Skip to main content

Amazon CloudFront

Amazon CloudFront is a global Content Delivery Network (CDN) service that securely delivers data, videos, applications, and APIs to your users with low latency and high transfer speeds.

1. Global Edge Network​

  • Edge Locations: CloudFront uses a network of edge locations distributed globally to cache content closer to users, reducing latency and improving load times.
  • Regional Edge Caches: Larger caching locations act as a buffer between the origin server and edge locations, further optimizing cache efficiency by retaining less frequently accessed content.

2. Content Delivery and Caching​

  • Static and Dynamic Content: CloudFront supports delivery of both static content (e.g., images, CSS files, JavaScript) and dynamic content (e.g., APIs, personalized content).
  • Caching Policies: CloudFront allows you to define cache behaviors for different URL patterns, controlling how long content is cached using Cache-Control headers from your origin or setting Time-to-Live (TTL) directly in CloudFront.

3. Caching and Performance​

  • Edge Caching: CloudFront caches copies of your content at edge locations, reducing the load on your origin servers and speeding up content delivery for end users.
  • Time to Live (TTL): You can configure caching behavior with the Time to Live (TTL) setting, specifying how long CloudFront should cache objects at each edge location. The cache can be configured for different types of content to optimize cache efficiency.
  • Dynamic Content: CloudFront can handle both static (e.g., images, CSS, JavaScript) and dynamic content (e.g., API responses), dynamically fetching updates from your origin while still optimizing performance.

4. Origins​

  • Multiple Origin Types: CloudFront can fetch content from various types of origins:
    • AWS Services: Like Amazon S3 (for static assets) or Amazon EC2/Elastic Load Balancing (for dynamic content).
    • Custom Origins: Your own HTTP servers running on-premises or in other clouds.
  • Origin Failover: You can configure failover origins, which allow CloudFront to automatically switch to a secondary origin if the primary origin is unavailable.
  • Origin Groups: You can create origin groups to set up origin failover, which automatically redirects requests to a secondary origin if the primary one fails, ensuring high availability.

5. Security Features​

  • HTTPS Support and SSL/TLS Termination: CloudFront supports HTTPS for secure delivery of content, allowing you to use SSL/TLS certificates managed by AWS Certificate Manager (ACM) or custom certificates.
  • Access Control:
    • Signed URLs and Cookies: Restrict access to content by generating signed URLs or cookies for authenticated users, useful for delivering private or premium content.
    • Origin Access Control (OAC): For S3 origins, you can use OAC (the newer way of restricting access) or Origin Access Identity (OAI) (legacy) to ensure that only CloudFront can fetch content from your S3 bucket, enhancing security.
    • Field-Level Encryption: This feature allows you to encrypt sensitive data (e.g., personal data, credit card information) at the field level in POST requests before forwarding them to your origin servers.
  • Origin Access Control (OAC): CloudFront can be configured to restrict access to Amazon S3 buckets using Origin Access Identity (OAI) or Origin Access Control (OAC). This ensures that content is only accessible via CloudFront and not directly from the origin.
  • AWS WAF Integration: Integrate CloudFront with AWS Web Application Firewall (WAF) to protect your applications from common web exploits, such as SQL injection and cross-site scripting.

6. Custom Error Pages​

  • You can configure CloudFront to return custom error pages (e.g., a branded 404 page) when certain HTTP status codes (e.g., 404 Not Found, 500 Internal Server Error) are returned from the origin. This improves user experience during failures or misconfigurations.

7. Content Versioning​

  • CloudFront caches content based on URLs. To update cached content, you should use content versioning (e.g., appending version numbers or timestamps to file names) or use cache invalidation to force CloudFront to fetch the updated content from the origin.

8. Cache Invalidation​

  • You can invalidate cache to force CloudFront to fetch the latest version of your content from the origin. This is useful when you make changes to content and need it to be updated across all edge locations.
  • Invalidation Costs: While the first 1,000 invalidation requests each month are free, additional invalidations incur charges.

9. Performance and Acceleration​

  • Content Optimization: CloudFront offers gzip and Brotli compression to reduce the size of assets delivered to clients, improving load times and reducing bandwidth costs.
  • Lambda@Edge and CloudFront Functions: Use Lambda@Edge to run serverless functions at CloudFront edge locations, enabling you to customize content, implement access control, rewrite URLs, and more. CloudFront Functions offer lightweight, low-latency JavaScript functions for simple HTTP request/response modifications.
  • Field-Level Encryption: Secure sensitive data like credit card information or PII by encrypting specific fields of your content while still caching other non-sensitive fields.

10. Support for HTTP/2, HTTP/3, and WebSocket​

  • CloudFront supports HTTP/2 for enhanced performance with multiplexed requests, header compression, and server push.
  • HTTP/3 Support: Provides improved performance and reliability over TCP, utilizing QUIC (Quick UDP Internet Connections) protocol.
  • WebSocket Support: Enables real-time, bi-directional communication between clients and servers, suitable for applications like chat apps or live updates.

11. Distribution Configuration and Management​

  • Distributions: A CloudFront distribution is a configuration that specifies how CloudFront should handle requests and cache content. You can set up:
    • Web Distributions: For delivering websites, APIs, and other HTTP/HTTPS content.
    • RTMP Distributions (Legacy): For streaming media over Adobe Real-Time Messaging Protocol (RTMP).
  • Behaviors: Within a distribution, you can define multiple behaviors to control how CloudFront handles requests for different parts of your application (e.g., different URL paths can use different origins, TTLs, or caching policies).

12. Geo-Restrictions and Geolocation​

  • Geo-Restriction (Geoblocking): CloudFront allows you to restrict access to content based on the geographic location of the viewer, enabling you to block or allow requests from specific countries.
  • Geolocation Headers: CloudFront provides geolocation headers that you can use to customize content based on the viewer's location, like showing different language options or regional promotions.

13. Lambda@Edge and CloudFront Functions​

  • Lambda@Edge: Allows you to run serverless code at CloudFront edge locations to customize content delivery. It supports use cases like URL rewriting, header manipulation, user authentication, and A/B testing.
  • CloudFront Functions: A lightweight, low-latency edge computing feature designed for simple, high-scale operations like header manipulation, URL redirection, and bot detection. These are cost-effective and operate at millisecond-level latency.

14. Monitoring, Logging, and Metrics​

  • CloudFront Access Logs: You can enable access logs to capture detailed information about every request served by CloudFront, which can be sent to an S3 bucket for analysis or auditing.
  • CloudFront Metrics in CloudWatch: CloudFront publishes various metrics to Amazon CloudWatch, such as cache hit ratio, request counts, and error rates, allowing you to monitor and set up alarms for performance and availability.
  • Real-Time Metrics: CloudFront supports real-time logging with logs available within a few seconds for debugging or monitoring highly dynamic content.
  • Real-Time Logging: You can also configure real-time logs to get request-level details within seconds. This helps in near real-time monitoring and debugging.

15. Content Delivery Protocols​

  • CloudFront supports both HTTP and HTTPS protocols, enabling secure content delivery. It automatically compresses files using gzip or Brotli to reduce file size, improving download speeds for users.
  • HTTP/2 and WebSocket Support: CloudFront supports HTTP/2, which offers improved performance with multiplexing, header compression, and server push. It also supports WebSockets for full-duplex communication in real-time applications.

16. Pricing Model​

  • Pay-As-You-Go Pricing: CloudFront charges based on the data transfer (GB), number of requests, and location of edge locations delivering content.
  • Cost Optimization: CloudFront pricing varies by geographic region, and data transfer between CloudFront and other AWS services is often free or discounted.
  • Savings Plans and Reserved Capacity Pricing: You can reduce costs by using Savings Plans for a 1- or 3-year commitment or by opting for reserved capacity pricing based on a set amount of data transfer.
  • Free Tier: CloudFront offers a free tier that includes 1 TB of data transfer out, 10 million HTTP/HTTPS requests, and 2 million CloudFront Functions invocations each month.

17. Access Control with Signed URLs and Cookies​

  • Signed URLs and Signed Cookies: CloudFront supports signed URLs and signed cookies to restrict access to your content. You can use these features to control who can access your content and for how long, often used for private content delivery (e.g., videos, software downloads).

18. Dynamic Content and API Acceleration​

  • CloudFront is not just for static content; it also helps accelerate dynamic content and APIs by optimizing the route between edge locations and the origin server.
  • Origin Shield: An additional layer of caching to reduce the load on your origin server and further improve cache hit ratios, improving performance for cache misses.

19. Integration with Other AWS Services​

  • Amazon S3: CloudFront is often used to cache content from S3 buckets, enhancing performance for static assets.
  • S3 as an Origin: CloudFront integrates seamlessly with Amazon S3 to accelerate content delivery. You can use S3 bucket policies and OAC to secure access to the content via CloudFront.
  • Amazon EC2 or ECS: Dynamic content from web servers running on EC2 instances or containers in ECS can be distributed using CloudFront.
  • AWS Elemental Media Services: CloudFront integrates with media services for video streaming and content delivery.
  • AWS Shield and AWS WAF: CloudFront integrates with AWS Shield Standard and AWS Shield Advanced to provide DDoS protection and with AWS WAF for web application security.
  • AWS Certificate Manager (ACM): You can use ACM to provision and manage custom SSL/TLS certificates for CloudFront, enabling secure content delivery under your custom domain name.

20. Custom Origin Headers​

  • You can configure CloudFront to include custom headers in requests to your origin. This allows you to send additional information (e.g., authentication tokens, geolocation data) or apply custom routing logic at the origin.

21. Regional Edge Caches​

  • CloudFront includes regional edge caches, which are intermediate caching layers between the origin and edge locations. This helps keep more content cached closer to viewers, reducing the need to fetch frequently requested content from the origin.

22. Invalidation and Cache Management​

  • Cache Invalidation: CloudFront provides the ability to invalidate cached content, allowing you to quickly remove outdated or sensitive content from edge locations.
  • TTL Settings: Configure Time-to-Live (TTL) settings to control the duration for which objects are cached. Shorter TTLs ensure fresher content, while longer TTLs improve cache hit rates and reduce origin load.

23. Custom Error Pages and Failover​

  • Custom Error Responses: Customize CloudFront's error pages and responses (e.g., return a branded 404 page instead of the default CloudFront error page).
  • Failover and High Availability: You can set up failover between primary and secondary origins to enhance the availability of your application.

24. AWS CloudFront Policies​

  • Cache Policies: Fine-tune cache settings, including headers, query strings, and cookies that should be considered for caching decisions.
  • Origin Request Policies: Control which headers, cookies, and query strings CloudFront forwards to your origin, helping you balance performance and caching needs.

25. Cost Optimization with Origin Shield​

  • Origin Shield: An additional layer in the CloudFront architecture that provides a centralized caching layer to optimize your origin’s workload and reduce costs by minimizing the number of requests made to your origin server.