Amazon CloudFront
Amazon CloudFront
Overview
Amazon CloudFront is a CDN (Content Delivery Network) that caches and delivers content from edge locations worldwide — serving users from geographically nearby points of presence to reduce latency and offload the origin (S3, load balancer, etc.). Handles static files, dynamic content, and APIs, and integrates edge-level security and cache control to improve the performance and safety of your delivery infrastructure.
Key Concepts
Edge Locations and Caching
CloudFront caches content at edge locations globally. The first request retrieves content from the origin; subsequent requests are served from the nearby edge — reducing latency and origin load. TTL, cache policies, and Cache-Control headers control how long content is cached. For immediate updates, use cache invalidation.
Origins and Origin Groups
Origins can be S3 buckets, ALBs, EC2 instances, or any HTTP server. Use origin groups for failover between multiple origins, or configure multiple behaviors to route different URL paths to different origins. Origin Access Control (OAC) keeps S3 buckets private while serving content exclusively through CloudFront.
HTTPS and Security Integrations
CloudFront delivers over HTTPS using ACM certificates for custom domains. Associate AWS WAF to filter malicious requests at the edge. AWS Shield provides DDoS protection. Blocking threats at the edge prevents them from reaching the origin.
Signed URLs/Cookies and Access Control
Signed URLs and signed cookies grant time-limited access to specific content — essential for paid or private content delivery. Geo Restriction allows or blocks access by country to enforce distribution requirements.
Edge Code Execution
CloudFront Functions execute lightweight JavaScript for request/response header manipulation, redirects, and URL rewrites at the edge with minimal latency overhead. Lambda@Edge handles more complex processing at the edge, close to the user. Both avoid round-trips to the origin for customization.
Typical Use Cases
- Deliver static websites and SPA assets from S3 globally at low latency
- Stream video, serve large file downloads, and deliver media with low latency
- Block attacks at the edge with WAF, reducing origin load and risk
- Control access to premium or member-only content with signed URLs and expiration
- Serve S3 content privately using OAC while keeping the bucket blocked from public access
Exam Relevance
CloudFront is heavily tested in SAA and SOA as the CDN solution. 'Reduce latency for global users,' 'reduce origin load and data transfer cost' → CloudFront is the first candidate. S3 delivery with OAC to keep the bucket private is a canonical pattern. Security: WAF (application-layer attack filtering) combined with Shield (DDoS protection) is a frequent pairing. For paid/limited content: signed URLs or cookies. For country blocking: Geo Restriction. For edge processing: distinguish CloudFront Functions (lightweight) from Lambda@Edge (complex).
Related Services
References
Last updated: 2026-06-24
This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.