# CloudFront Object Structure (https://www.librechat.ai/docs/configuration/librechat_yaml/object_structure/cloudfront)

The `cloudfront` object configures CloudFront delivery for files stored in S3. It is required when `fileStrategy` or any `fileStrategies` entry uses `"cloudfront"`.

## Example

```yaml filename="cloudfront"
fileStrategies:
  avatar: 'cloudfront'
  image: 'cloudfront'
  document: 's3'

cloudfront:
  domain: 'https://cdn.example.com'
  distributionId: 'E1234ABCD'
  invalidateOnDelete: false
  imageSigning: 'cookies'
  cookieDomain: '.example.com'
  cookieExpiry: 1800
  urlExpiry: 3600
  storageRegion: 'us-east-2'
  includeRegionInPath: false
  requireSignedAccess: true
```

## Fields

<OptionTable
  options={[
    [
      'domain',
      'String',
      'CloudFront distribution domain or CNAME. Required.',
      'domain: "https://cdn.example.com"',
    ],
    [
      'distributionId',
      'String',
      'CloudFront distribution ID. Required when `invalidateOnDelete` is true.',
      'distributionId: "E1234ABCD"',
    ],
    [
      'invalidateOnDelete',
      'Boolean',
      'Creates a CloudFront invalidation after deleting the S3 object. Default: false.',
      'invalidateOnDelete: false',
    ],
    [
      'imageSigning',
      'String',
      'Inline media signing mode. Options: `"none"`, `"cookies"`, `"url"`. `"url"` is reserved and not implemented for images.',
      'imageSigning: "cookies"',
    ],
    [
      'urlExpiry',
      'Number',
      'Signed CloudFront download URL lifetime in seconds. Default: 3600.',
      'urlExpiry: 3600',
    ],
    [
      'cookieExpiry',
      'Number',
      'Signed cookie lifetime in seconds. Default: 1800. Maximum: 604800.',
      'cookieExpiry: 1800',
    ],
    [
      'cookieDomain',
      'String',
      'Shared parent domain for signed cookies. Required when `imageSigning` is `"cookies"`. Must start with a dot.',
      'cookieDomain: ".example.com"',
    ],
    [
      'storageRegion',
      'String',
      'Optional region label used in generated object keys when `includeRegionInPath` is true.',
      'storageRegion: "us-east-2"',
    ],
    [
      'includeRegionInPath',
      'Boolean',
      'Includes the storage region in newly generated object keys. Default: false.',
      'includeRegionInPath: false',
    ],
    [
      'requireSignedAccess',
      'Boolean',
      'Requires signed-cookie CloudFront access to initialize successfully at startup. Default: false.',
      'requireSignedAccess: true',
    ],
  ]}
/>

## Validation Rules

- `distributionId` is required when `invalidateOnDelete` is `true`.
- `cookieDomain` is required when `imageSigning` is `"cookies"`.
- `cookieDomain` must start with a dot, for example `.example.com`.
- `requireSignedAccess: true` requires `imageSigning: "cookies"`.

## Related Environment Variables

<OptionTable
  options={[
    [
      'CLOUDFRONT_KEY_PAIR_ID',
      'String',
      'CloudFront public key pair ID. Required for signed cookies and signed downloads.',
      '# CLOUDFRONT_KEY_PAIR_ID=K1234567890ABC',
    ],
    [
      'CLOUDFRONT_PRIVATE_KEY',
      'String',
      'CloudFront private key PEM. Required for signed cookies and signed downloads.',
      '# CLOUDFRONT_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\\n...\\n-----END RSA PRIVATE KEY-----"',
    ],
  ]}
/>

For deployment guidance, see [CloudFront with S3](/docs/configuration/cdn/cloudfront).