AWS CloudFront CDN

Table of Contents

• [Overview](#overview)
• [When to Use](#when-to-use)
• [Quick Start](#quick-start)
• [Reference Guides](#reference-guides)
• [Best Practices](#best-practices)

Overview

Amazon CloudFront is a fast, globally distributed content delivery network (CDN). Cache content at edge locations worldwide to reduce latency, improve performance, and provide high availability with DDoS protection.

When to Use

• Static website hosting and assets
• API acceleration and dynamic content
• Video and media streaming
• Mobile application content
• Large file downloads
• Real-time data distribution
• DDoS protection for origins
• Origin isolation and security

Quick Start

Minimal working example:

# Create distribution for S3 origin
aws cloudfront create-distribution \
  --distribution-config '{
    "CallerReference": "myapp-'$(date +%s)'",
    "Enabled": true,
    "Comment": "My application distribution",
    "Origins": {
      "Quantity": 1,
      "Items": [{
        "Id": "myS3Origin",
        "DomainName": "mybucket.s3.us-east-1.amazonaws.com",
        "S3OriginConfig": {
          "OriginAccessIdentity": "origin-access-identity/cloudfront/ABCDEFG1234567"
        }
      }]
    },
    "DefaultCacheBehavior": {
      "AllowedMethods": {
        "Quantity": 3,
        "Items": ["GET", "HEAD", "OPTIONS"]
      },
      "ViewerProtocolPolicy": "redirect-to-https",
      "TargetOriginId": "myS3Origin",
      "ForwardedValues": {
        "QueryString": false,
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Best Practices

✅ DO

• Use Origin Access Identity (OAI) for S3
• Enable HTTPS only for viewers
• Compress content at CloudFront
• Set appropriate cache TTLs
• Use cache invalidation cautiously
• Enable WAF for protection
• Monitor CloudWatch metrics
• Use multiple origins for redundancy

❌ DON'T

• Make S3 buckets public
• Cache sensitive data
• Use HTTP for production
• Ignore cache headers
• Create excessive invalidations
• Skip WAF protection