Design High Performing Architectures · Topic 4 of 7
Global Delivery and Edge Networking
Speed up global applications with CloudFront, Global Accelerator, Route 53 routing policies and edge functions, and learn which to choose for each case.
- 5 min
- Includes a diagram
- CloudFront caches content at edge locations and lowers latency and origin load, for static and dynamic content.
- Use origin access control to keep an S3 origin private behind CloudFront.
- Signed URLs protect single files, and signed cookies protect many files.
What it is
Users far from your Region see higher latency, because data travels over many public network hops. AWS reduces this with a global network of edge locations that sit near users.
Three services appear in almost every question on this topic. Amazon CloudFront caches and delivers content, AWS Global Accelerator speeds up the network path to your application, and Amazon Route 53 directs users to the right endpoint using DNS.
How it works
Amazon CloudFront
CloudFront is a content delivery network (CDN). A distribution points to one or more origins, such as an S3 bucket, an Application Load Balancer, an API Gateway endpoint or any HTTP server. At the edge, CloudFront returns a cached copy when it has one, and fetches from the origin when it does not.
Important controls include these.
- Cache behavior and TTL: rules per path pattern for what to cache and for how long. A cache invalidation removes objects before their time to live (TTL) ends.
- Origin access control (OAC): lets only CloudFront read a private S3 bucket.
- Signed URLs and signed cookies: restrict content to authorized users. Use signed cookies to cover many files at once.
- HTTPS and AWS WAF: CloudFront can enforce HTTPS to viewers and attach WAF rules.
- Geographic restriction: allow or block countries.
- Edge compute: CloudFront Functions run very light request and response code at the edge, and Lambda@Edge runs heavier code.
CloudFront speeds up dynamic content as well as static content, because connections to the origin travel over the AWS network and are reused. It also supports streaming media.
AWS Global Accelerator
Global Accelerator gives your application two static anycast IP addresses. Users connect to the nearest edge location, and traffic then travels the AWS backbone to the best healthy endpoint, such as an ALB, NLB, EC2 instance or Elastic IP address.
It works with TCP and UDP, so it fits non HTTP traffic such as gaming, voice over IP and IoT. It fails over to a healthy endpoint quickly and does not depend on DNS caching. Traffic dials and weights let you shift traffic between Regions.
| Question | CloudFront | Global Accelerator |
|---|---|---|
| Caches content? | Yes | No |
| Protocols | HTTP and HTTPS (and WebSocket), plus streaming | TCP and UDP |
| Entry point | DNS name | Two static anycast IPs |
| Best for | Websites, media, APIs with cacheable content | Non HTTP apps, fixed IPs, fast regional failover |
Amazon Route 53 routing for performance
Route 53 is the DNS service. Routing policies decide which record to return.
| Policy | Use it to |
|---|---|
| Latency | Send users to the Region with the lowest latency |
| Geolocation | Route by user location, for compliance or language |
| Geoproximity | Route by distance, with a bias to shift load |
| Weighted | Split traffic for testing or gradual rollout |
| Failover | Move to a backup when the primary fails the health check |
| Multivalue answer | Return several healthy records |
An alias record points a name, including the root of a domain, to AWS resources such as CloudFront or a load balancer.
S3 Transfer Acceleration
For uploads from far away to one bucket, S3 Transfer Acceleration sends data to the closest edge location first. This is the standard answer for "global users uploading large files to a single Region".
Putting it together
A global web application often uses Route 53 to find CloudFront, CloudFront to cache static files and reach a regional ALB, and Global Accelerator when the front door must be a fixed IP or non HTTP. For multi Region active active, use latency routing or Global Accelerator with replicated data.
"Static IP addresses" or "non HTTP protocol with global users" points to Global Accelerator. "Cache static or media content close to users" points to CloudFront.
What to remember for the exam
- CloudFront caches content at edge locations and lowers latency and origin load, for static and dynamic content.
- Use origin access control to keep an S3 origin private behind CloudFront.
- Signed URLs protect single files, and signed cookies protect many files.
- Global Accelerator gives static anycast IPs and uses the AWS backbone, with fast failover and no caching.
- Route 53 latency routing picks the lowest latency Region. Weighted and failover routing support rollout and recovery.
- Alias records can point the zone apex to AWS resources, whereas a CNAME cannot be used at the apex.
- S3 Transfer Acceleration speeds up long distance uploads.
- Lambda@Edge and CloudFront Functions run code at the edge.
Common mistakes
Choosing Global Accelerator for caching. It does not cache. If the goal is to serve repeat content faster or offload the origin, use CloudFront.
Using a CNAME at the root of a domain. DNS rules prevent it. Use a Route 53 alias record.
Leaving the S3 origin public. Use origin access control so users cannot bypass CloudFront.
Expecting DNS failover to be instant. Resolvers cache records for their TTL, so failover through DNS can be slower than Global Accelerator.
Cached content can be stale. After an urgent change, create an invalidation or use versioned file names so users do not see old copies.
Check yourself
Which service provides two static anycast IP addresses for a global application?
AWS Global Accelerator.
How do you let only CloudFront read a private S3 bucket?
Use an origin access control and a bucket policy that allows CloudFront.
Which Route 53 policy sends users to the Region with the lowest network latency?
Latency based routing.
Topic 4 of 7 in Design High Performing Architectures
Test yourself on Design High Performing Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.