[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud CDN](../../index.md) > [Step-by-step guides](../index.md) > Resources > Creating a resource # Creating a resource To create a [resource](../../concepts/resource.md): {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a resource. 1. Navigate to **Cloud CDN**. 1. Click **Create resource**. 1. Configure the basic CDN resource settings: {% note tip %} You can use CDN resource settings from a configuration of another CDN resource. To do this, select an existing CDN resource in the **Copy a configuration** field. Keep in mind the following: * A domain name is unique within a single resource, i.e., you cannot create another resource with the same domain name. A configuration copy does not inherit the domain name. * You can copy settings only from a CDN resource residing within the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). * If the existing resource indicates `POST`, `PUT`, `PATCH`, or `DELETE` under **Allowed methods**, these methods will not be available to users of the new resource. To find out if you can use these methods, contact [support](https://center.yandex.cloud/support). When contacting, describe your use case. * If you uploaded a TLS certificate for the original resource, the system will re-use it in the new resource. You do not need to upload it again. {% endnote %} * Under **Content**: * Enable or disable **Enable access to content**. * In the **Content query** field, select `From one origin` or `From origin group`: * When requesting `From one origin` content, select the **Origin type**: `Server`, `Bucket`, or `L7 load balancer`, and specify the [origin](../../concepts/origins.md). * When requesting content `From origin group`, select an [origin group](../../concepts/origins.md#groups) or create a new one: 1. Click **Create**. 1. Specify **Group name**. 1. Configure **Origin**: * Specify the **Origin type**: `Server`, `Bucket`, or `L7 load balancer`. * Specify an origin. * Select the **Priority**: `Active` or `Backup`. 1. Add other origins if needed. 1. Click **Create**. In the **Origin group** field, you will see the name of the created origin group. For more information, see [Origins and origin groups](../../concepts/origins.md). * In the **Origin request protocol** field, select a protocol for the origins. * In the **Domain name** field, specify the primary domain name you will use in your website links to CDN-hosted content, e.g., `cdn.example.com`. You can add multiple **Domain names**. Names may include characters other than [ASCII](https://en.wikipedia.org/wiki/ASCII), e.g., Cyrillic or [Punycode](https://en.wikipedia.org/wiki/Punycode). The first name is considered the primary domain name. {% note alert %} You cannot change the primary domain name used for content distribution after creating a CDN resource. {% endnote %} * Optionally, add [labels](../../concepts/labels.md): 1. Click **Add label**. 1. Enter a label in `key: value` format. 1. Press **Enter**. * Under **Additional settings**: * In the **Redirect clients** field, select `Don't use` or `HTTPS to HTTP`. To enable redirecting clients from HTTP to HTTPS, create a CDN resource without a redirect and get a [TLS certificate](../../concepts/clients-to-servers-tls.md) for your domain name. Next, in the CDN resource settings, [select](configure-basics.md) the `HTTP to HTTPS` client redirect method. * In the **Certificate type** field, select one of the options: * `Don't use`: Resource will only be available over HTTP. * `Use from Certificate Manager`: Select a certificate. The resource will be available over HTTP and HTTPS. Certificates from [Yandex Certificate Manager](../../../certificate-manager/index.md) are supported. You can [issue a new Let's Encrypt® certificate](../../../certificate-manager/operations/managed/cert-create.md) or [upload one of your own](../../../certificate-manager/operations/import/cert-create.md). The certificate must be located in the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) as your CDN resource. [Learn more about configuring TLS certificates for HTTPS connections](../../concepts/clients-to-servers-tls.md). * In the **Host header** field, select the value (`Primary domain name` or `Match client`) or opt for `Custom` and enter the **Header value**. [Learn more about the `Host` header in CDN server requests to origins](../../concepts/servers-to-origins-host.md). * Optionally, to enable [request redirection](../../concepts/http-rewrite.md) on a CDN resource, do the following: 1. Enable **Redirect requests**. 1. In the **Rewrite rule** field, set a rule, e.g., `/(.*) /new-folder/$1`. A rewrite rule must contain two space-separated directives: the original path you need to replace, and the edited path, which replaces the original path. You can use regular expressions in the rule. For more information, see [Rewrite rule](../../concepts/http-rewrite.md#rewrite-rule). 1. In the **Flag** field, specify the required [flag](../../concepts/http-rewrite.md#flag): * `break`: Terminates the processing of the current set of directives. * `last`: Terminates the processing of the current set of directives and starts searching for a new CDN server that matches the new URI. * `redirect`: Returns a temporary `redirect` with the `302` status code to the user. This flag is used if the replacement string does not start with `http://`, `https://`, or `$scheme`. * `permanent`: Returns a permanent `redirect` with the `301` status code to the user. * Optionally, to restrict access to resource content with [secure tokens](../../concepts/secure-tokens.md), enable **Access via secure token**: * Specify a **Secret key** that is a string of 6 to 32 characters. You will need a secret key to generate [pre-signed URLs](../../concepts/secure-tokens.md#protected-link). You can view the secret key you saved in the management console or using the `yc cdn resource list` [CLI](../../../cli/index.md) command. * Use the **Limit access by IP address** field to restrict access to content by IP address: * `Only trusted IP addresses`: Access to files will be allowed only from a specific IP address of the content recipient. The IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a pre-signed URL. * `No restrictions`: Access to files will be allowed from any IP address. [Learn more about access via a secure token](enable-secure-token.md). * Optionally, to restrict access to resource content using an [IP-based access policy](../../concepts/ip-address-acl.md), enable **IP-based access**: * Select the type of access policy: * `Block all except`: ALLOW policy. Access to the resource content will be allowed for any IP addresses other than those specified below. * `Allow all except`: DENY policy. Access to the resource content will be denied for any IP addresses other than those specified below. * In the **List of IP addresses** field, specify the list of IP addresses [excluded](../../concepts/ip-address-acl.md#ip-list) from the above access policy. You must specify IP addresses with a subnet prefix in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) separated by commas. For example, `192.168.3.2/32, 192.168.17.0/24`. 1. Click **Continue**. 1. Optionally, under **Caching**, do the following: {% note tip %} You can configure these settings later, if required. {% endnote %} * Under **CDN**: * Enable **CDN caching**. * Select the setting type: `Same as origin` or `Custom settings`. * Select the cache lifetime from the list. * Optionally, for the `Custom settings` setting type, set the cache lifetime for the required HTTP response codes. * Under **Browser**: * Enable **Browser caching**. * Select the cache lifetime from the list. * Under **Additional settings**: * Select the option to ignore Cookies. * Select the option to ignore the Query parameters. * For CDN servers to compress content before sending it to clients, select **GZip**. The content will be sent in `gzip` format with the `Content-Encoding` HTTP header. From origins, only uncompressed content will be requested. [Learn more about file compression](enable-compression.md). * If you want files larger than 10 MB to be requested and cached in parts, each part no larger than 10 MB, select **Segmentation of large files**. For segmentation to work, content origins must support partial GET requests with the `Range` header. [Learn more about segmentation](enable-segmentation.md). [Learn more about caching](configure-caching.md). 1. Click **Continue**. 1. Under **HTTP headers and methods**: {% note tip %} You can configure these settings later, if required. {% endnote %} * Under **Origin request headers**: * In the **Header** field, click **Add**. * Enter names and values of the headers you need. * Under **Client response headers**: * In the **Header** field, click **Add**. * Enter names and values of the headers you need. [Learn more about configuring HTTP headers for requests and responses](configure-headers.md). * Under **CORS when responding to client requests**: * In the **Access-Control-Allow-Origin header** field, specify whether to add this header to responses. * When adding a header, select the values of the `Origin` header that allow access to the content. To grant access only to specific origins, select `Same as Origin if on the list`, specify the origin domain names and click **Add domain name**. [Learn more about configuring CORS for responses to clients](configure-cors.md). * Under **Client request methods**, select **Allowed methods** from the drop-down list. {% note info %} By default, the `POST`, `PUT`, `PATCH`, and `DELETE` methods are not available in client requests. To find out whether you can use these methods, contact [support](https://center.yandex.cloud/support). When contacting, describe your use case. {% endnote %} [Learn more about configuring HTTP methods](configure-http.md). * Optionally, under **Response settings**, set up the HTTP response. [Learn more about setting up an HTTP response](configure-response.md). 1. Click **Create and continue**. 1. Optionally, under **Advanced**, do the following: {% note tip %} You can configure these settings later, if required. {% endnote %} * Under **Log export settings**, enable log export. [Learn more about log export](configure-logs.md). * Under **Origin shielding settings**, enable shielding and select the location you need in the **Location** field. [Learn more about shielding](enable-shielding.md). 1. Click **Continue**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. View the description of the [CLI](../../../cli/index.md) command to create a resource: ```bash yc cdn resource create --help ``` 1. Get a list of [origin groups](../../concepts/origins.md#groups) in the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder): ```bash yc cdn origin-group list --format yaml ``` Result: ```text - id: "90209" folder_id: s0mefo1der7p******** name: test-group-1 use_next: true origins: - id: "561547" origin_group_id: "90209" source: www.example2.com enabled: true backup: true - id: "561546" origin_group_id: "90209" source: www.example1.com enabled: true - id: "90208" folder_id: b1g86q4m5ve******** name: test-group use_next: true origins: - id: "561545" origin_group_id: "90208" source: www.a2.com enabled: true backup: true - id: "561544" origin_group_id: "90208" source: www.a1.com enabled: true ``` 1. Create a resource: ```bash yc cdn resource create \ --origin-group-id \ --origin-protocol ``` * Instead of `--origin-group-id`, you can specify the [origin](../../concepts/origins.md) domain name using the `--origin-custom-source` flag. * The possible `--origin-protocol` values are `HTTP`, `HTTPS`, and `MATCH` (same as the client's). To configure a [TLS certificate](../../concepts/clients-to-servers-tls.md) for a CDN resource, use these parameters: * `--dont-use-ssl-cert`: Do not use a certificate. The resource will be available only over HTTP. * `--cert-manager-ssl-cert-id`: Certificate ID. The resource will be available over HTTP and HTTPS. Certificates from [Yandex Certificate Manager](../../../certificate-manager/index.md) are supported. You can [issue a new Let's Encrypt® certificate](../../../certificate-manager/operations/managed/cert-create.md) or [upload one of your own](../../../certificate-manager/operations/import/cert-create.md). The certificate must be located in the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) as your CDN resource. To enable [request redirects](../../concepts/http-rewrite.md) on a CDN resource, use these parameters: * `--rewrite-body`: Rewrite rule, e.g., `--rewrite-body '/(.*) /new-folder/$1'`. A rewrite rule must contain two space-separated directives: the original path you need to replace, and the edited path, which replaces the original path. You can use regular expressions in the rule. For more information, see [Rewrite rule](../../concepts/http-rewrite.md#rewrite-rule). * `--rewrite-flag`: [Flag](../../concepts/http-rewrite.md#flag). The possible values are: * `break`: Terminates the processing of the current set of directives. * `last`: Terminates the processing of the current set of directives and starts searching for a new CDN server that matches the new URI. * `redirect`: Returns a temporary `redirect` with the `302` status code to the user. This flag is used if the replacement string does not start with `http://`, `https://`, or `$scheme`. * `permanent`: Returns a permanent `redirect` with the `301` status code to the user. * To add [labels](../../concepts/labels.md), use the `--add-labels` parameter, e.g., `--add-labels key1=value1`. If you want to restrict access to resource content with [secure tokens](../../concepts/secure-tokens.md), use the following parameters: * `--secure-key`: Secret key, a string of 6 to 32 characters. * `--enable-ip-url-signing`: Optional parameter that restricts access to the CDN resource by IP address. The trusted IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a [pre-signed URL](../../concepts/secure-tokens.md#protected-link). If the parameter is not set, file access will be allowed from any IP address. For more information, see [Setting up access via a secure token](enable-secure-token.md). If you want to restrict access to resource content using an [IP address access policy](../../concepts/ip-address-acl.md), use the following parameters: * `--acl-excepted-values`: IP address for which access to the content will be allowed or denied. For the address, specify the subnet prefix in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation), e.g., `192.168.3.2/32` or `2a03:d000:2980:7::8/128`. You can only provide one IP address in the `--acl-excepted-values` parameter. To provide multiple addresses, set the `--acl-excepted-values` parameter for each address. * `--policy-type`: [Policy type](../../concepts/ip-address-acl.md#policy-type). The possible values are as follows: * `allow`: ALLOW policy. Access to the resource content will be allowed for any IP addresses other than those specified in the `--acl-excepted-values` parameter. * `deny`: DENY policy. Access to the resource content will be denied for any IP addresses other than those specified in the `--acl-excepted-values` parameter. For more information about the `yc cdn resource create` command, see the [CLI reference](../../../cli/cli-ref/cdn/cli-ref/resource/create.md). - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. 1. In the configuration file, describe the properties of the CDN resource to create: ```hcl resource "yandex_cdn_resource" "my_resource" { cname = "" active = true origin_protocol = "https" origin_group_id = secondary_hostnames = ["", "additional_domain_name_2"] provider_type = "" ssl_certificate { type = "certificate_manager" certificate_manager_id = "" } options { redirect_http_to_https = true secure_key = "" enable_ip_url_signing = true ip_address_acl { excepted_values = ["", "", ..., ""] policy_type = "" } } } ``` Where: * `cname`: Primary domain name used for content distribution. This is a required setting. * `active`: Flag for content availability to end users, where `true` means the CDN content is available to clients, and `false` means the content not available. The default value is `true`. This is an optional setting. * `origin_protocol`: Protocol for origins. The default value is `http`. This is an optional setting. * `origin_group_id`: [Origin group](../../concepts/origins.md) ID. This is a required setting. Use the ID from the description of the origin group in the `yandex_cdn_origin_group` resource. * `secondary_hostnames`: Additional domain names. This is an optional setting. * `provider_type`: CDN provider. This is an optional setting. The only possible value is `ourcdn`, the Yandex Cloud CDN provider. * `ssl_certificate`: SSL certificate parameters. This is an optional setting. The possible values are: * `type`: Certificate type. * `not_used`: Certificate is not used. This is a default value. * `certificate_manager`: Custom certificate. Specify the certificate ID in the `certificate_manager_id` parameter. Certificates from [Yandex Certificate Manager](../../../certificate-manager/index.md) are supported. You can [issue a new Let's Encrypt® certificate](../../../certificate-manager/operations/managed/cert-create.md) or [upload one of your own](../../../certificate-manager/operations/import/cert-create.md). The certificate must be located in the same [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) as your CDN resource. * `certificate_manager_id`: Custom certificate ID in Certificate Manager. * `options`: Additional parameters of the CDN resource. This is an optional setting. The possible values are: * `redirect_http_to_https`: Parameter to redirect clients from HTTP to HTTPS, `true` or `false`. This parameter is available if an SSL certificate is used. * `secure_key`: Secret key, that is a string of 6 to 32 characters, which is required to restrict access to a resource using [secure tokens](../../concepts/secure-tokens.md). * `enable_ip_url_signing`: Optional parameter that enables restricting access to a CDN resource by IP address using [secure tokens](../../concepts/secure-tokens.md). The trusted IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a [pre-signed URL](../../concepts/secure-tokens.md#protected-link). If the parameter is not set, file access will be allowed from any IP address. * `ip_address_acl`: [IP-based access policy](../../concepts/ip-address-acl.md) parameters: * `excepted_values`: [List of IP addresses](../../concepts/ip-address-acl.md#ip-list) allowed or denied access to the resource's content. Separate IP addresses by commas. For each address, specify the subnet prefix in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation), e.g., `192.168.3.2/32` or `2a03:d000:2980:7::8/128`. * `policy_type`: [Policy type](../../concepts/ip-address-acl.md#policy-type). The possible values are as follows: * `allow`: ALLOW policy. Access to the resource content will be allowed for any IP addresses other than those specified in the `ip_address_acl.excepted_values` parameter. * `deny`: DENY policy. Access to the resource content will be denied for any IP addresses other than those specified in the `ip_address_acl.excepted_values` parameter. {% note info %} Deleting the `secure_key` and `ip_address_acl` parameters in the configuration file will not automatically disable them. You can delete `secure_key` and `ip_address_acl` using the [CLI](../../../cli/quickstart.md) or [API](../../../api-design-guide/concepts/general.md). {% endnote %} For more on the properties of `yandex_cdn_resource` in Terraform, see [this provider guide](../../../terraform/resources/cdn_resource.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new CDN resource using the [management console](https://console.yandex.cloud) or this CLI command: ```bash yc cdn resource list ``` - API {#api} Use the [create](../../api-ref/Resource/create.md) REST API method for the [Resource](../../api-ref/Resource/index.md) resource or the [ResourceService/Create](../../api-ref/grpc/Resource/create.md) gRPC API call. You can restrict access to the resource with [secure tokens](../../concepts/secure-tokens.md) and an [IP-based access policy](../../concepts/ip-address-acl.md). {% endlist %} Wait until the resource is created. It may take up to 15 minutes. Once the CDN resource is created, [get](get-resources-info.md#get-cname) the CDN provider's domain name and create a [CNAME resource record](../../../dns/concepts/resource-record.md#cname) for the specified name in your DNS hosting settings, e.g., in [Yandex Cloud DNS](../../../dns/operations/resource-record-create.md). For more information, see [Domain names for content distribution](../../concepts/resource.md#hostnames). Sample resource record: ```text cdn.example.com. CNAME e1b83ae3********.topology.gslb.yccdn.ru ``` The new resource will start working properly after the CNAME record you created on your DNS hosting (see the section on [host names for content distribution](../../concepts/resource.md#hostnames)) gets propagated across the DNS servers. This may take a few hours. {% note info %} Do not use an [ANAME](../../../dns/concepts/resource-record.md#aname) resource record with domain names for content distribution; otherwise, the end user will get a response from a CDN server not linked to the user geolocation. The response will always be the same for all users. {% endnote %} ## Examples {#examples} {% list tabs group=instructions %} - CLI {#cli} Create a resource with HTTP: ```bash yc cdn resource create testexample.com \ --origin-group-id 90209 \ --origin-protocol HTTP ``` Result: ```text id: s0me1dkfjq******** ... cname: testexample.com active: true ... origin_group_id: "90209" origin_group_name: test-group-1 origin_protocol: HTTP ssl_certificate: type: DONT_USE status: READY ``` {% endlist %}