---
title: "1.35.1 — Provisioned node roles can run CDN delivery"
description: "The node role that django-mojo provisioning writes now grants the CloudFront actions the new CDN delivery needs. Fleets provisioned by django-mojo can enable the CDN on the first try instead of seeing denied actions."
date: "2026-10-14"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-35-1/"
---

The node role that django-mojo provisioning writes now grants the CloudFront actions the new CDN delivery needs. Fleets provisioned by django-mojo can enable the CDN on the first try instead of seeing denied actions.

### Fixed
- The provisioned node role carries a `DjangoMojoFilemanCdn` statement with the CloudFront actions that enabling, checking, disabling, invalidating and key rotation for CDN delivery use. Before, the role named no CloudFront action and `enable_cdn` run on a node was denied on every call.

### Upgrade notes
- A fleet provisioned by `mojo.deploy.provision` picks the statement up on its next `apply`; the node role policy is rewritten whole, as always.
- A fleet whose node role was built elsewhere and narrowed is not touched by this. Add the CloudFront actions plus `kms:GetKeyPolicy` and `kms:PutKeyPolicy` on the media bucket's key to that role yourself; `check_cdn` names each missing action.