Amazon CloudFront

What it is

Amazon CloudFront is AWS's CDN (Content delivery network)A network of servers in many locations that caches content close to users, so that pages, images, and video load faster and the origin server handles less traffic. Amazon CloudFront is the AWS CDN.Glossary entry (CDN). It speeds up delivery of static and dynamic web content, such as HTML, CSS, JavaScript, images, video, and API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, through a worldwide network of Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry. A user's request goes to the edge location with the lowest LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry. If the content is cached there, CloudFront returns it immediately; if not, it fetches it from the origin and caches it for the next request.

Choose CloudFront when a question asks to reduce latency for users around the world, offload traffic from an origin such as S3 or an ALB, cache content at the edge, or protect a web application at the edge with HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry, WAF, and DDoS (Distributed denial of service)An attack that floods an application or network with traffic from many sources at once, to make it unavailable to real users. AWS Shield Standard protects every AWS customer from common network-layer DDoS attacks at no extra cost.Glossary entry protection.

Concepts

Distribution: the CloudFront configuration, with its own domain name (or your custom domain).
Origins:
- Amazon S3 buckets.
- ALBs, EC2 instances, and any HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry server.
- VPC origins: ALBs, NLBs, and EC2 instances in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, so the origin needs no public exposure.
Origin groups provide origin FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry: a primary and a secondary origin. CloudFront switches to the secondary when the primary is unavailable or returns specific error codes.
Behaviors: settings per URL path pattern, such as /images/* or /api/*, each with its own origin and cache settings.
Caching:
- Cache policies control the cache key (which headers, cookies, and query strings make objects different) and TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry.
- Without a cache policy, the default TTL is 24 hours.
- When the origin sends Cache-Control: max-age (or Expires), CloudFront caches for that long, kept within the minimum and maximum TTL. When it sends neither, the default TTL applies. To keep a file fresh for exactly 5 minutes, have the origin send max-age=300.
- Include as little as possible in the cache key to raise the cache hit ratio.
Invalidations remove files from edge caches before they expire. For frequent updates, versioned file names (such as app.v2.js) are often better and cheaper.
Origin Shield: an extra caching layer in front of the origin that reduces origin load and cost.

Securing content

OAC (Origin access control)The recommended way to let a CloudFront distribution read from a private S3 bucket: CloudFront signs its requests, and the bucket policy allows only that distribution. It replaces the older origin access identity (OAI).Glossary entry (OAC) lets CloudFront sign requests to a private S3 bucket, so users can't bypass CloudFront to reach the bucket directly. OAC replaces the legacy origin access identity (OAI). OAC works only with the bucket's regular (REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry) endpoint; an S3 static website endpoint is a custom origin and can't use OAC.
Public ALB or custom origin: OAC doesn't apply. Allow only the AWS-managed prefix list for CloudFront origin-facing servers in the ALB's Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry, and have CloudFront add a secret custom header that the ALB's listener rules require. The prefix list alone also admits other customers' distributions. A VPC origin with an internal ALB removes public exposure entirely.
Signed URLs and signed cookies restrict private content to authorized users, using trusted key groups. Use a signed URL for one file, and signed cookies for many files, such as a subscriber's video library.
Geographic restrictions: an allow list or block list of countries.
HTTPS: the viewer protocol policy (allow HTTP and HTTPS, redirect HTTP to HTTPS, or HTTPS only) controls viewer connections, and the origin protocol policy (HTTP only, HTTPS only, or match viewer) controls connections to a custom origin. Set both to HTTPS for end-to-end encryption. For a custom domain, request or import the ACM certificate in US East (N. Virginia), us-east-1.
AWS WAF filters requests at the edge, and AWS Shield Standard protects against common DDoS attacks.
Field-level encryption encrypts specific sensitive form fields at the edge.

Viewers connect to a CloudFront distribution over HTTPS. CloudFront uses origin access control to sign every request to a private S3 bucket. The bucket keeps Block Public Access on, and its bucket policy allows only the service principal cloudfront.amazonaws.com when AWS:SourceArn is this distribution. Objects are encrypted with SSE-KMS, and the key policy lets the distribution use the key; the legacy origin access identity cannot read SSE-KMS objects. A direct request to the S3 bucket is denied with 403.

Edge functions

	CloudFront Functions	Lambda@Edge
Runtime	Lightweight JavaScript	Node.js or Python
Scale and speed	Sub-millisecond startup, millions of requests per second	More compute, longer running time
Use for	Header changes, URL rewrites and redirects, cache key normalization, simple auth checks	Complex logic, calling other services, changing origin responses
Deployed	Natively in CloudFront	Published in one AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry and replicated worldwide

Security, resilience, performance, and cost

Security

OAC or VPC origins keep origins private; WAF, Shield, signed URLs, geo restrictions, and HTTPS protect at the edge.

Resilience

Origin groups fail over between origins. Edge caching keeps serving cached content and absorbs traffic spikes.

Performance

Edge caching, Origin Shield, Gzip and Brotli compression, and HTTP/2 and HTTP/3 speed up delivery.

Cost

With pay-as-you-go pricing, you pay mainly for data transfer out to the internet and requests.
Price classes (Price Class 100, 200, or All) exclude the most expensive edge locations to lower cost. Viewers in excluded areas are still served, from the nearest included edge location, with higher latency.
Flat-rate pricing plans (Free, Pro, Business, and Premium) bundle CloudFront with AWS WAF, DDoS protection, Route 53 DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry, edge compute, and more for a monthly price with no overage charges.

Monitoring

CloudWatch metrics (requests, error rates, cache hit rate), standard and real-time logs, and reports in the console.

CloudFront or another option?

If the requirement is	Choose
Cache web content close to global users	Amazon CloudFront
Serve a private S3 bucket only through the CDN	CloudFront with origin access control
Paid content for subscribers only	CloudFront signed URLs or signed cookies
Static IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry and fast failover for TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry or UDP (User Datagram Protocol)A transport protocol that sends packets without setting up a connection or resending lost ones, trading reliability for low latency. DNS, video calls, and games often use it; Network Load Balancer and AWS Global Accelerator support UDP.Glossary entry applications	AWS Global Accelerator
Route users to the nearest Region with DNS	Route 53 latency-based routing
Upload files faster to an S3 bucket from far away	S3 Transfer Acceleration
Lower delivery cost when users are mostly in a few areas	A cheaper price class
Time-limited download link without edge caching	S3 Presigned URLA URL that lets anyone who has it download or upload one specific S3 object for a limited time, using the permissions of the identity that created it.Glossary entry

Reverse mindmap: when the question points here

Is it Amazon CloudFront?

Yes, when the question says
- Reduce latency for global users leads to CloudFront
- Offload static content from the origin leads to CloudFront caching
- Cache API responses at the edge leads to CloudFront with a cache policy
Secure it
- S3 bucket reachable only through CloudFront leads to Origin access control
- Origin in a private subnet leads to VPC origin
- Only paying users see videos leads to Signed URLs or signed cookies
- Block some countries leads to Geographic restrictions
- Custom domain with HTTPS leads to ACM certificate in us-east-1
- Send HTTP viewers to HTTPS leads to Viewer protocol policy: redirect
- Public ALB only through CloudFront leads to Managed prefix list plus secret custom header
- S3 website endpoint must become private leads to REST endpoint with OAC
- Block SQL injection at the edge leads to AWS WAF
Tune it
- Remove an old file now leads to Invalidation or versioned names
- Fewer requests to the origin leads to Origin Shield, better cache key
- Object must never be older than N minutes leads to Origin sends Cache-Control max-age
- Cut cost, users mostly in Europe and America leads to Price class
- Switch to a backup origin leads to Origin group failover
- Rewrite URLs at the edge, cheaply leads to CloudFront Functions
- Complex logic at the edge leads to Lambda@Edge
No, when the question says
- Static anycast IPs, non-HTTP leads to Global Accelerator

Key takeaways

CloudFront is a global CDN that caches content at edge locations and fetches misses from origins such as S3, ALBs, or private VPC origins.
Cache policies control the cache key and TTLs (24 hours by default without a policy); invalidate or version files to update them.
Use OAC to keep S3 origins private (REST endpoint, not website endpoint), signed URLs or cookies for private content, geo restrictions, HTTPS with an ACM certificate in us-east-1, and WAF.
Protect a public ALB origin with the CloudFront managed prefix list plus a secret custom header, or use a VPC origin.
Origin groups provide failover; Origin Shield reduces origin load.
CloudFront Functions handle lightweight edge logic; Lambda@Edge handles complex logic.