How to Automate CloudFront Cache Invalidation After S3 Deploy in CodePipeline
A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?
Quick Answer
The answer is to add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation after the S3 deploy. This is the most efficient solution because CloudFront caches content at edge locations based on the original object’s TTL; updating the S3 bucket alone does not purge the cached copies, so stale files persist until they expire or are explicitly invalidated. By inserting a Lambda or CodeBuild action in the pipeline that calls the CreateInvalidation API, you automate the cache refresh immediately after each deployment, ensuring users always see the latest content. On the AWS Certified Developer Associate DVA-C02 exam, this scenario tests your understanding of CloudFront caching behavior and pipeline automation—a common trap is assuming that reducing the TTL is sufficient, but that still introduces a delay and may serve stale data during the transition. A useful memory tip: “Deploy to S3, then invalidate the CDN—automate it in the pipeline, never do it by hand again.”
⚠ Common exam trap
Many candidates think reducing TTL to 0 is a valid solution, but this ignores the fact that TTL controls how long objects are cached, not how to purge already-cached content, and it would severely degrade CDN performance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.
It automates the creation of a CloudFront invalidation as part of the CodePipeline post-deploy stage. This ensures that after new files are uploaded to S3, CloudFront's edge caches are purged of the old content, forcing it to fetch the updated files from the origin. This is the most efficient solution as it requires no manual intervention and does not compromise caching performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually create a CloudFront invalidation after each deployment.
Why it's wrong here
Manual process is error-prone and not automated; inefficient.
- ✗
Reduce the CloudFront distribution's default TTL to 0.
Why it's wrong here
Setting TTL to 0 would increase origin load and still may not clear cache immediately; also not best practice.
- ✓
Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.
Why this is correct
This automates cache invalidation after each deployment, ensuring fresh content.
- ✗
Update the S3 bucket policy to allow public read access.
Why it's wrong here
Bucket policy does not affect CloudFront cache.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a build stage that compiles the website and a deploy stage that syncs the build output to an S3 bucket. After a recent change, the pipeline succeeds but the website does not show the updated content. What is the most likely cause?
medium- ✓ A.Amazon CloudFront is caching the old content and needs an invalidation.
- B.The build output is empty because the build failed silently.
- C.The deploy action is configured to skip if the source content has not changed.
- D.The S3 bucket policy does not allow public read access.
Why A: When using CloudFront with an S3 origin, updating the S3 bucket does not automatically invalidate CloudFront's cache. The pipeline succeeds because it uploads the new content to S3, but CloudFront serves the old cached content until the cache expires or is manually invalidated. Option B is incorrect: if the build failed silently, the build output would be empty and the deploy stage would sync an empty folder to S3, which would actually remove the website content, causing the site to be unavailable, not show old content. Option C is incorrect: the deploy action is configured to skip if the source content hasn't changed, but here the build output changed (since a recent change was made), so the deploy should run. Option D is incorrect: if the bucket policy blocked public read access, the website would not load at all, regardless of CloudFront caching. The most likely cause is that CloudFront is caching the old version and needs an invalidation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.