1.35.1 — Provisioned node roles can run CDN delivery

2026-10-14

The node role that django-mojo provisioning writes now grants the CloudFront actions the new CDN delivery needs. Fleets provisioned by django-mojo can enable the CDN on the first try instead of seeing denied actions.

Fixed

• The provisioned node role carries a DjangoMojoFilemanCdn statement with the CloudFront actions that enabling, checking, disabling, invalidating and key rotation for CDN delivery use. Before, the role named no CloudFront action and enable_cdn run on a node was denied on every call.

Upgrade notes

• A fleet provisioned by mojo.deploy.provision picks the statement up on its next apply; the node role policy is rewritten whole, as always.
• A fleet whose node role was built elsewhere and narrowed is not touched by this. Add the CloudFront actions plus kms:GetKeyPolicy and kms:PutKeyPolicy on the media bucket's key to that role yourself; check_cdn names each missing action.