What is AWS CloudFront

• AWS CloudFront : Amazon's managed content delivery network that caches and serves content from hundreds of global edge locations.
• Cache behavior : a rule that matches a path pattern to an origin with specific TTL, cache-key, and failover settings.
• Origin group : a primary and secondary origin pair; CloudFront automatically fails over to the secondary if the primary returns errors.
• Origin Access Control (OAC) : a policy that locks an S3 bucket so it is reachable only through CloudFront, not directly.
• Lambda@Edge / CloudFront Functions : edge compute that runs code at the CDN edge for request and response transformation.
• AWS Shield : automatic DDoS protection integrated with CloudFront to absorb volumetric attacks at the edge.

What is AWS CloudFront?

CloudFront is AWS's managed content delivery network that caches and serves content from 400+ global edge locations. It sits in front of one or more origins, where an origin is where the real content lives: an S3 bucket for static files, an Application Load Balancer or EC2 for dynamic APIs. A CloudFront distribution is the configuration that ties edge locations to those origins.

How do cache behaviors work?

Cache behaviors are the rules engine of CloudFront. Each behavior matches a path pattern, such as images under /static/* or calls under /api/*, and maps it to an origin with its own settings. You set the TTL controlling how long an object stays cached, the cache key deciding which request attributes make objects distinct, and origin groups for failover.

package com.bank.aws;

public class CloudFrontBehaviors {
    // Conceptual mapping of cache behaviors
    void configure() {
        behavior("/static/*",  origin("s3-assets"),  ttl(86400), cacheKey("url"));
        behavior("/api/*",     origin("alb-api"),    ttl(0),     cacheKey("url+auth"));
    }
}

What are origin groups and failover?

Origin groups pair a primary and secondary origin. If the primary returns error status codes (like 500 or 502), CloudFront automatically retries against the secondary origin. This provides automatic disaster-recovery failover without the customer noticing.

package com.bank.aws;

public class OriginGroupConfig {
    void configure() {
        originGroup("api-failover",
            primary("alb-api-us-east-1"),
            secondary("alb-api-us-west-2"),
            failoverOn(500, 502, 503, 504));
    }
}

How do you invalidate cached content?

Invalidation removes cached objects before their TTL expires, issued as an invalidation request listing paths. However, versioned object names are preferred for frequent changes because invalidations have cost and propagation delay across all edges.

package com.bank.aws;

public class CloudFrontInvalidation {
    // Explicit purge (slow, costs money)
    public void invalidate(String distributionId, String path) {
        cloudFront.createInvalidation(distributionId, List.of(path));
    }

    // Preferred: versioned file names (instant, free)
    // /static/app-v1.2.3.js -> /static/app-v1.2.4.js
}

How do signed URLs and Origin Access Control restrict access?

Signed URLs and signed cookies grant time-limited access so only authorized users fetch premium content. Origin Access Control locks an S3 bucket so it is reachable only through CloudFront and not directly, preventing people from bypassing the CDN and its security.

package com.bank.aws;

import java.time.Duration;
import java.time.Instant;

public class SignedUrlGenerator {
    public String signedUrl(String path) {
        return cloudFront.signUrl(
            path,
            Instant.now().plus(Duration.ofMinutes(10)),  // expires in 10 min
            keyPairId,
            privateKey);
    }
    // /reports/premium/portfolio-SAV2001.pdf?Expires=...&Signature=...
}

What is Lambda@Edge and CloudFront Functions?

Lambda@Edge and CloudFront Functions run code at the edge to transform requests and responses. Use cases include adding security headers, rewriting URLs, doing lightweight authentication, and A/B testing close to the user without a round-trip to the origin.

package com.bank.aws;

public class EdgeFunctionExample {
    // CloudFront Function: add security headers to every response
    // exports.handler = (event) => {
    //     var response = event.response;
    //     response.headers['strict-transport-security'] =
    //         { value: 'max-age=31536000; includeSubdomains' };
    //     return response;
    // };
}

Why is CloudFront useful for API acceleration and DDoS protection?

Even uncacheable dynamic API traffic benefits from CloudFront's optimized, persistent connections from the edge to the origin over Amazon's backbone, reducing round-trip latency. CloudFront integrates with AWS Shield for automatic DDoS protection and with AWS WAF for request filtering, so the distributed edge absorbs and filters attacks far from the origin.

What should a senior engineer know?

A senior engineer configures CloudFront with a zero-TTL API behavior for dynamic traffic to get backbone acceleration without caching, uses Origin Access Control to prevent direct S3 access, sets up origin groups for cross-region failover, and monitors cache hit ratios and error rates through CloudWatch. They also understand that Lambda@Edge runs in specific regions (not all edges) while CloudFront Functions run everywhere but have tighter resource limits.