- CloudFrontCdnProvider: PATHS/ALL batches -> CreateInvalidation with the
batch caller reference as CallerReference (idempotent), IN_PROGRESS with
the invalidation id; checkPurge -> GetInvalidation. TAG/HOST batches are
refused. Throttling, TooManyInvalidationsInProgress, 429/5xx and network
failures are retryable; AccessDenied, InvalidArgument, NoSuchDistribution
and other 4xx are permanent. No SDK-level retries.
- testConnection: GetDistributionConfig + ListInvalidations(MaxItems=1) to
prove IAM scope, optional GetDistribution for domain/status, reports
whether X-Origin-Verify is configured without reading out its value.
- importStats: CloudWatch GetMetricData (AWS/CloudFront, DistributionId +
Region=Global, daily) into the new spi CdnEdgeStat.
- readConfig + CloudFrontDriftCheck.compare against the tofu
expected_config output (docs/cloudfront-expected-config.md).
- Credentials: env vars <secretRef>_ACCESS_KEY_ID / _SECRET_ACCESS_KEY.
- Tests use a JDK HttpServer stub (WireMock cannot start: the QQQ BOM pins
Jetty 12) with hand-built fixtures; CloudWatch (RPC v2 CBOR) is mocked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
