# CfnFieldLevelEncryptionConfigProps

Properties for defining a `CfnFieldLevelEncryptionConfig`.

Extends: CfnFieldLevelEncryptionConfigProps
Used as props by: CfnFieldLevelEncryptionConfig

- Source: Generated code
- Type last changed: v2.275.0 · 26 Oct 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cloudfront as cloudfront } from 'aws-cdk-lib';
const cfnFieldLevelEncryptionConfigProps: cloudfront.CfnFieldLevelEncryptionConfigProps = {
  callerReference: 'callerReference',
  contentTypeProfileConfig: {
    contentTypeProfiles: [{
      contentType: 'contentType',
      format: 'format',
      profileId: 'profileId',
    }],
    forwardWhenContentTypeIsUnknown: false,
  },
  queryArgProfileConfig: {
    forwardWhenQueryArgProfileIsUnknown: false,
    queryArgProfiles: [{
      profileId: 'profileId',
      queryArg: 'queryArg',
    }],
  },

  // the properties below are optional
  comment: 'comment',
};
```

## Properties

- `callerReference`: string (required) — A unique value that identifies the create request.

  Any string unique within the account works; CloudFront refuses to change it once set, so supplying a different value replaces the configuration. It is also the only value CloudFront returns that identifies a configuration as this stack's, so cleaning up after a failed create depends on the template keeping it.

- `comment`: string — An optional comment describing the field-level encryption configuration.

  CloudFront stores an omitted comment and an explicitly empty one identically as an empty string, and Read normalizes that empty string back to absent -- so omitting Comment round-trips, while asking for an empty string does not and would report perpetual drift. `minLength: 1` refuses the empty string at template validation; omission is the way to express no comment. The service documents a maximum of 128 characters, and `maxLength` moves that refusal from the API to template validation.

- `contentTypeProfileConfig`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnFieldLevelEncryptionConfig.ContentTypeProfileConfigProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CfnFieldLevelEncryptionConfig.ContentTypeProfileConfigProperty.html) (required) — How CloudFront handles content types, including the profile paired with each one.

- `queryArgProfileConfig`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnFieldLevelEncryptionConfig.QueryArgProfileConfigProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cloudfront.CfnFieldLevelEncryptionConfig.QueryArgProfileConfigProperty.html) (required) — How CloudFront handles query arguments, including the profile paired with each one.