Skip to content
Back to Cloud Services

AWS CloudFront CDN

Global CDN with 450+ edge locations, Lambda@Edge, and origin failover for low-latency content delivery.

AWSIntermediate

Why

CloudFront caches at 450+ POPs, cutting latency and S3 egress 90%. Lambda@Edge runs code at POP for header rewrites and A/B testing.

Free tier: 1TB egress + 10M requests/mo.

When

Use for static assets, video streaming, API acceleration, and S3 website hosting. Avoid for content needing no caching or single-region only.

How

1. Create distribution — origin (S3/ALB/custom), behaviors, cache policies 2. Cache policy — managed policies (CachingOptimized, CachingDisabled) or custom 3. Origin access — OAC for S3 (replaces deprecated OAI), restrict to CF only 4. Lambda@Edge — run on viewer-request/origin-response events, transform headers 5. Failover — primary + secondary origin, failover on 5xx/4xx 6. Custom domain — ACM cert (us-east-1), attach, auto HTTPS 7. Invalidation — aws cloudfront create-invalidation, expensive, version files instead 8. Signed URLs/cookies — restrict content to authenticated users

Example

# CloudFront distribution for S3 static site aws cloudfront create-distribution --distribution-config '{ "Origins": [{ "Id": "s3-origin", "DomainName": "my-bucket.s3.amazonaws.com", "S3OriginConfig": {"OriginAccessIdentity": ""} }], "DefaultCacheBehavior": { "TargetOriginId": "s3-origin", "ViewerProtocolPolicy": "redirect-to-https", "CachePolicyId": "658327ea-f89d-4fab-a63d-9141e9ce4f11" }, "Enabled": true, "DefaultRootObject": "index.html" }' # Invalidation (use sparingly — costs $0.005 per path) aws cloudfront create-invalidation \ --distribution-id E123ABC \ --paths "/*"

Common Problems

  • ⚠Invalidation too frequent — costs add up, use versioned filenames (app.v123.js) instead
  • ⚠Caching headers ignored — CloudFront uses cache policy, not origin Cache-Control by default
  • ⚠ACM cert must be in us-east-1 — CloudFront requires this region for certs

Best Practices

  • ✓Version assets not invalidate — app.[hash].js caches forever, no invalidation needed
  • ✓Use Origin Access Control (OAC) — keeps S3 private, only CloudFront can read
  • ✓Enable Origin Shield — second-tier cache, reduces origin load 90% for global traffic

FAQ

What is AWS CloudFront CDN and what problem does it solve?

Global CDN with 450+ edge locations, Lambda@Edge, and origin failover for low-latency content delivery. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with AWS CloudFront CDN in 5 minutes?

Two steps to run it: (1) Create distribution — origin (S3/ALB/custom), behaviors, cache policies; (2) Cache policy — managed policies (CachingOptimized, CachingDisabled) or custom. Validate on the free tier first, then wire into production.

What is the #1 pitfall with AWS CloudFront CDN?

The most frequent issue is: Invalidation too frequent — costs add up, use versioned filenames (app.v123.js) instead. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for AWS CloudFront CDN?

Best practices for AWS CloudFront CDN include: Version assets not invalidate — app.[hash].js caches forever, no invalidation needed; Use Origin Access Control (OAC) — keeps S3 private, only CloudFront can read; Enable Origin Shield — second-tier cache, reduces origin load 90% for global traffic. The first one — "Version assets not invalidate — app.[hash].js caches forever, no invalidation needed" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with AWS CloudFront CDN?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most AWS CloudFront CDN options offer a free tier — validate within free quota before scaling.