CloudFront & Global Content Delivery

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations.

The Pizza Delivery Analogy: Imagine you own a world-famous pizzeria in Italy (Origin). If a customer in New York (User) orders a pizza, flying it directly from Italy takes hours and the pizza gets cold (Latency). Instead, you set up small local kitchens (Edge Locations) in major cities. You send your secret dough recipe and toppings to these kitchens once. Now, when the New Yorker orders, the pizza is cooked and delivered from the New York kitchen in minutes.

Core Concepts & Well-Architected Framework

1. Performance Efficiency

By caching content at Edge Locations, CloudFront reduces the number of network hops required to deliver content. It uses the AWS global network backbone for the path back to the origin, ensuring the fastest possible transit.

2. Security

CloudFront integrates with AWS WAF (Web Application Firewall) and AWS Shield for DDoS protection. It also supports Field-Level Encryption and Signed URLs/Cookies to restrict content access.

3. Cost Optimization

Data transfer out from AWS origins (like S3) to CloudFront is free. This often makes CloudFront cheaper than serving content directly from S3 to the public internet.

Service Comparison: Delivery Methods

Feature	CloudFront	Global Accelerator
Primary Use	Caching static/dynamic web content (HTTP/HTTPS).	Improving availability for non-HTTP (TCP/UDP) or multi-region apps.
Caching	Yes, stores content at the Edge.	No, proxies traffic to the nearest healthy endpoint.
IP Addresses	Dynamic IP addresses (DNS based).	Two static Anycast IP addresses.

Decision Matrix

If the requirement is… Then use…

Static Assets (Images/JS): CloudFront with S3 Origin.
Secure S3 Content: CloudFront with Origin Access Control (OAC).
Real-time Multiplayer Gaming: AWS Global Accelerator.
Customizing Content at the Edge: CloudFront Functions or Lambda@Edge.

Exam Tips: Golden Nuggets

OAC vs OAI: Always choose Origin Access Control (OAC) over the legacy OAI for S3 security; it supports KMS encryption and all S3 regions.
TTL (Time to Live): To remove an object from cache before it expires, use an Invalidation (costs money) or versioned filenames (free/recommended).
Lambda@Edge vs Functions: Use CloudFront Functions for high-scale, simple JS tasks (header manipulation). Use Lambda@Edge for complex logic or external API calls.
Dynamic Content: CloudFront isn’t just for static files; it accelerates dynamic content by optimizing the TCP handshake and maintaining “keep-alive” connections to the origin.

Architectural Flow

Key Services

Origin Access Control (OAC), S3, Application Load Balancers, Route 53 Latency Routing.

Common Pitfalls

Not setting up OAC (leaving S3 public), forgetting to update TTLs, over-using invalidations.

Quick Patterns

S3 + CloudFront (Static), ALB + CloudFront (Dynamic), WAF + CloudFront (Secure).