START HERE — CloudFront Media Behavior Automation PHP Tool

Purpose: This is a private web tool for updating CloudFront cache behavior rules and cache policies. This package includes the long-cache/event-invalidation model for generated directory JSON.

What this tool is for

Use this tool when you need to update CloudFront behavior/cache-policy configuration through a browser instead of manually editing every rule in the AWS Console.

The important policy in this package is:

JsonLong1YearEventInvalidated

That policy means generated JSON such as .directory-index.json can cache for 365 days, because the S3 updater Lambda invalidates CloudFront whenever S3 changes.

Where every important file goes

Step 1 — Put the PHP tool somewhere private

1. Unzip this package on the machine/server where PHP runs.
2. Put the folder cloudfront-media-behavior-automation-web-php in a private/admin web directory.
3. Do not put it in s3://www.8k.art/beta/ if it contains real AWS credentials.
4. Confirm PHP is working by opening the tool URL in your browser.

Step 2 — Set a tool password before using it

Open:

cloudfront-media-behavior-automation.php

Near the top, change:

const TOOL_PASSWORD_DEFAULT = 'change-this-password-now';

to a private password you will remember or store safely. Alternative: set an environment variable named:

CF_TOOL_PASSWORD

Step 3 — Decide how you will provide AWS credentials

Safer option: enter credentials in the browser only while using the tool

1. Leave cloudfront-tool-local-config.php with placeholders.
2. Open the PHP tool.
3. Paste AWS access key, secret key, and session token if needed into the form.
4. Run the tool.
5. Close the browser when finished.

Convenience option: local config file

1. Open cloudfront-tool-local-config.php.
2. Fill in awsAccessKeyId and awsSecretAccessKey.
3. Fill in awsSessionToken only if using temporary/session credentials.
4. Keep this file private.

Step 4 — Open the PHP tool

1. Open the private URL for cloudfront-media-behavior-automation.php.
2. Enter the tool password.
3. Enter AWS credentials if they are not in local config.
4. Click the button to load/list CloudFront distributions.
5. Choose the 8k.art CloudFront distribution.

Step 5 — Always dry run first

1. Click Dry Run first.
2. Read the RunLog.
3. Confirm it is targeting the intended 8k.art distribution.
4. Confirm it is creating/using JsonLong1YearEventInvalidated for generated directory JSON.
5. Confirm it is not trying to change the Default behavior unexpectedly.
6. Copy or download the RunLog before applying.

Step 6 — Apply only after the dry run looks correct

1. Click Apply.
2. Do not close the browser while it runs.
3. Watch the RunLog.
4. Download or copy the final RunLog.
5. Open AWS CloudFront and wait for the distribution deployment to complete.

Step 7 — Test after CloudFront deploys

1. Open https://8k.art/beta/.
2. Upload or overwrite a small test file in s3://www.8k.art/beta/.
3. Confirm the updater Lambda creates an invalidation.
4. Confirm the directory listing updates.
5. Confirm unchanged generated JSON/directory pages can still use long cache headers.

Do-not-do list

• Do not run Apply without a Dry Run.
• Do not use this tool from a public URL without password protection.
• Do not leave real AWS keys in a publicly accessible config file.
• Do not manually edit Default CloudFront behavior while testing this tool.
• Do not delete the distribution if a run fails. Stop and inspect the RunLog.

Final success condition

The CloudFront distribution has the expected cache behavior/policy rules.
Generated directory JSON uses JsonLong1YearEventInvalidated.
The S3 updater Lambda invalidates CloudFront when S3 changes.
https://8k.art/beta/ updates after uploads, overwrites, and deletes.