Cost-Optimized Architecture Design · Topic 4 of 8
Content Delivery and Multi Region Replication
Design cost aware CloudFront delivery with Origin Shield, cache policies and origin failover, and replicate data with S3 CRR and DynamoDB global tables.
- 6 min
- Data from AWS origins to CloudFront is not charged as origin data transfer out.
- A lean cache key raises the hit ratio and lowers origin cost.
- Origin Shield adds a per request charge, so use it for cacheable content with many viewer Regions.
What it is
Two designs decide how much a global application pays to move data: how content reaches users, and how data is copied between Regions. Both trade cost against latency and recovery goals.
Amazon CloudFront cuts origin load and delivery cost when the cache hit ratio is high. Replication with Amazon S3 Cross-Region Replication (CRR) or Amazon DynamoDB global tables buys a lower RPO, but every replicated byte and write is paid for again.
How it works
Origin selection
| Origin | Typical content | Cost and security notes |
|---|---|---|
| S3 bucket | Static assets, downloads, media files | Use origin access control so the bucket stays private |
| Application Load Balancer or EC2 | Dynamic pages and APIs | VPC origins let CloudFront reach private ALBs, NLBs and instances |
| Custom origin outside AWS | On premises or another provider | Origin Shield can protect limited bandwidth |
Data transfer from an AWS origin to CloudFront is not charged as data transfer out of the origin. Users pay the CloudFront delivery rate instead, and the origin serves far fewer requests.
Caching strategy
The cache key decides the hit ratio. A cache policy should include only the headers, cookies and query strings that really change the response. Every extra value in the key splits the cache and sends more requests to the origin.
Set long TTLs for versioned static files, and short or zero TTLs for personalized content. Turn on compression to reduce bytes delivered. Use price classes to serve only from lower priced edge locations when some users can accept higher latency.
CloudFront Origin Shield
Origin Shield is an extra caching layer in one Region placed in front of the origin. Requests from all regional edge caches funnel through it, so the origin may see as few as one request for an object.
Choose the Origin Shield Region with the lowest latency to the origin. It helps when viewers are spread worldwide, when the origin does just in time packaging or image processing, when an on premises origin has limited bandwidth, and in multi CDN setups.
Origin Shield has its own per request charge. It is a poor fit for dynamic, uncacheable or rarely requested content, because those requests pay the extra layer without benefit.
Origin failover
An origin group pairs a primary and a secondary origin. CloudFront fails over when the primary returns a configured HTTP status code or cannot be reached. Origin failover applies to GET, HEAD and OPTIONS requests, so it protects reads, not writes.
When Origin Shield is enabled on both origins, each request travels through that origin's Origin Shield. This read failover pattern is cheaper than running active active compute in two Regions.
S3 Cross-Region Replication costs
| Cost element | How to control it |
|---|---|
| Inter Region data transfer | Replicate only the prefixes or tags you need |
| Replication requests | Avoid replicating short lived or temporary objects |
| Destination storage | Write replicas to a colder storage class such as S3 Standard-IA or an S3 Glacier storage class |
| S3 Replication Time Control | Pay for it only when an SLA on replication time is required |
CRR replicates new objects after the rule is in place. Use S3 Batch Replication for existing objects. Delete marker replication is optional, so decide whether deletes in the source should reach the DR copy.
A DR copy that is rarely read is a strong case for a colder destination class. The replica must meet the recovery time, so do not pick a class with long retrieval times if the copy must serve traffic quickly.
DynamoDB global tables costs
Global tables replicate a table across Regions with active active writes. You pay for replicated writes in every replica Region, for storage in each Region, and for cross Region data transfer.
Keep the replica count to the Regions that really serve users or meet DR needs. Each added Region multiplies write cost. For provisioned tables, each replica also needs enough write capacity, so use auto scaling or on-demand mode.
Choosing the replication pattern
| Need | Cost aware choice |
|---|---|
| Low RPO, multi Region writes | DynamoDB global tables |
| Low RPO copy of objects | S3 CRR to a colder class |
| Hours of RPO acceptable | AWS Backup cross Region copy of backups |
| Read failover for static content | CloudFront origin group with CRR |
Backups copied on a schedule cost far less than continuous replication when the RPO allows it.
How the exam asks about this
- "Viewers worldwide request the same live video segments, and the packaging origin is overloaded." -> Enable CloudFront Origin Shield in the Region closest to the origin.
- "A DR copy of S3 data must exist in another Region but will be read only during a disaster." -> CRR with the replica storage class set to a colder class.
- "Static site reads must survive a Regional S3 outage at the lowest cost." -> A CloudFront origin group with a secondary bucket kept current by CRR.
What to remember for the exam
- Data from AWS origins to CloudFront is not charged as origin data transfer out.
- A lean cache key raises the hit ratio and lowers origin cost.
- Origin Shield adds a per request charge, so use it for cacheable content with many viewer Regions.
- Origin failover covers GET, HEAD and OPTIONS requests only.
- CRR costs transfer, requests and destination storage, and Batch Replication handles existing objects.
- Global tables bill replicated writes in every replica Region, so add Regions only when needed.
Do not choose DynamoDB global tables or S3 Replication Time Control when the scenario allows an RPO of hours. Scheduled cross Region backup copies meet it for much less.
Common mistakes
Putting every header and cookie in the cache key. The cache fragments, the hit ratio drops and the origin pays for the traffic. Forward only what changes the response.
Enabling Origin Shield for dynamic APIs. Uncacheable requests pay the extra layer and gain nothing. Origin Shield helps cacheable, popular content.
Replicating whole buckets to S3 Standard. Filter by prefix or tag and write replicas to a colder class when the copy is only for recovery.
Check yourself
Which Region should host CloudFront Origin Shield?
The Region with the lowest latency to the origin, which for an AWS origin is usually the origin's own Region.
Does CloudFront origin failover protect POST requests?
No. Origin failover applies only to GET, HEAD and OPTIONS requests.
How do you replicate objects that existed before a CRR rule was created?
Use S3 Batch Replication, because CRR rules apply only to objects written after the rule exists.
Topic 4 of 8 in Cost-Optimized Architecture Design
Test yourself on Cost-Optimized Architecture Design
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.