CloudFront Media Behavior Automation Web PHP v43

Built UTC: 2026-05-20T15:44:25Z

Goal

This is a portable PHP tool: unzip it anywhere PHP can run, update the password and credentials, then use the browser to configure CloudFront media caching and CORS.

Package files

This package intentionally contains only these files:

cloudfront-media-behavior-automation.php — main tool
cloudfront-tool-local-config.php — optional local AWS credential config
README.html — documentation
LICENSE.txt — MIT license

No index.php, no web.config, no Markdown files.

Quick start

Unzip the package anywhere PHP can run.
Open cloudfront-media-behavior-automation.php in your editor.
Edit the first PHP setting line, immediately after <?php: const TOOL_PASSWORD_DEFAULT = 'change-this-password-now';
Open cloudfront-tool-local-config.php and add AWS credentials, or leave placeholders and enter keys manually in the browser.
Open cloudfront-media-behavior-automation.php in your browser.
Click Load distributions.
Select the distributions you want.
Run Dry run.
If the dry run looks right, run Apply.

Launch URL example

http://localhost/beta/cloudfront-media-behavior-automation-web-php/cloudfront-media-behavior-automation.php

App password

In cloudfront-media-behavior-automation.php, set:

const TOOL_PASSWORD_DEFAULT = 'your-private-tool-password';

Optional local credential file

The tool uses exactly one local credential filename:

cloudfront-tool-local-config.php

Edit it on your trusted private machine:

<?php
return [
    'awsAccessKeyId' => 'REAL_AWS_ACCESS_KEY_ID_HERE',
    'awsSecretAccessKey' => 'REAL_AWS_SECRET_ACCESS_KEY_HERE',
    'awsSessionToken' => '',
];

You can also leave placeholders and enter keys manually in the browser.

What the tool automates

Creates or reuses:

MediaCacheLong1Year
PublicMediaCORSFromEverywhere
JsonNearFresh
DebugNoCache

Adds or updates media, JSON, and debug CloudFront behaviors on selected distributions.

Security

Use local config only on localhost/private IIS. Do not upload filled-in AWS credentials to public hosting or a public repository.

For shared or temporary hosting, enter AWS keys manually at run time, run the tool, delete the tool, and deactivate/delete the temporary AWS key.

v43 package rule

cloudfront-media-behavior-automation.php
cloudfront-tool-local-config.php
README.html
LICENSE.txt

Browser password saving

The tool uses a fixed username so Chrome and other password managers can save the tool password reliably:

cloudfront-media-tool

Do not change the username unless you also want the browser to treat it as a different saved login.