{
  "additionalProperties" : false,
  "definitions" : {
    "Certificate" : {
      "additionalProperties" : false,
      "properties" : {
        "Arn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of the ACM certificate."
        }
      },
      "type" : "object",
      "description" : "The ACMlong (ACM) certificate associated with your distribution."
    },
    "Customizations" : {
      "additionalProperties" : false,
      "properties" : {
        "WebAcl" : {
          "$ref" : "#/definitions/WebAclCustomization",
          "description" : "The WAF web ACL."
        },
        "Certificate" : {
          "$ref" : "#/definitions/Certificate",
          "description" : "The ACMlong (ACM) certificate."
        },
        "GeoRestrictions" : {
          "$ref" : "#/definitions/GeoRestrictionCustomization",
          "description" : "The geographic restrictions."
        }
      },
      "type" : "object",
      "description" : "Customizations for the distribution tenant. For each distribution tenant, you can specify the geographic restrictions, and the Amazon Resource Names (ARNs) for the ACM certificate and WAF web ACL. These are specific values that you can override or disable from the multi-tenant distribution that was used to create the distribution tenant."
    },
    "DomainResult" : {
      "additionalProperties" : false,
      "properties" : {
        "Domain" : {
          "type" : "string",
          "description" : "The specified domain."
        },
        "Status" : {
          "type" : "string",
          "enum" : [ "active", "inactive" ],
          "description" : "Whether the domain is active or inactive."
        }
      },
      "type" : "object",
      "description" : "The details about the domain result."
    },
    "GeoRestrictionCustomization" : {
      "additionalProperties" : false,
      "properties" : {
        "RestrictionType" : {
          "enum" : [ "blacklist", "whitelist", "none" ],
          "type" : "string",
          "description" : "The method that you want to use to restrict distribution of your content by country:\n  +  ``none``: No geographic restriction is enabled, meaning access to content is not restricted by client geo location.\n  +  ``blacklist``: The ``Location`` elements specify the countries in which you don't want CloudFront to distribute your content.\n  +  ``whitelist``: The ``Location`` elements specify the countries in which you want CloudFront to distribute your content."
        },
        "Locations" : {
          "items" : {
            "type" : "string"
          },
          "type" : "array",
          "uniqueItems" : false,
          "description" : "The locations for geographic restrictions."
        }
      },
      "type" : "object",
      "description" : "The customizations that you specified for the distribution tenant for geographic restrictions."
    },
    "ManagedCertificateRequest" : {
      "additionalProperties" : false,
      "properties" : {
        "ValidationTokenHost" : {
          "enum" : [ "cloudfront", "self-hosted" ],
          "type" : "string",
          "description" : "Specify how the HTTP validation token will be served when requesting the CloudFront managed ACM certificate.\n  +  For ``cloudfront``, CloudFront will automatically serve the validation token. Choose this mode if you can point the domain's DNS to CloudFront immediately.\n  +  For ``self-hosted``, you serve the validation token from your existing infrastructure. Choose this mode when you need to maintain current traffic flow while your certificate is being issued. You can place the validation token at the well-known path on your existing web server, wait for ACM to validate and issue the certificate, and then update your DNS to point to CloudFront."
        },
        "PrimaryDomainName" : {
          "type" : "string",
          "description" : "The primary domain name associated with the CloudFront managed ACM certificate."
        },
        "CertificateTransparencyLoggingPreference" : {
          "enum" : [ "enabled", "disabled" ],
          "type" : "string",
          "description" : "You can opt out of certificate transparency logging by specifying the ``disabled`` option. Opt in by specifying ``enabled``. For more information, see [Certificate Transparency Logging](https://docs.aws.amazon.com/acm/latest/userguide/acm-concepts.html#concept-transparency) in the *User Guide*."
        }
      },
      "type" : "object",
      "description" : "An object that represents the request for the Amazon CloudFront managed ACM certificate."
    },
    "Parameter" : {
      "additionalProperties" : false,
      "properties" : {
        "Name" : {
          "type" : "string",
          "description" : "The parameter name."
        },
        "Value" : {
          "type" : "string",
          "description" : "The parameter value."
        }
      },
      "type" : "object",
      "description" : "A list of parameter values to add to the resource. A parameter is specified as a key-value pair. A valid parameter value must exist for any parameter that is marked as required in the multi-tenant distribution."
    },
    "Tag" : {
      "additionalProperties" : false,
      "properties" : {
        "Key" : {
          "type" : "string",
          "description" : "A string that contains ``Tag`` key.\n The string length should be between 1 and 128 characters. Valid characters include ``a-z``, ``A-Z``, ``0-9``, space, and the special characters ``_ - . : / = + @``."
        },
        "Value" : {
          "type" : "string",
          "description" : "A string that contains an optional ``Tag`` value.\n The string length should be between 0 and 256 characters. Valid characters include ``a-z``, ``A-Z``, ``0-9``, space, and the special characters ``_ - . : / = + @``."
        }
      },
      "required" : [ "Value", "Key" ],
      "type" : "object",
      "description" : "A complex type that contains ``Tag`` key and ``Tag`` value."
    },
    "WebAclCustomization" : {
      "additionalProperties" : false,
      "properties" : {
        "Action" : {
          "enum" : [ "override", "disable" ],
          "type" : "string",
          "description" : "The action for the WAF web ACL customization. You can specify ``override`` to specify a separate WAF web ACL for the distribution tenant. If you specify ``disable``, the distribution tenant won't have WAF web ACL protections and won't inherit from the multi-tenant distribution."
        },
        "Arn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of the WAF web ACL."
        }
      },
      "type" : "object",
      "description" : "The WAF web ACL customization specified for the distribution tenant."
    }
  },
  "description" : "The distribution tenant.",
  "handlers" : {
    "create" : {
      "permissions" : [ "acm:DescribeCertificate", "acm:RequestCertificate", "cloudfront:CreateDistributionTenant", "cloudfront:GetDistributionTenant", "cloudfront:GetManagedCertificateDetails", "cloudfront:TagResource", "cloudfront:VerifyDnsConfiguration", "wafv2:GetWebACL" ]
    },
    "delete" : {
      "permissions" : [ "cloudfront:DeleteDistributionTenant", "cloudfront:UpdateDistributionTenant", "cloudfront:GetDistributionTenant", "wafv2:GetWebACL" ]
    },
    "list" : {
      "permissions" : [ "cloudfront:ListDistributionTenants", "cloudfront:ListTagsForResource" ]
    },
    "read" : {
      "permissions" : [ "cloudfront:GetDistributionTenant", "cloudfront:ListTagsForResource" ]
    },
    "update" : {
      "permissions" : [ "acm:DescribeCertificate", "acm:RequestCertificate", "cloudfront:GetDistributionTenant", "cloudfront:GetManagedCertificateDetails", "cloudfront:UpdateDistributionTenant", "cloudfront:ListTagsForResource", "cloudfront:TagResource", "cloudfront:UntagResource", "cloudfront:VerifyDnsConfiguration", "wafv2:GetWebACL" ]
    }
  },
  "primaryIdentifier" : [ "/properties/Id" ],
  "properties" : {
    "Id" : {
      "type" : "string",
      "description" : ""
    },
    "DistributionId" : {
      "type" : "string",
      "description" : "The ID of the multi-tenant distribution."
    },
    "Name" : {
      "type" : "string",
      "description" : "The name of the distribution tenant."
    },
    "Arn" : {
      "type" : "string",
      "description" : ""
    },
    "DomainResults" : {
      "items" : {
        "$ref" : "#/definitions/DomainResult"
      },
      "type" : "array",
      "uniqueItems" : false,
      "description" : ""
    },
    "Tags" : {
      "items" : {
        "$ref" : "#/definitions/Tag"
      },
      "type" : "array",
      "uniqueItems" : false,
      "description" : "A complex type that contains zero or more ``Tag`` elements."
    },
    "Customizations" : {
      "$ref" : "#/definitions/Customizations",
      "description" : "Customizations for the distribution tenant. For each distribution tenant, you can specify the geographic restrictions, and the Amazon Resource Names (ARNs) for the ACM certificate and WAF web ACL. These are specific values that you can override or disable from the multi-tenant distribution that was used to create the distribution tenant."
    },
    "Parameters" : {
      "items" : {
        "$ref" : "#/definitions/Parameter"
      },
      "type" : "array",
      "uniqueItems" : false,
      "description" : "A list of parameter values to add to the resource. A parameter is specified as a key-value pair. A valid parameter value must exist for any parameter that is marked as required in the multi-tenant distribution."
    },
    "ConnectionGroupId" : {
      "type" : "string",
      "description" : "The ID of the connection group for the distribution tenant. If you don't specify a connection group, CloudFront uses the default connection group."
    },
    "CreatedTime" : {
      "format" : "date-time",
      "type" : "string",
      "description" : ""
    },
    "LastModifiedTime" : {
      "format" : "date-time",
      "type" : "string",
      "description" : ""
    },
    "Enabled" : {
      "type" : "boolean",
      "description" : "Indicates whether the distribution tenant is in an enabled state. If disabled, the distribution tenant won't serve traffic."
    },
    "Status" : {
      "type" : "string",
      "description" : ""
    },
    "ETag" : {
      "type" : "string",
      "description" : ""
    },
    "Domains" : {
      "items" : {
        "type" : "string"
      },
      "type" : "array",
      "uniqueItems" : false,
      "description" : "The domains associated with the distribution tenant."
    },
    "ManagedCertificateRequest" : {
      "$ref" : "#/definitions/ManagedCertificateRequest",
      "description" : "An object that represents the request for the Amazon CloudFront managed ACM certificate."
    }
  },
  "createOnlyProperties" : [ "/properties/Name" ],
  "readOnlyProperties" : [ "/properties/Id", "/properties/Arn", "/properties/DomainResults", "/properties/ETag", "/properties/Status", "/properties/CreatedTime", "/properties/LastModifiedTime" ],
  "required" : [ "DistributionId", "Name", "Domains" ],
  "writeOnlyProperties" : [ "/properties/ManagedCertificateRequest" ],
  "tagging" : {
    "cloudFormationSystemTags" : false,
    "permissions" : [ "cloudfront:TagResource", "cloudfront:ListTagsForResource", "cloudfront:UntagResource" ],
    "tagOnCreate" : true,
    "tagProperty" : "/properties/Tags",
    "tagUpdatable" : true,
    "taggable" : true
  },
  "typeName" : "AWS::CloudFront::DistributionTenant"
}