Allow-Headers` HTTP response header.
        :param pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs'] access_control_allow_methods: Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the `Access-Control-Allow-Methods` HTTP response header. Valid values: `GET` | `POST` | `OPTIONS` | `PUT` | `DELETE` | `HEAD` | `ALL`
        :param pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs'] access_control_allow_origins: Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the `Access-Control-Allow-Origin` HTTP response header.
        :param pulumi.Input[bool] origin_override: A Boolean value that determines how CloudFront behaves for the HTTP response header.
        :param pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs'] access_control_expose_headers: Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the `Access-Control-Expose-Headers` HTTP response header.
        :param pulumi.Input[int] access_control_max_age_sec: A number that CloudFront uses as the value for the `Access-Control-Max-Age` HTTP response header.
        """
        pulumi.set(__self__, "access_control_allow_credentials", access_control_allow_credentials)
        pulumi.set(__self__, "access_control_allow_headers", access_control_allow_headers)
        pulumi.set(__self__, "access_control_allow_methods", access_control_allow_methods)
        pulumi.set(__self__, "access_control_allow_origins", access_control_allow_origins)
        pulumi.set(__self__, "origin_override", origin_override)
        if access_control_expose_headers is not None:
            pulumi.set(__self__, "access_control_expose_headers", access_control_expose_headers)
        if access_control_max_age_sec is not None:
            pulumi.set(__self__, "access_control_max_age_sec", access_control_max_age_sec)

    @property
    @pulumi.getter(name="accessControlAllowCredentials")
    def access_control_allow_credentials(self) -> pulumi.Input[bool]:
        """
        A Boolean value that CloudFront uses as the value for the `Access-Control-Allow-Credentials` HTTP response header.
        """
        return pulumi.get(self, "access_control_allow_credentials")

    @access_control_allow_credentials.setter
    def access_control_allow_credentials(self, value: pulumi.Input[bool]):
        pulumi.set(self, "access_control_allow_credentials", value)

    @property
    @pulumi.getter(name="accessControlAllowHeaders")
    def access_control_allow_headers(self) -> pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs']:
        """
        Object that contains an attribute `items` that contains a list of HTTP header names that CloudFront includes as values for the `Access-Control-Allow-Headers` HTTP response header.
        """
        return pulumi.get(self, "access_control_allow_headers")

    @access_control_allow_headers.setter
    def access_control_allow_headers(self, value: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs']):
        pulumi.set(self, "access_control_allow_headers", value)

    @property
    @pulumi.getter(name="accessControlAllowMethods")
    def access_control_allow_methods(self) -> pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs']:
        """
        Object that contains an attribute `items` that contains a list of HTTP methods that CloudFront includes as values for the `Access-Control-Allow-Methods` HTTP response header. Valid values: `GET` | `POST` | `OPTIONS` | `PUT` | `DELETE` | `HEAD` | `ALL`
        """
        return pulumi.get(self, "access_control_allow_methods")

    @access_control_allow_methods.setter
    def access_control_allow_methods(self, value: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs']):
        pulumi.set(self, "access_control_allow_methods", value)

    @property
    @pulumi.getter(name="accessControlAllowOrigins")
    def access_control_allow_origins(self) -> pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs']:
        """
        Object that contains an attribute `items` that contains a list of origins that CloudFront can use as the value for the `Access-Control-Allow-Origin` HTTP response header.
        """
        return pulumi.get(self, "access_control_allow_origins")

    @access_control_allow_origins.setter
    def access_control_allow_origins(self, value: pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs']):
        pulumi.set(self, "access_control_allow_origins", value)

    @property
    @pulumi.getter(name="originOverride")
    def origin_override(self) -> pulumi.Input[bool]:
        """
        A Boolean value that determines how CloudFront behaves for the HTTP response header.
        """
        return pulumi.get(self, "origin_override")

    @origin_override.setter
    def origin_override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "origin_override", value)

    @property
    @pulumi.getter(name="accessControlExposeHeaders")
    def access_control_expose_headers(self) -> Optional[pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs']]:
        """
        Object that contains an attribute `items` that contains a list of HTTP headers that CloudFront includes as values for the `Access-Control-Expose-Headers` HTTP response header.
        """
        return pulumi.get(self, "access_control_expose_headers")

    @access_control_expose_headers.setter
    def access_control_expose_headers(self, value: Optional[pulumi.Input['ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs']]):
        pulumi.set(self, "access_control_expose_headers", value)

    @property
    @pulumi.getter(name="accessControlMaxAgeSec")
    def access_control_max_age_sec(self) -> Optional[pulumi.Input[int]]:
        """
        A number that CloudFront uses as the value for the `Access-Control-Max-Age` HTTP response header.
        """
        return pulumi.get(self, "access_control_max_age_sec")

    @access_control_max_age_sec.setter
    def access_control_max_age_sec(self, value: Optional[pulumi.Input[int]]):
        pulumi.set(self, "access_control_max_age_sec", value)


@pulumi.input_type
class ResponseHeadersPolicyCorsConfigAccessControlAllowHeadersArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class ResponseHeadersPolicyCorsConfigAccessControlAllowMethodsArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class ResponseHeadersPolicyCorsConfigAccessControlAllowOriginsArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class ResponseHeadersPolicyCorsConfigAccessControlExposeHeadersArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class ResponseHeadersPolicyCustomHeadersConfigArgs:
    def __init__(__self__, *,
                 items: Optional[pulumi.Input[Sequence[pulumi.Input['ResponseHeadersPolicyCustomHeadersConfigItemArgs']]]] = None):
        if items is not None:
            pulumi.set(__self__, "items", items)

    @property
    @pulumi.getter
    def items(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ResponseHeadersPolicyCustomHeadersConfigItemArgs']]]]:
        return pulumi.get(self, "items")

    @items.setter
    def items(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ResponseHeadersPolicyCustomHeadersConfigItemArgs']]]]):
        pulumi.set(self, "items", value)


@pulumi.input_type
class ResponseHeadersPolicyCustomHeadersConfigItemArgs:
    def __init__(__self__, *,
                 header: pulumi.Input[str],
                 override: pulumi.Input[bool],
                 value: pulumi.Input[str]):
        """
        :param pulumi.Input[str] header: The HTTP response header name.
        :param pulumi.Input[bool] override: Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
        :param pulumi.Input[str] value: The value for the HTTP response header.
        """
        pulumi.set(__self__, "header", header)
        pulumi.set(__self__, "override", override)
        pulumi.set(__self__, "value", value)

    @property
    @pulumi.getter
    def header(self) -> pulumi.Input[str]:
        """
        The HTTP response header name.
        """
        return pulumi.get(self, "header")

    @header.setter
    def header(self, value: pulumi.Input[str]):
        pulumi.set(self, "header", value)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides a response header with the same name received from the origin with the header specifies here.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)

    @property
    @pulumi.getter
    def value(self) -> pulumi.Input[str]:
        """
        The value for the HTTP response header.
        """
        return pulumi.get(self, "value")

    @value.setter
    def value(self, value: pulumi.Input[str]):
        pulumi.set(self, "value", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigArgs:
    def __init__(__self__, *,
                 content_security_policy: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs']] = None,
                 content_type_options: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs']] = None,
                 frame_options: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs']] = None,
                 referrer_policy: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs']] = None,
                 strict_transport_security: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs']] = None,
                 xss_protection: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs']] = None):
        """
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs'] content_security_policy: The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header. See Content Security Policy for more information.
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs'] content_type_options: Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff`. See Content Type Options for more information.
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs'] frame_options: Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header’s value. See Frame Options for more information.
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs'] referrer_policy: Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header’s value. See Referrer Policy for more information.
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs'] strict_transport_security: Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header’s value. See Strict Transport Security for more information.
        :param pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs'] xss_protection: Determine whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header’s value. See XSS Protection for more information.
        """
        if content_security_policy is not None:
            pulumi.set(__self__, "content_security_policy", content_security_policy)
        if content_type_options is not None:
            pulumi.set(__self__, "content_type_options", content_type_options)
        if frame_options is not None:
            pulumi.set(__self__, "frame_options", frame_options)
        if referrer_policy is not None:
            pulumi.set(__self__, "referrer_policy", referrer_policy)
        if strict_transport_security is not None:
            pulumi.set(__self__, "strict_transport_security", strict_transport_security)
        if xss_protection is not None:
            pulumi.set(__self__, "xss_protection", xss_protection)

    @property
    @pulumi.getter(name="contentSecurityPolicy")
    def content_security_policy(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs']]:
        """
        The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header. See Content Security Policy for more information.
        """
        return pulumi.get(self, "content_security_policy")

    @content_security_policy.setter
    def content_security_policy(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs']]):
        pulumi.set(self, "content_security_policy", value)

    @property
    @pulumi.getter(name="contentTypeOptions")
    def content_type_options(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs']]:
        """
        Determines whether CloudFront includes the `X-Content-Type-Options` HTTP response header with its value set to `nosniff`. See Content Type Options for more information.
        """
        return pulumi.get(self, "content_type_options")

    @content_type_options.setter
    def content_type_options(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs']]):
        pulumi.set(self, "content_type_options", value)

    @property
    @pulumi.getter(name="frameOptions")
    def frame_options(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs']]:
        """
        Determines whether CloudFront includes the `X-Frame-Options` HTTP response header and the header’s value. See Frame Options for more information.
        """
        return pulumi.get(self, "frame_options")

    @frame_options.setter
    def frame_options(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs']]):
        pulumi.set(self, "frame_options", value)

    @property
    @pulumi.getter(name="referrerPolicy")
    def referrer_policy(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs']]:
        """
        Determines whether CloudFront includes the `Referrer-Policy` HTTP response header and the header’s value. See Referrer Policy for more information.
        """
        return pulumi.get(self, "referrer_policy")

    @referrer_policy.setter
    def referrer_policy(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs']]):
        pulumi.set(self, "referrer_policy", value)

    @property
    @pulumi.getter(name="strictTransportSecurity")
    def strict_transport_security(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs']]:
        """
        Determines whether CloudFront includes the `Strict-Transport-Security` HTTP response header and the header’s value. See Strict Transport Security for more information.
        """
        return pulumi.get(self, "strict_transport_security")

    @strict_transport_security.setter
    def strict_transport_security(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs']]):
        pulumi.set(self, "strict_transport_security", value)

    @property
    @pulumi.getter(name="xssProtection")
    def xss_protection(self) -> Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs']]:
        """
        Determine whether CloudFront includes the `X-XSS-Protection` HTTP response header and the header’s value. See XSS Protection for more information.
        """
        return pulumi.get(self, "xss_protection")

    @xss_protection.setter
    def xss_protection(self, value: Optional[pulumi.Input['ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs']]):
        pulumi.set(self, "xss_protection", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigContentSecurityPolicyArgs:
    def __init__(__self__, *,
                 content_security_policy: pulumi.Input[str],
                 override: pulumi.Input[bool]):
        """
        :param pulumi.Input[str] content_security_policy: The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `Content-Security-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        pulumi.set(__self__, "content_security_policy", content_security_policy)
        pulumi.set(__self__, "override", override)

    @property
    @pulumi.getter(name="contentSecurityPolicy")
    def content_security_policy(self) -> pulumi.Input[str]:
        """
        The policy directives and their values that CloudFront includes as values for the `Content-Security-Policy` HTTP response header.
        """
        return pulumi.get(self, "content_security_policy")

    @content_security_policy.setter
    def content_security_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "content_security_policy", value)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `Content-Security-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigContentTypeOptionsArgs:
    def __init__(__self__, *,
                 override: pulumi.Input[bool]):
        """
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `X-Content-Type-Options` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        pulumi.set(__self__, "override", override)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `X-Content-Type-Options` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigFrameOptionsArgs:
    def __init__(__self__, *,
                 frame_option: pulumi.Input[str],
                 override: pulumi.Input[bool]):
        """
        :param pulumi.Input[str] frame_option: The value of the `X-Frame-Options` HTTP response header. Valid values: `DENY` | `SAMEORIGIN`
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `X-Frame-Options` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        pulumi.set(__self__, "frame_option", frame_option)
        pulumi.set(__self__, "override", override)

    @property
    @pulumi.getter(name="frameOption")
    def frame_option(self) -> pulumi.Input[str]:
        """
        The value of the `X-Frame-Options` HTTP response header. Valid values: `DENY` | `SAMEORIGIN`
        """
        return pulumi.get(self, "frame_option")

    @frame_option.setter
    def frame_option(self, value: pulumi.Input[str]):
        pulumi.set(self, "frame_option", value)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `X-Frame-Options` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigReferrerPolicyArgs:
    def __init__(__self__, *,
                 override: pulumi.Input[bool],
                 referrer_policy: pulumi.Input[str]):
        """
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `Referrer-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
        :param pulumi.Input[str] referrer_policy: The value of the `Referrer-Policy` HTTP response header. Valid Values: `no-referrer` | `no-referrer-when-downgrade` | `origin` | `origin-when-cross-origin` | `same-origin` | `strict-origin` | `strict-origin-when-cross-origin` | `unsafe-url`
        """
        pulumi.set(__self__, "override", override)
        pulumi.set(__self__, "referrer_policy", referrer_policy)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `Referrer-Policy` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)

    @property
    @pulumi.getter(name="referrerPolicy")
    def referrer_policy(self) -> pulumi.Input[str]:
        """
        The value of the `Referrer-Policy` HTTP response header. Valid Values: `no-referrer` | `no-referrer-when-downgrade` | `origin` | `origin-when-cross-origin` | `same-origin` | `strict-origin` | `strict-origin-when-cross-origin` | `unsafe-url`
        """
        return pulumi.get(self, "referrer_policy")

    @referrer_policy.setter
    def referrer_policy(self, value: pulumi.Input[str]):
        pulumi.set(self, "referrer_policy", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigStrictTransportSecurityArgs:
    def __init__(__self__, *,
                 access_control_max_age_sec: pulumi.Input[int],
                 override: pulumi.Input[bool],
                 include_subdomains: Optional[pulumi.Input[bool]] = None,
                 preload: Optional[pulumi.Input[bool]] = None):
        """
        :param pulumi.Input[int] access_control_max_age_sec: A number that CloudFront uses as the value for the `max-age` directive in the `Strict-Transport-Security` HTTP response header.
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `Strict-Transport-Security` HTTP response header received from the origin with the one specified in this response headers policy.
        :param pulumi.Input[bool] include_subdomains: Whether CloudFront includes the `includeSubDomains` directive in the `Strict-Transport-Security` HTTP response header.
        :param pulumi.Input[bool] preload: Whether CloudFront includes the `preload` directive in the `Strict-Transport-Security` HTTP response header.
        """
        pulumi.set(__self__, "access_control_max_age_sec", access_control_max_age_sec)
        pulumi.set(__self__, "override", override)
        if include_subdomains is not None:
            pulumi.set(__self__, "include_subdomains", include_subdomains)
        if preload is not None:
            pulumi.set(__self__, "preload", preload)

    @property
    @pulumi.getter(name="accessControlMaxAgeSec")
    def access_control_max_age_sec(self) -> pulumi.Input[int]:
        """
        A number that CloudFront uses as the value for the `max-age` directive in the `Strict-Transport-Security` HTTP response header.
        """
        return pulumi.get(self, "access_control_max_age_sec")

    @access_control_max_age_sec.setter
    def access_control_max_age_sec(self, value: pulumi.Input[int]):
        pulumi.set(self, "access_control_max_age_sec", value)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `Strict-Transport-Security` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)

    @property
    @pulumi.getter(name="includeSubdomains")
    def include_subdomains(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether CloudFront includes the `includeSubDomains` directive in the `Strict-Transport-Security` HTTP response header.
        """
        return pulumi.get(self, "include_subdomains")

    @include_subdomains.setter
    def include_subdomains(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "include_subdomains", value)

    @property
    @pulumi.getter
    def preload(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether CloudFront includes the `preload` directive in the `Strict-Transport-Security` HTTP response header.
        """
        return pulumi.get(self, "preload")

    @preload.setter
    def preload(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "preload", value)


@pulumi.input_type
class ResponseHeadersPolicySecurityHeadersConfigXssProtectionArgs:
    def __init__(__self__, *,
                 override: pulumi.Input[bool],
                 protection: pulumi.Input[bool],
                 mode_block: Optional[pulumi.Input[bool]] = None,
                 report_uri: Optional[pulumi.Input[str]] = None):
        """
        :param pulumi.Input[bool] override: Whether CloudFront overrides the `X-XSS-Protection` HTTP response header received from the origin with the one specified in this response headers policy.
        :param pulumi.Input[bool] protection: A Boolean value that determines the value of the `X-XSS-Protection` HTTP response header. When this setting is `true`, the value of the `X-XSS-Protection` header is `1`. When this setting is `false`, the value of the `X-XSS-Protection` header is `0`.
        :param pulumi.Input[bool] mode_block: Whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
        :param pulumi.Input[str] report_uri: A reporting URI, which CloudFront uses as the value of the report directive in the `X-XSS-Protection` header. You cannot specify a `report_uri` when `mode_block` is `true`.
        """
        pulumi.set(__self__, "override", override)
        pulumi.set(__self__, "protection", protection)
        if mode_block is not None:
            pulumi.set(__self__, "mode_block", mode_block)
        if report_uri is not None:
            pulumi.set(__self__, "report_uri", report_uri)

    @property
    @pulumi.getter
    def override(self) -> pulumi.Input[bool]:
        """
        Whether CloudFront overrides the `X-XSS-Protection` HTTP response header received from the origin with the one specified in this response headers policy.
        """
        return pulumi.get(self, "override")

    @override.setter
    def override(self, value: pulumi.Input[bool]):
        pulumi.set(self, "override", value)

    @property
    @pulumi.getter
    def protection(self) -> pulumi.Input[bool]:
        """
        A Boolean value that determines the value of the `X-XSS-Protection` HTTP response header. When this setting is `true`, the value of the `X-XSS-Protection` header is `1`. When this setting is `false`, the value of the `X-XSS-Protection` header is `0`.
        """
        return pulumi.get(self, "protection")

    @protection.setter
    def protection(self, value: pulumi.Input[bool]):
        pulumi.set(self, "protection", value)

    @property
    @pulumi.getter(name="modeBlock")
    def mode_block(self) -> Optional[pulumi.Input[bool]]:
        """
        Whether CloudFront includes the `mode=block` directive in the `X-XSS-Protection` header.
        """
        return pulumi.get(self, "mode_block")

    @mode_block.setter
    def mode_block(self, value: Optional[pulumi.Input[bool]]):
        pulumi.set(self, "mode_block", value)

    @property
    @pulumi.getter(name="reportUri")
    def report_uri(self) -> Optional[pulumi.Input[str]]:
        """
        A reporting URI, which CloudFront uses as the value of the report directive in the `X-XSS-Protection` header. You cannot specify a `report_uri` when `mode_block` is `true`.
        """
        return pulumi.get(self, "report_uri")

    @report_uri.setter
    def report_uri(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "report_uri", value)


@pulumi.input_type
class ResponseHeadersPolicyServerTimingHeadersConfigArgs:
    def __init__(__self__, *,
                 enabled: pulumi.Input[bool],
                 sampling_rate: pulumi.Input[float]):
        """
        :param pulumi.Input[bool] enabled: A Whether CloudFront adds the `Server-Timing` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
        :param pulumi.Input[float] sampling_rate: A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to. Valid range: Minimum value of 0.0. Maximum value of 100.0.
        """
        pulumi.set(__self__, "enabled", enabled)
        pulumi.set(__self__, "sampling_rate", sampling_rate)

    @property
    @pulumi.getter
    def enabled(self) -> pulumi.Input[bool]:
        """
        A Whether CloudFront adds the `Server-Timing` header to HTTP responses that it sends in response to requests that match a cache behavior that's associated with this response headers policy.
        """
        return pulumi.get(self, "enabled")

    @enabled.setter
    def enabled(self, value: pulumi.Input[bool]):
        pulumi.set(self, "enabled", value)

    @property
    @pulumi.getter(name="samplingRate")
    def sampling_rate(self) -> pulumi.Input[float]:
        """
        A number 0–100 (inclusive) that specifies the percentage of responses that you want CloudFront to add the Server-Timing header to. Valid range: Minimum value of 0.0. Maximum value of 100.0.
        """
        return pulumi.get(self, "sampling_rate")

    @sampling_rate.setter
    def sampling_rate(self, value: pulumi.Input[float]):
        pulumi.set(self, "sampling_rate", value)


