Skip to main content

AWS cloud front

1. Cache Hit vs Cache Miss​

Cache Hit​

User
  ↓
Edge Location (Content Found)
  ↓
Response to User
  • Fastest response.
  • No call to Regional Edge Cache or Origin.
  • Lowest cost and latency.

Cache Miss​

User
  ↓
Edge Location
  ↓
Regional Edge Cache
  ↓
Origin
  • Content fetched from origin.
  • Cached for future requests.

2. Origin Shield​

An additional caching layer between Regional Edge Cache and Origin.

User
  ↓
Edge Location
  ↓
Regional Edge Cache
  ↓
Origin Shield
  ↓
Origin

Benefits:

  • Reduces origin requests.
  • Useful for high-traffic applications.
  • Improves cache hit ratio.

3. Dynamic vs Static Content​

Static Content​

  • Images
  • CSS
  • JavaScript
  • Videos
  • PDFs

Usually served directly from Edge Locations.

Dynamic Content​

  • API calls
  • Personalized responses
  • Login requests

Usually forwarded to the origin but still benefit from CloudFront's global network.

4. TTL (Time To Live)​

Controls how long content remains cached.

  • Minimum TTL
  • Default TTL
  • Maximum TTL

Example:

TTL = 3600 seconds

Content remains cached for 1 hour before CloudFront checks the origin again.

5. Cache Invalidation​

When content changes before TTL expires:

/index.html
/images/*

Invalidate cached objects so users receive the latest version.

6. CloudFront + S3​

Most common architecture:

Users
  ↓
CloudFront
  ↓
S3 Bucket

Benefits:

  • Faster global access.
  • Reduced S3 requests.
  • HTTPS support.

7. CloudFront + ALB + EC2​

Users
  ↓
CloudFront
  ↓
ALB
  ↓
EC2 Instances

Common for web applications.

8. HTTPS and SSL Certificates​

CloudFront uses:

  • SSL/TLS certificates from Amazon Web Services Certificate Manager (ACM)
  • Custom domains (CNAMEs)

Example:

www.example.com

CloudFront terminates HTTPS at the edge location.

9. Geographic Restrictions​

Block or allow specific countries.

Examples:

  • Allow only India.
  • Block specific countries.

Useful for licensing and compliance requirements.

10. AWS WAF Integration​

Users
  ↓
AWS WAF
  ↓
CloudFront
  ↓
Origin

Protects against:

  • SQL Injection
  • Cross-Site Scripting (XSS)
  • Bot traffic
  • Rate-based attacks

11. Signed URLs and Signed Cookies​

Used for private content.

Examples:

  • Paid videos
  • Internal documents
  • Premium downloads

Only authorized users can access the content.

12. Price Classes​

CloudFront can use:

  • Price Class 100
  • Price Class 200
  • Price Class All

Trade-off:

More Edge Locations = Better Performance = Higher Cost

13. Origin Access Control (OAC)​

Current best practice for S3 origins.

Users
  ↓
CloudFront
  ↓
Private S3 Bucket

Users cannot access the S3 bucket directly.

Important interview point: OAC is the modern replacement for OAI (Origin Access Identity).

Quick Interview Flow to Remember​

User
  ↓
Edge Location
  ↓ (Cache Miss)
Regional Edge Cache
  ↓ (Optional)
Origin Shield
  ↓
Origin (S3 / ALB / EC2)

If you are creating AWS learning documentation, these 13 points are usually enough to understand 80–90% of CloudFront concepts used in real projects and interviews.