diff --git a/.projenrc.ts b/.projenrc.ts
index 3b28edc2..c0ba7208 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -34,10 +34,10 @@ import {
 	awscdk,
 	cdk8s,
 	DependencyType,
+	github,
 	javascript,
 	LogLevel,
 	type typescript,
-	github,
 } from 'projen'
 import { secretToString } from 'projen/lib/github/util'
 import { CdkTsAppCompileBuilder } from './projenrc/builders'
@@ -460,6 +460,33 @@ NxProject.ensure(pdfRendererConstruct).addBuildTargetFiles(
 	['{projectRoot}/assets'],
 )
 
+/**
+ * Cloudfront URL Rewrite Construct
+ */
+const cloudfrontUrlRewriteConstruct = AwsCdkTsConstructBuilder.build({
+	name: 'construct.awscdk.cloudfront-url-rewrite',
+	devDeps: ['@types/aws-lambda', 'esbuild'],
+	prettier: true,
+	jest: false,
+	unbuild: true,
+})
+// TODO: support unbuild array configs
+cloudfrontUrlRewriteConstruct.tasks
+	.tryFind('compile')!
+	.exec(
+		`esbuild --bundle src/handler.function.ts --format="esm" --target="node18" --platform="node" --outfile="dist/handler.function.mjs" --tsconfig="tsconfig.dev.json" --external:@aws-sdk/*`,
+	)
+cloudfrontUrlRewriteConstruct.package.file.addDeletionOverride('main')
+cloudfrontUrlRewriteConstruct.tasks.tryFind('docgen')?.reset?.()
+NxProject.ensure(cloudfrontUrlRewriteConstruct).addBuildTargetFiles(
+	[],
+	['{projectRoot}/assets'],
+)
+new Vitest(cloudfrontUrlRewriteConstruct)
+cloudfrontUrlRewriteConstruct.tasks
+	.tryFind('test')!
+	.prependSpawn(cloudfrontUrlRewriteConstruct.tasks.tryFind('compile')!)
+
 // Stacks
 const apiStack = AwsCdkTsAppBuilder.add(new CdkTsAppCompileBuilder()).build({
 	name: 'stacks.api',
diff --git a/package.json b/package.json
index ac092a4f..73c9be46 100644
--- a/package.json
+++ b/package.json
@@ -112,6 +112,7 @@
     "packages": [
       "packages/charts/crisiscleanup",
       "packages/config",
+      "packages/construct/awscdk/cloudfront-url-rewrite",
       "packages/construct/awscdk/github-pipeline",
       "packages/construct/awscdk/pdf-renderer",
       "packages/k8s/construct/api",
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.eslintrc.json b/packages/construct/awscdk/cloudfront-url-rewrite/.eslintrc.json
new file mode 100644
index 00000000..4a0018cb
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.eslintrc.json
@@ -0,0 +1,254 @@
+// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+{
+  "env": {
+    "jest": true,
+    "node": true
+  },
+  "root": true,
+  "plugins": [
+    "@typescript-eslint",
+    "import",
+    "prettier"
+  ],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 2018,
+    "sourceType": "module",
+    "project": "./tsconfig.dev.json",
+    "tsconfigRootDir": "."
+  },
+  "extends": [
+    "plugin:import/typescript",
+    "prettier",
+    "plugin:prettier/recommended",
+    "plugin:@typescript-eslint/recommended-requiring-type-checking"
+  ],
+  "settings": {
+    "import/parsers": {
+      "@typescript-eslint/parser": [
+        ".ts",
+        ".tsx"
+      ]
+    },
+    "import/resolver": {
+      "node": {
+        "extensions": [
+          ".js",
+          ".jsx",
+          ".mjs",
+          ".cjs",
+          ".ts",
+          ".tsx",
+          ".mts",
+          ".cts"
+        ]
+      },
+      "typescript": {
+        "project": "./tsconfig.dev.json",
+        "alwaysTryTypes": true
+      }
+    },
+    "import/extensions": [
+      ".js",
+      ".jsx",
+      ".mjs",
+      ".cjs",
+      ".ts",
+      ".tsx",
+      ".mts",
+      ".cts"
+    ]
+  },
+  "ignorePatterns": [
+    "*.js",
+    "*.d.ts",
+    "node_modules/",
+    "*.generated.ts",
+    "coverage",
+    ".eslintrc.json",
+    ".gitattributes",
+    ".gitignore",
+    ".prettierignore",
+    ".prettierrc.json",
+    ".projen/deps.json",
+    ".projen/files.json",
+    ".projen/tasks.json",
+    "LICENSE",
+    "project.json",
+    "tsconfig.dev.json",
+    "tsconfig.json",
+    ".eslintrc.json",
+    ".gitattributes",
+    ".gitignore",
+    ".prettierignore",
+    ".prettierrc.json",
+    ".projen/deps.json",
+    ".projen/files.json",
+    ".projen/tasks.json",
+    "LICENSE",
+    "project.json",
+    "tsconfig.dev.json",
+    "tsconfig.json"
+  ],
+  "rules": {
+    "prettier/prettier": [
+      "error"
+    ],
+    "@typescript-eslint/no-require-imports": [
+      "error"
+    ],
+    "import/no-extraneous-dependencies": [
+      "error",
+      {
+        "devDependencies": [
+          "**/test/**",
+          "**/build-tools/**"
+        ],
+        "optionalDependencies": false,
+        "peerDependencies": true
+      }
+    ],
+    "import/no-unresolved": [
+      "error"
+    ],
+    "import/order": [
+      "warn",
+      {
+        "groups": [
+          "builtin",
+          "external"
+        ],
+        "alphabetize": {
+          "order": "asc",
+          "caseInsensitive": true
+        }
+      }
+    ],
+    "no-duplicate-imports": [
+      "error"
+    ],
+    "no-shadow": [
+      "off"
+    ],
+    "@typescript-eslint/no-shadow": [
+      "error"
+    ],
+    "key-spacing": [
+      "off"
+    ],
+    "no-multiple-empty-lines": [
+      "off"
+    ],
+    "@typescript-eslint/no-floating-promises": [
+      "error"
+    ],
+    "no-return-await": [
+      "off"
+    ],
+    "@typescript-eslint/return-await": [
+      "error"
+    ],
+    "no-trailing-spaces": [
+      "off"
+    ],
+    "dot-notation": [
+      "error"
+    ],
+    "no-bitwise": [
+      "error"
+    ],
+    "@typescript-eslint/member-ordering": [
+      "error",
+      {
+        "default": [
+          "public-static-field",
+          "public-static-method",
+          "protected-static-field",
+          "protected-static-method",
+          "private-static-field",
+          "private-static-method",
+          "field",
+          "constructor",
+          "method"
+        ]
+      }
+    ],
+    "@typescript-eslint/consistent-type-definitions": [
+      "error",
+      "interface"
+    ],
+    "@typescript-eslint/consistent-type-imports": [
+      "error",
+      {
+        "prefer": "type-imports",
+        "fixStyle": "inline-type-imports"
+      }
+    ],
+    "import/no-duplicates": [
+      "error",
+      {
+        "prefer-inline": true
+      }
+    ],
+    "@typescript-eslint/no-explicit-any": [
+      "warn",
+      {
+        "fixToUnknown": false,
+        "ignoreRestArgs": true
+      }
+    ]
+  },
+  "overrides": [
+    {
+      "files": [
+        "test/**"
+      ],
+      "rules": {
+        "@typescript-eslint/require-await": [
+          "warn"
+        ]
+      }
+    },
+    {
+      "files": [
+        "build.config.ts"
+      ],
+      "rules": {
+        "import/no-extraneous-dependencies": [
+          "off"
+        ]
+      }
+    },
+    {
+      "files": [
+        "build.config.ts"
+      ],
+      "rules": {
+        "import/order": [
+          "off"
+        ]
+      }
+    },
+    {
+      "files": [
+        "vitest.config.ts",
+        "test/**/*.spec.ts"
+      ],
+      "rules": {
+        "import/no-extraneous-dependencies": [
+          "off"
+        ]
+      }
+    },
+    {
+      "files": [
+        "vitest.config.ts"
+      ],
+      "rules": {
+        "import/order": [
+          "off"
+        ]
+      }
+    }
+  ]
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.gitattributes b/packages/construct/awscdk/cloudfront-url-rewrite/.gitattributes
new file mode 100644
index 00000000..ed109aa6
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.gitattributes
@@ -0,0 +1,22 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+
+/.eslintrc.json linguist-generated
+/.gitattributes linguist-generated
+/.gitignore linguist-generated
+/.npmignore linguist-generated
+/.npmrc linguist-generated
+/.prettierignore linguist-generated
+/.prettierrc.json linguist-generated
+/.projen/** linguist-generated
+/.projen/deps.json linguist-generated
+/.projen/files.json linguist-generated
+/.projen/tasks.json linguist-generated
+/API.md linguist-generated
+/build.config.ts linguist-generated
+/LICENSE linguist-generated
+/package.json linguist-generated
+/pnpm-lock.yaml linguist-generated
+/project.json linguist-generated
+/tsconfig.dev.json linguist-generated
+/tsconfig.json linguist-generated
+/vitest.config.ts linguist-generated
\ No newline at end of file
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.gitignore b/packages/construct/awscdk/cloudfront-url-rewrite/.gitignore
new file mode 100644
index 00000000..a178f556
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.gitignore
@@ -0,0 +1,49 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+!/.gitattributes
+!/.projen/tasks.json
+!/.projen/deps.json
+!/.projen/files.json
+!/package.json
+!/LICENSE
+!/.npmignore
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+pids
+*.pid
+*.seed
+*.pid.lock
+lib-cov
+coverage
+*.lcov
+.nyc_output
+build/Release
+node_modules/
+jspm_packages/
+*.tsbuildinfo
+.eslintcache
+*.tgz
+.yarn-integrity
+.cache
+!/.projenrc.js
+!/.prettierignore
+!/.prettierrc.json
+!/.npmrc
+!/test/
+!/src/
+/dist
+/dist/
+!/.eslintrc.json
+.jsii
+tsconfig.json
+!/API.md
+dist-types
+!/tsconfig.json
+!/tsconfig.dev.json
+!/build.config.ts
+!/project.json
+!/vitest.config.ts
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.npmignore b/packages/construct/awscdk/cloudfront-url-rewrite/.npmignore
new file mode 100644
index 00000000..927ad667
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.npmignore
@@ -0,0 +1,17 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+/.projen/
+/test/
+/src/
+!/dist/
+!/dist/**/*.js
+!/dist/**/*.d.ts
+dist
+/.github/
+/.vscode/
+/.idea/
+/.projenrc.js
+tsconfig.tsbuildinfo
+/.eslintrc.json
+!.jsii
+/tsconfig.json
+/tsconfig.dev.json
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.prettierignore b/packages/construct/awscdk/cloudfront-url-rewrite/.prettierignore
new file mode 100644
index 00000000..2c084622
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.prettierignore
@@ -0,0 +1,13 @@
+# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+.eslintrc.json
+.gitattributes
+.gitignore
+.prettierignore
+.prettierrc.json
+.projen/deps.json
+.projen/files.json
+.projen/tasks.json
+LICENSE
+project.json
+tsconfig.dev.json
+tsconfig.json
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.prettierrc.json b/packages/construct/awscdk/cloudfront-url-rewrite/.prettierrc.json
new file mode 100644
index 00000000..7afe062b
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.prettierrc.json
@@ -0,0 +1,7 @@
+{
+  "overrides": [],
+  "singleQuote": true,
+  "semi": false,
+  "useTabs": true,
+  "tabWidth": 2
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.projen/deps.json b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/deps.json
new file mode 100644
index 00000000..72e0ed86
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/deps.json
@@ -0,0 +1,129 @@
+{
+  "dependencies": [
+    {
+      "name": "@arroyodev-llc/utils.unbuild-composite-preset",
+      "type": "build"
+    },
+    {
+      "name": "@types/aws-lambda",
+      "type": "build"
+    },
+    {
+      "name": "@types/node",
+      "version": "^18",
+      "type": "build"
+    },
+    {
+      "name": "@typescript-eslint/eslint-plugin",
+      "version": "^6",
+      "type": "build"
+    },
+    {
+      "name": "@typescript-eslint/parser",
+      "version": "^6",
+      "type": "build"
+    },
+    {
+      "name": "aws-cdk-lib",
+      "version": "2.97.0",
+      "type": "build"
+    },
+    {
+      "name": "constructs",
+      "version": "10.2.70",
+      "type": "build"
+    },
+    {
+      "name": "esbuild",
+      "type": "build"
+    },
+    {
+      "name": "eslint-config-prettier",
+      "type": "build"
+    },
+    {
+      "name": "eslint-import-resolver-node",
+      "type": "build"
+    },
+    {
+      "name": "eslint-import-resolver-typescript",
+      "type": "build"
+    },
+    {
+      "name": "eslint-plugin-import",
+      "type": "build"
+    },
+    {
+      "name": "eslint-plugin-prettier",
+      "type": "build"
+    },
+    {
+      "name": "eslint",
+      "version": "^8",
+      "type": "build"
+    },
+    {
+      "name": "jsii-diff",
+      "type": "build"
+    },
+    {
+      "name": "jsii-docgen",
+      "type": "build"
+    },
+    {
+      "name": "jsii-pacmak",
+      "type": "build"
+    },
+    {
+      "name": "jsii-rosetta",
+      "version": "~5",
+      "type": "build"
+    },
+    {
+      "name": "jsii",
+      "version": "~5",
+      "type": "build"
+    },
+    {
+      "name": "lint-staged",
+      "type": "build"
+    },
+    {
+      "name": "npm-check-updates",
+      "version": "^16",
+      "type": "build"
+    },
+    {
+      "name": "prettier",
+      "type": "build"
+    },
+    {
+      "name": "projen",
+      "type": "build"
+    },
+    {
+      "name": "typescript",
+      "version": "~5.1",
+      "type": "build"
+    },
+    {
+      "name": "unbuild",
+      "type": "build"
+    },
+    {
+      "name": "vitest",
+      "type": "build"
+    },
+    {
+      "name": "aws-cdk-lib",
+      "version": "^2.97.0",
+      "type": "peer"
+    },
+    {
+      "name": "constructs",
+      "version": "^10.2.70",
+      "type": "peer"
+    }
+  ],
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.projen/files.json b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/files.json
new file mode 100644
index 00000000..cdc33c3c
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/files.json
@@ -0,0 +1,17 @@
+{
+  "files": [
+    ".eslintrc.json",
+    ".gitattributes",
+    ".gitignore",
+    ".prettierignore",
+    ".prettierrc.json",
+    ".projen/deps.json",
+    ".projen/files.json",
+    ".projen/tasks.json",
+    "LICENSE",
+    "project.json",
+    "tsconfig.dev.json",
+    "tsconfig.json"
+  ],
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/.projen/tasks.json b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/tasks.json
new file mode 100644
index 00000000..f2db1f82
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/.projen/tasks.json
@@ -0,0 +1,221 @@
+{
+  "tasks": {
+    "build": {
+      "name": "build",
+      "description": "Full release build",
+      "steps": [
+        {
+          "spawn": "pre-compile"
+        },
+        {
+          "spawn": "compile"
+        },
+        {
+          "spawn": "post-compile"
+        },
+        {
+          "spawn": "test"
+        },
+        {
+          "spawn": "package"
+        }
+      ]
+    },
+    "clean": {
+      "name": "clean",
+      "steps": [
+        {
+          "exec": "pnpm exec tsc --build --clean"
+        },
+        {
+          "exec": "pnpm exec rimraf dist lib tsconfig.tsbuildinfo"
+        }
+      ]
+    },
+    "compat": {
+      "name": "compat",
+      "description": "Perform API compatibility check against latest version",
+      "steps": [
+        {
+          "exec": "jsii-diff npm:$(node -p \"require('./package.json').name\") -k --ignore-file .compatignore || (echo \"\nUNEXPECTED BREAKING CHANGES: add keys such as 'removed:constructs.Node.of' to .compatignore to skip.\n\" && exit 1)"
+        }
+      ]
+    },
+    "compile": {
+      "name": "compile",
+      "description": "Only compile",
+      "steps": [
+        {
+          "exec": "pnpm exec tsc --build --emitDeclarationOnly"
+        },
+        {
+          "exec": "pnpm exec unbuild",
+          "name": "Unbuild"
+        },
+        {
+          "exec": "esbuild --bundle src/handler.function.ts --format=\"esm\" --target=\"node18\" --platform=\"node\" --outfile=\"dist/handler.function.mjs\" --tsconfig=\"tsconfig.dev.json\" --external:@aws-sdk/*"
+        }
+      ]
+    },
+    "default": {
+      "name": "default",
+      "description": "Synthesize project files"
+    },
+    "docgen": {
+      "name": "docgen",
+      "description": "Generate API.md from .jsii manifest"
+    },
+    "eslint": {
+      "name": "eslint",
+      "description": "Runs eslint against the codebase",
+      "steps": [
+        {
+          "exec": "eslint --ext .ts,.tsx --fix --no-error-on-unmatched-pattern src test build-tools"
+        }
+      ]
+    },
+    "install": {
+      "name": "install",
+      "description": "Install project dependencies and update lockfile (non-frozen)",
+      "steps": [
+        {
+          "exec": "pnpm i --no-frozen-lockfile"
+        }
+      ]
+    },
+    "install:ci": {
+      "name": "install:ci",
+      "description": "Install project dependencies using frozen lockfile",
+      "steps": [
+        {
+          "exec": "pnpm i --frozen-lockfile"
+        }
+      ]
+    },
+    "package": {
+      "name": "package",
+      "description": "Creates the distribution package"
+    },
+    "package-all": {
+      "name": "package-all",
+      "description": "Packages artifacts for all target languages",
+      "steps": [
+        {
+          "spawn": "package:js"
+        }
+      ]
+    },
+    "package:js": {
+      "name": "package:js",
+      "description": "Create js language bindings",
+      "steps": [
+        {
+          "exec": "jsii-pacmak -v --target js"
+        }
+      ]
+    },
+    "post-compile": {
+      "name": "post-compile",
+      "description": "Runs after successful compilation",
+      "steps": [
+        {
+          "spawn": "docgen"
+        }
+      ]
+    },
+    "post-install": {
+      "name": "post-install",
+      "steps": [
+        {
+          "spawn": "stub"
+        }
+      ]
+    },
+    "post-upgrade": {
+      "name": "post-upgrade",
+      "description": "Runs after upgrading dependencies"
+    },
+    "pre-compile": {
+      "name": "pre-compile",
+      "description": "Prepare the project for compilation"
+    },
+    "stub": {
+      "name": "stub",
+      "steps": [
+        {
+          "exec": "pnpm exec unbuild --stub"
+        }
+      ],
+      "condition": "test -z \"$CI\""
+    },
+    "test": {
+      "name": "test",
+      "description": "Run tests",
+      "steps": [
+        {
+          "spawn": "compile"
+        },
+        {
+          "spawn": "eslint"
+        },
+        {
+          "exec": "vitest",
+          "args": [
+            "--run"
+          ],
+          "receiveArgs": true
+        }
+      ]
+    },
+    "test:watch": {
+      "name": "test:watch",
+      "description": "Run tests on changes.",
+      "steps": [
+        {
+          "exec": "vitest",
+          "receiveArgs": true
+        }
+      ]
+    },
+    "upgrade": {
+      "name": "upgrade",
+      "description": "upgrade dependencies",
+      "env": {
+        "CI": "0"
+      },
+      "steps": [
+        {
+          "exec": "pnpm update npm-check-updates"
+        },
+        {
+          "exec": "npm-check-updates --upgrade --target=minor --peer --dep=dev,peer,prod,optional --filter=@arroyodev-llc/utils.unbuild-composite-preset,@types/aws-lambda,@types/node,@typescript-eslint/eslint-plugin,@typescript-eslint/parser,esbuild,eslint-config-prettier,eslint-import-resolver-node,eslint-import-resolver-typescript,eslint-plugin-import,eslint-plugin-prettier,eslint,jsii-diff,jsii-docgen,jsii-pacmak,lint-staged,npm-check-updates,prettier,projen,unbuild,vitest,aws-cdk-lib,constructs"
+        },
+        {
+          "exec": "pnpm i --no-frozen-lockfile"
+        },
+        {
+          "exec": "pnpm update @arroyodev-llc/utils.unbuild-composite-preset @types/aws-lambda @types/node @typescript-eslint/eslint-plugin @typescript-eslint/parser esbuild eslint-config-prettier eslint-import-resolver-node eslint-import-resolver-typescript eslint-plugin-import eslint-plugin-prettier eslint jsii-diff jsii-docgen jsii-pacmak lint-staged npm-check-updates prettier projen unbuild vitest aws-cdk-lib constructs"
+        },
+        {
+          "exec": "npx projen"
+        },
+        {
+          "spawn": "post-upgrade"
+        }
+      ]
+    },
+    "watch": {
+      "name": "watch",
+      "description": "Watch & compile in the background",
+      "steps": [
+        {
+          "exec": "jsii -w --silence-warnings=reserved-word"
+        }
+      ]
+    }
+  },
+  "env": {
+    "PATH": "$(pnpm -c exec \"node --print process.env.PATH\")"
+  },
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/LICENSE b/packages/construct/awscdk/cloudfront-url-rewrite/LICENSE
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/README.md b/packages/construct/awscdk/cloudfront-url-rewrite/README.md
new file mode 100644
index 00000000..b3fa7ddc
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/README.md
@@ -0,0 +1 @@
+# replace this
\ No newline at end of file
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/build.config.ts b/packages/construct/awscdk/cloudfront-url-rewrite/build.config.ts
new file mode 100644
index 00000000..4ebfc75b
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/build.config.ts
@@ -0,0 +1,21 @@
+// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+
+import { compositePreset } from '@arroyodev-llc/utils.unbuild-composite-preset'
+import { defineBuildConfig } from 'unbuild'
+
+export default defineBuildConfig({
+	name: 'construct.awscdk.cloudfront-url-rewrite',
+	declaration: true,
+	clean: true,
+	entries: ['./src/index'],
+	sourcemap: true,
+	rollup: {
+		emitCJS: true,
+		cjsBridge: true,
+		esbuild: {
+			treeShaking: true,
+			sourcemap: true,
+		},
+	},
+	preset: compositePreset(),
+})
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/package.json b/packages/construct/awscdk/cloudfront-url-rewrite/package.json
new file mode 100644
index 00000000..4e31c1bb
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/package.json
@@ -0,0 +1,105 @@
+{
+  "name": "@crisiscleanup/construct.awscdk.cloudfront-url-rewrite",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CrisisCleanup/infrastructure"
+  },
+  "scripts": {
+    "build": "npx projen build",
+    "clean": "pnpm exec projen clean",
+    "compat": "npx projen compat",
+    "compile": "npx projen compile",
+    "default": "npx projen default",
+    "docgen": "npx projen docgen",
+    "eslint": "npx projen eslint",
+    "package": "npx projen package",
+    "package-all": "npx projen package-all",
+    "package:js": "npx projen package:js",
+    "post-compile": "npx projen post-compile",
+    "post-install": "npx projen post-install",
+    "post-upgrade": "npx projen post-upgrade",
+    "pre-compile": "npx projen pre-compile",
+    "stub": "npx projen stub",
+    "test": "npx projen test",
+    "test:watch": "npx projen test:watch",
+    "upgrade": "npx projen upgrade",
+    "watch": "npx projen watch"
+  },
+  "author": {
+    "name": "CrisisCleanup",
+    "url": "https://crisiscleanup.org",
+    "organization": true
+  },
+  "devDependencies": {
+    "@arroyodev-llc/utils.unbuild-composite-preset": "^0.1.3",
+    "@types/aws-lambda": "^8.10.122",
+    "@types/node": "^18",
+    "@typescript-eslint/eslint-plugin": "^6",
+    "@typescript-eslint/parser": "^6",
+    "aws-cdk-lib": "2.97.0",
+    "constructs": "10.2.70",
+    "esbuild": "^0.19.3",
+    "eslint": "^8",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-import-resolver-node": "^0.3.9",
+    "eslint-import-resolver-typescript": "^3.6.1",
+    "eslint-plugin-import": "^2.28.1",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jsii": "~5",
+    "jsii-diff": "^1.89.0",
+    "jsii-docgen": "^9.1.2",
+    "jsii-pacmak": "^1.89.0",
+    "jsii-rosetta": "~5",
+    "lint-staged": "^14.0.1",
+    "npm-check-updates": "^16",
+    "prettier": "^3.0.3",
+    "projen": "^0.73.31",
+    "typescript": "~5.1",
+    "unbuild": "^2.0.0",
+    "vitest": "^0.34.5"
+  },
+  "peerDependencies": {
+    "aws-cdk-lib": "^2.97.0",
+    "constructs": "^10.2.70"
+  },
+  "keywords": [
+    "cdk"
+  ],
+  "engines": {
+    "node": ">= 18.16.0"
+  },
+  "license": "Apache-2.0",
+  "version": "0.0.0",
+  "types": "./dist/index.d.ts",
+  "stability": "stable",
+  "jsii": {
+    "outdir": "dist",
+    "targets": {},
+    "tsc": {
+      "outDir": "dist",
+      "rootDir": "src"
+    }
+  },
+  "type": "module",
+  "sideEffects": true,
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "packageManager": "pnpm@9.2.0",
+  "lint-staged": {
+    "*.{ts,tsx,mts,cts,js,jsx,jts,jts}": [
+      "pnpm exec eslint --fix --no-error-on-unmatched-pattern"
+    ],
+    "*.{yaml,yml}": [
+      "pnpm exec prettier --write"
+    ]
+  },
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/project.json b/packages/construct/awscdk/cloudfront-url-rewrite/project.json
new file mode 100644
index 00000000..f7ed9ef1
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/project.json
@@ -0,0 +1,155 @@
+{
+  "name": "construct.awscdk.cloudfront-url-rewrite",
+  "root": "packages/construct/awscdk/cloudfront-url-rewrite",
+  "targets": {
+    "build": {
+      "inputs": [
+        "default",
+        "^default",
+        "!{projectRoot}/.jsii",
+        "!{projectRoot}/dist/**/*",
+        "!{projectRoot}/dist/**/*"
+      ],
+      "outputs": [
+        "{projectRoot}/.jsii",
+        "{projectRoot}/dist",
+        "{projectRoot}/assets"
+      ],
+      "dependsOn": [
+        "^build"
+      ],
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen build",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "default": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen default",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "pre-compile": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen pre-compile",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "compile": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen compile",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "post-compile": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen post-compile",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "test": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen test",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "package": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen package",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "post-upgrade": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen post-upgrade",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "upgrade": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen upgrade",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "watch": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen watch",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "eslint": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen eslint",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "compat": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen compat",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "package-all": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen package-all",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "package:js": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen package:js",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "docgen": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen docgen",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "stub": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen stub",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "post-install": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen post-install",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "test:watch": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen test:watch",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    },
+    "clean": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "pnpm exec projen clean",
+        "cwd": "packages/construct/awscdk/cloudfront-url-rewrite"
+      }
+    }
+  },
+  "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/src/cloudfront-url-rewrite.ts b/packages/construct/awscdk/cloudfront-url-rewrite/src/cloudfront-url-rewrite.ts
new file mode 100644
index 00000000..d7e09cd5
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/src/cloudfront-url-rewrite.ts
@@ -0,0 +1,75 @@
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'
+import * as origins from 'aws-cdk-lib/aws-cloudfront-origins'
+import { Construct } from 'constructs'
+import {
+	HandlerLambdaCloudFrontFunction,
+	type HandlerLambdaCloudFrontFunctionProps,
+} from './handler.cfn-function.ts'
+
+/**
+ * Represents the properties required to configure URL rewriting for CloudFront.
+ */
+export interface CloudFrontUrlRewriteProps {
+	/**
+	 * CloudFront distribution to which the URL rewrite will be applied.
+	 */
+	readonly distribution: cloudfront.Distribution
+	/**
+	 * Optional origin to use for the behavior.
+	 * @default - {@link cloudfront.IOrigin} with {@link fromHostname}
+	 */
+	readonly origin?: cloudfront.IOrigin
+	/**
+	 * Optional path for the behavior.
+	 * @default - '/*'
+	 */
+	readonly behaviorPath?: string
+	/**
+	 * The hostname to rewrite from.
+	 */
+	readonly fromHostname: string
+	/**
+	 * The hostname to rewrite to.
+	 */
+	readonly toHostname: string
+	/**
+	 * The redirect URI match pattern used for substitution.
+	 */
+	readonly redirectUriPattern: string
+	/**
+	 * Target URI pattern for substitution.
+	 */
+	readonly targetUriPattern: string
+	/**
+	 * Optional props for the function.
+	 */
+	readonly functionProps?: Partial<HandlerLambdaCloudFrontFunctionProps>
+}
+
+export class CloudFrontUrlRewrite extends Construct {
+	readonly distribution: cloudfront.Distribution
+	readonly origin: cloudfront.IOrigin
+
+	constructor(scope: Construct, id: string, props: CloudFrontUrlRewriteProps) {
+		super(scope, id)
+		this.distribution = props.distribution
+
+		const handler = new HandlerLambdaCloudFrontFunction(this, 'Handler', {
+			...(props.functionProps ?? {}),
+			fromHostname: props.fromHostname,
+			redirectUriPattern: props.redirectUriPattern,
+			targetUriPattern: props.targetUriPattern,
+			toHostname: props.toHostname,
+		})
+
+		this.origin = props.origin ?? new origins.HttpOrigin(props.fromHostname)
+		this.distribution.addBehavior(props.behaviorPath ?? '/*', this.origin, {
+			functionAssociations: [
+				{
+					function: handler,
+					eventType: cloudfront.FunctionEventType.VIEWER_REQUEST,
+				},
+			],
+		})
+	}
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.cfn-function.ts b/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.cfn-function.ts
new file mode 100644
index 00000000..8eb4827a
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.cfn-function.ts
@@ -0,0 +1,51 @@
+import fs from 'node:fs'
+import * as path from 'path'
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'
+import { type Construct } from 'constructs'
+
+/**
+ * Props for HandlerLambdaCloudFrontFunction
+ */
+export interface HandlerLambdaCloudFrontFunctionProps
+	extends Omit<cloudfront.FunctionProps, 'code'> {
+	/**
+	 * The hostname to rewrite from.
+	 */
+	readonly fromHostname: string
+	/**
+	 * The hostname to rewrite to.
+	 */
+	readonly toHostname: string
+	/**
+	 * The redirect URI match pattern used for substitution.
+	 */
+	readonly redirectUriPattern: string
+	/**
+	 * Target URI pattern for substitution.
+	 */
+	readonly targetUriPattern: string
+}
+
+/**
+ * An AWS CloudFront function which executes src/handler.lambda.ts.
+ */
+export class HandlerLambdaCloudFrontFunction extends cloudfront.Function {
+	constructor(
+		scope: Construct,
+		id: string,
+		props: HandlerLambdaCloudFrontFunctionProps,
+	) {
+		const filePath = path.join(__dirname, '../dist/handler.function.mjs')
+		const content = fs
+			.readFileSync(filePath, 'utf8')
+			.replace('<FROM_HOSTNAME>', props.fromHostname)
+			.replace('<TO_HOSTNAME>', props.toHostname)
+			.replace('<REDIRECT_URI_PATTERN>', props.redirectUriPattern)
+			.replace('<TARGET_URI_PATTERN>', props.targetUriPattern)
+		super(scope, id, {
+			comment: 'src/handler.lambda.ts',
+			...props,
+			code: cloudfront.FunctionCode.fromInline(content),
+		})
+	}
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.function.ts b/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.function.ts
new file mode 100644
index 00000000..d9a21c70
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/src/handler.function.ts
@@ -0,0 +1,27 @@
+import type { CloudFrontFunctionsEvent } from 'aws-lambda'
+
+const FROM_HOSTNAME = '<FROM_HOSTNAME>'
+const REDIRECT_URI_PATTERN = new RegExp('<REDIRECT_URI_PATTERN>', 'g')
+const TO_HOSTNAME = '<TO_HOSTNAME>'
+const TARGET_URI_PATTERN = '<TARGET_URI_PATTERN>'
+
+// eslint-disable-next-line @typescript-eslint/require-await,@typescript-eslint/no-unused-vars
+export async function handler(event: CloudFrontFunctionsEvent) {
+	const { request } = event
+	const { headers, uri } = request
+
+	const host = headers.host?.value
+	if (!host || host !== FROM_HOSTNAME) {
+		return request
+	}
+
+	const newUri = uri.replace(REDIRECT_URI_PATTERN, TARGET_URI_PATTERN)
+	const newUrl = `https://${TO_HOSTNAME}${newUri}`
+	return {
+		statusCode: 301,
+		statusDescription: 'Moved Permanently',
+		headers: {
+			location: { value: newUrl },
+		},
+	}
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/src/index.ts b/packages/construct/awscdk/cloudfront-url-rewrite/src/index.ts
new file mode 100644
index 00000000..dbc37732
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/src/index.ts
@@ -0,0 +1,5 @@
+export * from './cloudfront-url-rewrite'
+export {
+	type HandlerLambdaCloudFrontFunctionProps as CloudFrontRewriteFunctionProps,
+	HandlerLambdaCloudFrontFunction as CloudFrontRewriteFunction,
+} from './handler.cfn-function.ts'
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/test/__snapshots__/cloudfront-url-rewrite.spec.ts.snap b/packages/construct/awscdk/cloudfront-url-rewrite/test/__snapshots__/cloudfront-url-rewrite.spec.ts.snap
new file mode 100644
index 00000000..2d975278
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/test/__snapshots__/cloudfront-url-rewrite.spec.ts.snap
@@ -0,0 +1,147 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`CloudFrontUrlRewrite > should create a CloudFront distribution with the correct behavior 1`] = `
+{
+  "Parameters": {
+    "BootstrapVersion": {
+      "Default": "/cdk-bootstrap/hnb659fds/version",
+      "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]",
+      "Type": "AWS::SSM::Parameter::Value<String>",
+    },
+  },
+  "Resources": {
+    "MyDistribution6271DFB5": {
+      "Properties": {
+        "DistributionConfig": {
+          "CacheBehaviors": [
+            {
+              "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
+              "Compress": true,
+              "FunctionAssociations": [
+                {
+                  "EventType": "viewer-request",
+                  "FunctionARN": {
+                    "Fn::GetAtt": [
+                      "MyUrlRewriteHandlerC655E710",
+                      "FunctionARN",
+                    ],
+                  },
+                },
+              ],
+              "PathPattern": "/*",
+              "TargetOriginId": "TestStackMyDistributionOrigin2B54A80B9",
+              "ViewerProtocolPolicy": "allow-all",
+            },
+          ],
+          "DefaultCacheBehavior": {
+            "CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
+            "Compress": true,
+            "TargetOriginId": "TestStackMyDistributionOrigin1485E8085",
+            "ViewerProtocolPolicy": "allow-all",
+          },
+          "Enabled": true,
+          "HttpVersion": "http2",
+          "IPV6Enabled": true,
+          "Origins": [
+            {
+              "CustomOriginConfig": {
+                "OriginProtocolPolicy": "https-only",
+                "OriginSSLProtocols": [
+                  "TLSv1.2",
+                ],
+              },
+              "DomainName": "example.com",
+              "Id": "TestStackMyDistributionOrigin1485E8085",
+            },
+            {
+              "CustomOriginConfig": {
+                "OriginProtocolPolicy": "https-only",
+                "OriginSSLProtocols": [
+                  "TLSv1.2",
+                ],
+              },
+              "DomainName": "original.example.com",
+              "Id": "TestStackMyDistributionOrigin2B54A80B9",
+            },
+          ],
+        },
+      },
+      "Type": "AWS::CloudFront::Distribution",
+    },
+    "MyUrlRewriteHandlerC655E710": {
+      "Properties": {
+        "AutoPublish": true,
+        "FunctionCode": "// src/handler.function.ts
+var FROM_HOSTNAME = \\"original.example.com\\";
+var REDIRECT_URI_PATTERN = new RegExp(\\"^/oldpath/(.*)\\", \\"g\\");
+var TO_HOSTNAME = \\"new.example.com\\";
+var TARGET_URI_PATTERN = \\"/newpath/$1\\";
+async function handler(event) {
+  const { request } = event;
+  const { headers, uri } = request;
+  const host = headers.host?.value;
+  if (!host || host !== FROM_HOSTNAME) {
+    return request;
+  }
+  const newUri = uri.replace(REDIRECT_URI_PATTERN, TARGET_URI_PATTERN);
+  const newUrl = \`https://\${TO_HOSTNAME}\${newUri}\`;
+  return {
+    statusCode: 301,
+    statusDescription: \\"Moved Permanently\\",
+    headers: {
+      location: { value: newUrl }
+    }
+  };
+}
+export {
+  handler
+};
+",
+        "FunctionConfig": {
+          "Comment": "src/handler.lambda.ts",
+          "Runtime": "cloudfront-js-1.0",
+        },
+        "Name": {
+          "Fn::Join": [
+            "",
+            [
+              {
+                "Ref": "AWS::Region",
+              },
+              "TestStackMyUrlRewriteHandlerD49D13ED",
+            ],
+          ],
+        },
+      },
+      "Type": "AWS::CloudFront::Function",
+    },
+  },
+  "Rules": {
+    "CheckBootstrapVersion": {
+      "Assertions": [
+        {
+          "Assert": {
+            "Fn::Not": [
+              {
+                "Fn::Contains": [
+                  [
+                    "1",
+                    "2",
+                    "3",
+                    "4",
+                    "5",
+                  ],
+                  {
+                    "Ref": "BootstrapVersion",
+                  },
+                ],
+              },
+            ],
+          },
+          "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI.",
+        },
+      ],
+    },
+  },
+}
+`;
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/test/cloudfront-url-rewrite.spec.ts b/packages/construct/awscdk/cloudfront-url-rewrite/test/cloudfront-url-rewrite.spec.ts
new file mode 100644
index 00000000..a49aff5d
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/test/cloudfront-url-rewrite.spec.ts
@@ -0,0 +1,29 @@
+import { App, Stack } from 'aws-cdk-lib'
+import { Template } from 'aws-cdk-lib/assertions'
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'
+import * as origins from 'aws-cdk-lib/aws-cloudfront-origins'
+import { describe, expect, it } from 'vitest'
+import { CloudFrontUrlRewrite } from '../src/cloudfront-url-rewrite'
+
+describe('CloudFrontUrlRewrite', () => {
+	it('should create a CloudFront distribution with the correct behavior', () => {
+		const app = new App()
+		const stack = new Stack(app, 'TestStack')
+		const distribution = new cloudfront.Distribution(stack, 'MyDistribution', {
+			defaultBehavior: {
+				origin: new origins.HttpOrigin('example.com'),
+			},
+		})
+
+		new CloudFrontUrlRewrite(stack, 'MyUrlRewrite', {
+			distribution,
+			fromHostname: 'original.example.com',
+			toHostname: 'new.example.com',
+			redirectUriPattern: '^/oldpath/(.*)',
+			targetUriPattern: '/newpath/$1',
+		})
+
+		const template = Template.fromStack(stack)
+		expect(template.toJSON()).toMatchSnapshot()
+	})
+})
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.dev.json b/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.dev.json
new file mode 100644
index 00000000..296dba7a
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.dev.json
@@ -0,0 +1,17 @@
+// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {},
+  "include": [
+    ".projenrc.js",
+    "src/**/*.ts",
+    "test/**/*.ts",
+    "src/*.ts",
+    "*.ts",
+    "**/*.ts",
+    "vitest.config.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.json b/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.json
new file mode 100644
index 00000000..ac787254
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/tsconfig.json
@@ -0,0 +1,26 @@
+// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+{
+  "extends": [
+    "../../../../tsconfig/tsconfig.base.json",
+    "../../../../tsconfig/tsconfig.esm.json",
+    "../../../../tsconfig/tsconfig.bundler.json",
+    "../../../../tsconfig/tsconfig.composite.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "dist",
+    "declarationDir": "dist-types",
+    "tsBuildInfoFile": "tsconfig.tsbuildinfo"
+  },
+  "include": [
+    "src/*.ts",
+    "src/**/*.ts"
+  ],
+  "exclude": [],
+  "typedocOptions": {
+    "entryPoints": [
+      "src/index.ts"
+    ],
+    "useTsLinkResolution": true
+  }
+}
diff --git a/packages/construct/awscdk/cloudfront-url-rewrite/vitest.config.ts b/packages/construct/awscdk/cloudfront-url-rewrite/vitest.config.ts
new file mode 100644
index 00000000..7b44c7e6
--- /dev/null
+++ b/packages/construct/awscdk/cloudfront-url-rewrite/vitest.config.ts
@@ -0,0 +1,10 @@
+// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+
+import { defineProject } from 'vitest/config'
+
+export default defineProject({
+	test: {
+		name: 'construct.awscdk.cloudfront-url-rewrite',
+		include: ['test/**/*.spec.ts'],
+	},
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 42625283..d1c561bf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -351,6 +351,87 @@ importers:
         specifier: ^0.34.5
         version: 0.34.5(supports-color@9.4.0)
 
+  packages/construct/awscdk/cloudfront-url-rewrite:
+    devDependencies:
+      '@arroyodev-llc/utils.unbuild-composite-preset':
+        specifier: ^0.1.3
+        version: 0.1.3(unbuild@2.0.0(typescript@5.1.6))
+      '@types/aws-lambda':
+        specifier: ^8.10.122
+        version: 8.10.122
+      '@types/node':
+        specifier: ^18
+        version: 18.16.19
+      '@typescript-eslint/eslint-plugin':
+        specifier: ^6
+        version: 6.7.2(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint@8.47.0)(typescript@5.1.6)
+      '@typescript-eslint/parser':
+        specifier: ^6
+        version: 6.7.2(eslint@8.47.0)(typescript@5.1.6)
+      aws-cdk-lib:
+        specifier: 2.97.0
+        version: 2.97.0(constructs@10.2.70)
+      constructs:
+        specifier: 10.2.70
+        version: 10.2.70
+      esbuild:
+        specifier: ^0.19.3
+        version: 0.19.3
+      eslint:
+        specifier: ^8
+        version: 8.47.0
+      eslint-config-prettier:
+        specifier: ^9.0.0
+        version: 9.0.0(eslint@8.47.0)
+      eslint-import-resolver-node:
+        specifier: ^0.3.9
+        version: 0.3.9(supports-color@9.4.0)
+      eslint-import-resolver-typescript:
+        specifier: ^3.6.1
+        version: 3.6.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.28.1)(eslint@8.47.0)
+      eslint-plugin-import:
+        specifier: ^2.28.1
+        version: 2.28.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint-import-resolver-typescript@3.6.1)(eslint@8.47.0)
+      eslint-plugin-prettier:
+        specifier: ^5.0.0
+        version: 5.0.0(eslint-config-prettier@9.0.0(eslint@8.47.0))(eslint@8.47.0)(prettier@3.0.3)
+      jsii:
+        specifier: ~5
+        version: 5.1.10
+      jsii-diff:
+        specifier: ^1.89.0
+        version: 1.89.0
+      jsii-docgen:
+        specifier: ^9.1.2
+        version: 9.1.2(jsii-rosetta@5.1.7)
+      jsii-pacmak:
+        specifier: ^1.89.0
+        version: 1.89.0
+      jsii-rosetta:
+        specifier: ~5
+        version: 5.1.7
+      lint-staged:
+        specifier: ^14.0.1
+        version: 14.0.1(enquirer@2.4.1)(supports-color@9.4.0)
+      npm-check-updates:
+        specifier: ^16
+        version: 16.14.4(supports-color@9.4.0)
+      prettier:
+        specifier: ^3.0.3
+        version: 3.0.3
+      projen:
+        specifier: ^0.73.31
+        version: 0.73.31
+      typescript:
+        specifier: ~5.1
+        version: 5.1.6
+      unbuild:
+        specifier: ^2.0.0-rc.0
+        version: 2.0.0(typescript@5.1.6)
+      vitest:
+        specifier: ^0.34.5
+        version: 0.34.5(supports-color@9.4.0)
+
   packages/construct/awscdk/github-pipeline:
     dependencies:
       '@crisiscleanup/config':
@@ -1266,6 +1347,15 @@ packages:
       aws-cdk-lib: 2.97.0
       constructs: 10.2.70
 
+  '@aws-cdk/lambda-layer-kubectl-v30@2.0.0':
+    resolution:
+      {
+        integrity: sha512-yES6NfrJ3QV1372lAZ2FLXp/no4bqDWBXeSREJdrpWjQzD0wvL/hCpHEyjZrzHhOi27YbMxFTQ3g9isKAul8+A==,
+      }
+    peerDependencies:
+      aws-cdk-lib: 2.97.0
+      constructs: 10.2.70
+
   '@aws-crypto/crc32@3.0.0':
     resolution:
       {
@@ -1333,13 +1423,13 @@ packages:
         integrity: sha512-h3hNjcrSTbC4kuKWF/oCxL4J0ajD70cw7LSO4bk74qeuRsp4KybaPkadiEvRkEr/eoq6iOuQyr5toMdxreueyQ==,
       }
 
-  '@aws-quickstart/eks-blueprints@1.14.1':
+  '@aws-quickstart/eks-blueprints@1.15.1':
     resolution:
       {
-        integrity: sha512-4aWhst730xp812PwfTD2QvniGahrjoB1fBiWAAX/NzkPzejey9ZyuwhVrzcnqTucUCzwVuzI2K+xWy9ir1EM2A==,
+        integrity: sha512-Z0uGIpoPOes/1UpF+loQFb4ecW9F3UgDxoleLePxSiIH+kDTEyv0OVhk70KKHzT8epIRIzmrEvKr7v7IQYzzhw==,
       }
     peerDependencies:
-      aws-cdk: 2.133.0
+      aws-cdk: 2.147.3
       aws-cdk-lib: 2.97.0
 
   '@aws-sdk/client-eks@3.418.0':
@@ -1926,6 +2016,13 @@ packages:
       }
     engines: { node: '>=6.9.0' }
 
+  '@babel/helper-string-parser@7.24.7':
+    resolution:
+      {
+        integrity: sha512-7MbVt6xrwFQbunH2DNQsAP5sTGxfqQtErvBIvIMi6EQnbgUOuVYanvREcmFrOPhoXBrTtjhhP+lW+o5UfK+tDg==,
+      }
+    engines: { node: '>=6.9.0' }
+
   '@babel/helper-validator-identifier@7.22.20':
     resolution:
       {
@@ -1940,6 +2037,13 @@ packages:
       }
     engines: { node: '>=6.9.0' }
 
+  '@babel/helper-validator-identifier@7.24.7':
+    resolution:
+      {
+        integrity: sha512-rR+PBcQ1SMQDDyF6X0wxtG8QyLCgUB0eRAGguqRLfkCA87l7yAP7ehq8SNj96OOGTO8OBV70KhuFYcIkHXOg0w==,
+      }
+    engines: { node: '>=6.9.0' }
+
   '@babel/helper-validator-option@7.22.15':
     resolution:
       {
@@ -1991,6 +2095,14 @@ packages:
     engines: { node: '>=6.0.0' }
     hasBin: true
 
+  '@babel/parser@7.24.7':
+    resolution:
+      {
+        integrity: sha512-9uUYRm6OqQrCqQdG1iCBwBPZgN8ciDBro2nIOFaiRz1/BCxaI7CNvQbDHvsArAC7Tw9Hda/B3U+6ui9u4HWXPw==,
+      }
+    engines: { node: '>=6.0.0' }
+    hasBin: true
+
   '@babel/plugin-syntax-jsx@7.22.5':
     resolution:
       {
@@ -2074,6 +2186,13 @@ packages:
       }
     engines: { node: '>=6.9.0' }
 
+  '@babel/types@7.24.7':
+    resolution:
+      {
+        integrity: sha512-XEFXSlxiG5td2EJRe8vOmRbaXVgfcBlszKujvVmWIK/UpywWljQCfzAv3RQCGujWQ1RD4YYWEAqDXfuJiy8f5Q==,
+      }
+    engines: { node: '>=6.9.0' }
+
   '@cdklabs/cdk-validator-cfnguard@0.0.54':
     resolution:
       {
@@ -2872,13 +2991,6 @@ packages:
       }
     engines: { node: '>= 14.17.0' }
 
-  '@jsii/check-node@1.87.0':
-    resolution:
-      {
-        integrity: sha512-P4mhtFMwntFpqGNanp0L86bskuiNEw1TVKJzhemR3OK2vWb3IyYn1ZHc/o3Sn2xjpwX/OLwVhcuXOOcMFMQViQ==,
-      }
-    engines: { node: '>= 14.17.0' }
-
   '@jsii/check-node@1.89.0':
     resolution:
       {
@@ -4180,16 +4292,16 @@ packages:
         integrity: sha512-txGIh+0eDFzKGC25zORnswy+br1Ha7hj5cMVwKIU7+s0U2AxxJru/jZSMU6OC9MJWP6+pc/hc6ZjyZShpsyY2g==,
       }
 
-  '@types/uuid@9.0.4':
+  '@types/uuid@10.0.0':
     resolution:
       {
-        integrity: sha512-zAuJWQflfx6dYJM62vna+Sn5aeSWhh3OB+wfUEACNcqUSc0AGc5JKl+ycL1vrH7frGTXhJchYjE1Hak8L819dA==,
+        integrity: sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==,
       }
 
-  '@types/uuid@9.0.8':
+  '@types/uuid@9.0.4':
     resolution:
       {
-        integrity: sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==,
+        integrity: sha512-zAuJWQflfx6dYJM62vna+Sn5aeSWhh3OB+wfUEACNcqUSc0AGc5JKl+ycL1vrH7frGTXhJchYjE1Hak8L819dA==,
       }
 
   '@types/which@3.0.0':
@@ -6830,12 +6942,6 @@ packages:
       }
     engines: { node: '>= 0.4' }
 
-  get-tsconfig@4.6.2:
-    resolution:
-      {
-        integrity: sha512-E5XrT4CbbXcXWy+1jChlZmrmCwd5KGx502kDCXJJ7y898TtWW9FwoG5HfOLVRKmlmDGkWN2HM9Ho+/Y8F0sJDg==,
-      }
-
   get-tsconfig@4.7.2:
     resolution:
       {
@@ -7735,14 +7841,6 @@ packages:
     engines: { node: '>= 14.17.0' }
     hasBin: true
 
-  jsii-reflect@1.87.0:
-    resolution:
-      {
-        integrity: sha512-Gk+Kat0O/+OFw1Q85HEq1Beoc6o4lqWNp7v7wZKwLLs4JFrBGOu1cIurAwfk6sFaWD2R7q85jZKs3tEbPzZlrA==,
-      }
-    engines: { node: '>= 14.17.0' }
-    hasBin: true
-
   jsii-reflect@1.89.0:
     resolution:
       {
@@ -8848,13 +8946,6 @@ packages:
       }
     engines: { node: '>=12' }
 
-  oo-ascii-tree@1.87.0:
-    resolution:
-      {
-        integrity: sha512-AvQw3bQAiZrx1h4+LnK6s/AxhHv3cs/j4f4T+r+JOO++Qx3i0ZIf8h9/aG/O4byGQPWRKKwpjvV+74cxbJv+0g==,
-      }
-    engines: { node: '>= 14.17.0' }
-
   oo-ascii-tree@1.89.0:
     resolution:
       {
@@ -10788,10 +10879,10 @@ packages:
     engines: { node: '>=14.17' }
     hasBin: true
 
-  typescript@5.6.0-dev.20240619:
+  typescript@5.6.0-dev.20240703:
     resolution:
       {
-        integrity: sha512-sm/XGC2JAkC4NyslRNZhIyHOTEEcl3sY2bzaJ4mi1iz/wAH5nzOblREvminnB5lleWZhWxJiA+IgM0VBMdMmfA==,
+        integrity: sha512-AAOGWtykhMpxB4l+5CwojT2aBVAszalz9guzYaZMavmKHWxm3HciR+cIcKqDgR22hR7fPBJHtOti7uFCo4mt4A==,
       }
     engines: { node: '>=14.17' }
     hasBin: true
@@ -11585,6 +11676,10 @@ snapshots:
       ts-morph: 19.0.0
       type-fest: 4.3.1
 
+  '@arroyodev-llc/utils.unbuild-composite-preset@0.1.3(unbuild@2.0.0(typescript@5.1.6))':
+    dependencies:
+      unbuild: 2.0.0(typescript@5.1.6)
+
   '@arroyodev-llc/utils.unbuild-composite-preset@0.1.3(unbuild@2.0.0-rc.0(patch_hash=lulzlhanbemembpay2kcfiuibq)(supports-color@9.4.0)(typescript@5.1.6))':
     dependencies:
       unbuild: 2.0.0-rc.0(patch_hash=lulzlhanbemembpay2kcfiuibq)(supports-color@9.4.0)(typescript@5.1.6)
@@ -11652,10 +11747,15 @@ snapshots:
       aws-cdk-lib: 2.97.0(constructs@10.2.70)
       constructs: 10.2.70
 
+  '@aws-cdk/lambda-layer-kubectl-v30@2.0.0(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)':
+    dependencies:
+      aws-cdk-lib: 2.97.0(constructs@10.2.70)
+      constructs: 10.2.70
+
   '@aws-crypto/crc32@3.0.0':
     dependencies:
       '@aws-crypto/util': 3.0.0
-      '@aws-sdk/types': 3.418.0
+      '@aws-sdk/types': 3.598.0
       tslib: 1.14.1
 
   '@aws-crypto/ie11-detection@3.0.0':
@@ -11668,7 +11768,7 @@ snapshots:
       '@aws-crypto/sha256-js': 3.0.0
       '@aws-crypto/supports-web-crypto': 3.0.0
       '@aws-crypto/util': 3.0.0
-      '@aws-sdk/types': 3.418.0
+      '@aws-sdk/types': 3.598.0
       '@aws-sdk/util-locate-window': 3.310.0
       '@aws-sdk/util-utf8-browser': 3.259.0
       tslib: 1.14.1
@@ -11686,7 +11786,7 @@ snapshots:
   '@aws-crypto/sha256-js@3.0.0':
     dependencies:
       '@aws-crypto/util': 3.0.0
-      '@aws-sdk/types': 3.418.0
+      '@aws-sdk/types': 3.598.0
       tslib: 1.14.1
 
   '@aws-crypto/sha256-js@5.2.0':
@@ -11705,7 +11805,7 @@ snapshots:
 
   '@aws-crypto/util@3.0.0':
     dependencies:
-      '@aws-sdk/types': 3.418.0
+      '@aws-sdk/types': 3.598.0
       '@aws-sdk/util-utf8-browser': 3.259.0
       tslib: 1.14.1
 
@@ -11741,7 +11841,7 @@ snapshots:
       tslog: 4.9.2
       uuid: 9.0.1
       yaml: 2.3.2
-      zod: 3.22.2
+      zod: 3.23.8
     optionalDependencies:
       '@aws-cdk/lambda-layer-kubectl-v23': 2.0.8(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
       '@aws-cdk/lambda-layer-kubectl-v24': 2.0.242(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
@@ -11750,17 +11850,18 @@ snapshots:
       - encoding
       - supports-color
 
-  '@aws-quickstart/eks-blueprints@1.14.1(aws-cdk-lib@2.97.0(constructs@10.2.70))(aws-cdk@2.17.0)(encoding@0.1.13)':
+  '@aws-quickstart/eks-blueprints@1.15.1(aws-cdk-lib@2.97.0(constructs@10.2.70))(aws-cdk@2.17.0)(encoding@0.1.13)':
     dependencies:
       '@aws-cdk/lambda-layer-kubectl-v27': 2.1.0(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
       '@aws-cdk/lambda-layer-kubectl-v28': 2.2.0(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
       '@aws-cdk/lambda-layer-kubectl-v29': 2.1.0(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
+      '@aws-cdk/lambda-layer-kubectl-v30': 2.0.0(aws-cdk-lib@2.97.0(constructs@10.2.70))(constructs@10.2.70)
       '@aws-sdk/client-eks': 3.600.0
       '@aws-sdk/client-secrets-manager': 3.600.0
       '@types/assert': 1.5.10
       '@types/bcrypt': 5.0.2
       '@types/lodash.clonedeep': 4.5.9
-      '@types/uuid': 9.0.8
+      '@types/uuid': 10.0.0
       aws-cdk: 2.17.0
       aws-cdk-lib: 2.97.0(constructs@10.2.70)
       bcrypt: 5.1.1(encoding@0.1.13)
@@ -12622,7 +12723,7 @@ snapshots:
 
   '@babel/generator@7.22.10':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
       '@jridgewell/gen-mapping': 0.3.3
       '@jridgewell/trace-mapping': 0.3.18
       jsesc: 2.5.2
@@ -12673,12 +12774,12 @@ snapshots:
 
   '@babel/helper-function-name@7.22.5':
     dependencies:
-      '@babel/template': 7.22.5
-      '@babel/types': 7.22.10
+      '@babel/template': 7.22.15
+      '@babel/types': 7.22.19
 
   '@babel/helper-hoist-variables@7.22.5':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/helper-member-expression-to-functions@7.22.15':
     dependencies:
@@ -12690,7 +12791,7 @@ snapshots:
 
   '@babel/helper-module-imports@7.22.5':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/helper-module-transforms@7.22.20(@babel/core@7.22.20)':
     dependencies:
@@ -12734,7 +12835,7 @@ snapshots:
 
   '@babel/helper-simple-access@7.22.5':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/helper-skip-transparent-expression-wrappers@7.22.5':
     dependencies:
@@ -12742,14 +12843,18 @@ snapshots:
 
   '@babel/helper-split-export-declaration@7.22.6':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/helper-string-parser@7.22.5': {}
 
+  '@babel/helper-string-parser@7.24.7': {}
+
   '@babel/helper-validator-identifier@7.22.20': {}
 
   '@babel/helper-validator-identifier@7.22.5': {}
 
+  '@babel/helper-validator-identifier@7.24.7': {}
+
   '@babel/helper-validator-option@7.22.15': {}
 
   '@babel/helper-validator-option@7.22.5': {}
@@ -12758,7 +12863,7 @@ snapshots:
     dependencies:
       '@babel/template': 7.22.5
       '@babel/traverse': 7.22.10(supports-color@9.4.0)
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
     transitivePeerDependencies:
       - supports-color
 
@@ -12778,12 +12883,16 @@ snapshots:
 
   '@babel/parser@7.22.10':
     dependencies:
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/parser@7.22.16':
     dependencies:
       '@babel/types': 7.22.19
 
+  '@babel/parser@7.24.7':
+    dependencies:
+      '@babel/types': 7.24.7
+
   '@babel/plugin-syntax-jsx@7.22.5(@babel/core@7.22.20)':
     dependencies:
       '@babel/core': 7.22.20
@@ -12816,7 +12925,7 @@ snapshots:
     dependencies:
       '@babel/code-frame': 7.22.13
       '@babel/parser': 7.22.10
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
 
   '@babel/traverse@7.22.10(supports-color@9.4.0)':
     dependencies:
@@ -12827,7 +12936,7 @@ snapshots:
       '@babel/helper-hoist-variables': 7.22.5
       '@babel/helper-split-export-declaration': 7.22.6
       '@babel/parser': 7.22.10
-      '@babel/types': 7.22.10
+      '@babel/types': 7.22.19
       debug: 4.3.5(supports-color@9.4.0)
       globals: 11.12.0
     transitivePeerDependencies:
@@ -12860,6 +12969,12 @@ snapshots:
       '@babel/helper-validator-identifier': 7.22.20
       to-fast-properties: 2.0.0
 
+  '@babel/types@7.24.7':
+    dependencies:
+      '@babel/helper-string-parser': 7.24.7
+      '@babel/helper-validator-identifier': 7.24.7
+      to-fast-properties: 2.0.0
+
   '@cdklabs/cdk-validator-cfnguard@0.0.54(aws-cdk-lib@2.97.0(constructs@10.2.70))':
     dependencies:
       aws-cdk-lib: 2.97.0(constructs@10.2.70)
@@ -13189,11 +13304,6 @@ snapshots:
       chalk: 4.1.2
       semver: 7.5.4
 
-  '@jsii/check-node@1.87.0':
-    dependencies:
-      chalk: 4.1.2
-      semver: 7.5.4
-
   '@jsii/check-node@1.89.0':
     dependencies:
       chalk: 4.1.2
@@ -13209,7 +13319,7 @@ snapshots:
 
   '@kubecost/kubecost-eks-blueprints-addon@0.1.8(aws-cdk-lib@2.97.0(constructs@10.2.70))(encoding@0.1.13)':
     dependencies:
-      '@aws-quickstart/eks-blueprints': 1.14.1(aws-cdk-lib@2.97.0(constructs@10.2.70))(aws-cdk@2.17.0)(encoding@0.1.13)
+      '@aws-quickstart/eks-blueprints': 1.15.1(aws-cdk-lib@2.97.0(constructs@10.2.70))(aws-cdk@2.17.0)(encoding@0.1.13)
       aws-cdk: 2.17.0
       constructs: 10.2.70
     transitivePeerDependencies:
@@ -14210,9 +14320,9 @@ snapshots:
   '@types/triple-beam@1.3.2':
     optional: true
 
-  '@types/uuid@9.0.4': {}
+  '@types/uuid@10.0.0': {}
 
-  '@types/uuid@9.0.8': {}
+  '@types/uuid@9.0.4': {}
 
   '@types/which@3.0.0': {}
 
@@ -14429,7 +14539,7 @@ snapshots:
 
   '@vue/compiler-core@3.3.4':
     dependencies:
-      '@babel/parser': 7.22.16
+      '@babel/parser': 7.24.7
       '@vue/shared': 3.3.4
       estree-walker: 2.0.2
       source-map-js: 1.0.2
@@ -14441,7 +14551,7 @@ snapshots:
 
   '@vue/compiler-sfc@3.3.4':
     dependencies:
-      '@babel/parser': 7.22.16
+      '@babel/parser': 7.24.7
       '@vue/compiler-core': 3.3.4
       '@vue/compiler-dom': 3.3.4
       '@vue/compiler-ssr': 3.3.4
@@ -14459,7 +14569,7 @@ snapshots:
 
   '@vue/reactivity-transform@3.3.4':
     dependencies:
-      '@babel/parser': 7.22.16
+      '@babel/parser': 7.24.7
       '@vue/compiler-core': 3.3.4
       '@vue/shared': 3.3.4
       estree-walker: 2.0.2
@@ -15501,7 +15611,7 @@ snapshots:
     dependencies:
       semver: 7.5.4
       shelljs: 0.8.5
-      typescript: 5.6.0-dev.20240619
+      typescript: 5.6.0-dev.20240703
 
   duplexer@0.1.2: {}
 
@@ -15711,7 +15821,7 @@ snapshots:
       eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.7.2(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0)(typescript@5.1.6))(eslint-import-resolver-node@0.3.9(supports-color@9.4.0))(eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0)(typescript@5.1.6))(eslint-import-resolver-node@0.3.9(supports-color@9.4.0))(eslint-plugin-import@2.28.1)(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0))(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0)
       eslint-plugin-import: 2.28.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0)(typescript@5.1.6))(eslint-import-resolver-typescript@3.6.1)(eslint@8.47.0(supports-color@9.4.0))(supports-color@9.4.0)
       fast-glob: 3.3.1
-      get-tsconfig: 4.6.2
+      get-tsconfig: 4.7.2
       is-core-module: 2.13.0
       is-glob: 4.0.3
     transitivePeerDependencies:
@@ -15728,7 +15838,7 @@ snapshots:
       eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint-import-resolver-node@0.3.9)(eslint-plugin-import@2.28.1)(eslint@8.47.0))(eslint@8.47.0)
       eslint-plugin-import: 2.28.1(@typescript-eslint/parser@6.7.2(eslint@8.47.0)(typescript@5.1.6))(eslint-import-resolver-typescript@3.6.1)(eslint@8.47.0)
       fast-glob: 3.3.1
-      get-tsconfig: 4.6.2
+      get-tsconfig: 4.7.2
       is-core-module: 2.13.0
       is-glob: 4.0.3
     transitivePeerDependencies:
@@ -16244,10 +16354,6 @@ snapshots:
       call-bind: 1.0.2
       get-intrinsic: 1.2.1
 
-  get-tsconfig@4.6.2:
-    dependencies:
-      resolve-pkg-maps: 1.0.0
-
   get-tsconfig@4.7.2:
     dependencies:
       resolve-pkg-maps: 1.0.0
@@ -16764,12 +16870,12 @@ snapshots:
 
   jsii-docgen@9.1.2(jsii-rosetta@5.1.7):
     dependencies:
-      '@jsii/spec': 1.87.0
+      '@jsii/spec': 1.89.0
       case: 1.6.3
       fs-extra: 10.1.0
       glob: 8.1.0
       glob-promise: 6.0.3(glob@8.1.0)
-      jsii-reflect: 1.87.0
+      jsii-reflect: 1.89.0
       jsii-rosetta: 5.1.7
       semver: 7.5.4
       yargs: 16.2.0
@@ -16792,15 +16898,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  jsii-reflect@1.87.0:
-    dependencies:
-      '@jsii/check-node': 1.87.0
-      '@jsii/spec': 1.87.0
-      chalk: 4.1.2
-      fs-extra: 10.1.0
-      oo-ascii-tree: 1.87.0
-      yargs: 16.2.0
-
   jsii-reflect@1.89.0:
     dependencies:
       '@jsii/check-node': 1.89.0
@@ -17257,7 +17354,7 @@ snapshots:
     dependencies:
       citty: 0.1.2
       defu: 6.1.2
-      esbuild: 0.18.17
+      esbuild: 0.18.20
       fs-extra: 11.1.1
       globby: 13.2.2
       jiti: 1.19.1
@@ -17603,8 +17700,6 @@ snapshots:
     dependencies:
       mimic-fn: 4.0.0
 
-  oo-ascii-tree@1.87.0: {}
-
   oo-ascii-tree@1.89.0: {}
 
   open@8.4.2:
@@ -18746,7 +18841,7 @@ snapshots:
 
   typescript@5.1.6: {}
 
-  typescript@5.6.0-dev.20240619: {}
+  typescript@5.6.0-dev.20240703: {}
 
   ufo@1.1.2: {}
 
@@ -18995,7 +19090,7 @@ snapshots:
 
   vite@4.4.9(@types/node@18.16.19):
     dependencies:
-      esbuild: 0.18.17
+      esbuild: 0.18.20
       postcss: 8.4.30
       rollup: 3.29.3
     optionalDependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e54b25c2..850f7ff1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,6 +3,7 @@
 packages:
   - packages/charts/crisiscleanup
   - packages/config
+  - packages/construct/awscdk/cloudfront-url-rewrite
   - packages/construct/awscdk/github-pipeline
   - packages/construct/awscdk/pdf-renderer
   - packages/k8s/construct/api
diff --git a/tsconfig.json b/tsconfig.json
index 9b91f6d7..91edd8fd 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -37,6 +37,7 @@
     "entryPoints": [
       "./packages/charts/crisiscleanup",
       "./packages/config",
+      "./packages/construct/awscdk/cloudfront-url-rewrite",
       "./packages/construct/awscdk/github-pipeline",
       "./packages/construct/awscdk/pdf-renderer",
       "./packages/k8s/construct/api",
diff --git a/vitest.workspace.json b/vitest.workspace.json
index 8372e303..3109ec01 100644
--- a/vitest.workspace.json
+++ b/vitest.workspace.json
@@ -2,6 +2,7 @@
   "./packages/config/vitest.config.ts",
   "./packages/charts/crisiscleanup/vitest.config.ts",
   "./packages/construct/awscdk/github-pipeline/vitest.config.ts",
+  "./packages/construct/awscdk/cloudfront-url-rewrite/vitest.config.ts",
   "./packages/stacks/api/vitest.config.ts",
   "./packages/stacks/maintenance-site/vitest.config.ts",
   "./packages/stacks/web/vitest.config.ts"