feat(cloudfront): scaffold service + distributions, invalidations, tags

[vieiralucas]

Summary

First batch of CloudFront control-plane support: 29 ops covering distribution CRUD with ETag/If-Match concurrency, invalidations, tags, alias and web ACL associations, and the read-only "by predicate" listings. Adds the fakecloud-cloudfront crate, REST-XML routing, and a typed DistributionConfig model that round-trips origins, cache behaviors, custom error responses, viewer certificates, geo restrictions, and tenant config via quick-xml.

The remaining 138 CloudFront ops (OAC, cache/origin/response policies, Functions, key groups, OAIs, streaming distributions, field-level encryption, real-time logs, monitoring, VPC origins, anycast IP lists, trust stores, distribution tenants, connection groups/functions, resource policy) ship in subsequent batches.

Highlights

• Idempotent CallerReference enforcement returns DistributionAlreadyExists (matches AWS).
• UpdateDistribution/DeleteDistribution enforce If-Match; DeleteDistribution rejects enabled distributions with DistributionNotDisabled.
• CreateInvalidation returns Completed immediately so tests don't need to poll, consistent with how ECS/RDS lifecycles behave in fakecloud.
• cloudfront registered on its SigV4 service name and added to the REST-XML services list in fakecloud-core.
• aws-sdk-cloudfront wired into fakecloud-testkit behind sdk-clients.
• README, services index, and per-service cloudfront.md page are updated to reflect the new service and which surfaces remain for follow-up batches.

Test plan

• cargo test -p fakecloud-cloudfront — 15/15 unit tests
• cargo test -p fakecloud-e2e --test cloudfront — 6/6 SDK e2e (incl. complex DistributionConfig round-trip)
• cargo test -p fakecloud-conformance --test cloudfront — 14/14 SDK conformance pinned to Smithy checksums
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --check

---

Summary by cubic

Adds the first batch of CloudFront control-plane support (29 ops): distribution CRUD with ETag/If-Match, invalidations, tags, and alias/web ACL associations. Registers cloudfront as a REST-XML global service, adds fakecloud-cloudfront, updates tests/docs, and wires reset.

• New Features

  • Distribution lifecycle: create/get/update/delete with idempotent CallerReference; If-Match for update/delete; delete blocked when enabled.
  • Tags: CreateDistributionWithTags, ListTagsForResource, TagResource, UntagResource.
  • Invalidations: CreateInvalidation returns Completed immediately.
  • Read-only listings: by alias and by web ACL.
  • SDK/tests: add aws-sdk-cloudfront; 15 unit, 6 e2e, 14 conformance.
  • Docs: README, services index, and website page.

• Bug Fixes

  • Escape XML metacharacters in hand-built REST-XML responses; add xml_escape unit test.
  • Enforce CallerReference validation in CopyDistribution (reject empty).
  • Wire CloudFront into /_fakecloud/reset to clear per-service/per-account state; align with core response API via body_stream.
  • Remove conflicting --paths flag from the CloudFront CLI snippet in docs.

^{Written for commit dcf71ea. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 25 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/fakecloud-cloudfront/src/service.rs">

<violation number="1" location="crates/fakecloud-cloudfront/src/service.rs:466">
P2: `CopyDistribution` skips caller-reference validation, so it can create distributions with an empty `CallerReference` that other distribution write paths reject.</violation>

<violation number="2" location="crates/fakecloud-cloudfront/src/service.rs:879">
P1: Response XML includes unescaped user-provided fields, which can produce malformed XML for valid inputs containing XML metacharacters.</violation>
</file>

<file name="crates/fakecloud-server/src/main.rs">

<violation number="1" location="crates/fakecloud-server/src/main.rs:1956">
P2: CloudFront state is registered but not wired into reset handling, so reset endpoints won’t clear CloudFront resources.</violation>
</file>

<file name="website/content/docs/services/cloudfront.md">

<violation number="1" location="website/content/docs/services/cloudfront.md:61">
P2: The smoke-test `create-invalidation` command passes both `--paths` and `--invalidation-batch`, but these options are mutually exclusive in AWS CLI.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[codecov]

Codecov Report

❌ Patch coverage is 62.12664% with 634 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/fakecloud-cloudfront/src/service.rs	70.33%	350 Missing ⚠️
crates/fakecloud-cloudfront/src/router.rs	38.53%	260 Missing ⚠️
crates/fakecloud-server/src/reset.rs	20.00%	12 Missing ⚠️
crates/fakecloud-cloudfront/src/state.rs	50.00%	6 Missing ⚠️
crates/fakecloud-server/src/main.rs	0.00%	5 Missing ⚠️
crates/fakecloud-cloudfront/src/xml_io.rs	97.14%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!