Amazon CloudFront

A content delivery network (CDN) that caches and serves web content from a global network of edge locations to reduce latency for end users. It operates by routing user requests to edge locations and fetching from configured origins when content is not cached. It typically sits between internet clients and application or storage origins such as Amazon S3, Application Load Balancers, or custom HTTP origins.

🗂 Resource Category

Networking and Content Delivery

🧠 Exam Memory Hook

Think: "Global content delivery + edge compute at network edge = Amazon CloudFront"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the global edge network and control plane, including physical edge locations, networking, and the managed CloudFront service platform; AWS secures and patches the underlying infrastructure and the managed runtime that executes edge features. AWS is responsible for availability of the CloudFront service endpoints and the underlying hardware and network components. AWS manages service-level logging endpoints (for example, access logs) as a feature but does not manage or access customer origin data.

Customer responsibilities: The customer configures distributions, cache behaviors, origins, TLS certificates, access controls (signed URLs/cookies), and edge function code; secures origin servers and origin credentials; monitors distribution metrics and access logs; and manages content, origin scaling, and application patching on origin resources. Customers are responsible for configuring integrations such as AWS WAF, AWS Shield advanced subscriptions, and IAM policies that control distribution management and access.

Patching responsibilities: AWS patches the physical infrastructure hosting edge locations and the managed service platform that runs CloudFront and its edge features. There is no customer-accessible guest operating system at the CloudFront edge to patch. Customers patch and maintain their origin systems' guest operating systems, application runtimes, libraries, dependencies, and deployed applications; customers are also responsible for updating any code they deploy to edge compute runtimes such as Lambda@Edge or CloudFront Functions.

🏗 Typical Architecture

💡 Top 5 Features

Global edge caching of static and dynamic HTTP(S) content to reduce origin load and user-perceived latency.
Configurable cache behaviors and multiple origin support with path-based routing to select origins per request.
Origin groups and origin failover to improve availability when primary origins are unreachable.
Edge compute capabilities via Lambda@Edge and CloudFront Functions for request/response manipulation at the edge.
TLS termination with support for custom certificates and SNI, plus signed URLs and signed cookies for restricted content delivery.

✅ Top 5 Use Cases

Distribute static website assets stored in Amazon S3 to global users with caching at edge locations to reduce latency and origin load.
Front APIs or dynamic web applications to provide caching of cacheable responses, TLS termination, and reduced round-trip time for global clients.
Deliver protected content (media or downloads) using signed URLs or signed cookies while preventing direct origin access.
Use edge functions (Lambda@Edge or CloudFront Functions) to modify requests or responses for personalization, A/B testing, or header-based routing at the edge.
Implement origin failover and caching to increase resilience for public-facing endpoints and reduce the impact of origin spikes.

🏗 Architecture Placement

CloudFront is an edge-based, global CDN placed between internet clients and one or more configured origins; DNS (for example Amazon Route 53) typically directs client requests to CloudFront which caches content at edge locations and forwards cache-misses to origins such as Amazon S3, ALBs, or custom HTTP origins. Depending on configuration, CloudFront can invoke edge compute (Lambda@Edge/CloudFront Functions), integrate with AWS WAF, and send logs and metrics to Amazon CloudWatch or S3. Placement and behaviour depend on distribution configuration and origin types.

🎯 Commonly Used With

- Amazon S3
- AWS WAF
- Amazon Route 53
- AWS Lambda
- Amazon CloudWatch

🌍 5 Real-World Examples

A retail website uses CloudFront to serve product images and static assets from Amazon S3 to international customers, reducing latency and origin bandwidth usage.
A media company delivers video segments through CloudFront with signed URLs and origin failover to ensure reliable playback for global viewers.
A financial services firm fronts its web application with CloudFront and strict TLS settings plus WAF rules to reduce direct exposure of origin infrastructure.
A healthcare provider distributes large medical reference documents from S3 through CloudFront while using signed URLs to restrict access to authorized users.
A government agency publishes software updates via CloudFront-backed origins to provide scalable global downloads and reduce the load on primary servers.

🎓 AWS Exam Clues

Use CloudFront when low-latency global content delivery and edge caching are required between users and origins.
Consider CloudFront when you need edge compute for request/response manipulation using Lambda@Edge or CloudFront Functions.
Choose CloudFront to offload origins and reduce bandwidth/requests to S3 or application endpoints through caching and compression.
When secure, restricted access to objects is required, look for signed URLs/cookies or origin access controls rather than relying on origin ACLs alone.
Caching behaviour, invalidation, and TTL configuration are key operational decisions that affect cost, freshness, and origin load.

📝 Quick Revision

Amazon CloudFront is a global CDN that caches and serves HTTP(S) content from edge locations and can run edge compute. Use it to reduce latency and origin load; plan cache behaviours, invalidation patterns, and origin security/credentials.

🏷 Keywords

CDN • edge locations • caching • cache behavior • origin group • origin failover • Lambda@Edge • CloudFront Functions • signed URLs • TLS termination • georestriction • invalidation