CloudFront and Global Accelerator

What it is

Amazon CloudFront is a content delivery network (CDN). It keeps copies of your content at edge locations close to users, so repeated requests are answered nearby instead of travelling to your origin each time.

AWS Global Accelerator is a different tool. It gives your application static IP addresses and sends traffic over the AWS global network to the best healthy Regional endpoint.

How it works

Distributions and origins

You create a distribution that has one or more origins. An origin can be an S3 bucket, an Application Load Balancer, an EC2 instance, an API Gateway endpoint or any HTTP server. Cache behaviors map URL path patterns to origins and set rules such as allowed methods and caching settings.

An origin group provides failover: if the primary origin returns configured error codes, CloudFront tries the secondary.

Caching

When a user requests an object, the edge location checks its cache. A hit is returned immediately, and a miss is fetched from the origin and stored. The cache policy decides what is part of the cache key (headers, cookies, query strings) and how long objects live (TTL).

• A longer TTL improves hit ratio and reduces origin load.
• Forwarding extra headers or cookies in the cache key lowers the hit ratio, so forward only what the origin needs.
• Compression and HTTP/2 or HTTP/3 improve speed.

To remove content before the TTL ends, create an invalidation for a path. A better habit for static files is to use versioned file names, such as app.v2.js, which avoids invalidations.

# AWS CLI: invalidate cached files
aws cloudfront create-invalidation \
  --distribution-id E1ABCDEXAMPLE \
  --paths "/index.html" "/css/*"

Protecting the origin and content

• Origin access control (OAC) lets only CloudFront read a private S3 bucket. The bucket policy allows the CloudFront service for that distribution, and the bucket stays non public. OAC replaces the older origin access identity.
• Signed URLs and signed cookies limit access to paying or logged in users.
• Geographic restrictions allow or block countries.
• HTTPS can be required between the viewer and CloudFront (viewer protocol policy) and between CloudFront and the origin. A custom domain needs a certificate from AWS Certificate Manager in US East (N. Virginia).
• AWS WAF can be attached to a distribution to filter requests at the edge.
• For ALB or custom origins, restrict the origin security group to the CloudFront managed prefix list, or require a secret custom header.

Running code at the edge

CloudFront Functions run lightweight JavaScript for simple tasks such as URL rewrites or header changes at very low latency. Lambda@Edge runs fuller functions for more complex logic. Both run at CloudFront events without servers to manage.

Troubleshooting CloudFront

Global Accelerator

Global Accelerator provides two static anycast IP addresses. It routes TCP and UDP traffic to endpoints such as Application Load Balancers, Network Load Balancers, EC2 instances and Elastic IP addresses, in one or more Regions. It performs health checks and shifts traffic away from unhealthy endpoints quickly, without waiting for DNS caches to expire.

S3 Transfer Acceleration is also edge based, but only for faster uploads and downloads to an S3 bucket from far away.