Distribution.Builder.create(
        this,
        "CdnDistribution",
      )
        .defaultBehavior(
          BehaviorOptions.Builder()
            .origin(S3BucketOrigin.withOriginAccessControl(props.staticAssetsBucket))
            .viewerProtocolPolicy(ViewerProtocolPolicy.HTTPS_ONLY)
            .responseHeadersPolicy(noIndexHeaderPolicy())
            .build(),
        )
        .priceClass(if (props.appEnv.isProd)PriceClass.PRICE_CLASS_ALL else PriceClass.PRICE_CLASS_100)
        .certificate(props.certificate)
        .sslSupportMethod(SSLMethod.SNI)
        .minimumProtocolVersion(SecurityPolicyProtocol.TLS_V1_2_2021)
        .domainNames(aliases) 
        .enableLogging(true)
        .logBucket(logBucket)
        .logFilePrefix("cdn-cloudfront/")
        .logIncludesCookies(false)
        .webAclId(props.webAclId)
        .errorResponses(
          listOf(
            ErrorResponse.builder().httpStatus(500).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(501).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(502).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(503).ttl(Duration.minutes(10)).build(),
            ErrorResponse.builder().httpStatus(504).ttl(Duration.minutes(10)).build(),
          ),
        )
        .build()

suspend fun addOrUpdateBehavior(
    distributionId: String,
    functionArn: String,
    originDomainName: String,
    originPath: String,
    pathPattern: String,
    cachePolicyId: String,
    originRequestPolicyId: String,
  ) {
    val distConfigResp = clClient.getDistributionConfig {
      id = distributionId
    }

    val config = distConfigResp.distributionConfig!!
    val etag = distConfigResp.eTag!!

    val originId = "custom-${originDomainName.lowercase().replace(Regex("[^a-z0-9-]"), "-")}"

    val originExists = config.origins?.items?.any { it.id == originId } ?: false

    val newOrigins = if (!originExists) {
      logger.info { "Adding new origin $originId with domain $originDomainName and path $originPath" }
      val updatedItems = (config.origins?.items ?: emptyList()).toMutableList()
      updatedItems.add(
        Origin {
          id = originId
          domainName = originDomainName
          this.originPath = originPath
          customOriginConfig = CustomOriginConfig {
            httpPort = 80
            httpsPort = 443
            originProtocolPolicy = OriginProtocolPolicy.HttpsOnly
            originSslProtocols = OriginSslProtocols {
              quantity = 1
              items = listOf(SslProtocol.TlsV1_2)
            }
          }
        },
      )
      Origins {
        quantity = updatedItems.size
        items = updatedItems
      }
    } else {
      config.origins!!
    }

    val newBehavior = CacheBehavior {
      this.pathPattern = pathPattern
      this.targetOriginId = originId
      this.viewerProtocolPolicy = ViewerProtocolPolicy.RedirectToHttps
      this.allowedMethods = AllowedMethods {
        quantity = 2
        items = listOf(Method.Get, Method.Head)
        cachedMethods = CachedMethods {
          quantity = 2
          items = listOf(Method.Get, Method.Head)
        }
      }
      this.compress = true
      this.cachePolicyId = cachePolicyId
      this.originRequestPolicyId = originRequestPolicyId
      this.functionAssociations = FunctionAssociations {
        quantity = 1
        items = listOf(
          FunctionAssociation {
            eventType = EventType.ViewerRequest
            this.functionArn = functionArn
          },
        )
      }
    }

    val updatedBehaviors = config.cacheBehaviors?.items?.map {
      if (it.pathPattern == pathPattern) {
        logger.info { "Updating existing behavior for $pathPattern" }
        newBehavior
      } else {
        it
      }
    }?.toMutableList() ?: mutableListOf(newBehavior)

    // If not updated, add it
    if (updatedBehaviors.none { it.pathPattern == pathPattern }) {
      logger.info { "Adding new behavior for $pathPattern" }
      updatedBehaviors.add(newBehavior)
    } else {
      logger.info { "Behavior for $pathPattern already updated" }
    }

    val newConfig = config.copy {
      origins = newOrigins
      cacheBehaviors {
        quantity = updatedBehaviors.size
        items = updatedBehaviors
      }
    }

    clClient.updateDistribution {
      id = distributionId
      ifMatch = etag
      distributionConfig = newConfig
    }
  }

      logging = config.logging?.copy {
        enabled = config.logging?.enabled ?: false
        includeCookies = config.logging?.includeCookies ?: false
        bucket = config.logging?.bucket ?: ""
        prefix = config.logging?.prefix ?: ""
      }