cdn‐inv - uhop/dotfiles GitHub Wiki

cdn-inv

Resolve CloudFront distributions by domain alias and create invalidations. Thin bash wrapper over the aws cloudfront CLI — replaces the legacy v2-SDK JS gist with the same primitives the AWS CLI already exposes (server-side pagination, wait invalidation-completed, AWS_PROFILE/AWS_REGION env handling).

Usage

cdn-inv list                              # All distributions + aliases (default)
cdn-inv list --output tsv                 # Scriptable TSV
cdn-inv find www.example.com              # Resolve domain → distribution ID
cdn-inv invalidate www.example.com        # Invalidate /* and wait for completion
cdn-inv invalidate www.example.com /a /b  # Invalidate specific paths
cdn-inv invalidate www.example.com --no-wait

Profile selection follows the AWS CLI convention — invoke as AWS_PROFILE=X cdn-inv .... There is no --profile flag.

Commands

Command Description
list, ls, l List all distributions, their DomainName, Aliases, and Comment (default)
find, f <domain> Resolve a CNAME alias to its distribution ID; exits 1 if no exact-alias match
invalidate, inv, i <domain> [paths...] Create a CloudFront invalidation; waits for completion via aws cloudfront wait invalidation-completed (skip with --no-wait). Defaults to /* if no paths given

Options

Option Description
--output FMT list output format: table (default) or tsv
--no-wait invalidate: return as soon as the invalidation is created, don't block on completion
-n, --dry-run invalidate: resolve the distribution and print the would-be AWS calls without creating an invalidation. Useful for verifying the resolved distribution and path list before firing a real invalidation.

How alias resolution works

Both find and invalidate resolve a domain to a distribution ID via a single server-side query:

DistributionList.Items[?contains(Aliases.Items, '<domain>')].Id | [0]

aws cloudfront list-distributions paginates server-side before --query runs, so all distributions across the account are searched in one call. The [0] selector takes the first match — one alias per distribution is the common case. If the resolution returns nothing, cdn-inv exits 1 with No distribution found with alias: <domain>.

Blog deploy example

hugo
bin/optimize-images public/                          # imop variants + optimize
cxop -j0 --min-ratio=5 public/                       # text-compression siblings
aws s3 sync public/ s3://www.lazutkin.com/ --delete  # publish
cdn-inv invalidate www.lazutkin.com                  # bust the CF cache, wait

The wait step matters: returning early lets a subsequent step (smoke test, deploy notification, etc.) hit a stale CF response.

Profile handling

cdn-inv does not parse credentials — it just runs aws cloudfront ... and inherits whichever profile the calling shell has set:

AWS_PROFILE=blog cdn-inv invalidate www.lazutkin.com
AWS_PROFILE=client-x cdn-inv list

This matches aws CLI conventions, retires the per-tool credential shim from the legacy JS implementation, and keeps the script thin (~120 lines).

Why bash, not JS

The old JS gist (fb79b00d9cb12a9d451b9f18f6ffbb90) reimplemented three things the AWS CLI now provides directly:

  • A setInterval poll loop → aws cloudfront wait invalidation-completed.
  • A custom paginator over listDistributions → the CLI returns one JSON blob with all pages, ready for --query.
  • A credential-chain shim (getAWS.js) → native AWS_PROFILE / AWS_REGION env handling.

A v3-SDK port would still wrap the same calls in ~200 lines of imports + boilerplate. Bash + aws keeps cdn-inv ~120 lines and any change to AWS auth or pagination behavior comes for free with the next CLI update.

⚠️ **GitHub.com Fallback** ⚠️