CloudFront Distribution Design

Amazon CloudFront is a global content delivery network (CDN) that securely delivers data, videos, applications, and APIs to customers with low latency and high transfer speeds. It uses a network of edge locations—over 450 points of presence (PoPs) across 90+ cities—to cache content closer to users. The primary benefits are: - Reduced Latency: Content served from nearest edge location instead of origin. - Offload Origin: Reduces load on origin servers (S3, EC2, or on-premises). - DDoS Protection: Integrated with AWS Shield Standard and Shield Advanced. - Security: Supports HTTPS, field-level encryption, and AWS WAF. - Programmable Edge: Lambda@Edge and CloudFront Functions for custom logic.

When a user requests content from a CloudFront distribution, the following steps occur: 1. DNS Resolution: The user's browser resolves the CloudFront domain (e.g., d123.cloudfront.net) to the IP of the nearest edge location based on latency-based routing. 2. Edge Location Check: The edge location checks its cache for the requested object. If found and not expired (cache hit), it serves the object immediately. 3. Cache Miss: If not cached, the edge location forwards the request to the origin (e.g., S3 bucket or HTTP server). The origin responds with the object and optional Cache-Control headers. 4. Caching: The edge location stores the object according to the TTL (time-to-live) set by Cache-Control max-age or the CloudFront minimum TTL default (24 hours if not specified). 5. Response: The edge location serves the object to the user and caches it for subsequent requests.

#### Distributions A distribution is the unit of configuration. You can create web distributions (HTTP/HTTPS) or RTMP distributions (Adobe Flash—deprecated). Each distribution has: - Origin: The source of content (S3 bucket, Elastic Load Balancer, EC2 instance, or custom origin). - Behaviors: Path patterns that map requests to specific origins and caching settings. Default behavior covers all requests. - Price Class: Limits edge locations used. Options: Price Class All (all regions), Price Class 200 (most regions, excludes South America), Price Class 100 (only US, Canada, Europe). - SSL/TLS: Supports dedicated IP or SNI (Server Name Indication) for custom domains. Default is *.cloudfront.net.

#### Cache Behavior Settings - Path Pattern: E.g., /images/*. Default is *. - Viewer Protocol Policy: HTTP, HTTPS, or Redirect HTTP to HTTPS. - Allowed HTTP Methods: GET, HEAD (default) or GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE. - Cached HTTP Methods: GET, HEAD (only these are cached). - TTL Settings: Minimum TTL, Maximum TTL, Default TTL (24 hours). Can be overridden by origin Cache-Control headers. - Restrict Viewer Access: Use signed URLs or signed cookies. - Lambda@Function Associations: Trigger Lambda@Edge on viewer request/response or origin request/response.

#### Origins - S3 Origin: Use Origin Access Control (OAC) to restrict direct S3 access. OAC replaces the older Origin Access Identity (OAI). - Custom Origin: HTTP/HTTPS server. Must be publicly accessible or behind a load balancer with CloudFront's IP ranges whitelisted.

#### SSL/TLS - Default CloudFront Certificate: *.cloudfront.net, free. - Custom SSL Certificate: Upload via AWS Certificate Manager (ACM) or IAM. Must be in US East (N. Virginia) region for CloudFront. - SNI vs Dedicated IP: SNI is free and works with most modern browsers. Dedicated IP costs extra and is needed for legacy browser support.

#### Security - AWS WAF: Integrated for web ACLs (e.g., block SQL injection, IP blacklists). - Field-Level Encryption: Encrypt sensitive data before reaching origin. - Geo-Restriction: Allow or block countries using a whitelist or blacklist. - Origin Shield: An additional caching layer in a central AWS region to reduce origin load.

#### Creating a Distribution via AWS CLI

aws cloudfront create-distribution --distribution-config file://config.json

Example config.json:

{
  "CallerReference": "unique-ref",
  "Aliases": {
    "Quantity": 1,
    "Items": ["www.example.com"]
  },
  "DefaultRootObject": "index.html",
  "Origins": {
    "Quantity": 1,
    "Items": [
      {
        "Id": "myS3Origin",
        "DomainName": "my-bucket.s3.amazonaws.com",
        "OriginAccessControlId": "oac-id",
        "S3OriginConfig": {
          "OriginAccessIdentity": ""
        }
      }
    ]
  },
  "DefaultCacheBehavior": {
    "TargetOriginId": "myS3Origin",
    "ViewerProtocolPolicy": "redirect-to-https",
    "MinTTL": 0,
    "DefaultTTL": 86400,
    "MaxTTL": 31536000,
    "ForwardedValues": {
      "QueryString": false,
      "Cookies": {
        "Forward": "none"
      }
    },
    "TrustedSigners": {
      "Enabled": false,
      "Quantity": 0
    }
  },
  "PriceClass": "PriceClass_All",
  "Enabled": true
}

#### Verification Commands

# List distributions
aws cloudfront list-distributions

# Get distribution details
aws cloudfront get-distribution --id E1234567890ABC

# Test with curl
curl -I https://d123.cloudfront.net/image.jpg

CloudFront caches objects based on TTL values. The actual TTL is determined by:

#### Cache Invalidation You can invalidate objects by path (e.g., /images/*). Each invalidation costs $0.005 per path. Invalidation is not instant; it takes a few seconds to propagate. Alternatively, use versioned filenames (e.g., image_v2.jpg) to avoid invalidation costs.

#### Origin Shield Origin Shield is an optional caching layer that aggregates requests from multiple edge locations, reducing origin load. It is enabled per origin group and incurs additional costs. Use it for high-traffic origins to improve cache hit ratio.

A media company streams video content to millions of users worldwide. They use CloudFront with S3 as the origin for video files (MP4, HLS). They configure multiple origins: one for video files (S3) and one for API requests (ALB). For video, they set TTL to 1 year and use signed URLs for premium content. They enable Origin Shield in US East to reduce load on S3. They also use Lambda@Edge to authenticate users before serving video. Common issues: expired signed URLs cause 403 errors; low cache hit ratio due to unique query strings for analytics. Solution: use cookies instead of query strings for analytics, or forward only specific parameters.

An e-commerce site uses CloudFront to serve static assets (CSS, JS, images) and dynamic content (product pages, cart). They use two origins: S3 for static assets and an ALB for dynamic content. For static assets, TTL is 1 day, and they use versioned filenames to avoid invalidation. For dynamic content, they set TTL=0 and forward cookies for session management. They attach WAF to block bots and SQL injection. They use CloudFront Functions to rewrite URLs (e.g., /product/123 to /product?id=123). Performance: average latency reduced from 500ms to 50ms. Misconfiguration: forwarding all query strings leads to cache misses; solution: whitelist only necessary parameters.

A software company distributes large binaries (up to 20 GB) via CloudFront. They use S3 as origin with OAC. They set TTL to 1 year and use signed URLs for controlled access. They enable chunked transfer for large files. They also use CloudFront's geo-restriction to comply with export laws. They monitor cache hit ratio and use Origin Shield to handle peak loads. Common mistake: not setting appropriate MaxTTL, causing objects to be revalidated frequently. Best practice: set MaxTTL to 365 days for immutable objects.