5.1.4. Amazon CloudFront (Content Delivery Network - CDN)

Amazon CloudFront accelerates content delivery globally by caching data at Edge Locations closer to users, reducing latency, and offloading origin servers.

Scenario: You need to optimize the delivery of static website assets (images, CSS, JavaScript) for a global e-commerce website. Users from around the world are experiencing slow load times for these assets.

Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. It works by caching copies of your content at Edge Locations (data centers) worldwide.

Key Features of Amazon CloudFront:

• Global Content Delivery: Distributes your content globally through AWS's network of Edge Locations and Regional Edge Caches.
• Caching: Caches content (static files like images, CSS, JavaScript, and dynamic content) at Edge Locations closer to users.
• Reduced Latency: Users retrieve content from the nearest Edge Location, significantly improving page load times and application responsiveness.
• Offloads Origin Servers: Reduces the load on your origin servers (e.g., Amazon S3 buckets, EC2 instances), as many requests are served directly from the cache.
• Security: Integrates with AWS WAF (Web Application Firewall) for application-layer DDoS protection and AWS Shield for broader DDoS protection.
• SSL/TLS Termination: Can serve content over HTTPS and manage SSL/TLS certificates.
• Cost Optimization: Reduces data transfer costs from your origin Region.
• Cache behaviors: One distribution holds several behaviors matched by path pattern — e.g. /images/* with a long TTL and the default * behavior with caching disabled for API calls. No second distribution or Lambda@Edge is needed.
• Cache hit ratio: Every query string, header or cookie in the cache key splits the cache, so forwarding all of them for static objects drives the hit ratio down. Use long TTLs with versioned file names rather than invalidating /*, which empties the whole cache. Origin Shield adds a central caching layer in one Region so all edge locations share one request to the origin. Automatic compression applies to text types (HTML, CSS, JavaScript), not already-compressed video.
• Origin security: Origin Access Control (OAC) plus a bucket policy that admits only CloudFront stops viewers fetching S3 objects directly. The origin protocol policy (HTTPS Only) encrypts CloudFront-to-origin traffic; the viewer protocol policy does the same between viewer and edge.
• Viewer access controls: Signed URLs grant access to one file; signed cookies grant access to many (every segment of an HLS stream) without changing URLs. Field-level encryption encrypts chosen POST fields at the edge with your public key, so only the backend holding the private key can read them. Geographic restrictions allow or block whole countries natively.
• APIs: For a REST API on Amazon API Gateway, enabling the stage cache serves repeated responses without invoking the backend.
• Logging: Standard (access) logs record each request — including time-taken and time-to-first-byte, measured at the edge — and arrive in batches, typically within an hour, in S3 (standard logging v2 can also deliver to CloudWatch Logs or Amazon Data Firehose, and can add selected real-time fields such as origin-fbl/origin-lbl). Real-time logs arrive within seconds in an Amazon Kinesis Data Stream (their only destination; add Firehose downstream if needed), with a configurable sampling rate and field list. origin-fbl/origin-lbl — first- and last-byte latency between CloudFront and the origin — separate origin (ALB/EC2) time from edge time. CloudTrail records CloudFront API calls, not viewer requests.

Practical Implementation: Creating a CloudFront Distribution for S3 Origin

# Assuming S3_BUCKET_NAME is defined and is configured for static website hosting
# 1. Create a CloudFront distribution
aws cloudfront create-distribution \
  --distribution-config '{"CallerReference":"my-static-website-$(date +%s)","Comment":"My Static Website CDN","Enabled":true,"Origins":{"Quantity":1,"Items":[{"Id":"MyS3Origin","DomainName":"my-static-website-bucket.s3-website-us-east-1.amazonaws.com","CustomHeaders":{"Quantity":0},"OriginPath":""}]},"DefaultCacheBehavior":{"TargetOriginId":"MyS3Origin","ViewerProtocolPolicy":"redirect-to-https","AllowedMethods":{"Quantity":2,"Items":["GET","HEAD"]},"CachedMethods":{"Quantity":2,"Items":["GET","HEAD"]},"SmoothStreaming":false,"Compress":true,"ForwardedValues":{"QueryString":false,"Cookies":{"Forward":"none"},"Headers":{"Quantity":0},"QueryStringCacheKeys":{"Quantity":0}},"MinTTL":0,"DefaultTTL":86400,"MaxTTL":31536000,"LambdaFunctionAssociations":{"Quantity":0},"FunctionAssociations":{"Quantity":0}},"CacheBehaviors":{"Quantity":0},"CustomErrorResponses":{"Quantity":0},"HttpVersion":"http2","IsIPV6Enabled":true,"PriceClass":"PriceClass_All","Restrictions":{"GeoRestriction":{"RestrictionType":"none","Quantity":0}},"ViewerCertificate":{"CloudFrontDefaultCertificate":true}}' \
  --query Distribution.DomainName --output text

⚠️ Common Pitfall: Not configuring proper cache invalidation. If content on the origin changes but the cache is not invalidated, users will continue to see stale content.

Key Trade-Offs:

• Performance vs. Cost: CloudFront improves performance and can reduce egress costs from your origin, but it has its own pricing based on data transfer out from edge locations and requests.

Reflection Question: How does Amazon CloudFront, by caching content at Edge Locations closer to users and leveraging its global network, fundamentally accelerate content delivery, reduce latency, and offload origin servers, improving user experience?