Complete Guide to AWS CloudFront: Global Content Delivery Network#

AWS CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. CloudFront is integrated with AWS services including S3, EC2, Elastic Load Balancing, and Route 53.

Overview#

CloudFront speeds up the distribution of your static and dynamic web content by delivering it through a worldwide network of data centers called edge locations. When users request content, CloudFront delivers it from the edge location with the lowest latency.

Key Benefits#

1. Global Performance#

400+ edge locations worldwide
Sub-millisecond latency improvements
Intelligent routing to fastest edge location
Reduced server load

2. Security#

DDoS protection with AWS Shield
SSL/TLS encryption
AWS WAF integration
Origin access control
Signed URLs and cookies

3. Cost Optimization#

Pay-as-you-use pricing
Free data transfer between AWS services
Regional pricing tiers
Reserved capacity pricing

4. Scalability#

Automatic scaling
Handle traffic spikes
No capacity planning required
Global infrastructure

Core Concepts#

1. Distributions#

The entity you create in CloudFront to tell the service which files you want to deliver:

1
{
2
  "DistributionConfig": {
3
    "CallerReference": "my-distribution-2024",
4
    "Comment": "My website CDN",
5
    "DefaultRootObject": "index.html",
6
    "Origins": {
7
      "Items": [
8
        {
9
          "Id": "S3-my-bucket",
10
          "DomainName": "my-bucket.s3.amazonaws.com",
11
          "S3OriginConfig": {
12
            "OriginAccessIdentity": ""
13
          }
14
        }
15
      ]
16
    },
17
    "DefaultCacheBehavior": {
18
      "TargetOriginId": "S3-my-bucket",
19
      "ViewerProtocolPolicy": "redirect-to-https",
20
      "CachePolicyId": "managed-caching-optimized"
21
    },
22
    "Enabled": true
23
  }
24
}

2. Origins#

The source of your content (S3 bucket, EC2 instance, load balancer, or custom HTTP server):

1
# CloudFormation example
2
Resources:
3
  CloudFrontDistribution:
4
    Type: AWS::CloudFront::Distribution
5
    Properties:
6
      DistributionConfig:
7
        Origins:
8
          - Id: S3Origin
9
            DomainName: !GetAtt S3Bucket.RegionalDomainName
10
            S3OriginConfig:
11
              OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${OriginAccessIdentity}"
12
          - Id: ALBOrigin
13
            DomainName: !GetAtt ApplicationLoadBalancer.DNSName
14
            CustomOriginConfig:
15
              HTTPPort: 80
16
              HTTPSPort: 443
17
              OriginProtocolPolicy: https-only

3. Cache Behaviors#

Define how CloudFront handles requests for different URL patterns:

1
CacheBehaviors:
2
  - PathPattern: "/api/*"
3
    TargetOriginId: ALBOrigin
4
    ViewerProtocolPolicy: https-only
5
    CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad  # CachingDisabled
6
    OriginRequestPolicyId: 88a5eaf4-2fd4-4709-b370-b4c650ea3fcf  # CORS-S3Origin
7
  - PathPattern: "/images/*"
8
    TargetOriginId: S3Origin
9
    ViewerProtocolPolicy: redirect-to-https
10
    CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized

4. Edge Locations#

Physical locations where CloudFront caches your content:

400+ edge locations in 90+ cities
Regional Edge Caches for less popular content
Automatic failover and load balancing

Getting Started#

1. Simple S3 Website Distribution#

1
# Create S3 bucket
2
aws s3 mb s3://my-website-bucket
3

4
# Upload content
5
aws s3 sync ./website/ s3://my-website-bucket/
6

7
# Create CloudFront distribution
8
aws cloudfront create-distribution --distribution-config '{
9
  "CallerReference": "my-site-'$(date +%s)'",
10
  "Comment": "My website CDN",
11
  "DefaultRootObject": "index.html",
12
  "Origins": {
13
    "Quantity": 1,
14
    "Items": [
15
      {
16
        "Id": "S3-my-website-bucket",
17
        "DomainName": "my-website-bucket.s3.amazonaws.com",
18
        "S3OriginConfig": {
19
          "OriginAccessIdentity": ""
20
        }
21
      }
22
    ]
23
  },
24
  "DefaultCacheBehavior": {
25
    "TargetOriginId": "S3-my-website-bucket",
26
    "ViewerProtocolPolicy": "redirect-to-https",
27
    "MinTTL": 0,
28
    "ForwardedValues": {
29
      "QueryString": false,
30
      "Cookies": {"Forward": "none"}
31
    }
32
  },
33
  "Enabled": true
34
}'

2. Distribution with Custom Domain#

1
# CloudFormation template
2
Resources:
3
  CloudFrontDistribution:
4
    Type: AWS::CloudFront::Distribution
5
    Properties:
6
      DistributionConfig:
7
        Aliases:
8
          - www.example.com
9
          - example.com
10
        ViewerCertificate:
11
          AcmCertificateArn: !Ref SSLCertificate
12
          SslSupportMethod: sni-only
13
          MinimumProtocolVersion: TLSv1.2_2021
14

15
  SSLCertificate:
16
    Type: AWS::CertificateManager::Certificate
17
    Properties:
18
      DomainName: example.com
19
      SubjectAlternativeNames:
20
        - www.example.com
21
      ValidationMethod: DNS

Advanced Configuration#

1. Multiple Origins Setup#

1
Origins:
2
  - Id: StaticContent
3
    DomainName: static.example.com.s3.amazonaws.com
4
    S3OriginConfig:
5
      OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${OAI}"
6
  - Id: DynamicContent
7
    DomainName: api.example.com
8
    CustomOriginConfig:
9
      HTTPPort: 80
10
      HTTPSPort: 443
11
      OriginProtocolPolicy: https-only
12
      OriginSSLProtocols:
13
        - TLSv1.2
14
      OriginReadTimeout: 30
15
      OriginKeepaliveTimeout: 5
16

17
CacheBehaviors:
18
  - PathPattern: "/static/*"
19
    TargetOriginId: StaticContent
20
    ViewerProtocolPolicy: redirect-to-https
21
    Compress: true
22
    CachePolicyId: "managed-caching-optimized"
23
  - PathPattern: "/api/*"
24
    TargetOriginId: DynamicContent
25
    ViewerProtocolPolicy: https-only
26
    CachePolicyId: "managed-caching-disabled"
27
    OriginRequestPolicyId: "managed-cors-s3-origin"

2. Lambda@Edge Functions#

1
# Edge function example - Add security headers
2
import json
3

4
def lambda_handler(event, context):
5
    response = event['Records'][0]['cf']['response']
6
    headers = response['headers']
7

8
    # Add security headers
9
    headers['strict-transport-security'] = [{
10
        'key': 'Strict-Transport-Security',
11
        'value': 'max-age=31536000; includeSubDomains'
12
    }]
13
    headers['x-content-type-options'] = [{
14
        'key': 'X-Content-Type-Options',
15
        'value': 'nosniff'
16
    }]
17
    headers['x-frame-options'] = [{
18
        'key': 'X-Frame-Options',
19
        'value': 'DENY'
20
    }]
21

22
    return response

3. CloudFront Functions#

1
// Viewer request function - URL rewriting
2
function handler(event) {
3
    var request = event.request;
4
    var uri = request.uri;
5

6
    // Redirect root to index.html
7
    if (uri === '/') {
8
        request.uri = '/index.html';
9
    }
10
    // Add .html to clean URLs
11
    else if (!uri.includes('.')) {
12
        request.uri = uri + '.html';
13
    }
14

15
    return request;
16
}

Caching Strategies#

1. Cache Policies#

1
# Custom cache policy
2
CachePolicy:
3
  Type: AWS::CloudFront::CachePolicy
4
  Properties:
5
    CachePolicyConfig:
6
      Name: MyCustomCachePolicy
7
      Comment: "Custom caching for my application"
8
      DefaultTTL: 86400  # 1 day
9
      MaxTTL: 31536000   # 1 year
10
      MinTTL: 1
11
      ParametersInCacheKeyAndForwardedToOrigin:
12
        EnableAcceptEncodingBrotli: true
13
        EnableAcceptEncodingGzip: true
14
        QueryStringsConfig:
15
          QueryStringBehavior: whitelist
16
          QueryStrings:
17
            - version
18
            - locale
19
        HeadersConfig:
20
          HeaderBehavior: whitelist
21
          Headers:
22
            - CloudFront-Viewer-Country
23
            - CloudFront-Is-Mobile-Viewer

2. Origin Request Policies#

1
OriginRequestPolicy:
2
  Type: AWS::CloudFront::OriginRequestPolicy
3
  Properties:
4
    OriginRequestPolicyConfig:
5
      Name: MyOriginRequestPolicy
6
      Comment: "Custom origin request policy"
7
      QueryStringsConfig:
8
        QueryStringBehavior: all
9
      HeadersConfig:
10
        HeaderBehavior: whitelist
11
        Headers:
12
          - Authorization
13
          - User-Agent
14
          - Referer
15
      CookiesConfig:
16
        CookieBehavior: whitelist
17
        Cookies:
18
          - session-id
19
          - user-preferences

3. Cache Invalidation#

1
# Invalidate specific files
2
aws cloudfront create-invalidation \
3
  --distribution-id E1234567890123 \
4
  --paths "/index.html" "/css/*" "/js/app.js"
5

6
# Invalidate everything (costly)
7
aws cloudfront create-invalidation \
8
  --distribution-id E1234567890123 \
9
  --paths "/*"
10

11
# Check invalidation status
12
aws cloudfront get-invalidation \
13
  --distribution-id E1234567890123 \
14
  --id I1234567890123

Security Features#

1. Origin Access Control (OAC)#

1
# Replace OAI with OAC (recommended)
2
OriginAccessControl:
3
  Type: AWS::CloudFront::OriginAccessControl
4
  Properties:
5
    OriginAccessControlConfig:
6
      Name: MyOAC
7
      OriginAccessControlOriginType: s3
8
      SigningBehavior: always
9
      SigningProtocol: sigv4
10

11
Distribution:
12
  Type: AWS::CloudFront::Distribution
13
  Properties:
14
    DistributionConfig:
15
      Origins:
16
        - Id: S3Origin
17
          DomainName: !GetAtt S3Bucket.RegionalDomainName
18
          OriginAccessControlId: !Ref OriginAccessControl
19
          S3OriginConfig: {}

2. AWS WAF Integration#

1
WebACL:
2
  Type: AWS::WAFv2::WebACL
3
  Properties:
4
    Name: CloudFrontWebACL
5
    Scope: CLOUDFRONT
6
    DefaultAction:
7
      Allow: {}
8
    Rules:
9
      - Name: AWSManagedRulesCommonRuleSet
10
        Priority: 1
11
        OverrideAction:
12
          None: {}
13
        Statement:
14
          ManagedRuleGroupStatement:
15
            VendorName: AWS
16
            Name: AWSManagedRulesCommonRuleSet
17
        VisibilityConfig:
18
          SampledRequestsEnabled: true
19
          CloudWatchMetricsEnabled: true
20
          MetricName: CommonRuleSetMetric
21

22
Distribution:
23
  Type: AWS::CloudFront::Distribution
24
  Properties:
25
    DistributionConfig:
26
      WebACLId: !GetAtt WebACL.Arn

3. Signed URLs and Cookies#

1
# Python example for signed URLs
2
import boto3
3
import datetime
4
from botocore.signers import CloudFrontSigner
5

6
def create_signed_url(url, key_id, private_key, expiration_date):
7
    signer = CloudFrontSigner(key_id, rsa_signer)
8

9
    signed_url = signer.generate_presigned_url(
10
        url,
11
        date_less_than=expiration_date
12
    )
13
    return signed_url
14

15
def rsa_signer(message):
16
    from cryptography.hazmat.primitives import hashes
17
    from cryptography.hazmat.primitives.asymmetric import padding
18
    from cryptography.hazmat.primitives import serialization
19

20
    with open('private_key.pem', 'rb') as key_file:
21
        private_key = serialization.load_pem_private_key(
22
            key_file.read(),
23
            password=None
24
        )
25
    return private_key.sign(message, padding.PKCS1v15(), hashes.SHA1())

Performance Optimization#

1. Compression#

1
DefaultCacheBehavior:
2
  TargetOriginId: MyOrigin
3
  ViewerProtocolPolicy: redirect-to-https
4
  Compress: true  # Enable compression
5
  CachePolicyId: managed-caching-optimized-for-uncompressed-objects

2. HTTP/2 and HTTP/3 Support#

1
Distribution:
2
  Type: AWS::CloudFront::Distribution
3
  Properties:
4
    DistributionConfig:
5
      HttpVersion: http2and3  # Enable HTTP/2 and HTTP/3
6
      IPV6Enabled: true       # Enable IPv6

3. Real-Time Logs#

1
RealtimeLogConfig:
2
  Type: AWS::CloudFront::RealtimeLogConfig
3
  Properties:
4
    Name: MyRealtimeLogConfig
5
    EndPoints:
6
      - StreamType: Kinesis
7
        KinesisStreamConfig:
8
          RoleArn: !GetAtt LogDeliveryRole.Arn
9
          StreamArn: !GetAtt KinesisStream.Arn
10
    Fields:
11
      - timestamp
12
      - c-ip
13
      - sc-status
14
      - cs-method
15
      - cs-uri-stem

Monitoring and Analytics#

1. CloudWatch Metrics#

1
# Custom metric collection
2
import boto3
3

4
cloudwatch = boto3.client('cloudwatch')
5

6
# Put custom metric
7
cloudwatch.put_metric_data(
8
    Namespace='CloudFront/Custom',
9
    MetricData=[
10
        {
11
            'MetricName': 'CacheHitRate',
12
            'Value': 85.5,
13
            'Unit': 'Percent',
14
            'Dimensions': [
15
                {
16
                    'Name': 'DistributionId',
17
                    'Value': 'E1234567890123'
18
                }
19
            ]
20
        }
21
    ]
22
)

2. Access Logs#

1
Distribution:
2
  Type: AWS::CloudFront::Distribution
3
  Properties:
4
    DistributionConfig:
5
      Logging:
6
        Bucket: !GetAtt LoggingBucket.DomainName
7
        IncludeCookies: false
8
        Prefix: "cloudfront-logs/"

3. CloudWatch Alarms#

1
HighErrorRateAlarm:
2
  Type: AWS::CloudWatch::Alarm
3
  Properties:
4
    AlarmName: CloudFront-High-Error-Rate
5
    AlarmDescription: CloudFront 4xx/5xx error rate is too high
6
    MetricName: 4xxErrorRate
7
    Namespace: AWS/CloudFront
8
    Statistic: Average
9
    Period: 300
10
    EvaluationPeriods: 2
11
    Threshold: 5
12
    ComparisonOperator: GreaterThanThreshold
13
    Dimensions:
14
      - Name: DistributionId
15
        Value: !Ref CloudFrontDistribution

Common Use Cases#

1. Static Website Hosting#

1
# Complete static website setup
2
S3Bucket:
3
  Type: AWS::S3::Bucket
4
  Properties:
5
    BucketName: my-static-website
6
    PublicAccessBlockConfiguration:
7
      BlockPublicAcls: true
8
      BlockPublicPolicy: true
9
      IgnorePublicAcls: true
10
      RestrictPublicBuckets: true
11

12
S3BucketPolicy:
13
  Type: AWS::S3::BucketPolicy
14
  Properties:
15
    Bucket: !Ref S3Bucket
16
    PolicyDocument:
17
      Statement:
18
        - Effect: Allow
19
          Principal:
20
            Service: cloudfront.amazonaws.com
21
          Action: s3:GetObject
22
          Resource: !Sub "${S3Bucket}/*"
23
          Condition:
24
            StringEquals:
25
              "AWS:SourceArn": !Sub "arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFrontDistribution}"

2. API Acceleration#

1
# API Gateway with CloudFront
2
ApiGatewayDistribution:
3
  Type: AWS::CloudFront::Distribution
4
  Properties:
5
    DistributionConfig:
6
      Origins:
7
        - Id: APIGateway
8
          DomainName: !Sub "${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com"
9
          CustomOriginConfig:
10
            HTTPSPort: 443
11
            OriginProtocolPolicy: https-only
12
      DefaultCacheBehavior:
13
        TargetOriginId: APIGateway
14
        ViewerProtocolPolicy: redirect-to-https
15
        CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad  # CachingDisabled
16
        AllowedMethods:
17
          - GET
18
          - HEAD
19
          - OPTIONS
20
          - PUT
21
          - POST
22
          - PATCH
23
          - DELETE

3. Video Streaming#

1
# Video content distribution
2
VideoDistribution:
3
  Type: AWS::CloudFront::Distribution
4
  Properties:
5
    DistributionConfig:
6
      Origins:
7
        - Id: VideoOrigin
8
          DomainName: video-content.s3.amazonaws.com
9
          S3OriginConfig:
10
            OriginAccessIdentity: !Sub "origin-access-identity/cloudfront/${OAI}"
11
      DefaultCacheBehavior:
12
        TargetOriginId: VideoOrigin
13
        ViewerProtocolPolicy: redirect-to-https
14
        CachePolicyId: managed-caching-optimized
15
        AllowedMethods:
16
          - GET
17
          - HEAD
18
        SmoothStreaming: false

Best Practices#

1. Performance#

Use appropriate cache policies for different content types
Enable compression for text-based content
Use HTTP/2 and HTTP/3
Implement proper cache headers at origin
Use CloudFront Functions for simple transformations

2. Security#

Use HTTPS-only policies
Implement Origin Access Control (OAC)
Use AWS WAF for application-level protection
Implement signed URLs for sensitive content
Regular security audits

3. Cost Optimization#

Use appropriate price classes
Implement smart caching strategies
Monitor and optimize cache hit ratios
Use reserved capacity for predictable workloads
Regular cleanup of old distributions

4. Monitoring#

Set up CloudWatch alarms for key metrics
Enable real-time logs for troubleshooting
Monitor cache performance regularly
Track error rates and response times

Troubleshooting#

1. Common Issues#

1
# Check distribution status
2
aws cloudfront get-distribution --id E1234567890123
3

4
# Test edge location response
5
curl -I https://d123456789012.cloudfront.net/
6

7
# Check cache behavior
8
curl -H "Cache-Control: no-cache" https://example.com/test.jpg

2. Error Handling#

1
# Custom error pages
2
Distribution:
3
  Type: AWS::CloudFront::Distribution
4
  Properties:
5
    DistributionConfig:
6
      CustomErrorResponses:
7
        - ErrorCode: 404
8
          ResponseCode: 404
9
          ResponsePagePath: /error-pages/404.html
10
          ErrorCachingMinTTL: 300
11
        - ErrorCode: 500
12
          ResponseCode: 500
13
          ResponsePagePath: /error-pages/500.html
14
          ErrorCachingMinTTL: 0

Newsletter

Complete Guide to AWS CloudFront: Global Content Delivery Network#

Overview#

Key Benefits#

1. Global Performance#

2. Security#

3. Cost Optimization#

4. Scalability#

Core Concepts#

1. Distributions#

2. Origins#

3. Cache Behaviors#

4. Edge Locations#

Getting Started#

1. Simple S3 Website Distribution#

2. Distribution with Custom Domain#

Advanced Configuration#

1. Multiple Origins Setup#

2. Lambda@Edge Functions#

3. CloudFront Functions#

Caching Strategies#

1. Cache Policies#

2. Origin Request Policies#

3. Cache Invalidation#

Security Features#

1. Origin Access Control (OAC)#

2. AWS WAF Integration#

3. Signed URLs and Cookies#

Performance Optimization#

1. Compression#

2. HTTP/2 and HTTP/3 Support#

3. Real-Time Logs#

Monitoring and Analytics#

1. CloudWatch Metrics#

2. Access Logs#

3. CloudWatch Alarms#

Common Use Cases#

1. Static Website Hosting#

2. API Acceleration#

3. Video Streaming#

Best Practices#

1. Performance#

2. Security#

3. Cost Optimization#

4. Monitoring#

Troubleshooting#

1. Common Issues#

2. Error Handling#

Additional Resources#